KR20230075905A - Geuine Product Certification System and Geuine Product Certification Using the Same - Google Patents

Abstract

an activation means attached to or included in the product and storing activation data to confirm whether the product is genuine; an activation terminal exchanging data with the activation means through communication; and a genuine product authentication network that is connected to the genuine product authentication terminal and stores genuine product validation data for confirming that the product is genuine through the product product authentication data; A product activation system characterized by receiving data and receiving the activation data from the activation means and determining whether or not the product is genuine through the activation data and the activation data, and a activation method using the same By providing, it is possible to enhance the reliability of authenticity by strengthening security.

Description

Product activation system and activation method using the same {Geuine Product Certification System and Geuine Product Certification Using the Same}

The present invention relates to a genuine product authentication system and a product authentication method using the same, and more particularly, to a product product authentication system with enhanced security by using a product authentication means included or attached to enable wired or wireless communication, and a product product authentication system using the same. It is about authenticity authentication method.

In general, consumers want to check whether a product is genuine when purchasing a product. It is true that the demand is very high.

In addition, manufacturers are devising various methods to certify that their products are genuine in order to prevent others from copying and distributing their products, and to allow consumers to trust the company and products. To prevent counterfeiting of products, manufacturers mark and provide special identification means such as trademarks, holograms, and phone verification codes on the trademark, but since counterfeit products that imitate not only the appearance of the product but also the identification means can be distributed, It is difficult for ordinary consumers to distinguish between counterfeit products and genuine products through the appearance of the product itself without the help of experts.

Therefore, in the method of verifying authenticity by mark, logo, etc., no matter how elaborate and special logo or mark, it is possible to imitate or steal, and even if it is a genuine product, there may be products with similar trademarks and logos, so the product that the consumer originally wanted to purchase There may be cases where similar products are confused and purchased.

In addition, the conventional genuineness confirmation method is to check the product's unique code number and simply check whether it is the correct code or not to confirm that it is genuine. occurred.

Republic of Korea Patent Registration No. 10-1467240 (2014.11.25)

The present invention is to solve the above problems, and an object of the present invention is to provide an activation system with enhanced security by using an NFC tag or a security zone (TrustZone) as an activation means and an activation method using the same.

The activation system according to the present invention includes: activation means attached to or included in a product and storing activation data to confirm whether the product is genuine; an activation terminal exchanging data with the activation means through communication; and a genuine product authentication network that is connected to the genuine product authentication terminal and stores genuine product validation data for confirming that the product is genuine through the product product authentication data; It is possible to receive data, receive the genuine product certification data from the genuine product authentication means, and determine whether or not the product is genuine through the genuine product confirmation data and the product certification data.

In the activation system according to the present invention, the activation network is a activation server connected through a network communication network, the activation data is an electronic certificate encrypted with a first private key, and the activation data is the first private key and Including the hash value of the electronic certificate and the first public key constituting a key pair, the genuine product authentication terminal receives the electronic certificate from the product authenticating means, and uses the first public key and the hash value of the electronic certificate to transmit the electronic certificate. By verifying the electronic certificate, it is possible to determine whether the product is genuine.

In the genuine product authentication system according to the present invention, the genuine product authentication network is a genuine product authentication server connected through a network communication network, and the product product authentication data is encrypted by first through Nth electronic certificates and first through N-1th private keys. a connected certificate chain, the genuineness confirmation data includes a hash value of the first electronic certificate and a first public key forming a key pair with the first private key, and the genuineness authentication terminal transmits the certificate chain to the genuineness authentication means It is possible to determine whether the product is genuine by receiving the transmission from and verifying the certificate chain through the hash value of the first public key and the first electronic certificate.

