KR20110029033A - System and method for issueing public certificate of attestation using usim information and recording medium - Google Patents

Abstract

PURPOSE: A system for issuing public key certificate using USIM information and a method thereof are provided to prevent the misuse of the illegally issued public key certificate by checking a user's identification using a USIM in the user's mobile terminal. CONSTITUTION: A communication company server(100) comprises following. If the public key certificate issuance request is inputted, and identification request information is transmitted, an information receiver(105) receives the identification request information. Based on the received identification request information, an information confirmer(110) checks the user's identification. An information provider(120) offers the identification result about the user to a certificate issuing terminal(135). An information storage unit(125) stores the identification result.

Description

System and Method for Issueing Public Certificate of Attestation using USIM Information and Recording Medium}

1 is a diagram illustrating a certificate issuing system for issuing and processing a public certificate through identity verification using USIM information provided in a wireless terminal according to an embodiment of the present invention.

2 is a diagram illustrating a certificate issuing system for issuing and processing a public certificate through identity verification using USIM information provided in a wireless terminal according to one embodiment of the present invention.

3 is a diagram illustrating a functional configuration of a certificate issuing terminal for issuing and processing a public certificate through identity verification using USIM information provided in a wireless terminal according to an embodiment of the present invention.

4A and 4B illustrate a process of issuing and processing a public certificate through identity verification using USIM information provided in a wireless terminal according to one embodiment of the present invention.

5A and 5B are diagrams illustrating a process of issuing and processing a public certificate through identity verification using USIM information provided in a wireless terminal according to another exemplary embodiment of the present invention.

6A and 6B are diagrams illustrating a process of issuing and processing a public certificate through identity verification using USIM information provided in a wireless terminal according to another embodiment of the present invention.

<Description of main parts of drawing>

100: communication company server 105: information receiving unit

110: information confirmation unit 115: information generation unit

120: information providing unit 125: information storage unit

130: storage medium 135: certificate issuing terminal

140: customer wireless terminal 145: certificate server

In the present invention, when issuing an accredited certificate through an unmanned accredited certificate issuing terminal, the carrier confirms the identity of the customer through a USIM provided in a wireless terminal such as a mobile phone carried by the customer, and the certificate is illegally issued and abused. Is to solve.

With the development of information and communication technology, financial transactions, which were only performed on the offline, have been made through a network called the Internet, thereby providing convenience to many customers.

However, Internet banking provided through a network called the Internet is always exposed to the problem of hacking due to the fact that the network is available and accessible to anyone, and thus various problems occur.

In order to solve this situation, by providing a public certificate as an authentication means and providing an Internet banking service through a public certificate, a security vulnerability is solved. However, when a public certificate is illegally issued, it is fundamentally hacked. The situation cannot be free.

An object of the present invention for solving the above problems, when issuing a certificate through an unmanned certificate issuing terminal, by verifying the identity of the customer through the USIM provided in the wireless terminal, such as a mobile phone carried by the customer, It is intended to provide a method and system for solving a problem in which a certificate is illegally issued and abused and a recording medium therefor.

The method for issuing an accredited certificate through an unmanned accredited certificate issuing terminal according to the present invention includes a wireless terminal inputted (or selected) by the customer when the customer inputs (or selects) the wireless terminal information for a request for issuing a public certificate. Requesting USIM authentication, confirming USIM information in the wireless terminal inputted (or selected) by the customer, and transmitting the confirmed USIM information to a communication company server to confirm the identity of the customer based on the USIM information; When the identification result is received from, characterized in that it comprises the step of issuing and processing a public certificate based on the received identification results.

The method for issuing an accredited certificate using USIM information according to the present invention includes a step of transmitting, when the USIM authentication is requested to a wireless terminal, the communication server server further comprising a communication number for transmitting an identity verification result to an unattended accredited certificate issuing terminal. Characterized in that made.

In the method of issuing an accredited certificate using USIM information according to the present invention, the identity verification result transmitted by the telecommunication company server is characterized in that the authentication code, and the telecommunication company server sends the authentication code to the unattended authorized certificate issuing terminal and the customer wireless terminal. When the customer confirms the authentication code transmitted to the customer wireless terminal and transmits (or selects) it to the unmanned official certificate issuing terminal, it comprises the step of comparing the authentication code transmitted by the communication company server with each other. .

On the other hand, it includes a computer-readable recording medium, characterized in that for recording a program for executing the method for issuing a public certificate using the above-described USIM information.

On the other hand, the system for issuing a public certificate through the unattended public certificate issuing terminal according to the present invention, if the customer inputs (or selects) the wireless terminal information for the request for issuing a public certificate, the customer inputs (or selects) A means for requesting USIM authentication to a terminal, and a wireless terminal inputted (or selected) by the customer to confirm USIM information, and transmit the confirmed USIM information to a communication company server to confirm customer identity based on USIM information, When the identification result is received from the communication company server, it is characterized in that it comprises a means for issuing and processing a public certificate based on the received identification result.

Hereinafter, with reference to the accompanying drawings and description will be described in detail the operating principle of the preferred embodiment of the present invention. However, the drawings and the following description shown below are for the preferred method among various methods for effectively explaining the features of the present invention, the present invention is not limited only to the drawings and description below. In addition, in the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. In addition, terms to be described below are terms defined in consideration of functions in the present invention, which may vary according to a user's or operator's intention or custom. Therefore, the definition should be made based on the contents throughout the present invention.

In addition, preferred embodiments of the present invention to be carried out below are provided in each system functional configuration to efficiently describe the technical components constituting the present invention, or system functions that are commonly provided in the technical field to which the present invention belongs. The configuration will be omitted, and described mainly on the functional configuration to be additionally provided for the present invention. If those skilled in the art to which the present invention pertains, it will be able to easily understand the function of the components that are conventionally used among the omitted functional configuration not shown below, and also the configuration omitted as described above The relationship between the elements and the components added for the present invention will also be clearly understood.

In addition, the following examples will be used to appropriately modify the terms so that those skilled in the art to clearly understand the technical features of the present invention to effectively understand, but the present invention It is by no means limited.

As a result, the technical spirit of the present invention is determined by the claims, and the following examples are one means for efficiently explaining the technical spirit of the present invention to those skilled in the art to which the present invention pertains. It is only.

1 is a diagram illustrating a certificate issuing system for issuing and processing a public certificate through identity verification using USIM information provided in a wireless terminal according to an embodiment of the present invention.

In more detail, in Figure 1, a predetermined customer issues a certified certificate through identification verification using USIM information provided in a wireless terminal, and the customer uses the certificate issuing terminal 135 to obtain customer information and wireless terminal number information. (Eg, mobile phone number information) and certificate issuing request information including terminal specific information on the certificate issuing terminal 135 are input (or selected), and the certificate issuing terminal 135 is based on the radio terminal number information. After requesting the USIM information transmission through the customer wireless terminal 140, when the identification request information transmitted from the customer wireless terminal 140 is received, confirms the identity based on the received identification information and confirms the identity. As a system configuration for transmitting a result to the certificate issuing terminal 135 to be processed so that the public certificate is issued, in the technical field to which the present invention belongs Those skilled in the art can infer various implementation methods for the certificate issuing system configuration for issuing and processing the public certificate through the identification verification using the USIM information provided in the wireless terminal by referring to and / or modifying the drawing 1. However, the present invention includes all the implementation methods inferred above, and is not limited to the implementation method shown in FIG.

Hereinafter, in order to request for issuance of a certificate through a certificate issuing request interface output through a predetermined certificate issuing terminal 135 on the certificate issuing system shown in FIG. 1, customer information and wireless terminal number information (for example, a mobile phone number). Information) and certificate issuing request information including terminal specific information for the certificate issuing terminal 135 is input (or selected), and the customer issuing terminal 140 is based on the radio terminal number information in the certificate issuing terminal 135. After requesting the USIM information transmission through), the identification request information transmitted from the customer wireless terminal 140 is received, and after the identification process based on the received identification request information, the certificate issuing terminal Components corresponding to at least one or more means and / or functional configurations provided to 135 are referred to as " communication server 100 " for convenience.

Referring to FIG. 1 according to an embodiment of the present invention, a certificate issuing system for identification verification using USIM information provided in the wireless terminal is a branch (or a branch) or a public place that processes at least one authorized certificate issuance. It is characterized in that it comprises a certificate issuing terminal 135 provided in the back, the certificate issuing terminal 135 is a communication company server 100 and / or certificate server provided on the certificate issuing system through a predetermined communication network ( 145 and a communication channel are connected.

The storage medium 130 provided on the certificate issuing system according to the present invention is USIM issuance information for the USIM provided to the customer subscribed to one or more carriers, customer information for the customer who received the USIM, and the customer Characterized in that the identification history information for the feature characterized in that the processing to store.

The customer information includes personal information (eg, name, resident registration number, address, phone number, mobile phone number, e-mail address, etc.) of the customer who subscribes to the telecommunication company and receives the communication service, and the member information of the customer (eg, the And at least one or more member ID information included in the customer D / B provided on the telecommunication company server 100 associated with the certificate issuing system in response to the customer by joining as a customer of the telecommunication company. It is preferable to make.

The USIM issuance information may include at least one or more information (eg, a wireless terminal number (eg, a mobile phone number, etc.) used by the customer) corresponding to one or more USIMs provided to the customer.

