KR20020042083A - Method for double encryption of private key and sending/receiving the private key for transportation and roaming service of the private key in the public key infrastructure - Google Patents

Abstract

PURPOSE: A double encoding and transmitting/receiving method for a private key movement and roaming service in a public key based configuration is provided to draw out a private key through a stable communication channel by doubly encoding and entrusting a user's private key to a roaming service center. CONSTITUTION: A user firstly encodes one's private key as a password using a personal computer(S101). The user requests a roaming service center to authenticate a public key(S102). A roaming service center authenticates the user and issues a note of authentication(S103). The user secondly encodes a public key of the roaming service center(S104). The user transmits an identification authenticated by the roaming service center to a server of the roaming service center(S105). The server of the roaming service center stores an N value, a second encoded private key, and identification(S106). When the user requests the roaming service center to draw out a private key, the server of the roaming service center forms a stable communication channel, and requests the user to input the identification and a password. The user inputs and transmits the identification and the password to the roaming service center. The server of the roaming service center detects the identification which the user inputs and detects the second encoded private key from a double encoded private key.

Description

Method for double encryption of private key and sending / receiving the private key for transportation and roaming service of the private key in the public key infrastructure}

The present invention relates to a double encryption and a transmission / reception method for a private key movement and roaming service in a public key infrastructure. More specifically, the primary key is first encrypted with a symmetric encryption system and the result is hashed N times. After combining with the hashed password, the second key is encrypted with the public key of the roaming service center and stored in the roaming service center. It relates to a double encryption and transmission / reception method for.

With the rapid spread of the Internet, businesses using the Internet are becoming commonplace. The Internet is an open network that anyone can access, and it is the basis of electronic commerce because it is cheap and convenient. Normal commerce requires a party's certification and proof of transaction. In particular, in electronic commerce where sellers and consumers do not face each other, there is a need for a method of electronically authenticating a party and proving a transaction, and a public key cryptosystem has been proposed as a solution.

The public key cryptosystem is an asymmetric cryptosystem and consists of a public key and a corresponding private key. The private key is created and defined by the user, and the corresponding public key is sent to a trusted certification authority to request a certificate. The certification authority issues public key information and related information in the form of a certificate when authenticating a user, and publishes the certificate. Since the certificate is managed in a public place, anyone can access and obtain the certificate of the other party to obtain public key information. This set of infrastructures is called the public key infrastructure.

In public key systems, the entity authentication and digital signature tool is a private key. When a user signs his certificate with his private key and submits it, the user can verify its identity using the public key, thereby enabling authentication. In addition, when a user signs and submits an electronic document with a private key, the user can verify the signature with the public key. Such a private key is stored in a personal computer or a smart card in a state encrypted by a symmetric encryption system using a password as a key.

However, according to the conventional public key-based encryption scheme, the following problem (s) occur.

That is, when the user wants to move to another area and use his private key, a device for recognizing the smart card should be provided at the moved place. That is, when no device for recognizing a smart card is provided in another region, there is no way for a user to withdraw his or her private key. Thus, users cannot use electronic signatures or remote financial services (home trading, e-commerce, phone banking and PC banking, etc.).

In addition, even if the user loses the smart card or the smart card is damaged, there is no way to withdraw his or her private key as described above, so that the electronic signature or the remote financial service cannot be used.

Therefore, the present invention is to solve such a problem (s), the object of the present invention is to entrust the user's private key with a double encryption to the roaming service center, the private key through a secure communication channel whenever necessary The present invention provides a dual encryption and transmission / reception method for a private key movement and roaming service in a public key infrastructure that can be retrieved and used.

In addition, another object of the present invention is to enable the private key to be withdrawn without revealing the user's password, thereby preventing the leakage of the private key by the release of the password, and improves the security reliability of the public key infrastructure The present invention provides dual encryption and transmission / reception methods for private key movement and roaming services.

1 is a block diagram of a dual encryption and transmission / reception system for a private key movement and roaming service in a public key infrastructure applied to the present invention.

