KR20190072907A - Apparatus and method for supporting communication of wearable device - Google Patents

Abstract

Disclosed are an apparatus and a method for supporting wearable device communication. The method for supporting wearable device communication which is interlocked with an authentication request from a wearable device, comprises the steps of: performing a first interactive authentication between transport layer security servers in an authentication proxy terminal; performing a second interactive authentication between a wearable device in the TLS server when the first interactive authentication is successful; and supporting a data communication between the wearable device and an application server on the basis of a second session key by providing the wearable device for a second session key generated by being associated with the second interactive authentication and also, providing the same for the application server through the TLS server in the authentication proxy terminal when the second interactive authentication is successful.

Description

[0001] APPARATUS AND METHOD FOR SUPPORTING COMMUNICATION OF WEARABLE DEVICE [0002]

The present invention relates to a technique for supporting secure data communication between a wearable device and an application server.

A wearable device is a device manufactured by being lighter and smaller in size so that it can be attached to a body, and can collect personal information and transmit it to an application server.

At this time, the wearable device can support only communication with a relatively short distance, for example, using Bluetooth or NFC.

In order to compensate for this, it is possible to overcome the limitation of the communication distance by using a personal device (for example, mobile, tablet PC) as an intermediate apparatus between the wearable device and the application server.

However, the communication method using the intermediate apparatus between the wearable device and the application server overlooks the authentication of the wearable device, and does not provide sufficient security between the communication sections.

Therefore, not only the information can be exposed to the external attacker, but also the application server may receive erroneous information from the unauthorized wearable device.

According to the present invention, an authentication proxy terminal and a wearable device that serve as intermediaries between a wearable device and an application server are authenticated using a TLS server, respectively, thereby preventing information from being exposed to an external attacker, It is possible to prevent reception of erroneous information from a wearable device that is not wearable.

The present invention provides a session key generated as a result of authentication of a wearable device to each of a wearable device and an application server to share and transmit data by encrypting and using the shared session key, The purpose is to make.

In addition, the present invention provides a method for authenticating a wearable device, comprising: after a first mutual authentication between an authentication proxy terminal and a TLS server is successfully performed, a second mutual authentication between a wearable device and a TLS server, And the authentication proxy terminal performs the authentication instead of the wearable device, thereby reducing the amount of processing (calculation amount) in the wearable device and reducing power consumption.

In order to achieve the above object, a wearable device communication support apparatus includes an authentication proxy terminal that performs a first mutual authentication between TLS servers, in cooperation with an authentication request from a wearable device, Lt; RTI ID = 0.0 > TLS < / RTI > Wherein the authentication proxy terminal provides the second session key generated in association with the second mutual authentication to the wearable device when the second mutual authentication is successful and provides the second session key to the application server through the TLS server, And a terminal processor for supporting data communication between the wearable device and the application server based on the second session key.

To achieve the above object, a wearable device communication support method includes: performing a first mutual authentication between a TLS server and an authentication proxy terminal in cooperation with an authentication request from a wearable device; Performing a second mutual authentication between the wearable devices in the TLS server; and if the second mutual authentication is successful, transmitting, at the authentication proxy terminal, a second session key generated in association with the second mutual authentication, And providing data to the wearable device and providing the data to the application server through the TLS server to support data communication between the wearable device and the application server based on the second session key.

According to the present invention, the authentication proxy terminal and the wearable device, which serve as intermediaries between the wearable device and the application server, are authenticated using a TLS server, thereby preventing information disclosure to an external attacker, Thereby preventing erroneous information from being received from an unauthorized wearable device, and allowing reliable data to be received.

According to the present invention, the session key generated as the authentication result for the wearable device is provided to the wearable device and the application server, respectively, and is shared. By encrypting and transmitting the data using the shared session key, I can do it.

According to the present invention, after the first mutual authentication between the authentication proxy terminal and the TLS server is successfully performed, at the time of the second mutual authentication between the wearable device and the TLS server, the certificate of the wearable device stored in the authentication proxy terminal By performing the second mutual authentication on behalf of the wearable device in the authentication proxy terminal, the throughput (amount of calculation) in the wearable device can be reduced and power consumption can be reduced.

1 is a diagram showing an example of a network including a wearable device communication support apparatus according to an embodiment of the present invention.
2 is a diagram illustrating a configuration of a wearable device communication supporting apparatus according to an embodiment of the present invention.
3A is a diagram for explaining an example of mutual authentication based on a handshake protocol in a wearable device communication support apparatus according to an embodiment of the present invention.
FIG. 3B is a view for explaining an example of generating a session key in an authentication proxy terminal and a TLS server in a wearable device communication supporting apparatus according to an embodiment of the present invention.
4 is a diagram showing an example of operation of a network including a wearable device communication support apparatus according to an embodiment of the present invention.
5 is a diagram illustrating an example of mutual authentication between a wearable device and a TLS server using a session key in a wearable device communication support device according to an embodiment of the present invention.
6 is a flowchart illustrating a wearable device communication support method according to an embodiment of the present invention.

