KR20050112146A - Method for safely keeping and delivering a certificate and private secret information by using the web-service - Google Patents

Abstract

A method of securely storing and transferring a certificate and private secret information using a web service according to the present invention includes: (1) a first step of storing a certificate stored in a first local computer in a remote storage space; (2) a second step of receiving personal secret information from a user, encrypting the secret information using the certificate, and storing the secret information in the remote storage space; (3) a third step of downloading a certificate from the remote storage space and installing it on a second local computer; And (4) extracting the personal secret information from the remote storage space, and decrypting the personal secret information using a certificate installed in the second local computer and outputting the private secret information through the second local computer. Accordingly, the present invention enables secure transactions such as payment, internet banking, and stock trading using a local communication device without a certificate installed even without a portable recording medium having a certificate stored therein.

Description

METHOD FOR SAFELY KEEPING AND DELIVERING A CERTIFICATE AND PRIVATE SECRET INFORMATION BY USING THE WEB-SERVICE}

The present invention relates to a user authentication method using a computer network, and more particularly, to a method for effectively authenticating a user who wants to use a financial service using an information communication device without a certificate installed.

A user who wants to use commerce, financial transactions, stock trading service, etc. using a networked computer needs to authenticate himself to the server computer. If the relevant information is relatively inexpensive, it is sufficient to authenticate the user with a simple password. However, the above-mentioned password authentication method is insufficient when information is expensive or strict security is required, such as payment of expensive goods and large transfers.

Certificates are widely used to overcome the insecureness of such password authentication methods. In other words, the certificate is registered in the hard disk of the networked client computer, and the certificate is authenticated when performing a transaction requiring security.

However, the use of such certificates is positive in increasing security, but limits the user's network activity to the communication device on which the certificate is installed. That is, even the user himself cannot use services such as electronic commerce, financial transactions, stock trading, etc. through a communication device that does not have his certificate installed. Of course, the above problems can be overcome by having a portable recording medium recording a certificate, but there is a problem of security release due to user inconvenience and loss of the recording medium.

The present inventors conceived that the existing problem of having a recording medium can be solved by storing the certificate in a remote storage space accessible through a network and downloading the certificate from the remote storage space when authentication is required.

That is, the present invention provides a method in which a user does not need to carry a certificate for authentication of a user who wants to use an online financial service.

The present invention also provides a method of downloading a certificate from a remote storage area accessible via a network and freely using it locally.

In addition, the present invention further provides a method of storing personal information that requires confidentiality, such as a bank security card, an account number, a family ID, a password of a safe, in a remote storage space, and enabling verification when necessary.

Other objects and advantages of the invention will be described below and will be appreciated by the embodiments of the invention. Furthermore, the objects and advantages of the present invention can be realized by means and combinations indicated in the appended claims.

In order to achieve the above object, a method for securely storing and transferring a certificate using a web service according to the present invention includes: (1) a first step of storing a certificate stored in a first local computer in a remote storage space; (2) a second step of downloading a certificate from said remote storage space and executing it on a second local computer;

The first step again includes (a) outputting a list of certificates stored on the first local computer, selecting a predetermined certificate from the list, and (b) identifying the owner of the selected certificate. A procedure for receiving a certificate password, (c) receiving an encryption key for encrypting the certificate, (d) encrypting the certificate using the encryption key, and (e) encrypting the certificate Uploading and storing in a remote storage space;

The second step may further include (f) accessing a remote computer managing the remote storage space using a second local computer without a certificate; (g) identifying a user based on the user identification information, and extracting and outputting a list of certificates registered for the user; (h) selecting a certificate to download from the list of certificates, (i) downloading the selected certificate to a second local computer, (j) receiving a decryption key for decrypting the downloaded certificate, (k) decrypting the certificate using the decryption key; and (l) storing the decrypted certificate in a certificate call location of a second local computer.

In addition, a method for securely storing and verifying personal secret information using a web service as another aspect of the present invention includes: (1) a first step of storing a certificate stored in a first local computer in a remote storage space; (2) a second step of receiving personal secret information from a user, encrypting the secret information using the certificate, and storing the secret information in the remote storage space; (3) a third step of downloading a certificate from the remote storage space and installing it on a second local computer; And (4) extracting the personal secret information from the remote storage space, and decrypting the personal secret information using a certificate installed in the second local computer and outputting the private secret information through the second local computer. ;

The first step again outputs a list of certificates stored on the first local computer, selects a predetermined certificate from the list, and inputs a certificate password to confirm the owner of the selected certificate. And a procedure of receiving an encryption key for encrypting the certificate, encrypting the certificate using the encryption key, and uploading and storing the encrypted certificate to the remote storage space;

The third step again

Accessing a remote computer managing the remote storage space using a second local computer without a certificate; Identifying a user based on the user identification information, and extracting and outputting a list of certificates registered for the user; Selecting a certificate to be downloaded from the list of certificates, downloading a selected certificate to a second local computer, receiving a decryption key for decrypting the downloaded certificate, and using the decryption key to obtain the certificate. And a process of storing the decrypted certificate at the certificate call location of the second local computer.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 shows a computer system for realizing the method of the present invention.