2A and 2B are flowcharts illustrating a process of performing dual encryption and transmission / reception methods for private key movement and roaming service in a public key infrastructure according to the present invention;

3A to 3E are diagrams illustrating an encryption process and a decryption process of a private key to help understanding of the present invention.

<Description of the code | symbol about the principal part of drawing>

100: user 200: roaming service center

201: Double Encryption Private Key Database

202: identifier database 300: Internet network

A feature of the present invention for achieving such object (s) is that a user's personal computer and a server of a roaming service center are connected to communicate with each other via an internet network, and authenticate the user at the roaming service center at the request of the user. And at the same time apply to a system for issuing and publishing certificates using a public key; The user computer encrypts the private key with a user's own password to generate a primary encrypted private key; Combining the first encrypted private key and the first encrypted private key set by the user, and encrypting the public key of the roaming service center to generate a second encrypted private key; Linking the user's identifier, the N value, and the secondary encrypted private key to the roaming service center for storage; The server of the roaming service center, when a private key withdrawal is requested from the user, sends a value of n-1 to the user and requests to input an identifier; When the user inputs the password and identifier hashed n-1 times, the secondary encrypted private key linked to the identifier is detected and decrypted with the private key of the roaming service center to detect the private key and password of the primary encrypted user. and; If the password hashed by the user and the password detected in the decryption process are identical, the first encrypted private key is transmitted to the user, and the (N-1) hashed password and the first encrypted private key are roamed. Store the value encrypted with the public key of the service center, the (N-1) value and the identifier; The user decodes the primary encrypted private key transmitted from the roaming service center with his password to detect the private key.

Herein, when the server of the roaming service center is requested to withdraw the private key from the user, it is preferable that the server of the roaming service center establishes a communication channel of a program layer that maintains a security state.

In this case, the communication channel is preferably a secure sockets layer (SSL).

Hereinafter, exemplary embodiment (s) of the present invention will be described in detail with reference to the accompanying drawings. First, in adding reference numerals to the elements of each drawing, it should be noted that the same elements are denoted by the same reference numerals as much as possible even if they are displayed on different drawings. In addition, in the following description there are shown a number of specific details, such as components of the specific circuit, which are provided only to help a more general understanding of the present invention that the present invention may be practiced without these specific details. It is self-evident to those of ordinary knowledge in Esau. In describing the present invention, when it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

1 is a block diagram of a dual encryption and transmission / reception system for a private key movement and roaming service in a public key infrastructure applied to the present invention, and FIGS. 2A and 2B illustrate a public key infrastructure according to the present invention. An operation flow diagram illustrating a procedure of performing double encryption and a transmission / reception method for a private key movement and roaming service is shown. FIGS. 3A to 3E illustrate an encryption process and a decryption process of a private key to help understanding of the present invention. The described figure is shown.

First, referring to FIG. 1, the configuration of the present invention will be described. The personal computer of the user 100 and the server of the roaming service center 200 are connected to each other to enable communication with each other through the Internet network 300. At this time, the roaming service center 200 is a double-encrypted private key database 201 for storing a double-encrypted private key entrusted by the user 100, an identifier (identification) and hashing value for identifying the user 100 ( An identifier database 202 is configured to store N values).

That is, the personal computer of the user 100 first encrypts the user's own private key with a password, and secondly encrypts the password and the first encrypted private key hashed N times with the public key of the roaming service center 200. After that, the second encrypted private key is transmitted to the server of the roaming service center 200.

In addition, the server of the roaming service center 200 stores the second encrypted private key transmitted from the personal computer of the user 100, and when the user 100 requests to withdraw the private key, the individual of the roaming service center 200 After decrypting the private key of the user 100, which is secondly encrypted with the key, and comparing the decrypted password with the hashed value of the password inputted by the user 100, the corresponding user 100 only when the match is matched. Send the primary encrypted private key.

Here, hashing is briefly described. Hashing refers to converting a string into a shorter value or key that symbolizes the original. Hashing is used to index and search items in the database because finding them using a short hashing key is faster than finding them using their original values.

