KR20020095815A - System and Method for issuing an Electronic Identification Card based on Certificates - Google Patents

Abstract

PURPOSE: A system and a method for issuing an electronic identification card based on a certificate are provided to identify a personal information such as a social security number by introducing an electronic identification card without changing a current certificate. CONSTITUTION: A system and a method for issuing an electronic identification card based on a certificate includes a user's terminal(210) provided with a plug-in module(211) for supplying a sign for a personal information required to issue the certificate and the electronic identification card to an electronic identification card issuing center(230), a certificate issuing server(221) for implementing the certificate issue examination based on the user's public key and the user's information received together with the certificate issue request of the user, a certification authority(220) provided with a private key(223), a public key certificate(224) and a DB server(222) for managing and storaging the user's information, an identification card issuing server(231) for issuing the electronic identification card by using the certificate extracted from a distinguished name(DN) and a certificate serial number, a certificate serial number and a user's personal information and the electronic identification card issuing center(230) provided with the public key(232) for being used in the issue of the electronic identification card and the public key certificate(233).

Description

System and Method for issuing an Electronic Identification Card based on Certificates}

Currently, the most optimal solution for user authentication in the Internet environment is recognized as using a P-K-eye based certificate. However, at present, the most widely used public certificate in Korea is user identification information in the certificate, so only the user name is included.

In order to solve this problem, putting a social security number into a specific field of a certificate has been considered. However, since anyone can easily access the public key directory that stores a public certificate, there is a need for an effective solution due to the exposure of personal information protection. .

In order to solve the problem that the Social Security Number is easily exposed when the Social Security Number is inserted in the certificate, the hash value of the Social Security Number can be put into a hash function, or the random number can be hashed by combining with the Social Security Number using a salt. Although it has been proposed, there is no fundamental solution to prolonging the time taken to extract the social security number and preventing the extraction of the social security number from the public key certificate.

In addition, the membership card required at a specific site may be a membership number required by the organization in addition to the social security number, and may also require an ID card including a picture of the members in order to increase mutual friendship between members through the Internet. In such a case, the simple solution of putting social security number information in the certificate does not solve the problem.

The present invention is to solve the above-described problems, an electronic identity card that can be commonly used on the Internet by setting up an electronic identity card issuing center for verifying the user's personal identity information for more accurate authentication of the user in an open network environment, such as the Internet Provides a system and method for issuing a certificate.

An object of the present invention is to solve the conventional problem that the certificate was not able to accurately authenticate the user by issuing a certificate-based electronic ID card that can serve as a user ID card such as an electronic resident card, a driver's license in the Internet environment.

1 is a block diagram of an electronic ID card issuing system according to the present invention;

2 is a block diagram of an electronic ID card issuing system according to the present invention;

3 is a flow chart of certificate issuance of a certification authority according to the present invention;

4 is a flow chart of an electronic ID card issued by the electronic ID card issuing center according to the present invention;

5 is an embodiment in which the electronic ID card issuing center authenticates a user by a certificate.

6 is an embodiment of a process of confirming a user's identity by an electronic ID card according to the present invention.

[Description of Symbols for Main Parts of Drawing]

101, 210: user

102, 220: Certificate Authority

103, 230: Electronic ID card issue center

211: plug-in module in the user terminal

221: certificate issuing server

222: database server

223: private key of the certification authority

224 Certificate Authority Certificate

231: ID card issue server

232: Private key of the issuing center

233: certificate of issuer

Exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a certificate-based electronic ID card issuing system according to the present invention. 101 is a user who issues a certificate from a certification authority and wants to issue an electronic ID from an electronic ID issuing center using a certificate, 102 is a certification authority that issues a certificate to a user, and 103 is an electronic certificate that issues an electronic ID based on a user certificate. ID card issuance center.

The issuing center 103 may be assisted by the certification authority 102 in the identification process of the user 101, and the certification authority 102 may be the issuing center 103.

