KR20170141976A - System and method for providing electronic signature service - Google Patents

Abstract

A system, a server, a terminal, and a method for providing an electronic signature service are provided. According to an embodiment of the present invention, the electronic signature service server can register a private key of a user, can receive signature target data and a request of an electronic signature on the signature target data from a user terminal, can generate an electronic signature by using the registered private key of the user, and can transmit the generated electronic signature to the user terminal.

Description

[0001] SYSTEM AND METHOD FOR PROVIDING ELECTRONIC SIGNATURE SERVICE [0002]

A server, a terminal, and a method for providing an electronic signature service.

An official certificate is an electronic signature certificate issued by a public certificate authority that has public confidence. In Korea, it is used in various fields such as electronic banking, online certificate issuance, electronic commerce, and Internet stock trading.

In the conventional PC environment, if the authorized certificate is stored in a hard disk, a removable disk, a mobile phone, a storage token, a security token, and the like, And the authentication server verifies the digital signature, thereby performing public authentication.

In the public authentication system described above, there is a problem that the user must carry a medium in which the public certificate is stored. In order to increase the number of media in which a user can use a public certificate, it is troublesome to copy and move the public certificate to various media. Also, if a public certificate is stored in a large number of media, there is a risk that the possibility of leakage of the public certificate may be increased by the loss of the medium or the access of the other party to the medium.

Some embodiments disclose an electronic signature service server that registers a user's private key and generates a digital signature for the data to be signed received from the user terminal using the private key of the registered user.

According to one aspect,

A method of providing an electronic signature service by an electronic signature service server,

Receiving a request for digital signature from the user terminal and data to be signed;

Generating, in response to the request, the digital signature for the signature subject data using the pre-registered private key of the user;

And transmitting the digital signature to the user terminal,

Wherein the digital signature transmitted to the user terminal is provided to the use server using the digital signature from the user terminal together with the signature subject data and the public key corresponding to the private key.

The step of registering the private key may store the private key so that a device other than the digital signature generation module that generates the digital signature using the private key can not duplicate and confirm the private key.

The certificate data of the user is registered with the electronic signature service server together with the private key,

And transmitting the user's certificate data to the user terminal.

The digital signature service method comprising: receiving device authentication data for authenticating the user terminal from the user terminal; And

And verifying the device authentication data,

The generating of the digital signature may generate the digital signature as the device authentication data is verified.

The device authentication data may be one generated by the device authentication private key included in the device authentication key pair.

Wherein the verifying the device authentication data comprises:

The device authentication data can be verified with the device authentication public key included in the device authentication key pair.

And generating a communication security session between the digital signature service server and the user terminal to secure information transmitted and received between the digital signature service server and the user terminal as the device authentication data is verified have.

Wherein the step of generating a communication security session comprises:

Generating a session key and a token, and encrypting the session key and the token with the device authentication public key, and transmitting the encrypted session key and the token to the user terminal.

The receiving of the digital signature request may include receiving a token transmitted by the user terminal,

The step of generating the digital signature may check whether the token received from the user terminal matches the token generated by the digital signature service server and generate the digital signature using the private key matched with the token .

Wherein the step of generating a communication security session comprises:

Receiving the terminal authentication data generated by the user terminal from the first random number using the session key from the user terminal and verifying the terminal authentication data;

Generating server authentication data from the second random number using the session key, and transmitting the server authentication data to the user terminal.

Wherein the digital signature request and signature target data received from the user terminal are encrypted using the session key,

The digital signature service method may further include decrypting the encrypted digital signature request and signature target data using the session key.

In another aspect,

A method of providing an electronic signature service by an electronic signature service server,

Receiving device authentication data from a user terminal;

Verifying the device authentication data;

Receiving a request for generating a key pair for generating the digital signature of the user from the user terminal according to the device authentication data being verified;

Generating a key pair for generating the digital signature of the user;

Storing a private key included in the key pair in a storage unit; And

And transmitting the public key included in the key pair to the user terminal,

Wherein the private key is used in an electronic signature service module in which an electronic signature generation module of an electronic signature service server is used to generate an electronic signature for the signature subject data.

The digital signature service method includes: receiving certificate data of the user from the user terminal; And

And storing the certificate data in the storage unit.

The step of storing the certificate data in the storage unit may store the certificate data so that the storage space in which the certificate data is stored is different from the storage space in which the private key is stored.

The digital signature service method may further include receiving a request for an electronic signature from the user terminal, the request for verification of the private key and the verification of whether the private key is possessed;

Generating a digital signature for the private key possessing verification information using the private key stored in the storage unit;

And transmitting the digital signature to the user terminal for verification of the private key possessing information.

In another aspect,

A method of providing an electronic signature service by an electronic signature service server,

Receiving device authentication data from a user terminal;

Verifying the device authentication data;

Receiving key pair information for generating a digital signature of a user from the user terminal according to the device authentication data being verified;

Storing the private key included in the key pair in the first storage space of the storage unit and storing the public key included in the key pair in the second storage space of the storage unit,

Wherein the private key is stored in the first storage space such that the private key can not be copied and verified by another device except for the digital signature generation module for generating the digital signature.

In another aspect,

A communication unit for communicating with a user terminal;

A storage unit for storing a private key for generating a digital signature of a user;

And an electronic signature generation module that generates a digital signature for the signature target data using the private key when the communication unit receives the signature object data and the digital signature request for the signature object data from the user terminal ,

And the communication unit transmits the digital signature generated by the digital signature generation module to the user terminal.

The storage unit may store the private key so that a device other than the digital signature generation module can not copy and confirm the private key.

Wherein the storage unit includes a first storage space for storing the private key,

The first storage space and the digital signature generation module may constitute a hardware security module.

The communication unit may receive the user's certificate data from the user terminal, and the storage unit may include a second storage space for storing the certificate data. The first storage space and the second storage space may be separated from each other.

The electronic signature service server may further include a processor for verifying terminal authentication data obtained from the user terminal and generating server authentication data to be transmitted to the user terminal.

The device authentication data is generated by the device authentication private key included in the device authentication key pair,

The processor can verify the device authentication data using the device authentication public key included in the device authentication key pair.

The processor may generate a communication security session between the digital signature service server and the user terminal to secure information transmitted and received between the digital signature service server and the user terminal as the device authentication data is verified.

In another aspect,

A method for a user terminal to obtain an electronic signature from an electronic signature service server,

Providing device authentication data to the electronic signature service server;

Transmitting a request for digital signature to the digital signature service server and the signature target data to the digital signature service server when the verification of the device authentication data is completed by the digital signature service server;

Receiving a digital signature generated by the user's private key registered in the digital signature service server from the digital signature service server;

Generating an electronic signature statement using the digital signature; And

And transmitting the electronic signature statement to the electronic signature digital signature utilization server.

