KR20050001173A - Apparatus and Method for issuing acknowledgment service of Certificate in Application Service System - Google Patents

Abstract

PURPOSE: A device and a method for approving certificate issuance on an application service system through an online CA(Certification Authority) are provided to perform a certificate issuance approval by making the application service system extract needed data from subscription information of an application service subscriber and transfer the extracted data to the CA through the online. CONSTITUTION: An application service user managing module(33) extracts information needed the user certificate issuance approval from the subscriber information, transfers the extracted information to the CA(27), and transfers a processing result received from the CA to the subscriber. A certificate storing part(31) stores/manages a certificate received from the CA certifying an application service system as an RA(Registration Authority). A CA interface module(32) generates a user certificate issuance approval requesting message by using the information received from the application service user managing module and extracted from the certificate storing part, transfers it to the CA, and receives/provides the result to the application service user managing module.

Description

Apparatus and Method for issuing acknowledgment service of Certificate in Application Service System}

The present invention relates to a service device for issuing a certificate in an application service system, and a method and a computer readable recording medium storing a program for realizing the method. More specifically, a certificate required for a user to use an application service is provided. A certificate issuing authorization service apparatus in an application service system for processing issuance authorization in an application service system, and a method and a computer-readable recording medium having recorded thereon a program for realizing the method.

The present invention deals with the technical field related to RFC 2510 {Internet X.509 Public Key Infrastructure Certificate Management Protocols (RFC2510)} defined by the Internet Engineering Task Force (IETF).

In order to obtain a certificate for the first time, a user must go through a "certificate issuance" process. "Certificate Issuance" means that the user's important personal information is submitted to a Certification Authority (CA), and the user's identity is entered and the user's information is entered into the authentication system. The process of automatically generating a reference number and notifying the applicant of a certificate is referred to as "certificate issuance". That is, as a confirmation process for the user to issue a certificate, it may be referred to as a preprocessing process of certificate issuance.

This "Issuance of Certification" is mentioned in the "Initial of Registration" section of RFC2510, which specifically addresses a technology (or protocol) in steps. Rather than being described, it is recorded that an example would be made in the course of a person talking to a Registration Authority (RA) operator or CA operator by phone, but no specific description was defined.

In addition, at the time when the use of accredited certificates is gradually increasing, the "certificate issuance accreditation" process adopted by domestic accredited certification bodies is processed through the procedure as shown in [Table 1].

process Explanation Learn 1 After the user fills out the application on the certificate application form, prepares the relevant documents necessary for the application and visits the accredited certification authority or the Registration Authority to request it. Learn 2 The registrar representative enters the applicant's information after face-to-face and identity verification. Learn 3 The registration number (authorization code / reference number) is automatically generated by the certification authority certification system. Learn 4 Send the registration number to the e-mail address listed on the application.

Here, it can be seen that the face-to-face and identification of "process 2" is the same way that the bank employee at the bank teller confirms the applicant's identity.

For reference, the RA or Branch Registration Authority (BRA) provides access to the CA's authentication system remotely from a more geographically located location for users who are geographically separated from the CA. This refers to a remote authentication system access system or access program capable of issuing a user certificate or revoking a user certificate, and refers to a RA operator or a BRA operator who operates such a RA or BRA. .

1 is an example of a conventional certificate issuance authorization process.

Figure 1 is a schematic diagram of the process described in Table 1 above. The dotted line shown in FIG. 1 is a place where offline work or manual work is performed, and there is a problem in that a processing delay or an input error may occur.

Therefore, the dotted line intervals have a negative effect on the user side or the application service provider side.

Using the National Pension EDI service as an example of an application service, the user of the National Pension EDI service wants to use the service at the same time as the service subscription, and the request for subscription to the National Pension EDI service is received. At the same time, the service provider expects to generate service revenue by providing the service, and following a series of procedures as shown in [Table 1] will not only enable the service to be opened immediately, but also cause errors in input by the RA operator or the BRA operator. There was a problem that can occur, the overall quality of service is reduced.

That is, a user who wants to use an application service wants to use the application service at the same time as joining the application service, but in the related art, a certificate issuance authorization process required after using the application service separately from the user's application service subscription and then. There was a problem that the certificate issuance process is required. Furthermore, when a user applies for an authorization to issue a corresponding certificate, face-to-face and identity verification should normally be handled by the RA or BRA operator, and there is a high possibility of input errors due to the intervention of a human operator in this process. There was a problem. In addition, such an overall certificate issuance authorization process has a problem that the application service user takes a long time from the application service subscription to the actual use of the service, which causes inconvenience to the application service user.