In the activation system according to the present invention, the first electronic certificate is generated by encrypting data including a first public key with the first private key, and the second electronic certificate to the Nth electronic certificate are respectively second to Nth electronic certificates. Data including the Nth public key is encrypted by first private keys to N−1th private keys, respectively, and the first to Nth public keys form a key pair with the first to Nth private keys, respectively. can

In the genuine product authentication system according to the present invention, the genuine product authentication means stores the Nth private key, generates a random number and transmits it to the genuine product authentication terminal, and the genuine product authentication terminal stores the random number and sends the genuine product Requests a signature from an authentication means, and upon receipt of the signature request, the genuine product authentication means encrypts the random number with an Nth private key to generate a random number electronic signature and transmits the random number electronic signature to the genuine product authentication terminal. The terminal can verify the random number electronic signature by decoding the random number electronic signature with the Nth public key.

In the genuine product authentication system according to the present invention, the genuine product authentication server may receive confirmation information on whether or not the product is genuine from the product product authentication terminal, and manage information related to product product authentication.

In the genuine product certification system according to the present invention, the genuine product certification network is a blockchain network, the genuine product verification data and the genuine product certification data are the differentiated characteristics of the product, and the genuine product authentication means forms a key pair with each other. Stores a private key, a first public key, and an owner address, which is an address for a block in which the genuine verification data is stored in the blockchain network, and the genuine product verification terminal receives the owner address from the genuine product verification means and The genuine product verification data included in the block corresponding to the owner's address is retrieved from the chain network and transmitted to the genuine product verification means, and the genuine product verification means compares the genuine product verification data with the genuine product verification data to determine whether the genuine product verification data matches the genuine product. After transmitting to the authentication terminal, a random number is generated and transmitted to the activation terminal, the activation terminal stores the random number, requests a signature from the activation means, and the activation means requested to sign the signature The random number is encrypted with the first private key to generate a random number digital signature and transmitted to the activation terminal, and the activation terminal receiving the random number digital signature decrypts the random number digital signature with the first public key and transmits the random number digital signature. Electronic signatures can be verified.

The genuine product authentication system according to the present invention further includes a registration server that stores product characteristic data, which is data related to the product, and the registration server transmits the product characteristic data, the first public key, and the owner's address to the block chain. network, and the blockchain network treats the product characteristic data as the product identification data, generates a block including the product identification data, the owner address, and the first public key, and the registration server The product characteristic data, the first private key, the first public key, and the owner's address may be transmitted to the genuine product authentication means.

In the activation system according to the present invention, the registration server transmits the manager identification number to the activation means so that the activation means stores the manager identification number. An identification number (PIN, Personal Identification Number) is transmitted to the activation means, and the activation means compares the activation data with the activation data only when the personal identification number matches the manager identification number, and matches the activation data. Whether or not the activation may be transmitted to the genuine authentication terminal.

In the activation system according to the present invention, the registration server extracts the differentiated features of the product and stores the digitized product differentiation data on a network using a distributed file system (IPFS, Inter Planetary File System), The product feature data may be a meta URL address where product differentiation data is stored.

In the genuine product authentication system according to the present invention, the registration server may encrypt and store the genuine product feature data, the first private key, and the first public key.

The genuine product authentication system according to the present invention further includes a registration server that stores product feature data, which is data related to the product, and the product product authentication means generates the first private key and the first public key to register the product. server, and the registration server transmits the product characteristic data, the first public key, and the owner address to the blockchain network, and the blockchain network treats the product characteristic data as the product identification data, A block including product identification data, the owner's address, and the first public key is generated, and the registration server may transmit the product characteristic data and the owner's address to the genuine product authentication means.

In the activation system according to the present invention, the registration server transmits the manager identification number to the activation means so that the activation means stores the manager identification number. An identification number (PIN, Personal Identification Number) is transmitted to the activation means, and the activation means compares the activation data with the activation data only when the personal identification number matches the manager identification number, and matches the activation data. Whether or not the activation may be transmitted to the genuine authentication terminal.

In the activation system according to the present invention, the registration server extracts the differentiated features of the product and stores the digitized product differentiation data on a network using a distributed file system (IPFS, Inter Planetary File System), The product feature data may be a meta URL address where product differentiation data is stored.