Hereinafter, various embodiments of the present invention will be described in detail with reference to the accompanying drawings and accompanying drawings, but the present invention is not limited to or limited by the embodiments.

1 is a diagram showing an example of a network including a wearable device communication support apparatus according to an embodiment of the present invention.

Referring to FIG. 1, a network 100 may include a wearable device 101, a wearable device communication support device 103, and an application server 109.

The wearable device 101 may be in the form of, for example, glasses, a watch, or the like, which is manufactured by being made lighter and smaller so that it can be attached to a body. The wearable device 101 may include a sensor for collecting user's data (e.g., personal information such as blood pressure, blood sugar, heart rate, exercise amount, etc.).

Further, the wearable device 101 can communicate with the authentication proxy terminal 105 using, for example, Bluetooth or NFC. At this time, the wearable device 101 encrypts data (data to be transmitted from the wearable device to the application server) using the second session key received from the authentication proxy terminal 105, and transmits the encrypted data to the authentication proxy terminal 105 To the application server 109 via the authentication proxy terminal 105. [ When the encrypted data (data to be transmitted from the application server to the wearable device) is received from the authentication proxy terminal 105, the wearable device 101 can decrypt the encrypted data using the second session key have.

The wearable device communication support device 103 may include an authentication proxy terminal 105 and a TLS (Transport Layer Security) server 107. [

The authentication proxy terminal 105 communicates with the wearable device 101 using, for example, Bluetooth or NFC (Near Field Communication), and communicates with the TLS server 107 and the application server 109, respectively, can do.

Upon receiving the authentication request from the wearable device 101, the authentication proxy terminal 105 can perform the first mutual authentication between the authentication proxy terminal 105 and the TLS server 107 in conjunction with the authentication request. At this time, the authentication proxy terminal 105 may perform the first mutual authentication based on the handshake protocol, and may generate the first session key when the first mutual authentication is successful.

Then, the authentication proxy terminal 105 can perform the second mutual authentication between the wearable device 101 and the TLS server 107 when the first mutual authentication is successful. At this time, the authentication proxy terminal 105 can perform the second mutual authentication based on the handshake protocol, and can generate the second session key when the second mutual authentication is successful.

When the second mutual authentication is successful, the authentication proxy terminal 105 provides the second session key to the wearable device 105 and provides the second session key to the application server 109 via the TLS server 107, It is possible to support data communication between the wearable device 101 and the application server 109 based on the second session key.

Specifically, the authentication proxy terminal 105 can receive the encrypted data and transmit it to the application server 109 when the wearable device 101 transmits the data encrypted using the second session key. The authentication proxy terminal 105 may receive the encrypted data and transmit the encrypted data to the wearable device 101 when the application server 109 transmits the encrypted data using the second session key.

The TLS server 107 can communicate with the authentication proxy terminal 105 using wireless communication. At this time, the TLS server 107 can perform the first mutual authentication with the authentication proxy terminal 105 and the second mutual authentication with the wearable device 101. Here, the first and second mutual authentication can be performed based on the handshake protocol.

The application server 109 can communicate with the authentication proxy terminal 105 using wireless communication. At this time, when the application server 109 receives the encrypted data (data sent from the wearable device) from the authentication proxy terminal 105, the application server 109 can decrypt the encrypted data using the second session key. At this time, when the personal data such as blood pressure, blood glucose, heart rate, and exercise amount are decoded as the data, the application server 109 can determine the health state based on the personal information.

The application server 109 also encrypts the data to be transmitted to the wearable device 101 using the second session key and transmits the encrypted data to the authentication proxy terminal 105 so that the authentication proxy terminal 105 ) To the wearable device 101 via the network. For example, the application server 109 may encrypt guide information on the determined health state using the second session key, and transmit the encrypted guidance information to the authentication proxy terminal 105.

2 is a diagram illustrating a configuration of a wearable device communication supporting apparatus according to an embodiment of the present invention.

Referring to FIG. 2, the wearable device communication support apparatus 200 may include an authentication proxy terminal 201 and a TLS server 207.

The authentication proxy terminal 201 can perform the first mutual authentication between the TLS servers 207 in association with the authentication request from the wearable device. At this time, the authentication proxy terminal 201 can perform the first mutual authentication based on the handshake protocol.

The authentication proxy terminal 201 may include a terminal authentication unit 203 and a terminal processor 205. [

When the TLS server certificate received from the TLS server is a certificate issued from a predetermined certification authority (trusted certification authority) or the certificate of the received TLS server is stored in the pre-stored TLS server And transmits the certificate of the authentication proxy terminal to the TLS server 207 when the certificate matches the certificate (for example, the certificate of the TLS server issued by the trusted certificate authority), and the certificate of the authentication proxy terminal is transmitted to the predetermined certificate authority Or the certificate of the authentication proxy terminal is authenticated by a certificate of the authentication proxy terminal previously stored in the TLS server 207 (for example, a certificate from a trusted certification authority (The certificate of the authentication proxy terminal issued by the TLS server 207) and confirmed by the TLS server 207 that the first mutual authentication is successful.

