KR20050031036A - Method for enhancing security by using pki for multi-cast - Google Patents

Abstract

A method for enhancing security is provided to realize PKI(public key infrastructure) in the multicast while keeping high security using common key on the end entities receiving the multicast. A private key and a public key are generated in the end entity(S301). If the End Entity requires to authentication to a registration authority(S302), the registration authority generates the private key using the public key(S311), and transmits the public key to a certificate authority(S312). The certificate authority generates and issues certification using the public key(S321). The certificate authority stores the generated certification to a storage(S322). A relying-party generates common key at every user device group for the multicast(S331), encodes the common key, and transmits the common key to the end entity(S332,S333). The end entity decodes the common key using the private key(S341), decodes contents with the decoded common key(S342), and regenerates the contents(S343).

Description

How to improve security by using PI for multicast {Method for Enhancing Security by Using PKI for Multi-cast}

The present invention relates to a method for encrypting content using a public key, and more particularly, to a method for improving security performance using a public key infrastructure (PKI) scheme in a network using multicast.

In recent years, the broadband network of the internet network has been made, thereby providing a high-definition video stream service. Such a stream method includes a unicast method and a multicast method. Unicast means communication between a single sender and a single receiver on an Internet network, and multicast means communication between a single sender and multiple receivers. In addition, there is an Anycast, which means communication between any sender on the network and the closest group of recipients.

In the case of multicasting, the amount of information transmitted over the Internet can be greatly reduced. However, authentication problems occur when PKI (public key infrastructure) is used. The outline of such PKI is as follows. A PKI is basically a secure and confidential exchange of data or funds by users of unsecured public networks, such as the Internet, by using a pair of public and private keys granted by a trusted authority. To make it possible. PKI provides a digital certificate that identifies an individual or organization, and a directory service that stores the certificate and retrieves it when needed. Although the components of the PKI are generally known, a number of different approaches and services are emerging for each provider, and in the meantime, the Internet standard for PKI continues to work.

PKI uses public key cryptography, the most common method of authenticating a message sender or encrypting a message on the Internet. Traditional ciphertext usually involves creating and sharing a private key used to encrypt and decrypt messages. This private key or private key system has a fatal weakness that the message can be easily deciphered if the key is known to others or intercepted. For this reason, public key cryptography and PKI are the preferred methods on the Internet.

PKI consists of the following: Certificate authority for issuing and verifying digital certificates, certificates containing information about public or public keys, and a registration authority that acts as a certification authority for digital certificates before they are issued to applicants. ), One or more directories in which certificates with public keys are stored, and a certificate management system.

The operation principle of public key and private key encryption is as follows. In public key cryptography, both public and private keys are created simultaneously by the certificate authority using the same algorithm (commonly known as RSA). The private key is given only to the requester, and the public key is published as part of a digital certificate in a directory accessible to everyone. Private keys are never shared with others or transmitted over the Internet. You use your private key to decrypt text that someone encrypted with their public key found in the public directory. Therefore, if a person sends a message to someone, first find the recipient's public key through the central administrator and then encrypt the message using that public key. The person who receives the message decrypts it using his private key. In addition to encrypting the message, the sender encrypts the digital certificate with its private key and sends it together so that the sender must know that the sender is the sender.

The authentication method in the case of streaming in multicast according to the conventional method related to the present invention will be considered. Components according to the prior art are largely composed of a PKI-Management-Entity and a PKI-User. The PKI-Management-Entity is composed of a Registration-Authority, a Certificate-Authority, and a Repository. In addition, the PKI-User is composed of End-Entity and Relying-Party.

The registrar is an organization on the network that verifies a user request for a digital certificate and informs the certificate authority to issue a digital certificate. The registrar is part of a public key infrastructure, or PKI, which is a network system that allows users to exchange information more securely and reliably.

The certification authority is an authority on the network that issues and manages security eligibility and public keys for encrypting and restoring messages. As part of the public key infrastructure, the certification authority checks the security with the registrar to verify the information provided by the digital certificate requester. If the registrar proves the claimant's information, the certification body may issue a certificate.

Digital certificates contain a public key that is used to encrypt and recover digital signatures and messages. Although slightly different depending on the implementation of the public key infrastructure, the certificate usually contains the owner's public key, the validity of the certificate, the owner's name, and other information about the owner of the public key.

Looking at the operation of the prior art, as follows.

First, a private key and a public key are generated through a key generation process. The key generation process is performed through Hardware-Talken inside the Set Top Box. Next, the set-top box is authenticated through the registrar, and after authentication, backs up the public key and transfers it to the certification authority. The certificate authority issues a certificate for the public key and stores it in a repository. Relying-Party obtains a certificate from the repository and uses it to encrypt the content. Then, the set-top box receiving the content decrypts the password using the private key and plays the content.

The above scheme can be applied to the case of using unicast, but there is a problem that cannot be applied as it is to the case of using multicast to reduce the amount of information transmitted in the Internet network. That is, in the case of multicasting, since the encrypted data is distributed to the group through the router, the user cannot encrypt the data using another public key, which causes a security problem.

Accordingly, the present invention was created in view of the above-described problems, and by using a common key, which is a key common to end entities receiving multicast, a PKI (multi-cast) is maintained in high security while maintaining high security performance. public key infrastructure).

In order to achieve the above object, a method for improving security performance using a public key infrastructure in a network for distributing content using multicast includes: a first step of generating a certificate using a public key; A second step of generating a common key for each group targeted for multicast; A third step of encrypting the common key through the generated certificate and transmitting it to a user side; A fourth step of encrypting content with the encrypted common key and transmitting the encrypted content to the user side; A fifth step of decrypting the transmitted common key using a stored private key; And a sixth step of decrypting the content encrypted by the transmitted common key using the decrypted common key.