In the activation system according to the present invention, the registration server may encrypt and store the product characteristic data, the first private key, and the first public key.

In the activation system according to the present invention, the activation means is an NFC tag, and the activation terminal may be an NFC terminal connected to the NFC tag through non-contact communication.

In the activation system according to the present invention, the product is an electronic product including a central processing unit (CPU), and the activation means may be a trust zone set inside the central processing unit.

The activation method according to the present invention is attached to or included in a product and stores a first private key and a first public key forming a key pair with the first private key, and the activation method and data are stored through communication. An activation method using an activation system including an exchange activation terminal and an activation server connected to the activation terminal, comprising: generating activation data and storing activation data in the activation means; a genuine product authentication data request step of requesting the product product authentication data from the product product authentication means by the product product authentication terminal; an activation data transmission step in which the activation means transmits the activation data to the activation terminal; and a genuine authentication data verification step in which the genuine product authentication terminal verifies the genuine product authentication data through the genuine product authentication data transmitted through the genuine product authentication server.

In the activation method according to the present invention, the activation data is an electronic certificate encrypted with a first private key, and the activation data is a hash value of a first public key forming a key pair with the first private key and the electronic certificate. wherein the issuing of the activation data is a step of issuing and storing the electronic certificate in the activation means, and storing the activation confirmation data in the activation server, and the step of verifying the activation data is a step of issuing the electronic certificate and storing the activation data in the activation device. may be a step of decrypting the electronic certificate with the first public key and verifying the electronic certificate by comparing hash values of the electronic certificate.

In the activation method according to the present invention, the activation data is a certificate chain in which 1st to Nth electronic certificates are encrypted and connected by 1st to N-1th private keys, and the 1st electronic certificate is a 1st public key. It is generated by encrypting data including the first private key, and the second electronic certificate to N-th electronic certificates respectively encrypt data including second to N-th public keys with first private keys to N-1th electronic certificates, respectively. It is encrypted with a private key, and the first to Nth public keys form a key pair with the first to Nth private keys, respectively, and the first to Nth electronic certificates are issued in the activation data issuance step. and the activation data includes a hash value of the first electronic certificate and a first public key forming a key pair with the first private key, It may be a step of verifying the certificate chain through a hash value of the first public key and the first electronic certificate after being received from the activation means.

The genuine product authentication method according to the present invention further includes a private key verifying step of verifying whether the Nth private key is valid, and in the private key verifying step, the genuine product authenticating means generates a random number to activate the genuine product authentication terminal. Random number transmission step to transmit to; a random number electronic signature request step of storing the random number in the genuine product authentication terminal and requesting a random number electronic signature from the genuine product authentication means; a random number electronic signature generation step of generating a random number electronic signature by encrypting the random number with the Nth private key stored in the genuine product authentication unit and transmitting the random number electronic signature to the genuine product authentication terminal; and a random number digital signature verifying step of verifying the random number electronic signature by decoding the random number electronic signature with the Nth public key by the genuine product authentication terminal.