The digital signature obtaining method includes:

Performing a local authentication of the user;

When the local authentication is completed,

And generating the device authentication data from information for device authentication of the user terminal using the device authentication private key included in the device authentication key pair.

There is provided a computer-readable recording medium storing a program for causing a computer to execute the digital signature obtaining method.

According to the embodiments, the effect that the user does not need to possess the medium in which the private key is stored by registering and managing the private key for generating the digital signature in the digital signature service server. In addition, it is possible to prevent the medium in which the private key is stored from being stolen.

In addition, the security of the user's private key can be improved by blocking the private key stored in the digital signature service server 100 from being verified and copied by a device other than the digital signature generation module.

1 is a diagram illustrating an electronic signature service system 1000 according to an exemplary embodiment.
2 is a block diagram schematically showing the digital signature service server 100 shown in FIG.
3 is a block diagram conceptually illustrating a storage space of the storage unit 130 shown in FIG.
FIG. 4 is a block diagram schematically illustrating the user user terminal 200 shown in FIG.
5 is a flowchart showing an example of a method in which an electronic signature service is provided by the digital signature service system shown in FIG.
6 is a flowchart showing another example of a method in which an electronic signature service is provided by the digital signature service system shown in FIG.
7 is a flowchart illustrating a process of authenticating a user of a user terminal by an electronic signature service server.
FIG. 8 is a flowchart illustrating an example in which a step of generating a secure communication session is added in the digital signature service method shown in FIG.
FIG. 9 is a flowchart illustrating a process of generating a secure communication session shown in FIG. 8 according to an exemplary embodiment of the present invention.
10 is a flowchart illustrating transmission and reception of data between the digital signature service server and the user terminal using the secure communication session.
11A and 11B are flowcharts illustrating an example of a method in which an electronic signature service is provided by the digital signature service system shown in FIG.
FIG. 12 is a flowchart illustrating a process of moving a private key and certificate data stored in a user terminal to an electronic signature service server.

Brief Description of the Drawings The advantages and features of the present invention, and the manner of achieving them, will be apparent from and elucidated with reference to the embodiments described in conjunction with the accompanying drawings. It should be understood, however, that the present invention is not limited to the embodiments set forth herein, but may be embodied in many different forms and includes all conversions, equivalents, and alternatives falling within the spirit and scope of the present invention . BRIEF DESCRIPTION OF THE DRAWINGS The above and other aspects of the present invention will become more apparent by describing in detail preferred embodiments thereof with reference to the attached drawings. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof. The terms first, second, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

Throughout the specification, an electronic signature means digital information attached to an electronic document, used for the purpose of confirming the identity of the user who created the electronic signature and indicating the user's approval of the electronic document.

The signature target document means an electronic document requiring a digital signature of the user. The user can authenticate that the user has approved the signature target document by generating a digital signature for the signature target document. The document to be signed may be created by the server of the user organization using the digital signature. The digital signature using institution may be a bank, a public institution, an electronic commerce service operating institution, a stock trading institution, and the like, but is not limited thereto. As another example, the signature target document may also be created by a user terminal authorized to sign. The document to be signed may be an electronic document, including but not limited to an online certificate, an electronic commerce document, an Internet stock trading document, and the like.

The signature target data means data derived from the signature target document.

Illustratively, the signature subject data may be data obtained by processing the original text data of the signature subject document with a predetermined algorithm.

For example, the signature target data may be data obtained by processing the original document data of the signature target document using a hash function. As another example, the signature target data may be data obtained by processing the original document data of the signature target document using a hash function and a padding algorithm. Padding refers to an algorithm that adjusts the size of data by adding spaces or meaningless symbols to the end of the data if the size of the data is less than the fixed length.

The above-described data processing algorithms are merely illustrative, and the embodiments are not limited thereto. The signature target data may be the same as the original document data of the signature target document.

A certificate is an electronic document for authenticating that a digital signature has been created by a user. The certificate may include at least one of the user information that has undergone the digital signature, the purpose of the certificate, the validity period of the certificate, the certificate expiration date, and the information about the certificate issuing authority.

And, the certificate data means data derived from the certificate. The certificate data may be data representing the information of the certificate as it is. As another example, the certificate data may be data in which the certificate is changed to an appropriate format for submission to an electronic signature using institution.

An electronic signature means an electronic document submitted to a user organization using an electronic signature. The digital signature may include the digital signature, the signature data, the certificate data, and the public key data for decrypting the digital signature. The digital signature use authority can verify whether the digital signature is created by the user by verifying the digital signature with the public key data attached to the digital signature statement.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout. .

1 is a diagram illustrating an electronic signature service system 1000 according to an exemplary embodiment.

Referring to FIG. 1, an electronic signature service system 1000 according to an embodiment includes a user terminal 200, an electronic signature server 100 that stores data for generating a digital signature of a user and provides an electronic signature service to the user, An electronic signature using server 300 using an electronic signature, and an authentication server 400 for authenticating an electronic signature.

The digital signature using server 300 means a server operated by an institution using an electronic signature. The digital signature using server 300 may include a bank server, a server operated by a public entity, a server providing an electronic commerce service, and the like, but is not limited thereto. The digital signature using server 300 can issue an electronic document requiring authentication of the user, that is, the signature target document. The digital signature using server 300 can transmit the signature target data derived from the signature target document to the user terminal 200. [ The signature target data may include the original document data of the signature target document as it is, or may include data processed to be suitable for encryption, which will be described later, on the original document data of the signature target document. The digital signature using server 300 may request the digital signature of the signature target data from the user terminal 200. [

The authentication server 400 means a server operated by an authorized certification authority that issues and manages a certificate for verifying digital signatures. Examples of such accredited certification bodies include KFTC, Korea Information Certification, Korea Securities Computing, Korea Electronics Certification, Korea Computer Center, and Korea Trade Information Telecommunication.

The user terminal 200 means a device used by a user who has the authority of digital signature. The user terminal may include, but is not limited to, a smart phone, a tablet PC, a laptop, and the like. The user terminal 200 may include communication means capable of communicating with the electronic signature utilizing server 300 and the electronic signature service server 100. [ The user terminal 200 can receive a digital signature request for the signature target data and the signature target data from the digital signature using server 300. [

The user terminal 200 may request the digital signature service server 100 to generate an electronic signature without directly generating the digital signature. If necessary, the user terminal 200 may process the signature target data into a format that facilitates digital signature, and then send a request for the digital signature to the processed signature target data to the digital signature service server 100.