The present invention has been made in order to solve the above problems, the application service system extracts the data required for the "authorization of the user certificate" from the subscription information of the application service subscriber and delivered to the certification authority (CA) online An object of the present invention is to provide a certificate issuance authorization service apparatus in an application service system that performs certificate issuance authorization processing, and a method and a computer-readable recording medium having recorded thereon a program for realizing the method.

1 is an example of a conventional certificate issuance authorization process.

2 is an exemplary configuration diagram of a network system to which the present invention is applied.

3 is a diagram illustrating an embodiment of a certificate issuing authorization service apparatus in an application service system according to the present invention;

4 is a flowchart illustrating an embodiment of a certificate issuance authorization service method in an application service system according to the present invention;

5 is an exemplary view showing a processing procedure for a user certificate issuance authorization request in the authentication system.

Figure 6 is a schematic illustration of an application service in an application service system to which the present invention is applied.

* Explanation of symbols for the main parts of the drawings

21: Application Service System 22: General User Computer

23: RA system (or BRA system) 24: Internet

25: Directory System 26: CA Operator System

27: CA system 31: certificate store

32: CA interface module 33: Application Service User Management Module

An apparatus of the present invention for achieving the above object is, in an application service device that requires a user certificate to use the service, according to the user certificate issuance or service processing request, the information necessary for authorization of the user certificate is issued from the information of the corresponding application service subscribers. An application service linking means for extracting and transferring and receiving the certificate issuance authorization processing result and delivering the result to the subscriber; The certificate containing the information necessary to reliably send and receive the certificate issued by the certification authority (CA) certification authority from the certification authority (CA), that is, the subscriber information for requesting authorization of the user certificate is issued. Certificate storage means for storage management; And receiving information and related information about the subscriber from the application service linking means, extracting information necessary for the user certificate issuance authorization request from the certificate storing means, and generating the user certificate issuance authorization request message for the subscriber. It is characterized in that it comprises an issuance authorization processing means for transmitting to the authentication system (CA) and receiving the results for the application service linking means.

In addition, the method of the present invention, in the certificate issuance authorization service method applied to a certificate issuance authorization service device in an application service system, receiving information on the subscriber of the application service, a user certificate issuance authorization service request and related information Extracting certificate information for the application service system as a registrar; A second step of performing security processing on the subscriber information based on the extracted certificate information to generate a user certificate issuance authorization request message and to transmit it to an authentication system (CA); And a third step of receiving a response message for the user certificate issuance authorization request from the authentication system CA and providing the result to the application service subscriber.

The present invention also provides an application service system including a processor, which receives information on an application service subscriber, a user certificate issuance authorization service request, and information related thereto, and extracts certificate information about the application service system as a registration authority. 1 function; A second function of performing a security process on the subscriber information based on the extracted certificate information, generating a user certificate issuance authorization request message, and delivering the request message to an authentication system (CA); And a response message to the user certificate issuance authorization request from the authentication system (CA) and a program for realizing a third function of providing the result to the application service subscriber for confirmation. Provide the medium.

The present invention proposes a mechanism capable of effectively and directly processing a task of a dotted line shown in FIG. 1 in an application service system. In other words, without using RA (or BRA) program by RA (or BRA) operator distributed by Certificate Authority (CA), device that can perform "Authentication of user certificate" online in application service system I would suggest a way.

That is, the present invention solves the above-mentioned problems by providing a mechanism for excluding the ineffective and error-prone sections in the "certificate issuing" process and performing the "certificate issuing" procedure directly in the application service system. To do this, first, the application service system is authorized as a BRA (or RA) that has been granted the "Issuing user certificate" authority from the Certificate Authority (CA), and stores the BRA (or RA) certificate accordingly. Store / manage it in the device, and secondly, extract the information necessary for "Issuing user certificate" from the authentication system (CA) and define it as an application programming interface (API) parameter to manage it in the application service system. When a new user of an application service is created, the defined parameters are delivered to the authentication system through the API to issue the corresponding certificate. Thirdly, if the request for authorization is delivered directly to the certification system of the certification authority. Third, when the API is successfully processed, the application service system receives the registration number necessary for issuing the certificate as a result of the API and the new user immediately issues a certificate. To receive it.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2 is an exemplary configuration diagram of a network system to which the present invention is applied.

The network system to which the present invention is applied includes an application service system 21, a general user computer 22, an RA system (or a BRA system 23), an Internet (24), a directory system (25), and a CA operator system ( 26) and CA system (27). Here, directory system 25, CA operator system 26 and CA system 27 are systems belonging to a certification authority.