When the authentication request from the other wearable device is received, the terminal authentication unit 203 performs the mutual authentication again between the TLS servers 207 using the first session key generated in association with the first mutual authentication , Mutual authentication based on the handshake protocol can be omitted. At this time, the terminal authentication unit 203 can perform the mutual authentication only when the first session key is valid (for example, when the time at which the first session key is generated is included in the set time limit).

The terminal processor 205 provides the second session key generated in association with the second mutual authentication to the wearable device when the second mutual authentication performed by the TLS server 207 is successful, (207) to the application server, and based on the second session key, support data communication between the wearable device and the application server.

Also, the terminal processor 205 obtains the public key of the wearable device from the certificate of the previously stored wearable device, encrypts the second session key using the acquired public key of the wearable device, and provides the encrypted key to the wearable device can do. Thereafter, the terminal processor 205 decrypts the encrypted second session key by the wearable device, and when data encrypted using the second session key is transmitted from the wearable device, the terminal processor 205 receives the encrypted data To the application server.

The TLS server 207 can perform the second mutual authentication between the wearable devices when the first mutual authentication is successful. At this time, the authentication proxy terminal 201 can perform the second mutual authentication based on the handshake protocol.

The TLS server 207 may include a server processor 209 and a server authentication unit 211.

The server processor 209 confirms whether the certificate of the TLS server transmitted to the authentication proxy terminal 201 is authenticated by the authentication proxy terminal 201 with a certificate issued from a predetermined certification authority (trusted certification authority) It is determined by the authentication proxy terminal 201 that the certificate of the authenticated proxy terminal 201 matches the certificate of the TLS server pre-stored in the authentication proxy terminal 201 (for example, the certificate of the TLS server issued by the trusted certificate authority) The authentication proxy terminal 201 can receive the certificate of the wearable device.

When the received certificate of the wearable device is a certificate issued from a predetermined certification authority (trusted certification authority) or the received certificate of the wearable device is a certificate of a previously stored wearable device For example, a certificate of a wearable device issued by a trusted certification authority), the second mutual authentication can be confirmed as a success.

Also, the server authentication unit 211 can encrypt the second session key using the public key of the pre-stored application server. At this time, the server processor 209 provides the encrypted second session key to the application server, decrypts the encrypted second session key by the application server, and encrypts the encrypted second session key using the second session key Is transmitted from the application server, the encrypted data can be received and transmitted to the wearable device.

3A is a diagram for explaining an example of mutual authentication based on a handshake protocol in a wearable device communication support apparatus according to an embodiment of the present invention.

3A, the authentication proxy terminal 301 performs a first mutual authentication with the TLS server 303 and a second mutual authentication between the wearable device (not shown) and the TLS server 303 .

In the first mutual authentication, the authentication proxy terminal 301 may first set a security function. At this time, the authentication proxy terminal 301 transmits a client hello message to the TLS server 303 (311) to start a logical connection and set a security function to be associated with the connection, and transmits the client hello message to the TLS server 303 from the TLS server 303 (312).

When setting the security function, the authentication proxy terminal 301 can use Rivest Shamir Adleman (RSA) key exchange, Diffe-Hellman key exchange, and Elliptic Curve Diffie-Hellman (ECDH) key exchange algorithms as an algorithm to be used for key exchange have.

The authentication proxy terminal 301 can perform server authentication and key exchange. At this time, the TLS server 303 may transmit the certificate (X.509) of the TLS server 303, for example, to the authentication proxy terminal 301, which is a client, to authenticate itself (313). Here, since the public key of the TLS server is included in the certificate of the TLS server, the authentication proxy that receives the certificate of the TLS server can acquire the TLS server after verifying that the certificate of the TLS server is issued by a trusted certificate authority.

In addition, the TLS server 303 may send a message requesting the certificate of the authentication proxy terminal 301 to the authentication proxy terminal 301 (314). The TLS server 303 may then send 315 a server hello done message to the authentication proxy terminal 301 indicating the end of the message associated with the server hello.

The authentication proxy terminal 301 can perform client authentication and key exchange. At this time, the authentication proxy terminal 301 may check the certificate of the TLS server 303 and then transmit the certificate of the authentication proxy terminal 301 to the TLS server 303 (316). In addition, the authentication proxy terminal 301 may transmit the key exchange and confirmation of the certificate of the authentication proxy terminal 301 (317). At this time, the authentication proxy terminal 301 can transmit the parameters to be used in the key exchange and the certificate of the authentication proxy terminal to the TLS server 303. The TLS server 303 may obtain the public key of the authentication proxy terminal from the certificate of the authentication proxy terminal.

The authentication proxy terminal 301 may exchange the cryptographic combination with the TLS server 303 (318) and establish a secure connection (319) by terminating the handshake protocol.