When the user terminal 200 receives the digital signature from the digital signature service server 100, the user terminal 200 can generate the digital signature using the digital signature. The digital signature can be created in a format that can be verified by the digital signature using server 300 or the authentication server 400. [ The user terminal 200 can transmit the generated digital signature statement to the digital signature using server 300. [

Information for generating a digital signature of a user may be registered in the digital signature service server 100. For example, the digital signature service server 100 may have a private key registered in the key pair for generating an electronic signature. The digital signature service server 100 can generate an electronic signature using the private key of the user registered in advance. The digital signature service server 100 may transmit the generated digital signature of the user to the user terminal 200. [

2 is a block diagram schematically showing the digital signature service server 100 shown in FIG.

2, an electronic signature service server 100 according to an embodiment of the present invention includes a communication unit 110 for communicating with a user terminal 200, a storage unit 130 for storing a private key for generating a digital signature of a user, When the communication unit 110 receives a request for an electronic signature for the signature target data and the signature target data from the user terminal 200, generates an electronic signature for the signature target data using the private key, (140). The electronic signature service server 100 may further include a processor 120 for verifying the device authentication data received from the user terminal 200 by the communication unit 110. [ The processor 120 may perform an arithmetic operation for encrypting and decrypting data transmitted and received by the communication unit 110. [

The communication unit 110 can exchange information and data with the user terminal 200. The communication unit 110 may include hardware resources that perform data transmission and reception functions.

The communication unit 110 may be connected to the user terminal 200 through a predetermined communication network. The predetermined communication network is an intermediary for connecting the communication unit 110 of the digital signature service server 100 and the user terminal 200. The predetermined communication network is a medium in which the user terminal 200 is connected to the digital signature service server 100 And a path for providing a connection path so that data can be transmitted and received. The communication network may be a wired network or a wireless network. The wired network may include Local Area Networks (LANs), Wide Area Networks (WANs), Metropolitan Area Networks (MANs), Integrated Service Digital Networks (ISDNs), and the wireless network may include wireless LANs, CDMA, Bluetooth, And the like, but the embodiment is not limited thereto.

The storage unit 130 may store information registered in the digital signature service server 100 for generating a digital signature of a user. For example, the storage unit 130 may store a private key for generating a digital signature of a user. Also, the storage unit 130 may store user certificate data together.

 The storage unit 130 may prevent other devices except the digital signature generation module 140 from duplicating and checking the user's private key. On the other hand, the certificate data stored in the storage unit 130 may be transmitted to the user terminal 200 through the communication unit 110 at the request of the user terminal 200. Accordingly, the storage unit 130 may store the certificate data and the private key in different storage spaces.

3 is a block diagram conceptually illustrating a storage space of the storage unit 130 shown in FIG.

Referring to FIG. 3, the storage unit 130 may include a first storage space 132 and a second storage space 134. The first storage space 132 and the second storage space 134 may be separated by hardware or may not be separated. Illustratively, the user's private key may be stored in the first storage space 132. Also, the second storage space 134 may include certificate data, user identification information, and the like. The processor 120 may utilize at least some of the data and information stored in the second storage space 134. Also, the certificate data stored in the second storage space 134 may be transmitted to the outside through the communication unit 110.

The first storage space 132 may be configured such that information stored in the first storage space 132 can not be checked and copied outside the digital signature service server 100. The private key stored in the first storage space 132 can be configured and verified only by the digital signature generation module 140. For example, the first storage space 132 and the digital signature generation module 140 may form a hardware security module (HSM) 150 together. The first storage space 132 and the digital signature generation module 140 constitute the hardware security module 150 so that the private key stored in the first storage space 132 can be securely managed without being disclosed.

The digital signature generation module 140 can encrypt the signature target data received by the communication unit 110 using the private key stored in the first storage space 132 of the storage unit 130. [ The digital signature generation module 140 may perform an operation process necessary for the encryption. The digital signature generation module 140 can generate an electronic signature by encrypting the data to be signed. When the digital signature generated by the digital signature generation module 140 is transmitted to the communication unit 110, the communication unit 110 can transmit the digital signature to the user terminal 200. [

Referring again to FIG. 2, the processor 120 may verify device authentication data obtained from the user terminal 200. The device authentication data may be data generated from information for device authentication of the user terminal 200. In addition, the information for the device authentication may include a unique identification number given to the device of the user terminal 200, device information, an ID given to the user terminal 200 when the user subscribes to the digital signature service, . The device authentication data may be data obtained by modulating all or a part of the information for the device authentication.

Processor 120 may determine whether the user is authorized to obtain an electronic signature by verifying device authentication data obtained from user terminal 200. [ The processor 120 may verify the device authentication data acquired from the user terminal 200 using information stored in the second storage space 134 of the storage unit 130. [ The processor 120 may determine whether the user is authorized to generate an electronic signature from the device authentication data acquired from the user terminal 200 by the communication unit 110. [

Upon completion of the verification of the device authentication data, the processor 120 can request the digital signature generation module 140 to generate the digital signature of the signature target data using the private key that the user has authority to use. The processor 120 may include hardware resources capable of performing an operation process required for a user authentication procedure.

FIG. 4 is a block diagram schematically illustrating the user user terminal 200 shown in FIG.

Referring to FIG. 4, a user terminal 200 according to an exemplary embodiment may include a communication unit 210, an input unit 230 for obtaining user input information, and a processor 240.

The communication unit 210 can transmit and receive data and information to and from the digital signature service server 100, the digital signature use server 300 and the authentication server 400. [ The communication unit 210 may transmit a digital signature request to the electronic signature service server 100. [ The communication unit 210 may receive the digital signature from the digital signature service server 100 and may transmit the digital signature generated using the digital signature to the digital signature using server 300. [

The input unit 230 may acquire user input information. The processor 240 may generate data transmitted by the communication unit 210 based on the user input information acquired by the input unit 230. [ The input method of the input unit 230 may be a button input method or a touch screen method. In the case of the button input method, the input unit 230 may include a predetermined button input device. In the case of the touch screen type, the input unit 230 may include a display supporting the touch screen function. The processor 240 may provide UI (User Interface) information to the input unit 230. The above-described example is merely illustrative and the embodiment is not limited thereto. For example, the input unit 230 may receive user input through voice recognition or other methods.

The processor 240 may be populating a predetermined application distributed by the electronic signature service server 100. [ The processor 240 may provide UI information for the input unit 230 and may generate data to be transmitted by the communication unit 210. The processor 240 may perform the arithmetic functions necessary for generating the digital signature statement. In addition, the processor 240 may perform an arithmetic function necessary for securing communication with the digital signature service server 100. [

The user terminal 200 according to the embodiment may further include a local authentication unit 220. In FIG. 4, the local authentication unit 220 shows the processor 240 as a separate component, but this does not mean that both components are separated in hardware. For example, the local authentication unit 220 and the processor 240 may or may not share at least some hardware resources.

The local authentication unit 220 may perform the local authentication process of the user. The local authentication unit 220 can perform local authentication based on the user input information acquired by the input unit 230. [ Here, the local authentication means a user authentication procedure performed by the user terminal 200 without exchanging data with the outside. The local authentication method will be described in more detail later in the description section.