That is, the system of the present invention includes a first local computer 200a and a second local computer 200b respectively connected to the storage server 300 and the service server 400 through the network 100. do. The network 100 may use an internet communication protocol (TCP / IP) that allows a client to communicate with a server.

The first and second local computers 200a and 200b may be personal computers (PCs), workstations, or larger or smaller computer systems. Typically, local computers 200a and 200b include one or more processors, memory, and input / output devices.

The user wishes to access the information records 360, 460 stored by, for example, the World Wide Web server 300 or 400. The information records 360 and 460 may be in the form of wired or wireless web pages 370 and 470. These web pages 370 and 470 may be data records such as simple content text information or more complex digitally encrypted multimedia content such as software programs, graphics, audio signals, image images, and the like.

Here, the first local computer 200a is a device mainly used by a user, and a certificate such as 250 is installed in the hard disk. Thus, the user uses this certificate 250 to perform identity authentication for the service server 400.

In addition, the second local computer 200b is an arbitrary device that is not normally used by a user, and unlike the first local computer 200a, the certificate 250 is not installed in the hard disk. Therefore, a user who wants to authenticate using the second local computer 200b must first download his or her certificate from the storage server 300.

The first and second local computers 200a and 200b monitor operating systems 210a and 210b as system software for monitoring and managing the hardware and software of the system so as to efficiently use the system, and navigation for positioning web pages. Web browser programs 220a and 220b such as Navigator and Explorer, and the like.

The browser programs 220a and 220b allow a user to enter the address (or location information) of a particular web page to search. The address (or location information) of the page is specified as a uniform resource locator (URL). In addition, the browser programs 220a and 220b allow a user to access another page by clicking on a hyperlink of the obtained web page when the page is obtained. These hyperlinks automate entering the URL of another page after obtaining the page.

The storage server 300 (or service server) connected to the first and second local computers 200a and 200b through the network 100 is connected to the multiprocessor P (connected to each other by the high speed communication bus 340 ( 320, a memory (M) 330, a storage (or database) 350, a network interface 310, and a driving program. Of course, the storage server 300 (or service server) of the present invention is not necessarily limited to a server computer composed of multiple processors connected to each other by a high speed communication bus.

The storage device 350 stores certificates 250 and personal secret information of a plurality of users uploaded from the first local computer 200a. This personal confidential information collectively refers to personal information that needs to be kept confidential, such as a bank's security card, account number, password, family social security number, passport number, and the password of the safe that they manage.

The personal secret information is stored encrypted with the public key of the certificate. Therefore, in order for the user to verify his personal secret information, the user must decrypt the encryption of the personal secret information using the private key. That is, a user who wants to check the personal secret information stored in the storage server 300 should perform user authentication through a certificate and decrypt the password with the private key.

The service server 400 is a commerce server for performing electronic commerce, a banking server located in a bank, a trading server located in a securities company, etc., and requires authentication through a certificate for processing a transaction. In particular, the service server 400 is a banking server of a financial institution for processing business, such as Internet banking may require a certificate and a security card number for the security of transactions.

Hereinafter, a method of executing a certificate according to the present invention will be described in detail with reference to FIGS. 2 to 4.

<Trust certificate>

First, a procedure of uploading a certificate stored in the first local computer 200a to the storage server 300 will be described with reference to FIGS. 2 and 4.

According to the present invention, the user who wants to register the certificate 250 stored in the first local computer 200a in the remote storage space accesses the storage server 300 via the network 100 (S110). At this time, the user confirms the authority as a party user through the normal authentication procedure (S115).

For the authenticated user, the storage server 300 provides a menu selection page that includes a menu such as, for example, "Leave a certificate, import a certificate, register personal secret information, and verify personal secret information." The user who has received the menu selection page from the storage server 300 selects a "trust certificate" menu to upload the certificate 250 stored in the first local computer 200a to the storage server 300. (S125)

At this time, a plug-in program such as, for example, an Active X control is automatically downloaded and installed from the storage server 300 to the first local computer 200a. Hereinafter, the plug-in program installed in the local computer will be referred to as "certificate management module" according to its function.