The authentication proxy terminal 301 and the TLS server 303 have parameters used for key exchange and mutual public keys, and can generate the same session key by using them.

In the second mutual authentication, the authentication proxy terminal 301 can perform authentication in the same manner as in the first mutual authentication. However, instead of the certificate of the authentication proxy terminal, the authentication proxy terminal 301 may transmit the previously stored certificate of the wearable device to the TLS server 303. Here, the previously stored certificate of the wearable device is updated every predetermined time, so that it can be prepared for an external attack.

In the second mutual authentication, the authentication proxy terminal 301 may reduce the use of a central processing unit (CPU) in the wearable device by performing an operation required in the handshake protocol instead of the wearable device.

FIG. 3B is a view for explaining an example of generating a session key in an authentication proxy terminal and a TLS server in a wearable device communication supporting apparatus according to an embodiment of the present invention.

Referring to FIG. 3B, in the server authentication and key exchange steps 313 to 315 in FIG. 3A, the TLS server 303 transmits the shared parameters to be used in the Diffe-Hellman key exchange algorithm and the disposable secret It can generate the disposable public DH value generated using the DH value and transmit it to the authentication proxy terminal 301. [

The authentication proxy terminal 301 converts its public DH value, which is generated using the parameters received in the client authentication and key exchange steps 316 and 317 in FIG. 3A, and the disposable secret DH value generated by itself, into TLS Encrypted with the public key of the server, and transmitted to the TLS server 303.

The authentication proxy terminal 301 and the TLS server 303 can generate the session key K using the shared parameters, the one-time public DH value, and the secret DH value of each other. At this time, the authentication proxy terminal 301 and the TLS server 303 can share the session key by generating the same session key K, respectively.

4 is a diagram showing an example of operation of a network including a wearable device communication support apparatus according to an embodiment of the present invention.

Referring to FIG. 4, in step 411, the wearable device 401 can connect to the authentication proxy terminal 403 using NFC or Bluetooth.

) 및 인증 프록시 단말(403)의 식별자(

)를 포함할 수 있다. 또한, 인증 요청 메시지는 리플레이(replay) 공격을 막기 위해서 타임스탬프를 더 포함할 수 있다.In step 412, the wearable device 401 may send an authentication request message to the authentication proxy terminal 403 for data transfer to the application server 407. [ Here, the authentication request message includes an identifier of the wearable device 401 (

And an identifier of the authentication proxy terminal 403 (

). In addition, the authentication request message may further include a time stamp to prevent a replay attack.

일 수 있다. 여기서,

는 웨어러블 디바이스(401)의 식별자를 의미하고,

는 인증 프록시 단말(403)의 식별자를 의미하며,

는 타임스탬프를 의미한다.If there is no response from the authentication proxy terminal 403 within the set time, the wearable device 401 may retransmit the authentication request message to the authentication proxy terminal 403 or search another authentication proxy terminal to transmit the authentication request message. At this time, the authentication request message includes, for example,

Lt; / RTI > here,

Means an identifier of the wearable device 401,

Means the identifier of the authentication proxy terminal 403,

Quot; means a time stamp.

When the authentication proxy terminal 403 receives the authentication request message from the wearable device 401 in step 413, the authentication proxy terminal 403 performs a first mutual authentication between the authentication proxy terminal 403 and the TLS server 405 based on the handshake protocol Can be performed.

)를 의미하고, 클라이언트의 인증서(client certificate)는 인증 프록시 단말의 인증서(

)를 의미한다.At this time, in the handshake protocol, the host certificate is a certificate of the TLS server

), The client's certificate means the certificate of the authentication proxy terminal

).

When the authentication proxy terminal 403 is an untrusted device, the authentication proxy terminal 403 fails the first mutual authentication based on the handshake protocol and terminates the connection between the authentication proxy terminal 403 and the TLS server 405 do. Thereafter, all the messages in the next step are not processed.

)를 생성할 수 있다. 상기 제1 상호 인증은 인증 프록시 단말(403)이 TLS 서버(405)에 최초로 접속할 때 단 한번 수행될 수 있다.On the other hand, if the authentication proxy terminal 403 is a trusted device, the authentication proxy terminal 403 can succeed in the first mutual authentication based on the handshake protocol. At this time, the authentication proxy terminal 403, upon successful completion of the first mutual authentication,

Can be generated. The first mutual authentication may be performed only once when the authentication proxy terminal 403 first connects to the TLS server 405.

When authenticating another wearable device, if the first session key is valid, the authentication proxy terminal 403 may perform symmetric key based mutual authentication with the TLS server 405 using the first session key. That is, the first mutual authentication based on the handshake protocol can be replaced with the symmetric key based mutual authentication as shown in FIG.