The identification history information includes at least one of identification request date information that has been processed for identification based on USIM issue information of the customer, identification result result information, and terminal unique information for the certificate issuing terminal 135 that has requested identification. It is preferable to comprise the above.

The telecommunication company server 100 provided on the certificate issuing system according to the present invention is a generic term for the certificate issuing system side components connected to the certificate issuing terminal 135 through a predetermined communication network, and includes at least one server (or Device) and / or at least one program recorded on a recording medium provided in a predetermined server (or device), and the present invention is not limited thereto.

Referring to FIG. 1, the telecommunication company server 100 includes customer information, wireless terminal number information (eg, mobile number information), and terminal unique information on the certificate issuing terminal 135 in the certificate issuing terminal 135. After the certificate issuing request information is input (or selected), the certificate issuing terminal 135 requests USIM information transmission through the customer radio terminal 140 based on the radio terminal number information, and then the customer radio terminal 140. When the identification request information is transmitted from the information receiving unit 105 (or information receiving means) for receiving the identification request information, and based on the identification request information received through the information receiving unit 105 for the customer Information confirmation unit 110 (or information confirmation means) for confirming the identity, and information providing unit 120 (or information) for providing the certificate issuing terminal 135 with the result of identity verification for the customer By having a gongsudan), it characterized in that formed.

In addition, the communication company server 100 in response to the identification request information transmitted from the certificate issuing terminal 135, when the identification is completed, in response to the customer wireless terminal 140 and the certificate issuing terminal 135 The information generating unit 115 (or information generating means) for generating (or extracting) an authentication code to be transmitted to the customer wireless terminal 140 and the certificate issuing terminal 135 are generated (or extracted). It is characterized in that it further comprises an information providing unit 120 (or information providing means) for processing to be transmitted.

The certificate issuing terminal 135 receives (or selects) certificate issuing request information including customer information, wireless terminal number information (for example, mobile phone number information), and terminal-specific information about the certificate issuing terminal 135. After the certificate issuing terminal 135 requests the USIM information transmission through the customer wireless terminal 140 based on the wireless terminal number information, if the identification request information is transmitted from the customer wireless terminal 140, The information receiving unit 105 may receive the identification request information transmitted from the certificate issuing terminal 135.

When the identification request information transmitted from the certificate issuing terminal 135 is received through the information receiving unit 105, the information checking unit 110 is based on the identification request information transmitted by the certificate issuing terminal 135. To verify the identity of the customer.

According to the embodiment of the present invention, the identification of the customer, the USIM issuance information matching the USIM information included in the received identification request information via the storage medium 130, the confirmed USIM It is preferable to process identity verification for the identification request information by checking whether the stored customer information and the customer information included in the identification request information match with the issuance information.

According to another embodiment of the present invention, when the identification of the customer is performed in the certificate issuing terminal 135, the storage medium 130 receives USIM issuance information matching the USIM information included in the received identification request information. By confirming through, and connected to the confirmed USIM issuing information to transmit the stored customer information to the certificate issuing terminal 135 to process the identity verification for the identity verification request information is made in the certificate issuing terminal 135 It is preferable.

In the case of directly providing an identification result (or customer information) corresponding to the received identification request information according to an embodiment of the present invention, the information verification unit 110 corresponds to the received identification request information. When the identity verification result is confirmed, the information providing unit 120 based on the terminal identification information included in the received identity verification request information on the identity verification result corresponding to the identification request information, the certificate issuing terminal 135 It characterized in that the transmission to.

Here, the identification result corresponding to the identification request information transmitted to the certificate issuing terminal 135, it is preferable to provide only the identification result corresponding to the identification request information, or provide the confirmed customer information. Do.

According to another embodiment of the present invention, if the identity corresponding to the received identification request information is confirmed, when transmitting an authentication code corresponding to the result of the identification, the information generating unit 115 is the customer wireless terminal 140 and (or extract) the authentication code to be sent to the certificate issuing terminal 135, the information providing unit 120 provides the generated (or extracted) authentication code information to the certificate issuing terminal 135 Characterized in that.

According to an embodiment of the present invention, the authentication code is preferably an authentication code for the final confirmation process for issuing a certificate by transmitting the certificate issuing terminal 135 and the customer wireless terminal 140 through identity verification, After transmitting the authentication code to the customer wireless terminal 140 and the certificate issuing terminal 135, the customer provides the authentication code transmitted to the wireless terminal to the certificate issuing terminal 135 (for example, the customer wireless terminal 140) Check the authentication code outputted on the input through the certificate issuing terminal 135, and / or provided to the certificate issuing terminal 135 using a short-range wireless communication function provided in the customer wireless terminal 140) Then, after checking this in the certificate issuing terminal 135 to check the mutual matching, it is preferable to process the issued certificate for the customer.

Referring to FIG. 1, the telecommunication company server 100 corresponds to the identification request information transmitted from the certificate issuing terminal 135, and transmits identification information corresponding to the identification request information received from the storage medium 130. And an information storage unit 125 (or information storage means) stored in the storage device.

According to the exemplary embodiment of the present invention, the identification history information may include date information on which identification request information is received from the certificate issuing terminal 135 and a part (or all) of customer information included in the received identification request information. ) And at least one identification result confirmed in correspondence with the identification request information.

2 is a diagram illustrating a certificate issuing system for issuing and processing a public certificate through identity verification using USIM information provided in a wireless terminal according to one embodiment of the present invention.

In more detail, FIG. 2 illustrates a process for issuing an authorized certificate through identity verification using USIM information provided in a wireless terminal according to a predetermined customer's request. After completing the identity verification using the USIM information provided in 250, receives the public key generated (or extracted) provided by the certificate issuing terminal 245, and generates the public certificate information based on the received public key As a system configuration for processing to be stored in the wired and wireless storage medium through the certificate issuing terminal 245, if those of ordinary skill in the art to which the present invention pertains, refer to and / or modified this figure 2 Various implementation methods can be inferred for the configuration of certificate issuing system for issuing and processing the public certificate through identification verification using USIM information provided in the terminal. The would, in the present invention includes all embodiments in which the inference method, shall not be limited to the exemplary method shown in the figure 2.

Hereinafter, customer information and wireless terminal number information (for example, mobile phone number information) for requesting the issuance of a certificate through a certificate issuing request interface output through a predetermined certificate issuing terminal 245 on the certificate issuing system shown in FIG. And certificate issuing request information including terminal specific information about the certificate issuing terminal 245 are inputted (or selected), and the identity verification for the customer is processed based on the inputted (or selected) certificate issuing request information. Afterwards, the components corresponding to at least one or more means and / or functional configurations for processing the issuance of a public certificate for the identified customer are referred to as "certificate server 200" for convenience.

Referring to FIG. 2 according to an embodiment of the present invention, a certificate issuance system for identity verification using USIM information provided in the wireless terminal is provided with at least one authorized certificate issuing agency branch (or branch) or a public place. And a certificate issuing terminal 245, wherein the certificate issuing terminal 245 is connected to a certificate server 200 provided on the certificate issuing system through a predetermined communication network.

The certificate D / B 240 provided on the certificate issuing system according to the present invention issues and processes an authorized certificate to a customer according to a request for issuing a public certificate, and links and processes customer information and public certificate information according to the public certificate issuance process. Characterized in that for storing.

The customer information requests the issuance of a public certificate through the certificate issuing system, and processes the public certificate issuance corresponding to the request for issuing the public certificate to provide public certificate information. (E.g., a customer's name, social security number, address, telephone number, mobile phone number, e-mail address, etc.) is preferably included.

The public certificate information is used as version information for distinguishing the public certificate type for the public certificate issued to the customer, and as reference information for the suspension and revocation list revocation list of the public certificate provided to the public certificate provided to the customer. Signing algorithm information having serial number information, signature algorithm value used when creating a public certificate, issuer information for the organization that issued the public certificate, validity period information for the period guaranteeing the status of the public certificate, Issuer public key identifier information for identifying the owner information that owns the certificate, the public key information held by the owner, the public key corresponding to the certificate authority private key used to sign the certificate, the owner public key identifier information, and the owner. Key usage information, including the purpose for which the public key of It is preferable to include at least one or more information.

The certificate server 200 provided on the certificate issuing system according to the present invention is a generic term of the certificate issuing system side component connected to the certificate issuing terminal 245 through a predetermined communication network, and includes at least one server (or Device) and / or at least one program recorded on a recording medium provided in a predetermined server (or device), and the present invention is not limited thereto.

According to an embodiment of the present invention, the certificate server 200 is provided with an interface unit 205 (or interface means) for connecting and managing a predetermined communication channel with the certificate issuing terminal 245 through the communication network. It is characterized by.

According to an embodiment of the present invention, the certificate issuing terminal 245 is connected to a predetermined communication channel based on a protocol stack defined in the communication network, and is defined in a certificate issuing program provided in the certificate issuing terminal 245. It is desirable to provide a communication interface for transmitting and receiving at least one or more information (or data) using the established communication protocol.