The invention is made on a network system as shown in FIG.

First, a user who wants to use an application service subscribes to the application service. At this time, the user requests the service subscription by accessing the application service system 21 through the Internet 24 using his computer 22.

A brief description of the present invention follows.

The user is authorized to subscribe to the application service or at the same time as the application for subscription to the application service, the user requests the certificate issuance authorization to the application service system 21. Accordingly, the application service system 21 provides information necessary for the certificate issuance authorization of the user. Extracted from the subscription information and delivered to the CA system (27). At this time, the application service system 21 transfers the secured data using the authentication information received from the CA system 27. Further, the application service system 21 assures that the CA system 27 has confirmed the identity of the user by requesting the CA system 27 to issue the certificate for the user.

Confirmation of the certificate issuance authorization is made in the CA system 27, and is transmitted to the application service system 21, so that the user can confirm it based on the user's prior request information.

3 is a configuration diagram of an embodiment of a certificate issuing authorization service apparatus in an application service system according to the present invention.

As shown in FIG. 3, the certificate issuance authorization service apparatus according to the present invention includes a certificate storage unit 31, a CA interface module 32, and an application service user management module 33.

Each function is described as follows.

First, the certificate storage unit 31 means a place for physically storing the RA certificate, for example, a hard disk or a smart card. When stored on a hard disk, the RA certificate is stored in a predefined directory location. The RA certificate to be stored is a certificate issued by a certification authority (CA), which is a certificate to which "authorization authorization" authority is granted.

Of course, as described above, the application service system may receive a certificate as a BRA, in which case the certificate storage unit 31 will store the BRA certificate.

The CA interface module 32 provides the following functions. The application service user management module 33 receives the information necessary for authorization of the user's certificate, and reads the RA (or BRA) digital signature secret key and digital signature certificate from the certificate storage unit 31 for the information. After importing and performing the digital signature, the packet is transmitted to the CA system 27 of the accredited certification authority, and the processing result in the CA system 27 is waited. And, it provides a function to receive the registration number of the user from the CA system 27 as a result value and deliver it to the application service user management module 33.

The application service user management module 33 receives a certificate issuance authorization process required to use an application service from a user who has subscribed to an application service, and extracts information necessary for authorization of the user's certificate from information related to subscription of an existing application service, or It receives from the management and transfers to the CA interface module 32 so that the certificate issuance authorization is made. In addition, the application service user management module 33 receives and manages the result value according to the certificate issuance authorization from the CA interface module 32 and delivers it to the user.

The manner in which the above-described certificate storage unit 31, CA interface module 32 and the application service user management module 33 is operated in conjunction will be more apparent through the detailed description of FIG.

In addition, in the above description, the certificate storage unit 31 is representatively expressing the 'certificate' for convenience and convention of notation, but more precisely, the certificate and private key are stored. In the public key infrastructure (PKI) system, which is a well-known technology, the subject of the 'electronic signature' in the technical configuration environment commonly used has a private key even if not specifically specified.

4 is a flowchart illustrating an embodiment of a certificate issuance authorization service method in an application service system according to the present invention.

Based on FIG. 4, a user certificate issuance authorization process in an application service system will be described.

First, the application service user management module 33 calls a function to perform a function for issuing a certificate for a new user, wherein the application service user management module 33 is required for authorization of the authentication system (CA) for issuing a new user. Information is passed to the CA interface module 32 in the form of parameters (401).

The CA interface module 32 examines the parameters defined as mandatory items among the received data and checks whether there are items having null values among them (402).

As a result of the check, if there are required items that are found to be null values, an appropriate error code value is extracted and transmitted to the application service user management module 33 (412).

As a result of the check, if there is no null value, the certificate storage unit 31 extracts the certificate of the BRA (or RA) and loads it into memory (403).

The CA interface module 32 decrypts the BRA (or RA) digital signature secret key file with the BRA (or RA) digital signature secret key password among the parameters received from the application service user management module 33. Obtain the private key value for the digital signature (404).

Next, the CA interface module 32 generates a "user certificate issuance" packet by performing an electronic signature on user information necessary for issuing a user certificate using the obtained BRA (or RA) digital signature private key. (405).

The IP address and port information of the certification authority are extracted from the information acquired by the CA interface module 32 from the application service user management module 33 and attempted to connect to the authentication system CA (406). Then, it is checked whether a session connection with the authentication system CA is established (407).