In this state, when the certificate management module is installed in the first local computer 200a, when the user requests "trust the certificate" (S130), the certificate management module is present in all the designated storage locations of the first local computer 200a. The certificate is searched and the list is displayed through the user interface (S135).

The user who checks the list of certificates selects a certificate to be registered in the storage server 300 (S140), and inputs a certificate password to confirm his / her identity. (S145) The certificate management module receiving the certificate password from the user corresponds to It is determined whether the password is valid and whether the certificate is valid (for example, whether the validity period has elapsed or whether the certificate has been revoked). After verifying the validity of the certificate and the validity of the owner, the certificate management module requests the user to input an encryption key to encrypt the certificate file.

The certificate management module, which receives the encryption key 201 from the user, extracts the selected certificate file 202 from the hard disk 205 of the first local computer 200a and encrypts it with the encryption key 201. Reference) (S155)

The encrypted certificate file 207 is uploaded to the storage server 300 (S160), the storage server 300 receives the encrypted certificate file 207 is stored in the storage area 350 for the user the certificate file (S165, S170)

As described above, the certificate of the first local computer is stored and registered in the remote storage space in a state in which the certificate of the first local computer is encrypted with the encryption key input by the user.

<Personal Secret Information Registration>

In addition, when a user wants to register personal secret information in the storage server 300, the user selects the "Register personal secret information" menu in S120. Accordingly, the storage server 300 transmits a personal secret information input page to the first local computer 200a, and the user inputs personal secret information such as an account number and a safe password through the input page. The personal secret information thus input is encrypted with the public key of the certificate installed in the first local computer 200a. The encrypted personal secret information is stored in the corresponding user storage area of the storage server to complete registration.

<Import certificate>

Hereinafter, a method of downloading and installing a certificate stored and registered in the remote storage space 350 to the second local computer 200b will be described with reference to FIGS. 3 and 4.

A user who wants to conduct an expensive secure transaction such as a financial transaction through the service server 300 using the second local computer 200b without a certificate installed therein, first to the second local computer 200b for a transaction. You need to install your own certificate. To this end, the user accesses the storage server 300 via the network 100 (S210). At this time, the user checks the authority as a party user through a normal authentication procedure (S215).

For the authenticated user, the storage server 300 provides a menu selection page that includes a menu such as, for example, "Leave a certificate, import a certificate, register personal secret information, and verify personal secret information." The user who receives the menu selection page from the storage server 300 selects a "get certificate" menu to download a certificate stored in a user storage area of the storage server to the second local computer 200b. S225)

When the user requests a "get certificate", the storage server 300 searches for a registered certificate stored in the storage area 350 of the user, and provides the list to the second local computer 200b. The browser of the second local computer 200b having received the certificate list from the storage server 300 displays the certificate list to the user (S235).

The user selects a certificate to be installed on the second local computer 200b from the displayed certificate list, and transmits the selection request to the storage server 300 (S240).

The storage server 300 receiving the certificate selection request from the user extracts the corresponding certificate file 307 from the user storage area 350 based on the request, and extracts the extracted certificate file 307 from the second local. The file is downloaded to the computer 200b. (S250) (See FIG. 4) At this time, the certificate file is a certificate 307 encrypted by the encryption key 201.

The second local computer 200b downloads the encrypted certificate 307 from the storage server 300 and at the same time downloads and installs a plug-in program such as an Active X control from the storage server 300. Hereinafter, the plug-in program installed in the second local computer 200b is referred to as a "certificate management module" according to its function.

The certificate management module installed in the second local computer 200b requests the user to input the decryption key 213 to decrypt the encrypted certificate 307 downloaded from the storage server 300. (S260)

The certificate management module receiving the decryption key 213 from the user decrypts the downloaded certificate 307 using the decryption key 213 (S265, S270).

After decrypting the certificate, the certificate management module automatically searches the storage location of the decrypted certificate 212 (S275), and stores the decrypted certificate 212 in the searched storage location 215. (S280) The location where the certificate will be stored is determined by appointment.

Through the above-described process, when a certificate is installed in the second local computer 200b, the user can authenticate the identity of the user with respect to the service server 300 by using the second local computer 200b. .

In addition, the certificate stored in the hard disk of the second local computer 200b may be permanently stored or deleted after use. When deleting, use a complete deletion algorithm that cannot be restored. That is, when the temporary use of the certificate is finished, a method of allowing a user to delete manually by providing a warning message indicating that the deletion should be performed or automatically deleting when a registered process is terminated can be adopted.