Referring to FIG. S, the certificate server 200 is connected to the wireless terminal when a predetermined certificate issuing terminal 245 connects a predetermined communication channel with the certificate server 200 through the interface unit 205. In order to determine non-USIM information through identity verification using the provided USIM information, the certificate issuing terminal 245 may request customer information and wireless terminal number information line terminal number mobile number information) and a certificate issuing terminal ( Issuing a certificate including the terminal unique information for 245 Generate (or extract) at least one user interface for inputting (or selecting) this information and transmitting it to the certificate server 200, and the interface unit 205 Interface providing unit 210 (or the number of interface provided to provide the generated (or extracted) user interface to the certificate issuing terminal 245 in conjunction with the And, when the certificate issuing information is input (or selected) through the provided user interface in the certificate issuing terminal 245 and the input (or selected) certificate issuing information is transmitted, the interface unit 205. An information receiving unit 215 (or information receiving means) for receiving certificate issuing request information transmitted from the certificate issuing terminal 245 in association with;

An information generating unit 220 (or information generating means) for generating identification request information based on the received customer information and biometric information, and transmitting the generated identification request information to a certification authority server to the biometric information. And an authentication confirmation unit (or authentication confirmation means) for confirming the authentication of the certificate, and when the certificate server 200 does not receive the biometric information and / or the identification is directly based on the biometric information. If not possible, the information generation unit 220 and the authentication confirmation unit may be omitted.

The interface provider 210 connects a predetermined communication channel with the certificate server 200 through the interface unit 205 through the certificate issuing terminal 245, and then the wireless terminal to the certificate server 200. When requesting a user interface for the process of issuing an authorized certificate through the identification verification using the USIM information provided in the, the certificate issuing terminal 245, the customer information and wireless terminal number information (for example, mobile phone number information) and the certificate issuing terminal ( Create (or select) at least one user interface for inputting (or selecting) certificate issuing request information including terminal specific information about the terminal 245 to the certificate server 200 through the communication network, and / or a predetermined database. (Not shown) and extract the generated (or extracted) user interface in cooperation with the interface unit in the communication network. Through it characterized in that provided in the certificate issued by the terminal (245).

According to an embodiment of the present invention, a predetermined user interface that can be provided by a certificate issuance related program included in the certificate issuing terminal 245 is generated (or extracted), and the generated (or extracted) through the interface unit 205. It is preferable to provide the user interface) to the certificate issuing terminal 245.

In this case, the certificate issuing terminal 245 is inputted with the certificate issuing request information including predetermined customer information, wireless terminal number information (for example, mobile phone number information), and terminal specific information about the certificate issuing terminal 245 (or If a predetermined certificate issuance related program having at least one user interface for transmitting to the certificate server 200 through the communication network is provided, input (or select) predetermined certificate issue request information as described above. The interface providing unit 210 for generating (or extracting) a user interface for transmitting to the certificate server 200 and providing it to the certificate issuing terminal 245 may be omitted, and the present invention is not limited thereto. No.

Thereafter, the certificate issuing terminal 245 inputs (or selects) the certificate issuing request information through the user interface, and the certificate server 200 receives the input (or selected) certificate issuing request information through the communication network. In response thereto, the information receiving unit 215 receives the certificate issuing request information transmitted from the certificate issuing terminal 245 in association with the interface unit 205.

According to an exemplary embodiment of the present invention, the certificate issuing terminal 245 may include at least one encryption method (eg, a symmetric key based encryption method and / or a public key based encryption method, and / or an electronic envelope) for the certificate issuing request information. Based encryption method, and / or key exchange based encryption method, etc.), and / or attach a predetermined electronic signature to the certificate issuing request information to transmit to the certificate server 200 through the network means. To this end, the certificate issuing terminal 245 is provided with at least one encryption key corresponding to the encryption scheme, and / or has a predetermined public certificate including at least one encryption key, and / or the If the public certificate is provided on a predetermined IC chip (or IC card), the public certificate provided on the IC chip (or IC card) It is equipped with a card reader for cut group is preferred.

Those skilled in the art to the present invention, the technical characteristics of the various encryption schemes for encrypting the certificate issuing request information, and the technical characteristics of attaching a predetermined electronic signature to the certificate issuing request information Since it will be, a detailed description thereof will be omitted for convenience.

When the certificate issuing request information is input (or selected) through the output user interface, the information generating unit 220 generates identification request information based on the input (or selected) certificate issuing request information. It is done.

Here, the identification request information, the USIM information provided in the radio terminal corresponding to the radio terminal number is transmitted to the communication company server based on the radio terminal number information included in the received certificate issuing request information to verify the identity It is preferable that the information is requested to be carried.

When the identification request information is generated through the information generation unit 220, the information transmission unit 225 transmits the generated identification request information to a certification authority server to provide USIM information included in the wireless terminal held by the customer. It is characterized in that the communication to the carrier server to process the identity verification for the customer in the carrier server.

Referring to FIG. S, the certificate server 200 generates public certificate information based on the received public key when identification of the customer is completed and a public key is received from the certificate issuing terminal 245. The information generating unit 220 (or information generating means) and the certificate issuing unit 230 for transmitting the generated official certificate information to the certificate issuing terminal 245 to be stored in the wired / wireless storage medium for the customer. (Or a certificate issuance means).

When the identification of the customer is completed and the public key is received from the certificate issuing terminal 245, the information generating unit 220 generates public certificate information based on the received customer information and public key information. It is characterized by.

According to an embodiment of the present invention, the public certificate information generated based on the customer information and the public key information is preferably generated according to the ITU-T Recommendation X.50x standard.

Here, the public certificate information is the version information for distinguishing the official certificate format, the serial number information used as reference information for the suspension and revocation list of the official certificate given to the public certificate provided to the customer; Signature algorithm information having a signature algorithm value used when creating a public certificate, issuer information for the authority that issued the public certificate, validity period information for the period that guarantees the status of the public certificate, and owner information of the public certificate holder. And the issuer public key identifier information for identifying the public key held by the owner, the public key corresponding to the certificate authority private key used to sign the certificate, the owner public key identifier information, and the owner's public key. At least one key usage purpose information including the purpose and certificate policy information It is made by also being preferred.

When the public certificate information is generated through the information generation unit 220, the certificate issuer 230 stores the generated public certificate information in the wired / wireless storage medium requested by the customer through the certificate issuing terminal 245. It is characterized by processing.

Referring to FIG. 2, the certificate server 200 links and processes the certificate information provided to the certificate issuing terminal 245 and the customer information on the target customer who issued the certificate. Information storage unit 235 (or information storage means) to be stored in the

According to an embodiment of the present invention, the certificate D / B 240 is a database accessible from the certificate server 200, the customer information for one or more customers, and the public certificate information corresponding to the certificate provided to the customer Is preferably stored.

In addition, the certificate D / B 240 is preferably a database that can not be modified / generated by accessing from an external server other than the certificate server 200.

3 is a diagram illustrating a functional configuration of a certificate issuing terminal 300 for issuing and processing a public certificate through identity verification using USIM information provided in a wireless terminal according to an embodiment of the present invention.

In more detail, FIG. 3 shows USIM information provided in a wireless terminal according to the present invention in an unmanned certificate issuing terminal 300 provided in a predetermined financial institution (eg, a commercial bank branch, a card company branch) and / or a public place. As showing a preferred functional configuration for processing the issuance of a public certificate through identity verification using a person having ordinary skill in the art to which the present invention pertains, referring to and / or modifying this drawing 3 according to the present invention Although various implementation methods for the certificate issuing terminal 300 for processing the issuance of a certificate through identification verification using USIM information provided in the wireless terminal may be inferred, the present invention includes all the inferred implementation methods, It is not limited by the implementation method shown in FIG.

For example, one of ordinary skill in the art to which the present invention pertains may refer to and / or modify the drawing 3, and infer an implementation method of applying to a financial institution-specific certificate issued by a financial institution in addition to the authorized certificate. There will be, and the invention is not limited thereby.

Referring to FIG. 3, the certificate issuing terminal 300 may use a wireless terminal such as a USB memory and / or a mobile phone and / or a wired / wireless storage medium such as an SD / MMC memory card and / or a CF memory card and / or an XD memory card. A storage medium control unit 310 for recognizing and storing certified certificate information issued using USIM information, and an authorized certificate through identity verification using USIM information provided in a wireless terminal provided through the certificate issuing terminal 300. A screen output unit 320 for outputting a processing screen of each step for issuance, a key input unit 330 for receiving predetermined information according to each step, and a biometric for recognizing biometric information of a user for user authentication The communication unit 335, which communicates with the authentication authority server and / or financial institution server and / or certificate server 395 through a predetermined communication network, and the certificate issuing terminal 300 is the wireless terminal Memory unit 350 for storing at least one certificate issuance processing information for the process of issuing a certificate through the identification verification using the provided USIM information, predetermined certificate issuance information after the certificate issuing process, and the certificate issuing terminal ( It includes a power supply unit 345 for supplying power to the 300 and at least one terminal function unit 340 and a control unit 305 for controlling each function component provided in the certificate issuing terminal (300).

In addition, the certificate issuing terminal 300 recognizes the MS card and / or IC card and / or bankbook that stores the customer's financial information (for example, the card information and / or account information possessed by the customer) and predetermined information It comprises a card reader unit 315 to obtain a.