)를 저장하고 있는, 인증 프록시 단말(403)은 웨어러블 디바이스(401) 대신에, 제2 상호 인증을 수행하여, 핸드셰이크 프로토콜에서 요구되는 연산을 수행 함에 따라, 웨어러블 디바이스(401)에서 제2 상호 인증을 수행하는 것에 비해 효과적으로 인증을 수행할 수 있다.In step 414, the authentication proxy terminal 403 may perform a second mutual authentication between the wearable device 401 and the TLS server 405 based on the handshake protocol. At this time, the certificate of the wearable device 401

The authentication proxy terminal 403 storing the authentication information in the wearable device 401 performs the second mutual authentication instead of the wearable device 401 and performs the operation required in the handshake protocol, Authentication can be performed more effectively than performing authentication.

At this time, if the authentication proxy terminal 403 can trust the TLS server 405, the second mutual authentication process is performed. If the TLS server 405 can not be trusted, the TLS server 405 ends the connection.

)를 의미하고, 클라이언트의 인증서(client certificate)는 웨어러블 디바이스(401)의 인증서(

)를 의미한다. 즉, 인증 프록시 단말(403)은 웨어러블 디바이스(401)의 인증서(

)를 이용하여, 핸드셰이크 프로토콜에 기초한 제2 상호 인증을 수행할 수 있다.When the second mutual authentication process proceeds normally as the authentication proxy terminal 403 is trusted, in the handshake protocol, the host certificate is a certificate of the TLS server 405

, And the client's certificate means the certificate of the wearable device 401

). That is, the authentication proxy terminal 403 authenticates the certificate 401 of the wearable device 401

) Can be used to perform the second mutual authentication based on the handshake protocol.

)를 생성할 수 있으며, TLS 서버(405)에 전달하여, 함께 공유할 수 있다.At this time, as the authentication proxy terminal 403 succeeds in the second mutual authentication, the second session key (

, And can transmit them to the TLS server 405 and share them together.

)를 이용하여, 전자 서명(

)을 생성하고, 생성된 전자 서명에 관한 메시지를 인증 프록시 단말(403)로 전송할 수 있다. 이때, 전자 서명은 전자 서명의 유효 기간 (

)을 포함할 수 있으며, 예컨대,

로 나타낼 수 있다. 여기서,

는 TLS 서버(405)의 개인키를 의미하고,

는 웨어러블 디바이스(401)의 식별자를 의미하며,

는 인증 프록시 단말(403)의 식별자를 의미할 수 있다. 또한,

는 타임스탬프를 의미하고,

는 전자 서명의 유효 기간을 의미할 수 있다.In step 415, the TLS server 405 sends its private key, the private key of the TLS server 405

), A digital signature (

And transmits a message relating to the generated digital signature to the authentication proxy terminal 403. [ At this time, the digital signature is the valid period of the digital signature

), For example,

. here,

Means the private key of the TLS server 405,

Means an identifier of the wearable device 401,

May refer to an identifier of the authentication proxy terminal 403. Also,

Quot; means a time stamp,

Can mean the validity period of the digital signature.

로 나타낼 수 있다. 여기서,

는 TLS 서버(405)의 식별자를 의미하고,

는 전자 서명을 의미할 수 있다.The message relating to the digital signature is, for example,

. here,

Means an identifier of the TLS server 405,

May mean an electronic signature.

)를 웨어러블 디바이스(401)에 전달할 수 있다. 또한, 인증 프록시 단말(403)은 2 세션키(

)를 TLS 서버(405)를 통해, 응용 서버(407)에 전달할 수 있다. 인증 프록시 단말(403)은 웨어러블 디바이스(401)의 인증서(

)를 저장하고 있기 때문에, 웨어러블 디바이스(401)의 공개키(

)를 알고 있다. 여기서, 웨어러블 디바이스(401)의 공개키(

)는 신뢰할 수 있다.In step 416, the authentication proxy terminal 403 sends a second session key ("

To the wearable device 401. [ In addition, the authentication proxy terminal 403 receives the 2-session key (

To the application server 407 via the TLS server 405. [ The authentication proxy terminal 403 authenticates the certificate 401 of the wearable device 401

), The public key of the wearable device 401

). Here, the public key of the wearable device 401

) Can be trusted.

)를 암호화하여, TLS 서버(405)의 전자 서명과 함께, 웨어러블 디바이스(401)에 전송할 수 있다.The authentication proxy terminal 403 receives the second session key (

And transmits it to the wearable device 401 together with the digital signature of the TLS server 405. [

로 나타낼 수 있다. 여기서,

는 키 X를 사용하여 Y를 암호화하는 것을 의미한다.

는 웨어러블 디바이스(401)의 공개키를 의미하고,

는 제2 세션키를 의미하며,

는 응용 서버(407)의 식별자를 의미할 수 있다.

는 타임스탬프를 의미하고,

는 제2 세션키의 유효 기간을 의미할 수 있다.The message transmitted from the authentication proxy terminal 403 to the wearable device 401 is, for example,

. here,

Means encrypting Y using the key X. [

Quot; means the public key of the wearable device 401,

Quot; means the second session key,

May refer to the identifier of the application server 407.

Quot; means a time stamp,

May mean the validity period of the second session key.