5 is a flowchart showing an example of a method in which an electronic signature service is provided by the digital signature service system 1000 shown in FIG.

Referring to FIG. 5, the digital signature service server may generate an electronic signature for the signature target data using a private key of a user registered in advance.

In step 1105, the digital signature service server 100 may register the private key for generating the digital signature of the user in the storage unit 130. [ The digital signature service server 100 may generate a key pair at the request of the user terminal 200 and store the private key included in the key pair in the storage unit 130. [ For example, the digital signature service server 100 may store the private key included in the key pair in the first storage space 132 shown in FIG. 3 and store the public key in the second storage space 134 .

As another example, the digital signature service server 100 may receive the generated private key from the user terminal 200. [ In this case, the private key received by the digital signature service server 100 from the user terminal 200 may be encrypted. The step 1105 of registering the user's private key will be described in more detail in the following description.

In step 1110, the user terminal 200 may receive a request for an electronic signature from the digital signature using server 300. The request for the digital signature means requesting the digital signature using server 300 to generate the digital signature for the signature target data to be verified. The signature target data may be generated in the digital signature using server 300. [ In this case, the digital signature using server 300 can transmit the digital signature request together with the signature target data to the user terminal 200 together.

For example, the digital signature using server 300 can generate an online certificate, an electronic commerce document, an Internet stock transaction document, or the like as a signature target document. Then, the digital signature using server 300 can transmit the signature target data derived from the signature target document to the user terminal 200. [ The signature target data transmitted by the electronic signature utilizing server 300 may be the original data of the signature target document or the original data of the signature target document.

As another example, the data to be signed may be generated at the user terminal 200. That is, the user terminal 200 may directly generate a signature target document to be subjected to digital signature. In this case, the digital signature using server 300 may request the user terminal 200 to transmit the signature subject data and the digital signature generated by the user terminal 200 to the digital signature use server 300.

In step 1120, the user terminal 200 may process the data to be signed. For example, the user terminal 200 may process the data to be signed by encoding the data to be signed using a hash function. Since the data of the hash function value has a certain size, the size of the signature data can be changed through the encoding process using the hash function. The user terminal 200 can process the signature target data to change the size of the signature target data, thereby facilitating generation of a digital signature to be described later.

The user terminal 200 can further perform the padding process in the process of processing the signature target data. The user terminal 200 can adjust the size of the signature target data through padding. The padding procedure may be performed when the size of the data processed by the encoding using the hash function is smaller than the size of data required for generating the digital signature described later. The user terminal 200 can transmit the processed signature subject data to the digital signature service server 100. [

In FIG. 5, it is exemplified that step 1120 of processing the data to be signed is performed in the user terminal 200, but the embodiment is not limited thereto. According to another embodiment, step 1120 may be performed in the digital signature service server 100 or the digital signature use server 300. [

When the digital signature using server 300 generates a signature target document, the digital signature using server 300 may perform the above encoding and padding procedure on the data of the signature target document. As another example, when the digital signature service server 100 does not have a size suitable for digital signature generation from the user terminal 200, the digital signature service server 100 processes the signature subject data, It is possible to generate a digital signature for the data.

In step 1124, the user terminal 200 may transmit the signature target data and the digital signature request to the digital signature service server 100. The digital signature request is a request to generate a digital signature for the data to be signed using the user's private key. The signature target data transmitted in step 1124 may be original data of the signature target document or data obtained by processing the original data of the signature target document through the encoding and padding.

In step 1126, the digital signature service server 100 may generate the digital signature using the signature subject data and the user's private key. The communication unit 110 may transmit the signature target data received from the user terminal 200 to the digital signature generation module 140. The digital signature generation module 140 can encrypt the signature target data using the private key stored in the first storage space 132. [ The digital signature generation module 140 may encrypt the signature target data using at least one of RSA, Rabin, and Elliptic Curve DSA (ECDSA) algorithms. The above-described algorithms are merely illustrative and the embodiments are not limited thereto.

The digital signature generation module 140 can generate the digital signature using the private key of the signature target data. The digital signature generated by the digital signature generation module 140 may be transmitted to the communication unit 110. However, the private key registered in the first storage space 132 of the storage unit 130 may not be transmitted to the outside of the hardware security module 150 of FIG. Accordingly, while the electronic signature service server 100 provides the electronic signature service, the user's private key may not be disclosed to the outside.

In step 1128, the communication unit 110 may transmit the digital signature generated by the digital signature generation module 140 and the user's certificate data stored in the second storage space 134 to the user terminal 200. The certificate data may include information on the user who has performed the digital signature, the purpose of the certificate, the validity period of the certificate, the expiration date of the certificate, the certificate issuing authority, and the like. Further, the certificate data may include a public key for verifying the digital signature. Further, the certificate data may be accompanied by additional signatures provided to judge whether the certificate data is falsified or altered. The additional signature may be configured to be verifiable only by the authentication server 400.

In step 1130, the processor 240 of the user terminal 200 may generate an electronic signature statement using the digital signature and the certificate data received from the digital signature service server 100. [ The electronic signature statement may be accompanied by data to be signed, a digital signature for the data to be signed, and certificate data for authenticating the digital signature. The user terminal 200 can generate a digital signature using a predetermined protocol.

The communication unit 210 of the user terminal 200 may transmit the digital signature generated in the processor 240 to the digital signature using server 300 in step 1132. [

In step 1134, the digital signature using server 300 may request the authentication server 400 to verify the certificate data attached to the digital signature.

In step 1136, the authentication server 400 may verify the certificate data. The authentication server 400 can verify whether the certificate data is falsified or tampered by verifying the additional signature attached to the certificate data.

In step 1138, the authentication server 400 may transmit the verification result of the certificate data to the digital signature using server 300. [

In step 1140, when the verification of the certificate data is completed, the digital signature using server 300 can verify the digital signature received from the user terminal 200. The digital signature utilizing server 300 can verify the digital signature attached to the digital signature statement using the public key attached to the digital signature statement. The digital signature using server 300 can verify the digital signature statement by comparing the data obtained by decoding the digital signature with the signature subject data attached to the digital signature statement.

According to the embodiment shown in FIG. 5, since the digital signature service server 100 registers and manages the user's private key, the user terminal 200 does not have to manage the private key. Therefore, there is an effect that the user does not have to directly carry the medium in which the private key is stored. Also, there is an effect that the user does not need to move or copy the private key for digital signature to various media.

According to the embodiment, since the private key is stored in the digital signature service server 100, it is possible to prevent the digital signature of the user from being stolen as the user loses the medium in which the private key is stored. The hardware security module 150 is configured with the first storage space 132 and the digital signature generation module 140 of the digital signature service server 100 to prevent duplication or confirmation of the user's private key .