The control unit 305 controls the overall operation of the certificate issuing terminal 300 in function configuration, manages the flow of information or data between each component, and for issuing an authorized certificate based on USIM information according to the present invention. Control at least one or more components provided in the certificate issuing terminal 300, at least one processor and execution memory (Central Processing Unit) / MPU (Micro Processing Unit) in hardware For example, it comprises a register) and a bus (BUS) for inputting and outputting predetermined data and at least one or more electronic circuits (or integrated circuits) therefor, and also for performing software-specific functions. Loading into the execution memory from a predetermined recording medium provided in the certificate issuing terminal 300 and the pro It includes a predetermined program routine (Routine) and / or program data that is arithmetic processing by the parser. In particular, the controller 305 includes a predetermined operating system and / or a terminal control program routine for managing the certificate issuing terminal 300 after the certificate issuing terminal 300 is booted in software. .

3 illustrates at least one program component provided in the certificate issuing terminal 300 for issuance of an authorized certificate based on USIM information according to the present invention in the control unit 305 for convenience.

The storage medium controller 310 is issued and processed based on the USIM information in accordance with the present invention, in order to store / read the authorized certificate information in the wired and wireless storage medium, the wired and wireless storage medium and the certificate issuing terminal It characterized in that the interface between the 300, and controls according to the standard for reading and / or recording one or more information or data according to the type of wired and wireless storage medium (for example, SPI protocol, etc. in the case of a memory card) It is preferable.

The card reader unit 315 may provide an interface between the card and the certificate issuing terminal 300 to read at least one or more information or data included in the card for issuing a public certificate. MS reader interface to interface the MS (Magnetic Stripe) card based on the 7810 standard with the certificate issuing terminal 300, and / or contact type based on the ISO / IEC 7816 standard for the process of issuing a public certificate based on the USIM information A contact IC reader unit for interfacing an IC (Integrated Circuit) card with the certificate issuing terminal 300 and / or a contactless IC reader unit for interfacing a contactless IC card based on the ISO / IEC 14443 standard with the certificate issuing terminal 300. And the contact IC reader unit and / or the contactless IC reader unit correspond to the IC card reader provided in the certificate issuing terminal 300. Is recommended.

The MS reader unit is a card reader unit 315 based on ISO / IEC 7810, and includes at least one magnetic head including a predetermined coil, and includes predetermined information or data (eg, magnetization). When the MS card on which the stored binary information or binary data is recorded moves in a predetermined direction in close contact with the magnetic head (or the magnetic head moves in close contact with an MS card in which predetermined information or data is recorded), By using a predetermined electrical signal is loaded, it is characterized in that the predetermined information or data from at least one or more tracks included in the MS of the MS card to interface with the certificate issuing terminal (300).

The contact IC reader unit is a card reader unit 315 based on ISO / IEC 7816, and includes at least one contact point that makes electrical contact with a chip on board (COB) provided in the contact IC card. It supplies power to the IC chip of the IC card through the contact point, and the predetermined information or data from the IC chip through the half duplex transaction using an APDU (Application Protocol Data Unit) It is characterized in that the interface to the certificate issuing terminal 300.

The contactless IC reader unit is a card reader unit 315 based on ISO / IEC 14443. The contactless IC reader unit uses at least electrical contact with the contactless IC card by using capacitive coupling and / or inductive coupling. It comprises one or more antennas, and supplies power to the IC chip of the IC card through the antenna, the predetermined information or data from the IC chip through the half-duplex transaction using the APDU certificate Characterized by interfacing to the issuing terminal 300.

The screen output unit 320 is previously output from the certificate issuing terminal 300 to a predetermined screen output means including a liquid crystal display (LCD) and / or a cathode ray tube (CRT) by the controller 305. And at least one information or data that is defined or defined in real time, and the key input through the key input unit 330 to pre-defined information or data to be output on the screen from the certificate issuing terminal 300. Data, biometric information input through the biometric recognition unit 325, information stored or generated by a component provided in the certificate issuing terminal 300, information transmitted and received through the communication unit 335, a certificate issuing terminal ( Data corresponding to a predetermined calculation result performed at 300 is included.

According to the exemplary embodiment of the present invention, the screen output unit 320 may display a processing screen and / or an interface screen in accordance with each certificate issuance step through identity verification using USIM information provided in a wireless terminal according to the present invention. It is preferable to output to the screen output device.

The key input unit 330 is provided with at least one key button including at least one number key and / or character key and / or function key. Detects information (or a signal) input from a key input device of a predetermined key and is provided to the key input device in a specific input mode and / or an operation mode of the certificate issuing terminal 300 controlled by the controller 305. When predetermined information (or signal) is inputted from the key button of, a key event corresponding to the input information (or signal) is generated, and the generated key event is provided to the controller 305. The controller 305 may acquire predetermined key data corresponding to the key event in the current input mode and / or operation mode of the certificate issuing terminal 300, and / or match the key event. Characterized by obtaining a command for executing a predetermined function, the key input unit 330 and the key input device having at least one or more key buttons are provided in the certificate issuing terminal 300 in conjunction with each other Functions as a key input means.

According to an embodiment of the present invention, a key input device interoperating with the key input unit 330 may include a keypad device having at least one numeric key and a function key, and / or at least one numeric key and a character key (eg, A keyboard device having English character keys and / or Korean character keys) and a function key, and / or at least one numeric key and a function key in conjunction with the screen output means, and / or at least one numeric key And at least one touch screen device having character keys and function keys.

According to an exemplary embodiment of the present invention, the key input unit 330 is configured to obtain at least one or more pieces of information from each key from the predetermined key input device in accordance with the issuance step of the authorized certificate through identity verification using USIM information provided in the wireless terminal according to the present invention. It is preferable to receive an input.

The biometric recognition unit 325 detects information input from a biometric information recognition device having a function of reading at least one or more biometric information, and specifies the certificate issuing terminal 300 controlled by the control unit 305. When predetermined biometric information is input from the biometric information reader provided in the biometric information recognizing apparatus in an input mode and / or an operation mode, the input biometric information is provided to the controller 305. 305 is characterized in that to obtain the biometric information in the current input mode and / or operation mode of the certificate issuing terminal 300.

According to an exemplary embodiment of the present invention, a biometric information recognition device interoperating with the biometric recognition unit 325 may include a keypad device having at least one or more function keys, and / or at least one fingerprint recognition device, and / or at least one. At least one biometric device equipped with a biometric information reader function such as the iris recognition device and / or the face recognition device is preferable.

The communication unit 335 provides communication means for performing a transaction function (eg, a transaction function interoperating with one or more servers connected to the certificate issuing terminal 300 through a communication network) provided in the certificate issuing terminal 300. And a network communication unit 335 and / or a predetermined cable communication port (eg, providing transactional communication with a server on the communication network through a communication network (for example, a party network or a CD / ATM network) in hardware). Cable communication unit 335 and / or Infrared Ray communication, Radio Frequency (RF) communication, Bluetooth (BlueTooth), which provides transactional communication with external communication devices via RS-232c, USB (Universal Serial Bus (USB), etc.) Local area that provides transactional communication with a local area communication device through at least one local area wireless communication including wireless LAN, Wi-Fi, and ultra wide band system (UWB). It comprises a communication unit 335, and comprises a communication protocol and communication application for providing transactional communication in software.

According to an embodiment of the present invention, the communication unit 335 is an authorized certificate through identity verification using USIM information provided in at least one server and a wireless terminal on the communication network via a predetermined communication network through the network communication unit 335. It is preferable to connect a communication channel for issuing a.

The memory unit 350 is a storage medium storing at least one or more information or data required for the control unit 305 to perform a predetermined control function. The memory unit 350 hardware-electrically erasable and programmable read only memory (EEPROM), FM (Flash Memory), HDD (Hard Disk Drive), SSD (Solid State Drive), including at least one or more storage means, including the software, the control unit 305 is required to perform a predetermined control function A predetermined program routine and program data (e.g., data input or output for the program routine to perform a predetermined function).

According to an embodiment of the present invention, the memory unit 350 is at least one or more that the certificate issuing terminal 300 is used to process the financial transaction through the identification using the USIM information provided in the wireless terminal according to the present invention It is preferable to store certificate issuance processing information, and / or after issuing a public certificate issuance process through identity verification using USIM information provided in the wireless terminal, it is preferable to store certificate issuance history information corresponding to the issuance of the public certificate. Do.

The terminal function unit 340 is a component provided in the certificate issuing terminal 300 in addition to the components shown in FIG. 3 and / or components provided in the certificate issuing terminal 300 for a predetermined purpose or role. As a security application module (SAM), a user device such as a scanner device capable of confirming customer information, such as a resident registration card / driver's license / passport that is put by the user is made of a variety of additional function configuration according to the intention of those skilled in the art.

Those skilled in the art to which the present invention pertains will easily understand each terminal function unit 340 provided according to the characteristics of the certificate issuing terminal 300, so a detailed description thereof will be omitted.

Referring to FIG. 3, a mode check unit 355 for checking whether an operation mode of the certificate issuing terminal 300 is an authorized certificate issuing mode based on USIM information, and issuing an authorized certificate based on the USIM information. In response to an interface output unit 360 for processing one or more user interfaces corresponding to a mode to be output through the screen output unit 320 and an operation mode input (or selected) through the output one or more user interfaces. And an information generation unit 365 for generating identification request information based on the customer information and the wireless terminal number information inputted by the user requesting for issuance of the authorized certificate, and transmitting the generated identification request information to the customer wireless terminal. And an information transmitter 370 for requesting identification based on USIM information about the USIM provided to the customer wireless terminal. It characterized by comprising.