)를 자신의 개인키 즉, 웨어러블 디바이스의 개인키(

)로 복호화하여, 제2 세션키(

)를 획득할 수 있다.At this time, when the wearable device 401 receives the encrypted second session key from the authentication proxy terminal 403, the encrypted second session key (

) As its own private key, that is, the private key of the wearable device (

), And decrypts the second session key (

Can be obtained.

) 및 공개키(

)를 사용하여 인증 프록시 단말(403)이, 인증되었음을 확인할 수 있다. 즉, 웨어러블 디바이스(401)는 상기 제2 세션키(

)를 신뢰할 수 있다.The wearable device 401 also receives the digital signature of the TLS server 405

) And public key (

), It can be confirmed that the authentication proxy terminal 403 has been authenticated. That is, the wearable device 401 transmits the second session key (

).

)를 암호화하여, 응용 서버(407)에 전송할 수 있다. 한편, TLS 서버(405)는 신뢰할 수 있는 응용 서버(407)의 공개키(

)를 알고 있다.In step 417, the TLS server 405 sends a second session key

And transmits the encrypted data to the application server 407. On the other hand, the TLS server 405 sends the public key of the trusted application server 407

).

로 나타낼 수 있다. 여기서,

는 응용 서버(407)의 공개키를 의미하고,

는 제2 세션키를 의미하며,

는 웨어러블 디바이스(401)의 식별자를 의미할 수 있다. 또한,

는 타임스탬프를 의미하고,

는 제2 세션키의 유효 기간을 의미할 수 있다.The message transmitted from the TLS server 405 to the application server 407 is, for example,

. here,

Quot; means the public key of the application server 407,

Quot; means the second session key,

May refer to an identifier of the wearable device 401. Also,

Quot; means a time stamp,

May mean the validity period of the second session key.

)를 자신의 개인키 즉, 응용 서버의 개인키(

)로 복호화하여, 제2 세션키(

)를 획득할 수 있다.At this time, when the application server 407 receives the encrypted second session key from the TLS server 405, the application server 407 transmits the encrypted second session key

) As its own private key, that is, the private key of the application server

), And decrypts the second session key (

Can be obtained.

)로 데이터를 암호화하여, 전송하기 때문에 데이터가 외부에 노출되는 것을 방지할 수 있다. 또한, 웨어러블 디바이스(401)와 응용 서버(407) 간의 보안 세션은 대칭키 암호 알고리즘을 사용하기 때문에, 웨어러블 디바이스(401)가 지수 연산을 수행할 필요가 없다.In step 418, the wearable device 401 and the application server 407 send a second session key

) And transmits the data, it is possible to prevent the data from being exposed to the outside. In addition, since the secure session between the wearable device 401 and the application server 407 uses the symmetric key encryption algorithm, the wearable device 401 does not need to perform exponentiation.

5 is a diagram illustrating an example of mutual authentication between a wearable device and a TLS server using a session key in a wearable device communication support device according to an embodiment of the present invention.

5, upon receiving an authentication request from a first wearable device (not shown), the authentication proxy terminal 501 performs mutual authentication with the TLS server 503, and when the mutual authentication is successfully performed , The session key can be generated.

Thereafter, when an authentication request is received from the second wearable device (not shown), the authentication proxy terminal 501 performs mutual authentication with the TLS server 503 using the session key if the session key is valid .

) 및 제1 임의값(

)를 세션키(

)를 이용하여 암호화하고, 암호화된 정보를 TLS 서버(503)에 전송할 수 있다. 이때, TLS 서버(503)는 공유하는 세션키(

)를 이용하여, 상기 정보를 복호화함으로써, 인증 프록시 단말(501)의 식별자(

) 및 제1 임의값(

)를 획득할 수 있다.Specifically, in step 511, the authentication proxy terminal 501 transmits an identifier ("

) And a first random value (

) To the session key (

), And transmit the encrypted information to the TLS server 503. [ At this time, the TLS server 503 transmits the shared session key (

), Thereby decrypting the identifier of the authentication proxy terminal 501 (

) And a first random value (

Can be obtained.

), 제1 임의값(

) 및 제2 임의값(

)를 세션키(

)를 이용하여 암호화하고, 암호화된 정보를 인증 프록시 단말(501)에 전송할 수 있다. 이때, 인증 프록시 단말(501)는 세션키(

)를 이용하여, 상기 정보를 복호화함으로써, TLS 서버(503)의 식별자(

), 제1 임의값(

) 및 제2 임의값(

)를 세션키(

)를 획득할 수 있다. 여기서, 인증 프록시 단말(501)는 TLS 서버(503)로 전송한 제1 임의값(

)과 상기 획득한 제1 임의값(

)이 일치함에 따라, TLS 서버(503)를 신뢰할 수 있다.In step 512, the TLS server 503 receives an identifier (< RTI ID = 0.0 >

), A first arbitrary value (

) And a second random value (

) To the session key (

), And can transmit the encrypted information to the authentication proxy terminal 501. [ At this time, the authentication proxy terminal 501 transmits the session key

), Thereby decrypting the information by using the identifier of the TLS server 503 (

), A first arbitrary value (

) And a second random value (

) To the session key (

Can be obtained. Here, the authentication proxy terminal 501 transmits a first random value ("

) And the acquired first random value (

), The TLS server 503 can be trusted.