2 is a block diagram of an electronic ID card issuing system according to the present invention.

The electronic ID card issuing system of the present invention generates a public key and a private key, provides a user information and a public key necessary for issuing a certificate to the certification authority 220, requests for certificate issuance, and receives a certificate from the certification authority 220. And a user terminal 210 having a plug-in module 211 for transmitting the personal identification information necessary for issuing the electronic identification card and the signature for the personal identification information to the electronic identification card issuing center 230, received together with a request for issuing a certificate of the user. Issuing a certificate issuance based on the user public key and the user information and the certificate issuing server 221 for issuing the certificate, the private key (223) and public key certificate (224) required for certificate issuing, storing and managing the user information Certificate authority 220 having a DB server 222, the user 210 by the signature of the user identity information sent with the request for issuing an electronic ID of the user 210 Identification card issuing server (231), electronic identification card using the certificate DN, certificate serial number, and user identification information by extracting the DN (Distinguished Name) and certificate serial number to ensure the uniqueness of the certificate from the certificate Personal key 232 used for issuance, has a feature consisting of an electronic identity card issuing center 230 having a public key certificate 233.

The identification card issuing server 231 of the issuing center 230 may be linked with the certificate issuing server 221 of the certification authority 220 to confirm user information.

3 is a flowchart of certificate issuance of a certification authority according to the present invention.

The user 210 connects to the certificate issuing server 221 of the certification authority 220 (301), inputs user information necessary for issuance (302), generates a private key and a public key pair (303), and public key and user. The information is encrypted and transmitted to the public key 224 of the certification authority 220 using the plug-in module 211 (304).

The certificate issuing server 221 of the certification authority 220 decrypts the cipher text with the private key 223 of the certification authority 220 and performs certificate issuance examination (305). (306) The certificate and user information is stored in the DB through the DB server 222 (307), and the certificate is issued to the user 210 (308).

The user 210 who issued the certificate stores the certificate (309).

4 is a flowchart in which a user who has issued a certificate according to FIG. 3 receives an electronic ID from an electronic ID issuing center.

The user 210 accesses the issuing center 230 (401) inputs user identity information (402) and uses the plug-in module 211 to sign user identity information with the private key generated in the process of FIG. 3 (403). By encrypting the certificate, user identity information, signature information with the public key 233 of the issuing center 230 and transmits to the issuing center 230 (404).

The identification card issuing server 231 of the issuing center 230 decrypts the cipher text with the private key 232 of the issuing center 230 and verifies the signature of the user identity information with the user 210 certificate (405). The issuing center 230 confirms the validity of the identity information sent by the user 210 (406), the server 231 of the issuing center 230 is the DN (Distinguished Name) information, certificate serial number and user identity information of the certificate By using the personal information 232 of the issuing center 230 to create information to enter the electronic identification card to create an electronic identity card (407), the electronic identity card is encrypted with the public key of the user 210 and transmitted (408).

The user 210 checks and stores the electronic ID with the certificate 233 of the issuing center (409).

Figure 5 is an embodiment showing the structure of the electronic ID card issued by the issuing center in FIG.

501 is a certificate DN (Distiguished Name) extracted from the user 210 certificate and 502 is a certificate serial number. 503 is information provided by the user to confirm the identity of the user 210 may include a name, resident registration number, driver's license number, various certificate numbers, validity period of the identification card, the user's photo, fingerprint, and the like.

504 represents an electronic signature of the issuing center 230 for the certificate DN 501, the silver certificate serial number 502, and the user identification information 503.

FIG. 6 is an embodiment of a system configuration diagram in which an Internet shopping mall performs identification of a user who has been issued a certificate and an electronic ID as described above.

User 610, private key 622, certificate (with plug-in module 611 that wants to prove the identity of user 610 using private key 612, certificate 613, electronic identity card 614) 623 is configured as a shopping mall having a server 621 that performs a user authentication process.