The certificate issuing terminal 300 includes a plurality of operation modes, such as a public certificate issuing mode for processing the issuance of a public certificate by verifying identity using USIM information provided in the wireless terminal according to the present invention, the mode check unit 355 is characterized in that whether the operation mode of the certificate issuing terminal 300 is an authorized certificate issuing mode for processing the issuance of a certificate through the identification verification using the USIM information provided in the wireless terminal according to the present invention.

According to an exemplary embodiment of the present invention, the certificate issuing terminal 300 selects an issuance of a certificate through identification verification using USIM information provided in the wireless terminal according to the present invention among a plurality of operation modes on a basic screen, It is preferable to switch to the public certificate issuing mode for processing the public certificate issuance through identity verification using the USIM information provided in the wireless terminal.

When the mode check unit 355 is set to the public certificate issuance mode through identity verification using the USIM information provided in the wireless terminal, the interface output unit 360 and the customer information for processing the public certificate issue, and wireless Generating (or extracting) at least one user interface for inputting (or selecting) terminal number information, and processing the generated (or extracted) user interface to be output through the screen output unit 320 do.

According to an embodiment of the present invention, at least one user interface for inputting (or selecting) customer information for processing the issued certificate and wireless terminal number information may include a customer name, social security number, address, telephone number, and the like. At least one area for inputting (or selecting) customer information and at least one area for inputting wireless terminal number information is preferably included. According to the intention and purpose of a person skilled in the art, a specific action (for example, a customer information input button ( Or an icon) is outputted in a separate page, and / or outputted in a separate page when the wireless terminal number input button (or icon) is clicked).

When the customer information and the wireless terminal number information are input (or selected) through the output user interface, the information generating unit 365 requests the identification based on the input (or selected) customer information and the wireless terminal number information. It is characterized by generating information.

Here, the generated identity verification request information, the communication number corresponding to the communication function provided in the certificate issuing terminal 300 for receiving the identity verification result (for example, mobile phone number information, wired telephone function if the mobile phone function is included) If it is included, it is preferable to include a landline telephone number information).

When the identification request information is generated through the information generation unit 365, the information transmission unit 370 transmits the generated identification request information to the customer wireless terminal, for the USIM provided in the customer wireless terminal The USIM information may be transmitted to the communication company server 390 so that identification may be processed through the communication company server 390.

Referring to FIG. 3, the certificate issuing terminal 300, based on the identification result provided by the communication company server 390 corresponding to the identification request information, the identity through the USIM information provided in the customer wireless terminal When the verification is complete, the authentication key generation unit 375 for generating an authentication key for the public certificate issuance processing based on the USIM information and the generated authentication key is transmitted to the certificate server 395 to issue a public certificate. A certificate processing unit 380 for requesting and receiving public certificate information generated based on the transmitted authentication key from the certificate server 395, public certificate information received from the certificate server 395 and the generated authentication. And an information storage unit 385 for processing key information to be stored in a wired / wireless storage medium through the storage medium control unit 310.

Here, the identity verification result provided by the communication company server 390 may be provided as an authentication code, if provided as an authentication code, after the same authentication code is transmitted to the customer wireless terminal, the customer enters or the customer It is preferable to check the identity verification result by checking the mutual matching of the authentication codes received from the wireless terminal.

That is, even if the identification is completed, if the authentication code entered by the customer or received from the customer's wireless terminal does not match with the authentication code provided by the carrier server 390, the authentication is treated as an authentication failure and the certificate is issued. It is preferable to process so that it may not be.

Based on the identification result provided by the communication company server 390 in response to the identification request information, when identification verification through the USIM information provided in the customer wireless terminal is completed, the authentication key generation unit 375 is disclosed. And a key and a private key.

Those skilled in the art will be familiar with the method and / or process for generating the public and private keys, and the technical features of the public and private keys. Detailed description is omitted for convenience.

When a public key and a private key for issuing a public certificate are generated through the authentication key generation unit 375, the certificate processing unit 380 transmits the generated public key to a certificate server 395. And 395) receiving the public certificate information generated based on the transmitted public key.

According to the exemplary embodiment of the present invention, it is preferable that the authorized certificate information generated based on the transmitted public key is encrypted using the transmitted public key.

According to the implementation method of the present invention, the online request form for the wired public certificate is preferably composed of certificate request information, private key ownership verification information, and additional registration information. It is preferred, and may be changed according to the intention and purpose of those skilled in the art.

In addition, it is preferable that the online request form for the wireless certification certificate conforms to the WAPWPKI international standard.

CertReqMsg :: = SEQUENCE {

certReq CertRequest,

pop ProofOfPossession OPTIONAL,

regInfo SEQUENCE SIZE (1..MAX) of AttributeTypeAndValue OPTIONAL}

Here, certReq is the certificate request information, and includes only the contents to be included in the certificate. Pop is the verification information of the user's private key ownership. Is information used when additional registration information is required for the authentication request, and may include user identification information, user access information, and payment information.

The structure of the certificate request information is preferably the following structure.

CertRequest :: = SEQUENCE {

certReqId INTEGER,

certTemplate CertTemplate,

controls Controls OPTIONAL}

Here, the CertReqID is information used for confirming a certificate request message and a response message corresponding thereto. Preferably, the CertReqID value is the same between the corresponding messages.

In addition, the certTemplate includes respective information according to a user's request for certificate issuance according to the RFC2510 standard, and preferably has the following structure.

CertTemplate :: = SEQUENCE {

version [0] version OPTIONAL,

serialNumber [1] INTEGER OPTIONAL,

signingAlg [2] AlgorithmIdentifier OPTIONAL,

issuer [3] Name OPTIONAL,

validity [4] OptionalValidity OPTIONAL,

subject [5] Name OPTIONAL,

publicKey [6] SubjectPublicKeyInfo OPTIONAL,

issuerUID [7] UniqueIdentifier OPTIONAL,

subjectUID [8] UniqueIdentifier OPTIONAL,

extensions [9] Extensions OPTIONAL}

In addition, the control includes information affecting certificate issuance, and controls of regToken, authenticator, pkiPublicationInfo, and oldCertID may be used.

Here, the regToken control has one-time information for verifying the identity of the user, and this information may be generated by a certification authority (CA) or provided to the user from outside, only for a new user, UTF8 Is preferably encoded as.

In addition, the authenticator control may include a part of the subscriber information shared between the CA and the user to verify the identity of the user, this control can be used to request certificates of existing users in addition to the new user.

In addition, the pkiPublicationInfo control includes a certificate notification method and notification location information, and it is preferable to comply with the RFC2511 standard.

The information storage unit 385, when the public certificate information is received from the certificate server 395, the received certificate information is processed to be stored in the wired and wireless storage medium based on a protocol corresponding to the type of wired and wireless storage medium. It is characterized by.

According to the exemplary embodiment of the present invention, when the wired / wireless storage medium is a USB storage medium, the authorized certificate information storage is supplied with power for the operation of the USB storage medium, and the USB storage medium is operated through the applied power. Preferably, the public certificate is processed to be transmitted to and stored in the USB storage medium.

According to another exemplary embodiment of the present invention, when the wired / wireless storage medium is a mobile phone storage medium, the authorized certificate information storage drives a VM (Virtual Machine) provided in the mobile phone to operate the mobile phone storage medium. It is preferable to process the data to be stored in a Universal Subscriber Identifier Module (USIM) chip or IC chip or SD / MMC / CF / XD memory card provided in the mobile phone.

Those skilled in the art to which the present invention pertains may refer to and / or modify this drawing 3 to store all wired / wireless storage media (eg, smart) capable of storing authorized certificate information in addition to the USB storage media or mobile phone storage media. Card storage media, etc.), whereby the present invention is not limited thereto.

4A and 4B illustrate a process of issuing and processing a public certificate through identity verification using USIM information provided in a wireless terminal according to one embodiment of the present invention.

In more detail, Figures 4a and 4b is based on Figures 1, 2 and 3, the customer issuing a certificate issuing terminal (for issue processing of the authorized certificate through the identity verification using the USIM information provided in the wireless terminal based on 300 is inputted (or selected) certificate issuing request information including customer information, wireless terminal number information (for example, mobile phone number information) and terminal-specific information for the certificate issuing terminal 300, and the certificate issuing terminal ( In step 300), after requesting the USIM information transmission through the wireless terminal number information based on the wireless terminal number information, and receiving the identification request information transmitted from the wireless client terminal, the identification is based on the received identification information. Check, receive a public key generated (or extracted) by the certificate issuing terminal 300 and provide public certificate information based on the received public key. A process of generating and processing the certificate is issued to the wired / wireless storage medium through the terminal 300, and those skilled in the art to which the present invention pertains may refer to and / or refer to FIGS. 4a and 4b. It will be possible to infer various implementation methods for the process of issuing and processing a public certificate through identification verification using the USIM information provided in the wireless terminal, but the present invention includes all the implementation methods inferred, this figure 4a It is not limited only to the embodiment shown in Figure 4b.

For example, a person having ordinary knowledge in the technical field to which the present invention pertains, a process of issuing and processing a public certificate through identity verification using USIM information provided in a wireless terminal by referring to and / or modifying the drawings 4a and 4b. It is possible to deduce the order of and / or to infer some omitted implementation methods, thereby not limiting the present invention.