) 및 제2 임의값(

)를 세션키(

)를 이용하여 암호화하고, 암호화된 정보를 TLS 서버(503)에 전송할 수 있다. 이때, TLS 서버(503)는 공유하는 세션키(

)를 이용하여, 상기 정보를 복호화함으로써, 인증 프록시 단말(501)의 식별자(

) 및 2 임의값(

)를 획득할 수 있다. 여기서, TLS 서버(503)는 인증 프록시 단말(501)로 전송한 2 임의값(

)과 상기 획득한 2 임의값(

)이 일치함에 따라, 인증 프록시 단말(501)을 신뢰할 수 있다.In step 513, the authentication proxy terminal 501 identifies the authentication proxy terminal 501 (step < RTI ID = 0.0 >

) And a second random value (

) To the session key (

), And transmit the encrypted information to the TLS server 503. [ At this time, the TLS server 503 transmits the shared session key (

), Thereby decrypting the identifier of the authentication proxy terminal 501 (

) And 2 any value (

Can be obtained. Here, the TLS server 503 transmits 2 random values ("

) And the obtained 2 random values (

, The authentication proxy terminal 501 can be trusted.

6 is a flowchart illustrating a wearable device communication support method according to an embodiment of the present invention. Here, the wearable-device communication support device that implements the wearable-device communication support method may include an authentication proxy terminal and a TLS server.

Referring to FIG. 6, in step 601, the authentication proxy terminal may perform a first mutual authentication between the authentication proxy terminal and the TLS server in conjunction with an authentication request from the wearable device.

In this case, if the TLS server certificate received from the TLS server is a certificate issued from a predetermined certification authority (trusted certification authority) or the certificate of the received TLS server is a certificate of a pre-stored TLS server Transmits the certificate of the authentication proxy terminal to the TLS server when the certificate matches the certificate (e.g., the certificate of the TLS server issued by the trusted certificate authority), and the certificate of the authentication proxy terminal is transmitted to the predetermined certificate authority The certificate of the authentication proxy terminal is confirmed by the TLS server 207 as a certificate issued by the TLS server or a certificate of the authentication proxy terminal previously stored in the TLS server (for example, a certificate issued by a trusted certification authority The certificate of the proxy terminal), and when it is confirmed by the TLS server that the first mutual authentication is successful have.

The authentication proxy terminal performs mutual authentication between the authentication proxy terminal and the TLS server using the first session key generated in association with the first mutual authentication when an authentication request from another wearable device is received, Mutual authentication based on the handshake protocol can be omitted.

In step 603, if the first mutual authentication is successful, the TLS server may determine that the authentication proxy terminal is a trusted device and perform a second mutual authentication between the wearable device and the TLS server.

At this time, the TLS server confirms the certificate of the TLS server transmitted to the authentication proxy terminal by the authentication proxy terminal with the certificate issued by the predetermined certification authority (trusted certification authority), or the certificate of the transmitted TLS server (E.g., TLS server certificate issued by a trusted certification authority) stored in the authentication proxy terminal, and if it is confirmed by the authentication proxy terminal, And if the received certificate of the wearable device is a certificate issued by a predetermined certification authority (trusted certification authority), or if the certificate of the received wearable device is a certificate of a previously stored wearable device Authentication of a wearable device issued by a trusted certification authority , The second mutual authentication can be confirmed as a success.

In step 605, if the second mutual authentication is successful, the authentication proxy terminal provides the second session key generated according to the success of the second mutual authentication to the wearable device, and, through the TLS server, Can be provided to the server.

At this time, the authentication proxy terminal obtains the public key of the wearable device from the previously stored certificate of the wearable device, encrypts the second session key using the obtained public key of the wearable device, and provides the encryption key to the wearable device .

Meanwhile, the TLS server can encrypt the second session key using the public key of the pre-stored application server, and provide the encrypted second session key to the application server.

In step 607, the authentication proxy terminal can support data communication between the wearable device and the application server based on the second session key.

At this time, when the encrypted second session key is decrypted by the wearable device and data encrypted using the second session key is transmitted from the wearable device, the authentication proxy terminal receives the encrypted data, It can be delivered to the server.

In addition, when the TLS server decrypts the encrypted second session key by the application server and data encrypted using the second session key is transmitted from the application server, the TLS server transmits the encrypted data And transmit the received data to the wearable device.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable array (FPA) A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be permanently or temporarily embodied in a transmitted signal wave. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored in one or more computer readable storage media.