FIG. 7 is a diagram illustrating a process of identifying a user's identity by a shopping mall in the system configuration diagram shown in FIG.

In the identification process, the user and the shopping mall assume that the certificate 224 of the certification authority 220 and the certificate 233 of the issuing center 230 are publicly known. First, the user 610 encrypts and transmits his certificate 611 and the electronic identification card 614 with the public key 623 of the shopping mall 620 (701).

The shopping mall 620 verifies the validity of the certificate and the electronic ID with the certificate of the certificate authority 224 and the certificate of the issuing center 233, and the certificate DN and certificate serial number in the certificate match the certificate DN and certificate serial number in the electronic ID. In operation 702, the random number is encrypted with the user's public key 613 and transmitted to the user (703). The user 610 decrypts the cipher text using the private key 612 (704), encrypts the decrypted random number with the public key 623 of the shopping mall, and transmits the encrypted text to the shopping mall (705).

The shopping mall 620 verifies that the user is the owner of the electronic ID by decrypting the cipher text with the private key 622 (706) and confirming that it matches the random number generated by the user (707).

The present invention solves the problem that the user authentication using the existing certificate is not able to confirm the personal identification information such as the social security number by introducing an electronic identity card without changing the current certificate.

There may be a way to insert such information in the certificate as a way to verify personally identifiable information such as social security numbers, but this method has a problem of changing the current form of the certificate and the possibility of personal information being exposed when personal information is put in a public certificate. There is this.

In addition, the proposed method can be freely put into the electronic identity card without changing the certificate, such as photographs, fingerprint information, etc. can be utilized in various fields that require user identification through the Internet.

Claims (5)

Create a public key, private key, provide user information and public key required for certificate issuance to the certification authority 220, request for certificate issuance, receive a certificate from the certification authority 220, and then obtain a personal identity for issuing a certificate and electronic identity card. The user public key received with the user's 210 terminal and the user's 210 certificate issuance request provided with the plug-in module 211 providing the signature of the information and the personal identification information to the electronic ID card issuing center 230. And issuing a certificate issuing certificate based on user information and a certificate issuing server 221 for issuing a certificate, a private key 223 and a public key certificate 224 required for issuing a certificate, and a DB server 222 for storing and managing user information. Verification of the signature on the personal identification information by the certificate sent with the certificate authority 220, the user's 210 issuance request with the electronic card issuing certificate of the certificate Identification card issuing server (231) for issuing electronic identity using certificate DN, certificate serial number and user identification information by extracting DN (Distinguished Name) and certificate serial number that guarantees identity, and private key used for issuance of electronic identity card 232, a certificate-based electronic ID card issuing system and method, characterized in that consisting of the electronic card issuing center 230 with a public key certificate (233). The system and method of claim 1, wherein the electronic ID card issuing center (230) and the certification authority (220) are integrated together to issue an electronic ID card when the certification authority issues a certificate. According to claim 1, wherein the user 210 provides a signature for the certificate, user identity information, and user identity information to the electronic identity card issue center 230, and the electronic identity card issue center 230 signs the user identity information. By verifying the validity of the certificate with a certificate, using the certificate DN (Distinguished Name), certificate serial number, and user identification information to create the information to enter the electronic identity card, the electronic identity card issuing center 230 to sign the information entered into the electronic identity card Certificate-based electronic ID card issuance system and method comprising the steps of creating a. 4. The system and method of issuing an electronic identity card of claim 3 comprising a certificate DN (Distinguished Name), a certificate serial number, and user identification information. The user presents the electronic identity card including the certificate, the certificate DN, and the certificate serial number to the user (or site) who wants to authenticate the user. The user (or site) must present the certificate DN in the certificate, the certificate serial number and the certificate DN in the electronic identity card, A system and method for authenticating users using an electronic ID that includes comparing a certificate serial number.