4A and 4B, the certificate issuing terminal 300 illustrated in FIG. 9 uses customer information and wireless terminal number information to request an issuance of a certificate through identification verification using USIM information provided in the wireless terminal. Request (400) user interface output for input (or selection), generate (or extract) a user interface corresponding to the output request and process it to be output (405), and output the customer information and wirelessly through the output user interface. The terminal number information is input (or selected) (410).

If the customer information and the wireless terminal number information are input (or selected) through the output user interface (415), the certificate issuing terminal 300 displays the input (or selected) customer information and wireless terminal number information. When the identification request information is generated (or extracted) based on the request (420), and the identification request information is transmitted by transmitting the generated (or extracted) identification request information to the customer wireless terminal (425), corresponding to the customer wireless The terminal checks USIM information provided in the customer wireless terminal based on the received identification request information, and transmits the confirmed USIM information to the communication company server 390 (430).

Thereafter, the communication company server 390 receives the USIM information transmitted from the customer wireless terminal (435), and verifies the identity based on the received USIM information and USIM issuance information stored in the USIM D / B (440). .

According to the embodiment of the present invention, the identification of the customer, the USIM issuance information matching the USIM information included in the received identification request information through the storage medium, the confirmed USIM issuance information and It is preferable to process the identification of the identification request information by checking whether the customer information stored in the connection and the customer information included in the identification request information match.

According to another embodiment of the present invention, when the identification of the customer is performed in the certificate issuing terminal 300, the USIM issuance information matching the USIM information included in the received identification request information is confirmed through the storage medium. In addition, it is preferable to process the identification information on the identification request information to be performed in the certificate issuing terminal 300 by transmitting the stored customer information in connection with the confirmed USIM issuing information to the certificate issuing terminal 300. .

Here, the identification result corresponding to the identification request information transmitted to the certificate issuing terminal 300, it is preferable to provide only the identification result corresponding to the identification request information, or to provide the confirmed customer information. Do.

If it is confirmed that the USIM information received from the customer wireless terminal and USIM issuance information stored in the USIM D / B do not match each other (445), the communication company server 390 is connected to the USIM information received from the customer wireless terminal. A process of generating (or extracting) mutual matching error information about USIM issuing information stored in a USIM D / B is transmitted to the certificate issuing terminal 300 and outputting the same.

On the other hand, if it is confirmed that the USIM information received from the customer wireless terminal and the USIM issuance information stored in the USIM D / B are matched with each other (445), the communication company server 390 displays the confirmed identity verification result in the certificate issuing terminal. In step 455, the certificate issuing terminal 300 correspondingly generates a public key and a private key when the received identity verification result confirms that the identity verification is successful (460). The generated public key is transmitted to the certificate server 395 to request public certificate information (465).

Those skilled in the art will be familiar with the method and / or process for generating the public and private keys, and the technical features of the public and private keys. Detailed description is omitted for convenience.

Thereafter, the certificate server 395 generates public certificate information based on the received public key (470), and transmits the generated public certificate information to the certificate issuing terminal (300) (475). The certificate issuing terminal 300 processes the received public certificate information and the generated private key information to be stored in a wired / wireless storage medium connected to the certificate issuing terminal 300 (480).

According to the exemplary embodiment of the present invention, it is preferable that the authorized certificate information generated based on the transmitted public key is encrypted using the transmitted public key.

According to the implementation method of the present invention, the online request form for the wired public certificate is preferably composed of certificate request information, private key ownership verification information, and additional registration information. It is preferred, and may be changed according to the intention and purpose of those skilled in the art.

In addition, it is preferable that the online request form for the wireless certification certificate conforms to the WAPWPKI international standard.

CertReqMsg :: = SEQUENCE {

certReq CertRequest,

pop ProofOfPossession OPTIONAL,

regInfo SEQUENCE SIZE (1..MAX) of AttributeTypeAndValue OPTIONAL}

Here, certReq is the certificate request information, and includes only the contents to be included in the certificate, pop is the verification information of the user's private key ownership, and if the user's key is the digital signature key, it includes a signature value for the certificate request information. regInfo is information used when additional registration information is required for an authentication request, and may include user identification information, user access information, and payment information.

The structure of the certificate request information is preferably the following structure.

CertRequest :: = SEQUENCE {

certReqId INTEGER,

certTemplate CertTemplate,

controls Controls OPTIONAL}

Here, the CertReqID is information used for confirming a certificate request message and a response message corresponding thereto. Preferably, the CertReqID value is the same between the corresponding messages.

In addition, the certTemplate includes respective information according to a user's request for certificate issuance according to the RFC2510 standard, and preferably has the following structure.

CertTemplate :: = SEQUENCE {

version [0] version OPTIONAL,

serialNumber [1] INTEGER OPTIONAL,

signingAlg [2] AlgorithmIdentifier OPTIONAL,

issuer [3] Name OPTIONAL,

validity [4] OptionalValidity OPTIONAL,

subject [5] Name OPTIONAL,

publicKey [6] SubjectPublicKeyInfo OPTIONAL,

issuerUID [7] UniqueIdentifier OPTIONAL,

subjectUID [8] UniqueIdentifier OPTIONAL,

extensions [9] Extensions OPTIONAL}

In addition, the control includes information affecting certificate issuance, and controls of regToken, authenticator, pkiPublicationInfo, and oldCertID may be used.

Here, the regToken control has one-time information for verifying the identity of the user, and this information may be generated by a certification authority (CA) or provided to the user from outside, only for a new user, UTF8 Is preferably encoded as.

In addition, the authenticator control may include a part of the subscriber information shared between the CA and the user to verify the identity of the user, this control can be used to request certificates of existing users in addition to the new user.

In addition, the pkiPublicationInfo control includes a certificate notification method and notification location information, and it is preferable to comply with the RFC2511 standard.

According to an embodiment of the present invention, the public certificate information generated based on the customer information and the public key information is preferably generated according to the ITU-T Recommendation X.50x standard.

Here, the public certificate information is the version information for distinguishing the official certificate format, the serial number information used as reference information for the suspension and revocation list of the official certificate given to the public certificate provided to the customer; Signature algorithm information having a signature algorithm value used when creating a public certificate, issuer information for the authority that issued the public certificate, validity period information for the period that guarantees the status of the public certificate, and owner information of the public certificate holder. And the issuer public key identifier information for identifying the public key held by the owner, the public key corresponding to the certificate authority private key used to sign the certificate, the owner public key identifier information, and the owner's public key. At least one key usage information, including the purpose, and certificate policy information. It is preferable to comprise.

According to the exemplary embodiment of the present invention, when the wired / wireless storage medium is a USB storage medium, the authorized certificate information storage is supplied with power for the operation of the USB storage medium, and the USB storage medium is operated through the applied power. Preferably, the public certificate is processed to be transmitted to and stored in the USB storage medium.

According to another exemplary embodiment of the present invention, when the wired / wireless storage medium is a mobile phone storage medium, the authorized certificate information storage drives a VM (Virtual Machine) provided in the mobile phone to operate the mobile phone storage medium. It is preferable to process the data to be stored in a Universal Subscriber Identifier Module (USIM) chip or IC chip or SD / MMC / CF / XD memory card provided in the mobile phone.

Those skilled in the art to which the present invention pertains may refer to and / or modify the drawings 4a and 4b, and in addition to the USB storage medium or the mobile phone storage medium, any wired / wireless storage medium capable of storing authorized certificate information ( For example, a smart card storage medium, etc.) may be included, and the present invention is not limited thereto.

5A and 5B illustrate a process of issuing and processing a public certificate through identity verification using USIM information provided in a wireless terminal according to another exemplary embodiment of the present invention.

In more detail, Figures 5a and 5b is based on the Figures 1, 2 and 3, the customer issuing a certificate issuing terminal (for issue processing of the authorized certificate through identity verification using USIM information provided in the wireless terminal) 300 is inputted (or selected) certificate issuing request information including customer information, wireless terminal number information (for example, mobile phone number information) and terminal-specific information for the certificate issuing terminal 300, and the certificate issuing terminal ( In step 300), after requesting the USIM information transmission through the wireless terminal number information based on the wireless terminal number information, and receiving the identification request information transmitted from the wireless client terminal, the identification is based on the received identification information. Check, receive a public key provided later (or extract) from the certificate issuing terminal 300, and obtain public certificate information based on the received public key. A process for processing the data to be stored in a wired / wireless storage medium through the certificate issuing terminal 300, and those skilled in the art to which the present invention pertains, refer to and / or the present drawings 5a and 5b. It will be possible to infer various implementation methods for the process of issuing and processing a public certificate through identification verification using the USIM information provided in the wireless terminal, but the present invention includes all the implementation methods inferred, this figure 5a It is not limited to the implementation method shown in Figure 5b.

For example, those skilled in the art to which the present invention pertains may refer to and / or modify the present drawings 5a and 5b to issue and process a public certificate through identity verification using USIM information provided in a wireless terminal. It is possible to modify the order of the processes and / or to infer some omitted implementation methods, thereby not limiting the invention.