If the check results, if the session is not connected, returns an error to the application service user management module 33 (412), and if the check results, the session is connected, requesting to issue a certificate to the authentication system (CA) through the pre-connected session. In step 408, the user certificate issuance authorization packet is transmitted.

Then, while waiting, the CA interface module 32 receives a result of the "Authorization of user certificate" request from the authentication system CA (409). Then, it is checked whether the received result value is successful (410). As a result of the check, if the received value is unsuccessful, an error is transmitted to the application service user management module 33 (412), and if the received result indicates that the user certificate issuance is successful, registration of the user received from the authentication system (CA) The number (ie, reference number / authorization number) is transmitted to the application service user management module 33 (411).

5 is an exemplary view illustrating a processing procedure for a user certificate issuance authorization request in the authentication system.

In FIG. 4, the CA issue module 32 describes a certificate issuance authorization service method in an application service system according to the present invention. This user certificate issuance authorization process will be clearer by looking at the processing procedure in the authentication system (CA) through FIG.

First, the authentication system (CA) receives a "user certificate issuance" packet from the CA interface module 32 of the application service system (501), and is sent by a legitimate BRA (or RA) with the authority to issue the certificate. Check (502).

If the check indicates that a legitimate BRA (or RA) has not been sent, an error is forwarded to the CA interface module 32 of the application service system (508).

If it is determined that the legitimate BRA (or RA) has been sent, the user information is extracted from the received "user certificate issuance authorization" packet (503). In operation 504, it is checked whether a user who has requested to issue a user certificate is a user who has been registered.

As a result of the check, if the user requesting the user certificate issuance is a previously registered user, an error is transmitted (508) to the CA interface module 32 of the application service system.

As a result of the check, if the user requesting the user certificate issue authorization is not a previously registered user, a registration number (ie, reference number and authorization number) for a new user is generated (505). In operation 506, the user information extracted from the received " user certificate issuance authorization " packet and the generated registration number are stored in the database DB of the authentication system CA. Finally, the authentication system (CA) generates a result packet for the "issuance of user certificate" request and delivers it to the CA interface module of the application service system (507).

6 is a schematic diagram illustrating an application service in an application service system to which the present invention is applied.

In FIG. 6, "National Pension EDI Service" is shown as an example of an application service. When a user subscribes to and uses such an application service, authorization of user certificate is required. The application service system operates as one RA (or BRA) system to process it.

Referring to FIG. 6, an individual subscriber applies for the National Pension EDI service, is approved to subscribe to the EDI service, and then processes the agent through issuing an authorization for issuing a user certificate required to use the EDI service in the EDI service system, and notifies the subscriber of the result. The subscriber is issued a certificate and shows the overall process of using the EDI service. In particular, through FIG. 6, it can be seen that the subscriber processes the user certificate issuance authorization with the existing data submitted through the EDI service subscription, that is, the application service subscriber information. In the past, even in case of the in-depth subscriber's information submission, the user certificate issuance authorization has to be handled separately, but it can be seen that this has been greatly simplified and reduced in time.

The method of the present invention as described above may be implemented as a program and stored in a computer-readable recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.).

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and various substitutions, modifications, and changes are possible in the art without departing from the technical spirit of the present invention. It will be clear to those of ordinary knowledge.

The present invention as described above, the application service system has the subscription information of the application service subscriber, to guarantee the application service subscriber to operate as a RA (or BRA) system to process the user certificate issuance authorization faster and more accurate to the user Not only can the service be provided more quickly, but also the user's inconvenience can be reduced by eliminating redundant information from the user.

In other words, the present invention can be used for the application service, it is possible to automate the process of issuing the first certificate of the new user of the application service online, thereby increasing the service satisfaction of the user using the application service system In addition, the application service provider can effectively provide a service by excluding the service delay caused by the use of a certificate.

In addition, the present invention has the effect of improving the overall service quality by eliminating the occurrence of the input error that occurred while the RA operator (or BRA operator) manually input.

In addition, the present invention, if the user certificate issuance authorization request is successfully performed in the authentication system (CA), the authentication system (CA) the registration number (ie, authorization number / reference number) required for the user to be issued a certificate; By delivering to the application service system, there is an effect that the application service provider can deliver the registration number in a convenient way according to the service conditions or the user's choice.

In addition, the present invention has the effect of relieving the burden on the application service provider for the application of certificate-based security services can contribute to the spread of certificate-based security services.