Finding a name in a database consists of first calculating a hashing value and then using that value to compare matches. In general, this is faster to find a match in four digits, each with only nine cases, than in each character with an unpredictable length of 26 cases.

Hashing algorithms are called hashing functions. In addition to fast data retrieval, hashing is also used for digital signatures. That is, after hashing a message using a hashing function, the hashing value (also called a 'summary message') is digitally signed with a private key and then transmitted together with the message. The receiver uses the same hashing function used by the sender to extract the summary message from the signature and compare it with the hashed value. It is determined that the digital signature is valid only when the comparison result is the same.

The hashing function is used to index the original value or key and is used again whenever the data associated with that value is retrieved. However, hashing always works in one direction. Thus, there is no need for reverse engineering to extract hashing functions by analyzing the hashed values. In fact, the ideal hashing function should not be deduced by such reverse engineering analysis. Also, good hashing functions should not produce the same hash value for two different inputs. If so, a collision occurs. Hashing functions with a very low risk of collision are evaluated as good hashing functions.

An operation of the present invention having such a configuration will be described below with reference to FIGS. 2 and 3.

As shown in Figs. 2A and 2B, the user 100 first encrypts his private key with a password using a personal computer (primary encrypted private key) S101 (see Fig. 3A). Thereafter, the user 100 accesses the server of the roaming service center 200 through a personal computer, and then requests the roaming service center 200 to authenticate the public key (S102). Accordingly, the server of the roaming service center 200 authenticates the user 100 and issues a certificate issued by issuing a certificate of the public key (S103).

Subsequently, when a certificate is issued, the user 100 combines the first encrypted private key with a password hashed N times through a personal computer, and then secondly encrypts the public key of the roaming service center 200 (S104) (FIG. 3B). The N value and the secondary encrypted private key and the identifier authenticated by the roaming service center 200 are transmitted to the server of the roaming service center 200 (S105). Accordingly, the server of the roaming service center 200 stores the N value, the second encrypted private key and the identifier transmitted from the personal computer of the user 100 in the double encryption private key database 201 and the identifier database 202, respectively. Save 106.

Subsequently, after the user 100 accesses the roaming service center 200 using a personal computer and requests the withdrawal of the private key (S107), the server of the roaming service center 200 connects to a secure sockets layer (SSL) or After establishing a secure communication channel using its own secure encryption module (S108), the N value is detected from the double-encrypted private key database 201, and the identifier and (N) is transmitted to the user 100 using the detected N value. -1) Requests to input a password hashed times (S109).

Accordingly, when the user 100 inputs an identifier and a password that has been hashed (N-1) times and transmits the same to the roaming service center 200 (S110), the server of the roaming service center 200 is stored in the identifier database 202. After detecting the identifier input by the user 100 among various identifiers, and detecting the second encrypted private key corresponding to the detected identifier from the double encryption private key database 201 (S111), the detected second encrypted The private key is decrypted with the private key of the roaming service center 200 (S112) (see FIG. 3C). Accordingly, the server of the roaming service center 200 may obtain the primary encrypted private key and N times hashed password from the secondary encrypted private key.

Here, the SSL (secure sockets layer) briefly described, SSL refers to a program layer made by Netscape for managing the security of message transmission in the network. Netscape's idea is that a program with a message that needs to be kept confidential must go between a web browser or an application such as HTTP and the TCP / IP layer of the Internet. The term " socket &quot; is used herein to shorten the way that data is exchanged between client and server programs on a network, or between program layers on the same computer. Netscape's SSL uses RSA (Rivest-Shamir-Adleman) public / private key cryptography, which is also included in the use of digital certificates.

SSL is an integral part of the Netscape browser. If a website has a Netscape server installed, you can use SSL to identify whether a particular web page requires SSL access. On other servers you can use Netscape's SSLRef library. Netscape proposed SSL as a standard protocol to the World Wide Web Consortium (W3C), and the Internet Engineering Task Force (IETF) as a standard security approach for web browsers and servers.