5A and 5B, the certificate issuing terminal 300 illustrated in FIG. 9 uses customer information and wireless terminal number information to request an issuance of a certificate through identification verification using USIM information provided in the wireless terminal. Request a user interface output for input (or selection) (500), generate (or extract) a user interface corresponding to the output request, process the output to be output (505), and output the customer information and wireless through the output user interface. The terminal number information is input (or selected) (510).

If the customer information and the wireless terminal number information are input (or selected) through the output user interface (515), the certificate issuing terminal 300 receives the input (or selected) the customer information and wireless terminal number information. When the identification request information is generated (or extracted) based on the received information (520), the identification request information is transmitted (or extracted) to the communication company server 390 by requesting identification (525). The communication company server 390 requests and receives USIM information from the client wireless terminal corresponding to the wireless terminal number information included in the identification request information (530), and issues the USIM stored in the received USIM information and the USIM D / B. The identity is verified based on the information (535).

According to the embodiment of the present invention, the identification of the customer, the USIM issuance information matching the USIM information included in the received identification request information through the storage medium, the confirmed USIM issuance information and It is preferable to process the identification of the identification request information by checking whether the customer information stored in the connection and the customer information included in the identification request information match.

According to another embodiment of the present invention, when the identification of the customer is performed in the certificate issuing terminal 300, the USIM issuance information matching the USIM information included in the received identification request information is confirmed through the storage medium. In addition, it is preferable to process the identification information on the identification request information to be performed in the certificate issuing terminal 300 by transmitting the stored customer information in connection with the confirmed USIM issuing information to the certificate issuing terminal 300. .

Here, the identification result corresponding to the identification request information transmitted to the certificate issuing terminal 300, it is preferable to provide only the identification result corresponding to the identification request information, or to provide the confirmed customer information. Do.

If the USIM information received from the customer wireless terminal and the USIM issue information stored in the USIM D / B are not matched with each other (545), the service provider server 390 receives the USIM information received from the customer wireless terminal. And generating (or extracting) mutual matching error information for USIM issuance information stored in the USIM D / B, and transmitting the same to the certificate issuing terminal 300 for output.

On the other hand, if it is confirmed that the USIM information received from the customer wireless terminal and the USIM issuance information stored in the USIM D / B are matched with each other (545), the communication company server 390 uses the certificate identification terminal as the result of the identification verification. In step 555, the certificate issuing terminal 300 correspondingly generates a public key and a private key when it is determined that the received identity verification result is successful (560). The generated public key is transmitted to the certificate server 395 to request public certificate information (565).

Those skilled in the art will be familiar with the method and / or process for generating the public and private keys, and the technical features of the public and private keys. Detailed description is omitted for convenience.

Thereafter, the certificate server 395 generates public certificate information based on the received public key (570), and transmits the generated public certificate information to the certificate issuing terminal 300 (575), corresponding thereto. The certificate issuing terminal 300 processes the received public certificate information and the generated private key information to be stored in a wired / wireless storage medium connected to the certificate issuing terminal 300 (580).

According to the exemplary embodiment of the present invention, it is preferable that the authorized certificate information generated based on the transmitted public key is encrypted using the transmitted public key.

According to the implementation method of the present invention, the online request form for the wired public certificate is preferably composed of certificate request information, private key ownership verification information, and additional registration information. It is preferred, and may be changed according to the intention and purpose of those skilled in the art.

In addition, it is preferable that the online request form for the wireless certification certificate conforms to the WAPWPKI international standard.

CertReqMsg :: = SEQUENCE {

certReq CertRequest,

pop ProofOfPossession OPTIONAL,

regInfo SEQUENCE SIZE (1..MAX) of AttributeTypeAndValue OPTIONAL}

Here, certReq is the certificate request information, and includes only the contents to be included in the certificate, pop is the verification information of the user's private key ownership, and if the user's key is the digital signature key, it includes a signature value for the certificate request information. regInfo is information used when additional registration information is required for an authentication request, and may include user identification information, user access information, and payment information.

The structure of the certificate request information is preferably the following structure.

CertRequest :: = SEQUENCE {

certReqId INTEGER,

certTemplate CertTemplate,

controls Controls OPTIONAL}

Here, the CertReqID is information used for confirming a certificate request message and a response message corresponding thereto. Preferably, the CertReqID value is the same between the corresponding messages.

In addition, the certTemplate includes respective information according to a user's request for certificate issuance according to the RFC2510 standard, and preferably has the following structure.

CertTemplate :: = SEQUENCE {

version [0] version OPTIONAL,

serialNumber [1] INTEGER OPTIONAL,

signingAlg [2] AlgorithmIdentifier OPTIONAL,

issuer [3] Name OPTIONAL,

validity [4] OptionalValidity OPTIONAL,

subject [5] Name OPTIONAL,

publicKey [6] SubjectPublicKeyInfo OPTIONAL,

issuerUID [7] UniqueIdentifier OPTIONAL,

subjectUID [8] UniqueIdentifier OPTIONAL,

extensions [9] Extensions OPTIONAL}

In addition, the control includes information affecting certificate issuance, and controls of regToken, authenticator, pkiPublicationInfo, and oldCertID may be used.

Here, the regToken control has one-time information for verifying the identity of the user, and this information may be generated by a certification authority (CA) or provided to the user from outside, only for a new user, UTF8 Is preferably encoded as.

In addition, the authenticator control may include part of the subscriber information shared between the CA and the user to verify the identity of the user, and this control may be used when requesting certificates of existing users other than the new user.

In addition, the pkiPublicationInfo control includes a certificate notification method and notification location information, and it is preferable to comply with the RFC2511 standard.

According to an embodiment of the present invention, the public certificate information generated based on the customer information and the public key information is preferably generated according to the ITU-T Recommendation X.50x standard.

Here, the public certificate information is the version information for distinguishing the official certificate format, the serial number information used as reference information for the suspension and revocation list of the official certificate given to the public certificate provided to the customer; Signature algorithm information having a signature algorithm value used when creating a public certificate, issuer information for the authority that issued the public certificate, validity period information for the period that guarantees the status of the public certificate, and owner information of the public certificate holder. And the issuer public key identifier information for identifying the public key held by the owner, the public key corresponding to the certificate authority private key used to sign the certificate, the owner public key identifier information, and the owner's public key. At least one key usage purpose information including the purpose and certificate policy information It is made by also being preferred.

According to the exemplary embodiment of the present invention, when the wired / wireless storage medium is a USB storage medium, the authorized certificate information storage is supplied with power for the operation of the USB storage medium, and the USB storage medium is operated through the applied power. Preferably, the public certificate is processed to be transmitted to and stored in the USB storage medium.

According to another exemplary embodiment of the present invention, when the wired / wireless storage medium is a mobile phone storage medium, the authorized certificate information storage drives a VM (Virtual Machine) provided in the mobile phone to operate the mobile phone storage medium. It is preferable to process the data to be stored in a Universal Subscriber Identifier Module (USIM) chip or IC chip or SD / MMC / CF / XD memory card provided in the mobile phone.

Those skilled in the art to which the present invention pertains, all wired and wireless storage media capable of storing the authorized certificate information, in addition to the USB storage medium and the mobile phone storage medium by referring to and / or modifying the drawings 5a and 5b ( For example, a smart card storage medium, etc.) may be included, and the present invention is not limited thereto.

6A and 6B illustrate a process of issuing and processing a public certificate through identity verification using USIM information provided in a wireless terminal according to another embodiment of the present invention.

In more detail, Figures 6a and 6b are based on Figures 1, 2 and 3, the customer issuing a certificate issuing terminal (for the issuing process of the authorized certificate through the identification verification using the USIM information provided in the wireless terminal) 300 is inputted (or selected) certificate issuing request information including customer information, wireless terminal number information (for example, mobile phone number information) and terminal-specific information for the certificate issuing terminal 300, and the certificate issuing terminal ( In step 300), after requesting the USIM information transmission through the wireless terminal number information based on the wireless terminal number information, and receiving the identification request information transmitted from the wireless client terminal, the identification is based on the received identification information. Check, receive a public key generated (or extracted) by the certificate issuing terminal 300 and provide public certificate information based on the received public key. A process of generating and processing the certificate is issued to the wired / wireless storage medium through the certificate issuing terminal 300. Those skilled in the art to which the present invention pertains may refer to and / or refer to FIGS. 6a and 6b. It will be possible to infer various implementation methods for the process of issuing and processing a certificate issued through the identification verification using the USIM information provided in the wireless terminal, the present invention includes all the inferred implementation method, this figure 6a It is not limited only to the embodiment shown in Figure 6b.

For example, those skilled in the art to which the present invention pertains may refer to and / or modify the drawings 6a and 6b to issue and process a public certificate through identity verification using USIM information provided in a wireless terminal. It is possible to modify the order of the processes and / or to infer some omitted implementation methods, thereby not limiting the invention.

6A and 6B, the certificate issuing terminal 300 illustrated in FIG. 9 uses customer information and wireless terminal number information to request an issuance of a certificate through identification verification using USIM information provided in the wireless terminal. Request user interface output for input (or selection) (600), generate (or extract) a user interface corresponding to the output request and process it to be output (605), and output the customer information and wireless through the output user interface. The terminal number information is input (or selected) (610).