In order to achieve the above object, a method for improving security performance using the public key infrastructure further comprises the step of playing the decrypted content.

In order to achieve the above object, the first step comprises the steps of generating a private key and a public key at the user side, and submitting the generated public key to a registration authority; Generating and backing up a private key using the submitted public key and delivering the submitted public key to a certification authority; And generating a certificate using the transferred public key and storing the certificate in a storage.

In order to achieve the above object, it is preferable that the fifth and sixth steps are performed at the user side, and the third and fourth steps are performed at the content provider side.

In order to achieve the above object, the backup private key is preferably used to determine whether the public key is duplicated.

In order to achieve the above object, it is preferable that the common key is the same if the groups subject to the multicast are the same, and the common key is different if the groups are different.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Figure 1 shows the configuration of the PKI system of the present invention.

The components of the present invention are largely classified into a PKI-Management-Entity 100 and a PKI-User 200. The PKI-Management-Entity 100 is composed of a Registration-Authority 120, a Certificate-Authority 130 and 131, and a Repository 140. In addition, the PKI-User 200 is composed of an End-Entity 150 and a Relying-Party 160. The end entity 150 broadly means a content user side or a device on the user side. In this embodiment, the end entity 150 will be a set-top box, and the relying-Party 160 will be a contents provider.

The registrar 120 generates the private key 10 using the public key 20 submitted by the user and stores it in the backup DB 110. If the registered private key 10 is duplicated and the duplicated private key 10 is not duplicated, the submitted public key 20 is transmitted to the certification authority 130.

The certification authority 130 generates a certificate 21 using the transferred public key 20. The certificate 21 is distributed to the end entity 150 and stored in the storage 140.

In Relying-Party 160, a common key 30 is generated and this common key 30 is encrypted. Then, the content is encrypted using the encrypted common key 31, and thus the encrypted content 40 is distributed.

In the present invention, the key generation process is performed in the End Entity 150 and in the Relying-Party 160. The end entity 150 generates a private key 10 and a public key 20, and the relying-Party 160 generates a common key 30 for the multicast group. Since the prior art as described with reference to FIG. 1 illustrates the case of unicast, a private key played a role of the common key without generating a separate common key. The Hardware-Talken 151 exists inside the End Entity 150 and serves to generate and store the private key 10 and the public key 20. The Hardware-Talken method is useful for enhancing security in the process of generating the private key 10 and the public key 20.

2 is a flowchart illustrating the overall operation of the present invention.

First, the private key 10 and the public key 20 are generated and stored using the Hardware-Talken 151 inside the End Entity 150 (S301). Next, when the end entity 150 requests registration to the registrar 120 (S302), the registrar 120 generates a private key 10 using the public key 20 and backs it up (S311). ), And transmits the submitted public key 20 to the certification authority (S312).

The certification authority 130 generates a certificate 21 using the public key 20 and issues it (S321). In addition, the generated certificate 21 is stored in the storage 140 (S322).

In the relying-Party 160, a common key 30 is generated for each group of user-side devices that are subject to multicast (S331). Then, the encrypted public key, that is, the certificate (Certificate 21) is obtained from the storage 140, and the common key 30 is encrypted using the same, and then transmitted to the end entity 150 (S332). The certificate 21 includes contents of a certification authority name, a distinguished name, key information, algorithm, public key, authorizations, validity dates, and the like.

The Relying-Party 160 transmits the encrypted common key 31 to the End Entity 150, encrypts the content with the encrypted common key 31, and then encrypts the encrypted content 40. ) Is transmitted to the end entity (S333).

After receiving the encrypted common key 31, the end entity 150 releases encryption of the common key 31 by using the private key 10 stored in the hardware talken 151 (S341). The content 40 encrypted by the common key 31 is decrypted with the decrypted common key 30 (S342). The end entity 150 plays the decrypted content (not shown) (S343).

Although embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art to which the present invention pertains may implement the present invention in other specific forms without changing the technical spirit or essential features thereof. I can understand that. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive. The scope of the present invention is indicated by the scope of the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and the equivalent concept are included in the scope of the present invention. Should be interpreted.

According to the present invention, in addition to the unicast scheme, the strong security of the public key infrastructure can be applied to the content distribution by the multicast scheme or the like.

In addition, according to the present invention, a user, a registrar, a certification authority, and a content provider are all involved in security, thereby maintaining a higher security performance.

1 is a block diagram showing the configuration of a PKI system of the present invention.

2 is a flow chart showing the overall operation of the present invention.

Claims (6)

In a method for improving security performance using a public key infrastructure in a network that distributes content using multicast, Generating a certificate using a public key; A second step of generating a common key for each group targeted for multicast; A third step of encrypting the common key through the generated certificate and transmitting it to a user side; A fourth step of encrypting content with the encrypted common key and transmitting the encrypted content to the user side; A fifth step of decrypting the transmitted common key using a stored private key; And And a sixth step of decrypting the content encrypted by the transmitted common key by using the decrypted common key. The method of claim 1, wherein after the sixth step Playing the decrypted content further comprising using a multicast PKI. The method of claim 1, wherein the first step is Generating a private key and a public key at the user side and submitting the generated public key to a registration authority; Generating and backing up a private key using the submitted public key and delivering the submitted public key to a certification authority; And Generating a certificate by using the delivered public key and storing the certificate in a store. The method of claim 1, wherein the fifth and sixth steps are performed at the user side, and the third and fourth steps are performed at the content provider side. Way. 4. The method of claim 3, wherein the backed up private key is used to determine whether the public key is duplicated. 2. The method of claim 1, wherein the common key is the same if the groups targeted for the multicast are the same, and the common key is different if the groups are different. Way.