According to an embodiment, a method in which the digital signature service is performed by the digital signature service system 1000 may further include a step in which the digital signature service server 100 authenticates a user of the user terminal 200.

6 is a flowchart showing another example of a method in which an electronic signature service is provided by the digital signature service system 1000 shown in FIG.

In the following description of the embodiment of FIG. 6, contents overlapping with FIG. 5 will be omitted. Referring to FIG. 6, the digital signature service server 100 may authenticate a user of the user terminal 200. The processor 120 of the digital signature service server 100 may perform a process of verifying the device authentication data acquired from the user terminal 200. [ When the verification of the device authentication data is completed, the processor 120 may request the digital signature generation module 140 to generate a digital signature using the private key having a use right by the user.

In step 1210, the digital signature service server 100 may obtain the device authentication data from the user terminal 200. [ The device authentication data can be derived from the above-described information for device authentication. The process of generating the device authentication data by the user terminal 200 will be described later in more detail.

In step 1212, the communication unit 110 of the digital signature service server 100 can receive the device authentication data from the user terminal 200. [ The processor 120 can verify the device authentication data received by the communication unit 110. [ The processor 120 may determine whether the user is authorized to use the private key stored in the storage unit 130. [ In addition, when a plurality of private keys are stored in the storage unit 130, the processor 120 can determine which private key is usable by the user. The process of verifying the device authentication data by the digital signature service server 100 will be described later in more detail.

In step 1214, the digital signature service server 100 may transmit the result of verifying the device authentication data to the user terminal 200. [ When the verification of the device authentication data by the processor 120 fails, the communication unit 110 may transmit a message to the user terminal 200 that the user authentication has failed. When the processor 120 completes the verification of the device authentication data, the communication unit 110 may transmit a message to the user terminal 200 indicating that the user authentication is completed.

When the verification of the device authentication data is completed, the communication unit 110 can transmit the certificate list information usable by the user to the user terminal 200. [ If there are a plurality of certificates available to the user, the user terminal 200 may receive the selection information of the certificate from the user. The user terminal 200 can transmit the certificate selection information to the electronic signature service server 100. [

Hereinafter, a procedure for authenticating a user from device authentication data will be described as an example.

FIG. 7 is a flowchart illustrating a process of authenticating a user of the user terminal 200 by the digital signature service server 100. Referring to FIG.

Referring to FIG. 7, the user terminal 200 may perform a local authentication procedure. When the local authentication procedure is completed, the user terminal 200 can generate the device authentication data from the device authentication information and transmit the device authentication data to the digital signature service server 100. The electronic signature service server 100 can authenticate the user by verifying the device authentication data.

The device authentication information may include a unique identification number assigned to the device of the user terminal 200, device information, an ID assigned to the user terminal 200 when the user subscribes to the digital signature service, and the like. The device authentication data may be data obtained by modulating all or a part of the information for the device authentication.

In operation 1510, the user terminal 200 may perform a local authentication procedure. Local authentication is performed in the user terminal 200, and the user terminal 200 can verify the user authentication information input by the user. The input unit 230 of the user terminal 200 may receive user authentication information from a user. The input unit 230 may receive a user ID, biometric information of a user, a password, and the like as the user authentication information. When the input unit 230 receives the user's biometric information, the input unit 230 may include a sensor for sensing the user's biometric signal.

The local authentication unit 220 can authenticate the user from the user authentication information received by the input unit 230. The local authentication unit 220 can manage the user authentication information so that the user authentication information is not leaked to the outside during the local authentication process. The local authentication process of the local authentication unit 220 will be described later in detail.

In step 1530, the processor 240 may generate the device authentication data using the device authentication key pair. The key pair for device authentication may include a private key for device authentication for encryption and a public key for device authentication for decrypting the data encrypted with the private key for device authentication. The key pair for device authentication is used to generate the device authentication data from the information for device authentication, and may be different from the key pair for generating the digital signature. The key pair for device authentication may be generated by the user terminal 200 or provided by the digital signature service server 100 to the user terminal 200.

The processor 240 can generate the device authentication data using the device authentication private key included in the device authentication key pair. The user terminal 200 can generate device authentication data by encrypting all or a part of the information for device authentication using the device authentication private key. Processor 240 may encrypt at least a portion of the information for device authentication using at least one of RSA, Rabin, and Elliptic Curve DSA (ECDSA) algorithms. The above-described algorithms are merely illustrative and the embodiments are not limited thereto.

The key pair for device authentication can be renewed every time the device authentication data is generated. However, the embodiment is not limited thereto. For example, the key pair for device authentication may be repeatedly used a predetermined number of times and then discarded.

In step 1540, the communication unit 210 of the user terminal 200 may transmit to the electronic signature service server 100 the public key for device authentication and the device authentication data included in the key pair for device authentication.

In step 1550, the communication unit 110 of the digital signature service server 100 may receive the device authentication public key and the device authentication data from the user terminal 200. The processor 120 of the digital signature service server 100 can verify the device authentication data using the device authentication public key. Illustratively, the processor 120 may verify the device authentication data by decrypting the device authentication data using a public key for device authentication. The processor 120 may determine whether the user is authorized to generate the digital signature by verifying the device authentication data.

As shown in FIG. 7, since the local authentication performed in the user terminal 200 and the remote authentication performed between the user terminal 200 and the digital signature service server 100 are performed in parallel, . In addition, by modulating the information for device authentication with the device authentication data and transmitting the information to the digital signature service server 100, the user terminal 200 can prevent the information for device authentication from being stolen by the external device.

The local authentication process shown in step 1510 may be performed in various manners. For example, the local authentication unit 220 of the user terminal 200 may generate a captcha. The captcha may contain distorted text or numeric images that are difficult for a computer to distinguish. The captcha may also include a voice file that mixes noise with a voice or a voice reading digit. Then, the user terminal 200 can confirm that the user authentication is performed by a person other than the machine by using the captcha.

In addition, the input unit of the user terminal 200 may acquire user input information for user authentication. The user input information may include an ID, a password, a PIN, a user's bio-signal, etc. input by the user. The local authentication unit 220 can perform local authentication by verifying the user input information inputted by the input unit. When the local authentication is completed, the remote authentication procedure may proceed.

6, after the user authentication is completed in steps 1210, 1212, and 1214, the user terminal 200 and the digital signature service server 100 can transmit and receive data and information related to the digital signature service. It is necessary to prevent data and information transmitted and received between the digital signature service server 100 and the user terminal 200 from being disclosed to the outside in order to prevent the digital signature from being stolen and to protect the user's privacy in steps 1224,

FIG. 8 is a flowchart illustrating an example in which a step 1220 of creating a secure communication session in the digital signature service method shown in FIG. 6 is added. In the following description of the embodiment of FIG. 8, the contents which are the same as those in FIG. 6 will be omitted.