The activation method according to the present invention is attached to or included in a product and stores a first private key and a first public key forming a key pair with the first private key, and the activation method and data are stored through communication. A genuine product authentication method using a genuine product authentication system including a genuine product authentication terminal that is exchanged, a block chain network connected to the product product authentication device, and a registration server, wherein the product feature data, which is data related to the product, is transmitted by the registration server to the product product authentication method. an activation data storage step of transmitting the data to a means, wherein the activation means stores the product characteristic data as activation data; a key generation step of generating the first private key and the first public key and storing them in the registration server and the activation means; The registration server transmits the first public key and the product characteristic data to the blockchain network, and the blockchain network treats the product characteristic data as the genuine product verification data, and the genuine product verification data and the first public key , and a block forming step of forming a block including an owner address, which is an address for the block, and storing the owner address in the registration server and the genuine authentication means; an owner address request step in which the genuine product authentication terminal requests the owner address from the genuine product authentication means; a genuine authentication data transmission step in which the genuine product authentication terminal retrieves the genuine product validation data included in the block corresponding to the owner's address from the blockchain network and transmits the product to the product authenticator; a genuine authentication data verification step in which the genuine product authentication unit compares the genuine product confirmation data with the genuine product authentication data and transmits a match or not to the genuine product authentication terminal; a random number transmission step in which the genuine product authentication unit generates a random number and transmits the random number to the product authentication terminal; a random number electronic signature request step of storing the random number in the genuine product authentication terminal and requesting a random number electronic signature from the genuine product authentication means; a random number electronic signature generation step of generating a random number electronic signature by encrypting the random number with a first private key stored in the genuine product authentication unit and transmitting the random number digital signature to the genuine product authentication terminal; and a random number digital signature verification step of verifying the random number electronic signature by decoding the random number electronic signature with the first public key, by the genuine product authentication terminal.

In the activation method according to the present invention, before the activation data storage step, the registration server extracts the differentiated features of the product and digitizes the product differentiation data using a distributed file system (IPFS, Inter Planetary File System). and storing the product differentiation data on a network, and the product characteristic data may be a meta URL address in which product differentiation data is stored.

In the genuine product authentication method according to the present invention, the first private key and the first public key may be generated by the registration server.

In the activation method according to the present invention, the first private key and the first public key may be generated by the activation means.

In the activation method according to the present invention, the activation data storage step. The registration server transmits the manager identification number to the activation means so that the activation means stores the manager identification number, and the transmission of the genuineness confirmation data includes the personal identification number PIN, Personal Identification Number) to the activation means, and the activation means can perform the activation data verification step only when the personal identification number matches the manager identification number.

In the genuine product authentication method according to the present invention, the genuine product authentication means may be an NFC tag, and the genuine product authentication terminal may be an NFC terminal connected to the NFC tag through non-contact communication.

In the activation method according to the present invention, the product is an electronic product including a central processing unit (CPU), and the activation means may be a trust zone set inside the central processing unit.

According to the genuine product authentication system and the genuine product authentication method using the same according to an embodiment of the present invention, security is strengthened and reliability of whether a product is genuine can be increased.

1 is a reference diagram of a genuine product authentication system according to an embodiment of the present invention.
Figure 2 is a reference diagram showing a certificate chain.
3 is a reference diagram of a genuine product authentication system according to another embodiment of the present invention.
4 is a flow chart of a genuine product authentication method according to an embodiment of the present invention.
5 is a flow chart of a private key verification step;
6 is a flowchart of a genuine authentication method according to another embodiment of the present invention.

Hereinafter, specific embodiments of the present invention will be described in detail with reference to the drawings. However, the spirit of the present invention is not limited to the presented embodiments, and those skilled in the art who understand the spirit of the present invention can add, change, delete, etc. other elements within the scope of the same spirit, through other degenerative inventions or the present invention. Other embodiments included within the scope of the inventive concept can be easily suggested, but it will be said that this is also included in the scope of the inventive concept.

In addition, components having the same function within the scope of the same idea appearing in the drawings of the embodiment are described using the same reference numerals.

1 is a conceptual diagram of a genuine product authentication system 100 according to an embodiment of the present invention.

Referring to FIG. 1, the activation system 100 according to an embodiment of the present invention can exchange data with the activation means 110 attached to or included in the product P through communication. It may include a genuine product authentication terminal 120, and a product authentication network 130 connected to the product authentication device 120.

At this time, the activation means 110 may store activation data, and the activation terminal 120 may receive the activation data from the activation means 110 .

In addition, the genuine certification network 130 may store genuine product confirmation data, and the genuine product authentication terminal 120 may receive the genuine product confirmation data from the genuine product certification network 130 .

In this way, the genuine product authentication terminal 120 compares the genuine product authentication data transmitted from the genuine product authentication network 130 with the genuine product authentication data received from the genuine product authentication means 110, so that the product P is You can judge whether it is genuine or not.