The method according to an embodiment may be implemented in the form of a program instruction that may be executed through various computer means and stored in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions stored on the medium may be those specially designed and constructed for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable storage media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magneto-optical media such as floppy disks; Includes hardware devices specifically configured to store and execute program instructions such as magneto-optical media and ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

100: Network including a wearable device communication support device
101: Wearable device 103: Wearable device communication support device
105: Authentication proxy terminal 107: TLS server
109: application server

Claims (12)

In association with an authentication request from a wearable device,
Performing, at the authentication proxy terminal, first mutual authentication between Transport Layer Security (TLS) servers;
Performing a second mutual authentication between the wearable devices at the TLS server if the first mutual authentication is successful; And
If the second mutual authentication is successful, at the authentication proxy terminal, the second session key generated in association with the second mutual authentication is provided to the wearable device, and at the same time, to the application server via the TLS server And providing data communication between the wearable device and the application server based on the second session key
Gt; a < / RTI > wearable device communication support method. The method according to claim 1,
Wherein performing the first mutual authentication comprises:
Transmitting a certificate of an authentication proxy terminal to the TLS server when the certificate of the TLS server received from the TLS server is a certificate issued by a predetermined certificate authority; And
When the certificate of the authentication proxy terminal is confirmed by the TLS server with a certificate issued by a predetermined certificate authority,
Confirming that the first mutual authentication is successful
Gt; a < / RTI > wearable device communication support method. The method according to claim 1,
Wherein performing the second mutual authentication comprises:
When the certificate of the TLS server transmitted to the authentication proxy terminal is confirmed by the authentication proxy terminal with a certificate issued by a predetermined certificate authority,
Receiving a certificate of the wearable device from the authentication proxy terminal; And
If the received certificate of the wearable device is a certificate issued by a predetermined certificate authority, confirming the second mutual authentication as success
Gt; a < / RTI > wearable device communication support method. The method according to claim 1,
Encrypting the second session key using the public key of the wearable device obtained from the previously stored certificate of the wearable device and providing the encrypted second session key to the wearable device at the authentication proxy terminal; And
When the encrypted second session key is decrypted by the wearable device and data encrypted using the second session key is transmitted from the wearable device,
Receiving, at the authentication proxy terminal, the encrypted data and transmitting the encrypted data to the application server
Further comprising the step of: The method according to claim 1,
Encrypting the second session key using the public key of the pre-stored application server in the TLS server;
Providing the encrypted second session key to the application server; And
When the encrypted second session key is decrypted by the application server and data encrypted using the second session key is transmitted from the application server,
Receiving, at the TLS server, the encrypted data and delivering the encrypted data to the wearable device
Further comprising the step of: The method according to claim 1,
When an authentication request from another wearable device is received,
The authentication proxy terminal re-executing the mutual authentication between the TLS servers using the first session key generated in association with the first mutual authentication
Further comprising the step of: An authentication proxy terminal for performing a first mutual authentication between the TLS servers, in association with an authentication request from the wearable device; And
If the first mutual authentication is successful, the TLS server performing the second mutual authentication between the wearable devices
Lt; / RTI >
The authentication proxy terminal,
If the second mutual authentication is successful, providing the second session key generated in association with the second mutual authentication to the wearable device, and providing the second session key to the application server through the TLS server, A terminal processor that supports data communication between the wearable device and the application server,
And the wearable device communication support device. 8. The method of claim 7,
The authentication proxy terminal,
When the certificate of the TLS server received from the TLS server is a certificate issued by a predetermined certificate authority, transmits a certificate of the authentication proxy terminal to the TLS server, and the certificate of the authentication proxy terminal is issued The terminal authentication unit verifying that the first mutual authentication is successful when it is confirmed by the TLS server with one certificate,
The wearable device communication support apparatus further comprising: 8. The method of claim 7,
The TLS server,
A server processor for receiving a certificate of a wearable device from the authentication proxy terminal when the certificate of the TLS server transmitted to the authentication proxy terminal is a certificate issued by a predetermined certificate authority and confirmed by the authentication proxy terminal; And
And a server authentication unit for verifying that the second mutual authentication is successful when the received certificate of the wearable device is a certificate issued by a predetermined authentication authority,
And the wearable device communication support device. 8. The method of claim 7,
The terminal processor,
Encrypts the second session key using the public key of the wearable device acquired from the certificate of the previously stored wearable device, and provides the encrypted second session key to the wearable device,
When the encrypted second session key is decrypted by the wearable device and data encrypted using the second session key is transmitted from the wearable device, the encrypted data is received and transmitted to the application server
A wearable device communication supporting device. 8. The method of claim 7,
The TLS server,
A server authentication unit for encrypting the second session key using a public key of a previously stored application server; And
When the encrypted second session key is decrypted by the application server and data encrypted using the second session key is transmitted from the application server, A server processor for receiving the encrypted data and delivering the encrypted data to the wearable device
And the wearable device communication support device. 8. The method of claim 7,
The authentication proxy terminal,
When an authentication request from another wearable device is received,
A terminal authentication unit for re-performing mutual authentication between the TLS servers using the first session key generated in association with the first mutual authentication,
The wearable device communication support apparatus further comprising:

Images