If the customer information and the wireless terminal number information are input (or selected) through the output user interface (615), the certificate issuing terminal 300 receives the input (or selected) the customer information and wireless terminal number information. When the identification request information is generated (or extracted) on the basis of 620 and the identification request information is transmitted to the communication company server 390 to request identification (625). The communication company server 390 requests 630 and receives USIM information from the customer wireless terminal corresponding to the wireless terminal number information included in the identification request information (635), and transmits the received USIM information to the USIM D / B. The identity is verified based on the stored USIM information (640).

According to the embodiment of the present invention, the identification of the customer, the USIM issuance information matching the USIM information included in the received identification request information through the storage medium, the confirmed USIM issuance information and It is preferable to process the identification of the identification request information by checking whether the customer information stored in the connection and the customer information included in the identification request information match.

According to another embodiment of the present invention, when the identification of the customer is performed in the certificate issuing terminal 300, the USIM issuance information matching the USIM information included in the received identification request information is confirmed through the storage medium. In addition, it is preferable to process the identification information on the identification request information to be performed in the certificate issuing terminal 300 by transmitting the stored customer information in connection with the confirmed USIM issuing information to the certificate issuing terminal 300. .

Here, the identification result corresponding to the identification request information transmitted to the certificate issuing terminal 300, it is preferable to provide only the identification result corresponding to the identification request information, or to provide the confirmed customer information. Do.

If it is confirmed that the USIM information received from the customer wireless terminal and USIM issuance information stored in the USIM D / B do not match each other (645), the communication company server 390 and the USIM information received from the customer wireless terminal A process of generating (or extracting) mutual matching error information about USIM issuing information stored in a USIM D / B is transmitted to the certificate issuing terminal 300 and outputting the processed information (650).

On the other hand, if it is confirmed that the USIM information received from the customer wireless terminal and the USIM issuance information stored in the USIM D / B match each other (645), the communication company server 390 is an authentication code corresponding to the confirmed identity verification result. Generate (or extract) (655), and transmits the generated (or extracted) authentication code to the customer wireless terminal and the certificate issuing terminal 300 (660).

Thereafter, the certificate issuing terminal 300 checks whether the authentication code provided by the customer matches the authentication code received from the communication company server 390 (665).

If, when the mutual matching between the authentication code provided by the customer and the authentication code received from the carrier server 390 is not confirmed (670), the certificate issuing terminal 300 and the authentication code provided by the customer In operation 675, the controller 390 generates (or extracts) mutual matching error information regarding the authentication code received from the communication company server 390 and outputs the generated matching error information (675).

On the other hand, when the mutual matching between the authentication code provided by the customer and the authentication code received from the carrier server 390 is confirmed (670), the certificate issuing terminal 300 is a public key and private for issuing a public certificate A key is generated (680), and the generated public key is transmitted to the certificate server (395) to request public certificate information (685).

Those skilled in the art will be familiar with the method and / or process for generating the public and private keys, and the technical features of the public and private keys. Detailed description is omitted for convenience.

Thereafter, the certificate server 395 generates public certificate information based on the received public key (690), transmits the generated public certificate information to the certificate issuing terminal 300 (695), and corresponds to this. The certificate issuing terminal 300 processes the received public certificate information and the generated private key information to be stored in a wired / wireless storage medium connected to the certificate issuing terminal 300 (699).

According to the exemplary embodiment of the present invention, it is preferable that the authorized certificate information generated based on the transmitted public key is encrypted using the transmitted public key.

According to the implementation method of the present invention, the online request form for the wired public certificate is preferably composed of certificate request information, private key ownership verification information, and additional registration information. It is preferred, and may be changed according to the intention and purpose of those skilled in the art.

In addition, it is preferable that the online request form for the wireless certification certificate conforms to the WAPWPKI international standard.

CertReqMsg :: = SEQUENCE {

certReq CertRequest,

pop ProofOfPossession OPTIONAL,

regInfo SEQUENCE SIZE (1..MAX) of AttributeTypeAndValue OPTIONAL}

Here, certReq is the certificate request information, and includes only the contents to be included in the certificate. Pop is the verification information of the user's private key ownership. Is information used when additional registration information is required for the authentication request, and may include user identification information, user access information, and payment information.

The structure of the certificate request information is preferably the following structure.

CertRequest :: = SEQUENCE {

certReqId INTEGER,

certTemplate CertTemplate,

controls Controls OPTIONAL}

Here, the CertReqID is information used for confirming a certificate request message and a response message corresponding thereto. Preferably, the CertReqID value is the same between the corresponding messages.

In addition, the certTemplate includes respective information according to a user's request for certificate issuance according to the RFC2510 standard, and preferably has the following structure.

CertTemplate :: = SEQUENCE {

version [0] version OPTIONAL,

serialNumber [1] INTEGER OPTIONAL,

signingAlg [2] AlgorithmIdentifier OPTIONAL,

issuer [3] Name OPTIONAL,

validity [4] OptionalValidity OPTIONAL,

subject [5] Name OPTIONAL,

publicKey [6] SubjectPublicKeyInfo OPTIONAL,

issuerUID [7] UniqueIdentifier OPTIONAL,

subjectUID [8] UniqueIdentifier OPTIONAL,

extensions [9] Extensions OPTIONAL}

In addition, the control includes information affecting certificate issuance, and controls of regToken, authenticator, pkiPublicationInfo, and oldCertID may be used.

Here, the regToken control has one-time information for verifying the identity of the user, and this information may be generated by a certification authority (CA) or provided to the user from outside, only for a new user, UTF8 Is preferably encoded as.

In addition, the authenticator control may include a part of the subscriber information shared between the CA and the user to verify the identity of the user, this control can be used to request certificates of existing users in addition to the new user.

In addition, the pkiPublicationInfo control includes a certificate notification method and notification location information, and it is preferable to comply with the RFC2511 standard.

According to an embodiment of the present invention, the public certificate information generated based on the customer information and the public key information is preferably generated according to the ITU-T Recommendation X.50x standard.

Here, the public certificate information is the version information for distinguishing the official certificate format, the serial number information used as reference information for the suspension and revocation list of the official certificate given to the public certificate provided to the customer; Signature algorithm information having a signature algorithm value used when creating a public certificate, issuer information for the authority that issued the public certificate, validity period information for the period that guarantees the status of the public certificate, and owner information of the public certificate holder. And the issuer public key identifier information for identifying the public key held by the owner, the public key corresponding to the certificate authority private key used to sign the certificate, the owner public key identifier information, and the owner's public key. At least one key usage purpose information including the purpose and certificate policy information It is made by also being preferred.

According to the exemplary embodiment of the present invention, when the wired / wireless storage medium is a USB storage medium, the authorized certificate information storage is supplied with power for the operation of the USB storage medium, and the USB storage medium is operated through the applied power. Preferably, the public certificate is processed to be transmitted to and stored in the USB storage medium.

According to another exemplary embodiment of the present invention, when the wired / wireless storage medium is a mobile phone storage medium, the authorized certificate information storage drives a virtual machine provided in the mobile phone to operate the mobile phone storage medium. The VM may be processed to be stored in a USIM (Universal Subscriber Identifier Module) chip or IC chip or an SD / MMC / CF / XD memory card provided in the mobile phone.

Those skilled in the art to which the present invention pertains can refer to and / or modify the drawings 6a and 6b, in addition to the USB storage media or mobile phone storage media, all wired / wireless storage media capable of storing authorized certificate information ( For example, a smart card storage medium, etc.) may be included, and the present invention is not limited thereto.

The present invention, when issuing an accredited certificate through an unmanned accredited certificate issuing terminal, the carrier confirms the identity of the customer through the USIM provided in the wireless terminal, such as a mobile phone carried by the customer, the part where the official certificate is issued illegally There is an advantage to block.

Claims (5)

In the method for issuing a public certificate through an unmanned public certificate issuing terminal, Requesting USIM authentication to a wireless terminal inputted (or selected) by the customer when the customer inputs (or selects) wireless terminal information for a request for issuing a public certificate; After confirming the USIM information in the wireless terminal inputted (or selected) by the customer, and transmitting the confirmed USIM information to the communication company server, confirming the customer identity based on the USIM information, and receiving the identification result from the communication company server, Issuing and processing a public certificate based on the received identity verification result. The method of claim 1, When requesting USIM authentication to a wireless terminal, the service provider server further comprises a communication number for transmitting the identification result to the unattended certified certificate issuing terminal; issuing an authorized certificate using the USIM information, characterized in that it comprises a Way. The method of claim 1, The identity verification result transmitted from the communication company server is characterized in that the authentication code, The communication company server transmits the authentication code to the unattended authorized certificate issuing terminal and the customer wireless terminal, and when the customer who confirms the authentication code transmitted to the customer wireless terminal enters (or selects) the unattended authorized certificate issuing terminal, the communication company server Comparing the authentication code transmitted by the; issuing method of a public certificate using the USIM information, characterized in that it comprises a. A computer-readable recording medium having recorded thereon a program for executing the method of claim 1. In the system for issuing a public certificate through an unmanned public certificate issuing terminal, Means for requesting USIM authentication to a wireless terminal inputted (or selected) by the customer when the customer inputs (or selects) wireless terminal information for a request for issuance of a public certificate; After confirming the USIM information in the wireless terminal inputted (or selected) by the customer, and transmitting the confirmed USIM information to the communication company server, confirming the customer identity based on the USIM information, and receiving the identification result from the communication company server, And a means for issuing and processing a public certificate based on the received identity verification result.

Images