Accordingly, the server of the roaming service center 200 determines whether the hashed password obtained by the decryption process and the hashed password once hashed (N-1) times input by the user 100 coincide with each other. (S113), the first encryption private key is transmitted to the user 100 only when it matches (S114), and the N value stored in the identifier database 202 is replaced with the (N-1) value to be updated and stored (S115). ), After combining the first encrypted private key hashed (N-1) times, and after the second encryption with the public key of the roaming service center 200 (S116) (see Fig. 3d), the second encrypted individual The key is updated and stored in the double encryption private key database 201 (S117). This process provides an effect of preventing the theft and leakage of illegal information by changing and storing the hashing value even when information is hacked in the communication process between the user 100 and the roaming service center 200.

Accordingly, the user 100 may detect the private key by decrypting the primary encrypted private key transmitted from the roaming service center 200 with the user's own password using a personal computer (S118) ( 3e).

After all, in the present invention, without storing a separate smart card, by storing the double-encrypted private key in the roaming service center 200 even when the user 100 moved to other regions, withdraw the private key at any time can do. In particular, according to the present invention, since the user 100 can withdraw his or her private key without exposing his or her password and password, it is possible to further improve the safety of the private key movement.

As described above, although the specific embodiment (s) have been described in the detailed description of the present invention, various modifications are possible without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiment (s), but should be defined by the claims below and equivalents thereof.

As a result, according to the dual encryption and transmission / reception method for the private key movement and roaming service in the public key infrastructure according to the present invention, the following advantage (s) occurs.

That is, by double encrypting the private key of the user and storing it in the roaming service center, and detecting the private key as necessary, local restrictions and hardware environmental restrictions are eliminated, and the roaming service center can be accessed through the Internet. You can retrieve your own private key at any time in the region.

Also, by double encryption of the private key, only the user can withdraw the private key without exposing the password and password of the private key encrypted with the symmetric encryption system to the roaming service center. It can be further improved.

In addition, by updating and storing the hashing value and the second encrypted private key every time, information leakage by hacking can be effectively prevented.

Claims (4)

The user's personal computer and the server of the roaming service center are connected to each other so as to communicate with each other through the internet network, and upon the request of the user, the roaming service center authenticates the user and issues and publishes a certificate using a public key. Apply to a system to be configured; Generating a primary encrypted private key by encrypting the private key with a user's own password; After hashing the password set by the user N times, combining the hashed password n times with the primary encrypted private key, encrypting with the public key of the roaming service center to generate a second encrypted private key. step; And Linking the identifier of the user, the secondary encrypted private key, and the N value to the roaming service center for storage; When the server of the roaming service center is requested to withdraw the private key from the user, requesting the user to input a password and an identifier hashed (N-1) times; When the user inputs the cipher code and the identifier, the secondary encrypted private key linked to the identifier is detected, decrypted with the private key of the roaming service center, and the primary encrypted private key and the N times hashing. Detecting the encrypted password; And If the N times hashed cipher obtained by hashing the (N-1) times hashed cipher entered by the user and the N times hashed cipher detected in the decryption process are matched, the first encrypted private key is read. Sending to the user; The user double-ciphers and transmits / receives for a private key movement and roaming service in a public key infrastructure in which the primary encrypted private key transmitted from the roaming service center is decrypted with the user's own password to detect the private key. Way. The method of claim 1, wherein the roaming service center transmits the primary encrypted private key obtained through the decryption process to the user. Updating and storing the N value stored in the roaming service center to a value of (N-1); And After combining the N-hashed password and the primary encrypted private key, the private key encrypted second with the public key of the roaming service center is (N-1) hashed password and the primary encrypted private key. And a second encryption and transmission / reception method for a private key movement and roaming service in the public key infrastructure, further comprising updating and storing the secondary key encrypted with the public key of the roaming service center after combining. According to claim 1 or 2, wherein the server of the roaming service center, If a private key withdrawal is requested from the user, the method further comprises: establishing a communication channel of a program layer in which a security state is maintained, and double encryption and transmission / reception method for a private key movement and roaming service in a public key infrastructure. The method of claim 3, wherein the communication channel, Double encryption and transmission / reception method for private key movement and roaming service in public key infrastructure characterized by SSL (secure sockets layer).