Referring to FIG. 8, the digital signature service method of the digital signature service system 1000 may include a step 1220 of creating a secure communication session.

In step 1120, the processor 120 of the digital signature service server 100 may generate a session key and a token for encrypting data and information transmitted and received between the user terminals 200. The session key is a key for encrypting data and information transmitted and received in the secure communication session. The token is also a kind of message indicating the right to receive and transmit data and information in the secure communication session.

The processor 120 of the digital signature service server 100 may generate a secure communication session by generating the session key and the token and sharing the session key and the token with the user terminal 200. [ When a secure communication session is created, the digital signature service server 100 and the user terminal 200 can authenticate that they are authorized to use the secure communication session by attaching the token together with the information and data to be transmitted, respectively. In addition, the digital signature service server 100 can determine whether or not the user is authorized to generate the digital signature by verifying the token received from the user terminal 200. [ The digital signature generation module 140 determines what the private key corresponding to the token among the private keys stored in the storage unit 130 is and generates a digital signature of the user using the private key corresponding to the token can do.

Information and data transmitted and received between the digital signature service server 100 and the user terminal 200 through the secure communication session can be encrypted by the session key. For example, in step 1224, the user terminal 200 may encrypt the signature target data and the digital signature request using the session key and transmit the encrypted data to the digital signature service server 100. The processor 120 of the digital signature service server 100 may decrypt the encrypted digital signature request and the signature target data using the session key.

Similarly, in step 1228, the processor 120 of the digital signature service server 100 may encrypt the digital signature and the certificate data of the user using the session key, and transmit the digital signature and the certificate data to the user terminal 200. The processor 240 of the user terminal 200 may decrypt the encrypted digital signature and the certificate data using the session key.

According to the embodiment described with reference to FIG. 8, it is possible to encrypt data and information transmitted and received between the digital signature service server 100 and the user terminal 200 using the session key generated in operation 1220. It is possible to prevent the digital signature of the user from being stolen by encrypting data and information transmitted and received between the digital signature service server 100 and the user terminal 200. [ In addition, it is possible to prevent the user's digital signature service utilization information from being leaked to the outside.

FIG. 9 is a flowchart illustrating a process of generating secure communication session 1220 shown in FIG.

In step 1610, the processor 120 of the digital signature service server 100 may generate a session key and a token.

In step 1612, the processor 120 may encrypt the session key and the token. The session key and token can be encrypted in various ways. For example, the processor 120 may encrypt the session key and the token using the public key for device authentication acquired in step 1540 shown in FIG. The processor 120 may encrypt the session key and the token using at least one of RSA, Rabin, and Elliptic Curve DSA (ECDSA) algorithms.

In operation 1614, the digital signature service server 100 may transmit the encrypted session key and token data to the user terminal 200 through the communication unit 110.

In operation 1620, the processor 240 of the user terminal 200 may decrypt the encrypted session key and the token data. For example, the processor 240 may decrypt the encrypted session key and token data using the device authentication private key generated in step 1520 shown in FIG.

In step 1622, the processor 240 of the user terminal 200 may generate a first random number. The first random number is a random number generated by the user terminal 200.

In step 1624, the processor 240 of the user terminal 200 may derive terminal authentication data from the first random number using the session key. Illustratively, the processor 240 may generate terminal authentication data by encrypting the first random number using the session key. The terminal authentication data may include all or part of the encryption result of the first random number.

 In step 1626, the user terminal 200 may transmit the terminal authentication data generated from the first random number and the first random number to the digital signature service server 100 through the communication unit 210.

In step 1630, the processor 120 of the digital signature service server 100 may verify the terminal authentication data using the session key. The processor 120 can verify the terminal authentication data by comparing the data generated using the session key from the first random number with the terminal authentication data received from the user terminal 200 through the same process as step 1624. [ The processor 120 can verify that the user terminal 200 has obtained the session key and the token by verifying the terminal authentication data.

In step 1632, the processor 120 of the digital signature service server 100 can generate the second random number when the verification of the terminal authentication data is completed.

In step 1634, the digital signature service server 100 processor 120 may derive the server authentication data from the second random number using the session key. Illustratively, the processor 120 may generate the server authentication data by encrypting the second random number using the session key. The server authentication data may include all or part of the encryption result of the second random number.

In step 1636, the digital signature service server 100 may transmit the second random number and the server authentication data to the user terminal 200 through the communication unit 110.

In step 1640, the processor 240 of the user terminal 200 may verify the server authentication data using the session key. The processor 240 can verify the server authentication data by comparing the data generated through the same process as step 1634 with the server authentication data received from the electronic signature service server 100. [ The processor 240 can verify the session key and the token are generated by the electronic signature service server 100 by verifying the server authentication data.

When the verification of the terminal authentication data and the server authentication data is completed, a secure communication session can be created between the digital signature service server 100 and the user terminal 200. The electronic signature service server 100 and the user terminal 200 can encrypt transmission / reception data using the session key. The security of the digital signature service can be improved by encrypting the transmission / reception data between the digital signature service server 100 and the user terminal 200.

Although FIG. 9 exemplarily shows that the server authentication data and the terminal authentication data are generated from the first and second random numbers, the embodiment is not limited thereto. For example, the terminal authentication data may be generated from other authentication information stored in the user terminal 200. [ Server authentication data may also be generated from other authentication information stored in the electronic signature service server 100. [

10 is a flowchart showing that the digital signature service server 100 and the user terminal 200 transmit and receive data using the secure communication session.

In step 1712, the processor 240 of the user terminal 200 may generate the terminal transmission data to be transmitted to the digital signature service server 100. The terminal transmission data means data transmitted from the user terminal 200 to the digital signature service server 100. For example, the terminal transmission data may include a request for an electronic signature, data to be signed, and the like.

In step 1714, the processor 240 of the user terminal 200 may encrypt the terminal transmission data using the session key.

In step 1716, the user terminal 200 can transmit encrypted terminal transmission data through the communication unit 210. [

In step 1720, the processor 120 of the digital signature service server 100 may decrypt the encrypted terminal transmission data received by the communication unit 110. The processor 120 may decrypt the encrypted terminal transmission data using the session key.

In step 1722, when the terminal transmission data includes a service request for requesting a predetermined service, the digital signature service server 100 may process the request. For example, when the terminal transmission data includes a request for generating an electronic signature, the digital signature service server 100 can proceed to generate the digital signature of the user.

In step 1724, the processor 120 of the digital signature service server 100 may generate server transmission data to be transmitted to the user terminal 200. [ The server transmission data means data transmitted from the digital signature service server 100 to the user terminal 200. For example, the server transmission data may include an electronic signature, certificate data, and the like.

In step 1726, the processor 120 of the digital signature service server 100 may encrypt the server transmission data using the session key.