Claims (8)

In the application service system that requires a user certificate to use the service, An application service linking means for extracting and transferring information necessary for issuing a user certificate from information of a corresponding application service subscriber according to a user certificate issuance authorization service processing request, and receiving the certificate issuance authorization processing result and delivering it to the subscriber; The certificate containing the information necessary to reliably send and receive the certificate issued by the certification authority (CA) certification authority from the certification authority (CA), that is, the subscriber information for requesting authorization of the user certificate is issued. Certificate storage means for storage management; And Receive information and related information about the subscriber from the application service linking means, extract information necessary for the user certificate issuance authorization request from the certificate storage means to generate the user certificate issuance authorization request message for the subscriber to the authentication Issuance authorization processing means for delivering to the CA and receiving the result and providing the result to the application service linking means. Certificate issuance service device in the application service system comprising a. The method of claim 1, The application service linking means, The apparatus for issuing a certificate in an application service system, wherein the subscriber information necessary for issuing the user certificate is provided in a parameter format. The method according to claim 1 or 2, The issuance authorization processing means, Application service system, characterized in that after the request for the user certificate issuance authorization process from the application service linking means, the certificate as the registration authority is extracted from the certificate storage means and located in the memory so that the necessary information can be easily obtained. Issuing a certificate from a service device. A certificate issuance or service method applied to a certificate issuance or service device in an application service system, the method comprising: A first step of extracting certificate information on the application service system as a registration authority by receiving information on the application service subscriber, a user certificate issuance authorization service request, and information related thereto; Performing a security process on the subscriber information on the basis of the extracted certificate information to generate a user certificate issuance authorization request message and to transmit it to an authentication system (CA); And A third step of receiving a response message for the user certificate issuance authorization request from the authentication system (CA) and providing the result to the application service subscriber for confirmation; Certificate issuance authorization service method in an application service system comprising a. The method of claim 4, wherein The first step is, A service request message for the user certificate issuance authorization and the user certificate issuance authorization service required for the subscriber information generated based on the subscription information of the application service subscriber and the information received from the subscriber for authorization to issue the user certificate. A fourth step of receiving together with the information; A fifth step of confirming whether all items necessary for authorization of the user certificate in the subscriber information are present; A sixth step of generating and returning an error message if all items necessary for the user certificate issuance are not included in the subscriber information as a result of the checking in the fifth step; And As a result of the checking in the fifth step, if all items necessary for the user certificate issuance are issued from the information of the subscriber, the certificate information for the application service system as a registration authority is extracted from the certificate storing means so as to be used quickly. 7th Step Certificate issuance authorization service method in an application service system comprising a. The method of claim 4, wherein The third step, A fourth step of receiving a response message to the user certificate issuance authorization request from the authentication system (CA); A fifth step of extracting a result value from the received response message and checking whether the certificate issuance authorization has been granted to the subscriber; A sixth step of generating an error message and transmitting it as a response message to the user certificate issuance authorization service request message if the certificate issue authorization for the subscriber has not been performed as a result of the inspection in the fifth step; And A seventh step of transmitting, as a response message to the user certificate issuance authorization service request message, the registration information generated by the certificate issuance authorization of the subscriber if the certificate issuance authorization is performed for the subscriber as a result of the inspection in the fifth step; Certificate issuance authorization service method in an application service system comprising a. The method according to any one of claims 4 to 6, The second step, An eighth step of extracting a secret key password for digital signature from the information related to the received user certificate issuance authorization service and decrypting the secret key file from the extracted certificate information; A ninth step of generating the user certificate issuing authorization request message by performing an electronic signature on the subscriber information necessary for issuing the user certificate using the decrypted digital signature secret key; Extracting address and port information of the authentication system, attempting to connect to the authentication system, and checking whether a session is connected; An eleventh step of generating an error message and transmitting it as a response message to the user certificate issuance authorization service request message if the session connection with the authentication system is not established as a result of the check in the tenth step; And As a result of the check in the tenth step, when the session is connected to the authentication system, a twelfth step of transmitting the user certificate issuance authorization request message to the authentication system. Certificate issuance authorization service method in an application service system comprising a. In an application service system having a processor, A first function of receiving information on an application service subscriber, a user certificate issuance authorization service request, and information related thereto to extract certificate information for the application service system as a registrar; A second function of performing a security process on the subscriber information based on the extracted certificate information, generating a user certificate issuance authorization request message, and delivering the request message to an authentication system (CA); And A third function of receiving a response message for the user certificate issuance authorization request from the authentication system (CA) and providing the result to the application service subscriber A computer-readable recording medium having recorded thereon a program for realizing this.