<Personal Confidential Information Confirmation>

In the state where the decrypted certificate is installed on the second local computer 200b, and the user who wants to check the personal secret information (security card, account number, safe password, etc.) registered in the storage server 300, in step S220, the personal Confirm secret information 』menu. Accordingly, the storage server 300 requests a login of a certificate installed in the second local computer 200b for user authentication. When a user enters a certificate password, it uses the user authentication to decrypt the personal secret information. That is, the encrypted private secret information is decrypted using the private key input from the user. Accordingly, the user can check the decrypted personal secret information output on the browser screen.

The terms or words used in this specification and claims are not to be construed as being limited to their ordinary or dictionary meanings, and the inventors may appropriately define the concept of terms in order to best describe their invention. It should be interpreted as meaning and concept corresponding to the technical idea of the present invention based on the principle that the present invention.

Therefore, the embodiments described in the specification and the drawings shown in the drawings are only the most preferred embodiment of the present invention, and do not represent all of the technical idea of the present invention, which can be replaced at the time of the present application It should be understood that there may be various equivalents and variations.

The present invention is not limited to the above-described embodiments, and various modifications and variations are made by those skilled in the art within the equivalent scope of the technical concept of the present invention and the claims to be described below. Of course it is possible.

The present invention enables secure transactions such as payment, internet banking, and stock trading using a local communication device that does not have a certificate installed even without a portable recording medium containing the certificate.

In particular, when a certificate is registered in a remote storage space, the certificate is encrypted using an encryption key that only a user knows, so that the certificate can be protected from invasion such as hacking. In addition, the certificate is more secure because the certificate is downloaded from the remote storage in encrypted form and decrypted locally.

The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate the presently preferred embodiments of the invention and, together with the description of the following preferred embodiments, serve to explain the principles of the invention.

1 is a block diagram of a network system for implementing the method of the present invention.

2 is a flowchart for explaining a procedure of uploading and registering a certificate stored in a local computer to a certificate server.

3 is a flowchart for explaining a procedure of downloading and executing a certificate entrusted to a certificate server to a local computer.

4 is a process block diagram generally illustrating the procedure of the present invention.

<Description of the symbols for the main parts of the drawings>

100: network 200a, 200b: local computer

300: certificate server 400: service server

Claims (4)

It is a method to securely store and deliver a certificate using a web service. (1) a first step of storing a certificate stored in the first local computer in a remote storage space; (2) a second step of downloading a certificate from said remote storage space and executing it on a second local computer; The first step again (a) outputting a list of certificates stored on the first local computer, and selecting a predetermined certificate from the list; (b) inputting a certificate password to confirm the owner of the selected certificate; (c) receiving an encryption key for encrypting the certificate; (d) encrypting the certificate using the encryption key; (e) uploading and storing an encrypted certificate in the remote storage space; The second step again (f) accessing a remote computer managing the remote storage space using a second local computer without a certificate; (g) identifying a user based on the user identification information, and extracting and outputting a list of certificates registered for the user; (h) selecting a certificate to download from the list of certificates; (i) downloading the selected certificate to a second local computer, (j) receiving a decryption key for decrypting the downloaded certificate; (k) decrypting the certificate using the decryption key; (l) storing the decrypted certificate at the certificate call location of the second local computer. This is a method of securely storing and verifying personal confidential information using a web service. (1) a first step of storing a certificate stored in the first local computer in a remote storage space; (2) a second step of receiving personal secret information from a user, encrypting the secret information using the certificate, and storing the secret information in the remote storage space; (3) a third step of downloading a certificate from the remote storage space and installing it on a second local computer; And (4) extracting the personal secret information from the remote storage space, and decrypting the personal secret information using a certificate installed on the second local computer and outputting the private secret information through the second local computer; The first step again Outputting a list of certificates stored on the first local computer, and selecting a predetermined certificate from the list; Receiving a certificate password to confirm the owner of the selected certificate; Receiving an encryption key for encrypting the certificate; Encrypting the certificate using the encryption key; Uploading and storing an encrypted certificate in the remote storage space; The third step again Accessing a remote computer managing the remote storage space using a second local computer without a certificate; Identifying a user based on the user identification information, and extracting and outputting a list of certificates registered for the user; Selecting a certificate to download from the list of certificates; Downloading the selected certificate to a second local computer, Receiving a decryption key for decrypting the downloaded certificate; Decrypting the certificate using the decryption key; And storing the decrypted certificate at a certificate call location of the second local computer. The method of claim 2, The personal secret information comprises a bank security card, social security number, password of the safe, passport number, account number and the like. The method according to claim 1 or 2, wherein the first step and the third step are both And determining the validity of the certificate for checking the validity period or revocation of the certificate.