In step 1730, the digital signature service server 100 may transmit the encrypted server transmission data through the communication unit 110. [

In step 1732, the processor 240 of the user terminal 200 may decrypt the encrypted server transmission data received by the communication unit 210. The processor 240 may decrypt the encrypted server transmission data using the session key.

In the above description, the digital signature service server 100 generates the digital signature using the private key of the user registered in advance, and provides the generated digital signature to the user terminal 200. [

Hereinafter, a process of registering the user's private key in the digital signature service server will be described.

11A and 11B are flowcharts illustrating an example of how an electronic signature service is provided by the digital signature service system 1000 shown in FIG. Referring to FIGS. 11A and 11B, at least a part of a key pair corresponding to a certificate issued or renewed by a user may be registered in the digital signature service server 100. FIG.

User authentication may be performed at steps 2110, 2112, and 2114. The user authentication process may be performed according to the embodiments described with reference to FIGS.

In step 2120, the user terminal 200 may request the digital signature service server 100 to generate a key pair for generating a digital signature of the user.

In step 2122, the processor 120 of the digital signature service server 100 may generate a key pair in response to a request from the user terminal 200. [ The electronic signature service server 100 may register the private key included in the key pair. The digital signature service server 100 can register the private key by storing the private key in the first storage space 132 of the storage unit 130. [ The private key may not be disclosed outside the digital signature service server 100. The public key included in the key pair may be stored in the second storage space 134 of the storage unit 130. As another example, the public key may not be stored in the storage unit 130 but may be transmitted to the user terminal 200.

In step 2124, the digital signature service server 100 may transmit the result of generating the key pair to the user terminal 200 through the communication unit 110. [

In step 2126, the user terminal 200 may request the digital signature service server 100 to transmit the public key.

In step 2128, the digital signature service server 100 may transmit the public key included in the key pair to the user terminal 200 through the communication unit 110. [

In step 2130, the user terminal 200 may transmit a digital signature request to the electronic signature service server 100 through the communication unit 210. The digital signature service server 100 may verify whether the private key is possessed or not. The private key possessing verification information may be generated in accordance with a protocol required by the authentication server 400 as data generated for the purpose of verifying whether or not the user possesses a legitimate private key

In step 2132, the digital signature generation module 140 of the digital signature service server 100 may generate the digital signature of the private key possessing verification information using the private key of the user created and registered in step 2122. For example, the digital signature generation module 140 may generate an electronic signature for all or part of the private key propriety verification information using the user's private key.

In step 2134, the digital signature service server 100 may transmit the digital signature of the private key possessing verification information generated by the digital signature generation module 140 to the user terminal 200 through the communication unit 110. [

In step 2140, the processor 240 of the user terminal 200 may generate a message requesting to generate the certificate data corresponding to the key pair. The request to generate the certificate data may be generated according to a protocol required by the authentication server 400.

In step 2142, the user terminal 200 may transmit the request for generating the certificate data through the communication unit 210 to the authentication server 400 operated by the accredited certification authority. In addition, the user terminal 200 may transmit the digital signature of the private key possessing verification information acquired from the digital signature service server 100 to the authentication server 400. [

In step 2144, the authentication server 400 may verify the digital signature of the private key possessing verification information received from the user terminal 200. [ For example, the authentication server 400 may verify the digital signature of the private key propriety verification information using the public key. The authentication server 400 may determine that the user has acquired the authority to generate the digital signature using the private key when the digital signature of the private key possessing verification information is verified.

In step 2144, the authentication server 400 may generate the user's certificate data in response to the certificate data generation request received from the user terminal 200. [

In step 2146, the authentication server 400 may transmit the certificate data to the user terminal 200. The user terminal 200 may store the certificate data received from the authentication server 400 in the memory of the user terminal 200 or may not store the certificate data.

In step 2148, the user terminal 200 may transmit the certificate data to the digital signature service server 100 through the communication unit 210. [

In step 2150, the digital signature service server 100 may register the certificate data received from the user terminal 200. [ Illustratively, the digital signature service server 100 may register the certificate data by storing the certificate data in the second storage space 134 of the storage unit 130. The certificate data stored in the second storage space 134 may be used by the processor 120 and may be transmitted to the user terminal 200 through the communication unit 110.

11 shows an example in which a newly generated key pair is registered in the digital signature service server 100, but the embodiment is not limited thereto. For example, the user can register the private key and the certificate data in the digital signature service server 100 by moving the private key and the certificate data stored in advance in the user terminal 200 to the digital signature service server 100.

12 is a flowchart exemplarily showing a process of moving the private key and the certificate data stored in the user terminal 200 to the digital signature service server 100. FIG.

User authentication may be performed at steps 2310, 2312, and 2314. The user authentication process may be performed according to the embodiments described with reference to FIGS.

In operation 2320, the processor 240 of the user terminal 200 may encrypt the private key stored in the user terminal 200. The processor 240 may encrypt the private key stored in the user terminal 200 using the session key generated in step 1610 shown in FIG.

In operation 2322, the user terminal 200 may transmit the encrypted private key to the digital signature service server 100 through the communication unit 210.

In step 2324, the processor 120 of the digital signature service server 100 may decrypt the encrypted private key using the session key generated in step 1610 shown in FIG. In addition, the digital signature service server 100 may store the private key obtained by the decryption operation in the storage unit 130. [ Illustratively, the digital signature service server 100 may store the private key in the first storage space 132. [

In step 2330, the processor 240 of the user terminal 200 may encrypt the certificate data stored in the user terminal 200. The processor 240 may encrypt the certificate data stored in the user terminal 200 using the session key generated in step 1610 shown in FIG.

In step 2332, the user terminal 200 may transmit the encrypted certificate data and the encrypted public key to the digital signature service server 100 through the communication unit 210. [

In step 2334, the processor 120 of the digital signature service server 100 may decrypt the encrypted private key using the session key generated in step 1610 shown in FIG. In addition, the digital signature service server 100 may store the certificate data and the public key obtained by the decryption operation in the storage unit 130. [ Illustratively, the digital signature service server 100 may store the certificate data and the public key in the second storage space 134.

The digital signature service system, the server, the terminal, and the method according to the embodiments have been described above with reference to FIG. 1 through FIG.

According to the above-described embodiments, the digital signature service server registers and manages the private key for generating the digital signature, so that the user does not have to possess the medium in which the private key is stored. In addition, it is possible to prevent the medium in which the private key is stored from being stolen.

In addition, the security of the user's private key can be improved by blocking the private key stored in the digital signature service server 100 from being verified and copied by a device other than the digital signature generation module.

The above-described embodiments of the present invention can be embodied in a general-purpose digital computer that can be embodied as a program that can be executed by a computer and operates the program using a computer-readable recording medium. In addition, the structure of the data used in the above-described embodiments of the present invention can be recorded on a computer-readable recording medium through various means. The computer-readable recording medium includes a storage medium such as a magnetic storage medium (e.g., ROM, floppy disk, hard disk, etc.), optical reading medium (e.g., CD ROM,

The present invention has been described with reference to the preferred embodiments. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the appended claims rather than by the foregoing description, and all differences within the scope of equivalents thereof should be construed as being included in the present invention.

1000: Digital Signature Service System
100: Digital signature service server
110:
120: Processor
130:
132, 134: first and second storage spaces
140: Digital signature generation module
200: user terminal
210:
220: local authentication unit
230: Input unit
240: Processor

Claims (26)

A method of providing an electronic signature service by an electronic signature service server,
Receiving a request for digital signature from the user terminal and data to be signed;
Generating, in response to the request, the digital signature for the signature subject data using the pre-registered private key of the user;
And transmitting the digital signature to the user terminal,
Wherein the digital signature transmitted to the user terminal is provided to the use server using the digital signature from the user terminal together with the signature subject data and the public key corresponding to the private key. The method according to claim 1,
Wherein the step of registering the private key stores the private key so that a device other than the electronic signature generation module that generates the electronic signature using the private key can not duplicate and confirm the private key. The method according to claim 1,
The certificate data of the user is registered with the electronic signature service server together with the private key,
And transmitting the certificate data of the user to the user terminal. The method according to claim 1,
Receiving device authentication data for authenticating the user terminal from the user terminal; And
And verifying the device authentication data,
Wherein the step of generating the digital signature generates the digital signature as the device authentication data is verified. 5. The method of claim 4,
Wherein the device authentication data is generated by a device authentication private key included in a device key pair. 6. The method of claim 5,
Wherein the verifying the device authentication data comprises:
And the device authentication data is verified with the device authentication public key included in the device authentication key pair. 5. The method of claim 4,
And generating a communication security session between the digital signature service server and the user terminal for securing information transmitted and received between the digital signature service server and the user terminal as the device authentication data is verified Signature service method. 8. The method of claim 7,
Wherein the step of generating a communication security session comprises:
Generating a session key and a token, and encrypting the session key and the token with a public key for device authentication, and transmitting the encrypted session key and the token to the user terminal. 9. The method of claim 8,
The receiving of the digital signature request may include receiving a token transmitted by the user terminal,
Wherein the step of generating the digital signature comprises the steps of: verifying that the token received from the user terminal matches the token generated by the digital signature service server, generating an electronic signature by using the private key matched with the token Service method. 9. The method of claim 8,
Wherein the step of generating a communication security session comprises:
Receiving the terminal authentication data generated by the user terminal from the first random number using the session key from the user terminal and verifying the terminal authentication data;
Generating server authentication data from the second random number using the session key, and transmitting the server authentication data to the user terminal for verification. 9. The method of claim 8,
Wherein the digital signature request and signature target data received from the user terminal are encrypted using the session key,
And decrypting the request for the encrypted digital signature and the data to be signed using the session key. A method of providing an electronic signature service by an electronic signature service server,
Receiving device authentication data from a user terminal;
Verifying the device authentication data;
Receiving a request for generating a key pair for generating the digital signature of the user from the user terminal according to the device authentication data being verified;
Generating a key pair for generating the digital signature of the user;
Storing a private key included in the key pair in a storage unit; And
And transmitting the public key included in the key pair to the user terminal,
Wherein the private key is used by the digital signature generation module of the digital signature service server to generate an electronic signature for the data to be signed. 13. The method of claim 12,
Receiving certificate data of the user from the user terminal; And
And storing the certificate data in the storage unit. 14. The method of claim 13,
Wherein the step of storing the certificate data in the storage unit stores the certificate data so that a storage space in which the certificate data is stored is different from a storage space in which the private key is stored. 15. The method of claim 14,
Receiving, from the user terminal, a request for an electronic signature for verifying whether the private key is owned or not;
Generating a digital signature for the private key possessing verification information using the private key stored in the storage unit;
And transmitting a digital signature to the user terminal for verifying whether or not the private key is possessed. A method of providing an electronic signature service by an electronic signature service server,
Receiving device authentication data from a user terminal;
Verifying the device authentication data;
Receiving key pair information for generating a digital signature of a user from the user terminal according to the device authentication data being verified;
Storing the private key included in the key pair in the first storage space of the storage unit and storing the public key included in the key pair in the second storage space of the storage unit,
Wherein the private key is stored in the first storage space so that other devices other than the digital signature generation module for generating the digital signature can not be duplicated and verified. A communication unit for communicating with a user terminal;
A storage unit for storing a private key for generating a digital signature of a user;
And an electronic signature generation module that generates a digital signature for the signature target data using the private key when the communication unit receives the signature object data and the digital signature request for the signature object data from the user terminal ,
And the communication unit transmits the digital signature generated by the digital signature generation module to the user terminal. 18. The method of claim 17,
Wherein the storage unit stores the private key so that a device other than the digital signature generation module can not duplicate and confirm the private key. 19. The method of claim 18,
Wherein the storage unit includes a first storage space for storing the private key,
Wherein the first storage space and the digital signature generation module constitute a hardware security module. 20. The method of claim 19,
Wherein the communication unit receives the user's certificate data from the user terminal, and the storage unit includes a second storage space for storing the certificate data, wherein the first and second storage spaces are separated from each other, server. 18. The method of claim 17,
And a processor for verifying terminal authentication data obtained from the user terminal and generating server authentication data to be transmitted to the user terminal. 22. The method of claim 21,
The processor verifies the device authentication data acquired from the user terminal,
The device authentication data is generated by the device authentication private key included in the device authentication key pair,
Wherein the processor verifies the device authentication data using the device authentication public key included in the device authentication key pair. 23. The method of claim 22,
Wherein the processor is configured to generate an electronic signature service to generate a communication security session between the digital signature service server and the user terminal for securing information transmitted and received between the digital signature service server and the user terminal, server. A method for a user terminal to obtain an electronic signature from an electronic signature service server,
Providing device authentication data to the electronic signature service server;
Transmitting a request for digital signature to the digital signature service server and the signature target data to the digital signature service server when the verification of the device authentication data is completed by the digital signature service server;
Receiving, from the electronic signature service server, an electronic signature in which the signature target data is encrypted by the user's private key registered in the electronic signature service server;
Generating an electronic signature statement using the digital signature; And
And transmitting the electronic signature statement to the electronic signature digital signature utilization server. 25. The method of claim 24,
Performing a local authentication of the user;
When the local authentication is completed, generating a key pair for device authentication; And
And generating the device authentication data from information for device authentication of the user terminal using the device authentication private key included in the device authentication key pair. 24. A computer-readable recording medium storing a program for causing a computer to execute the method of claim 24.

Images