Here, the activation means 110 may be an NFC tag capable of near field communication (NFC), and the activation terminal 120 is the activation means 110 and a short-range wireless It may be an NFC terminal capable of exchanging data through communication (Near Field Communication (NFC)).

In addition, the genuine product authentication means 110 may be a secure module provided as a chip, and at this time, the genuine product authentication device 120 uses serial communication to 110) and a terminal capable of exchanging data.

Meanwhile, the genuine product authentication network 130 may be a genuine product authentication server 130 connected through a network communication network.

Here, the activation unit 110 may store a first private key and a first public key forming a key pair with the first private key.

In this case, the activation data may be an electronic certificate encrypted with a first private key, and the activation validation data may include the first public key and a hash value of the electronic certificate.

Through this, the genuine product authentication terminal 120 receives the electronic certificate from the genuine product authentication means 110, decrypts the electronic certificate with the first public key included in the genuine product confirmation data, compares hash values, By verifying the electronic certificate, it is possible to determine whether the product is genuine.

On the other hand, in the activation data, the first to Nth electronic certificates (C1, ..., CN) are encrypted and connected by the first to N-1th private keys (A1, ..., AN-1) It can also be a certificate chain.

2 is a reference diagram illustrating the concept of the certificate chain.

Referring to FIG. 2 , the certificate chain may be one in which first through Nth electronic certificates (C1, ..., CN) are connected.

At this time, the first electronic certificate (C1) includes the first public key (B1) forming a key pair with the first private key (A1), but may be digitally signed by the first private key (A1).

The second electronic certificate (C2) includes a second public key (B2) forming a key pair with the second private key (A2), but may be digitally signed by the first private key (A1).

In addition, the third electronic certificate (C3) uses the third public key (B3) forming a key pair with the third private key (A3).

Including, but may be signed by the second private key (A2).

In this way, the Nth electronic certificate (CN) includes the Nth private key (AN) and the Nth public key (B3) forming a key pair, but may be signed by the N-1th private key (AN-1). .

In other words, the second to Nth electronic certificates other than the first electronic certificate (C1) are the second to Nth public keys (B2) forming a key pair with the second to Nth private keys (A2, ... AN), respectively. , ... BN), but may be signed by the first to N-1th private keys A1, ..., AN-1, respectively.

At this time, the authenticity confirmation data may include a hash value of the first electronic certificate C1 and the first public key B1.

Accordingly, the activation terminal 120 receives the certificate chain from the activation means 110 and uses the hash value of the first public key B1 and the first electronic certificate C1 to obtain the certificate. By verifying the chain, it is possible to determine whether the product P is genuine.

In more detail, the genuine product authentication terminal 120 can decrypt the first electronic certificate C1 with the first public key B1, and after decryption, a hash value is generated and included in the genuine product confirmation data. The validity of the first electronic certificate C1 may be verified by comparing with the hash value of the first electronic certificate C1.

Thereafter, the validity of the second electronic certificate C2 may be verified by decrypting the second electronic certificate C2 using the first public key B1.

At this time, the second public key (B2) can be extracted by decrypting the second electronic certificate (C2), and then the third electronic certificate (C3) is decrypted with the second public key (B2) to obtain the third certificate. (C3) can be validated.

That is, the N-1th public key (BN-1) can be extracted by decrypting the N-1th electronic certificate (CN-1), and the N-th electronic certificate (CN-1) can be extracted using the extracted N-1th public key. ), the validity of the fraudulent Nth electronic certificate (CN) can be continuously verified.

Through this process, the validity of the certificate chain can be verified.

Meanwhile, the genuine product authentication means 110 may store the Nth private key.

Here, the genuine product authentication terminal 120 may request the genuine product authentication unit 110 to generate a random number, and the genuine product authentication unit 110 that has received the random number generation request generates and stores a random number, and then returns the random number to the It can be transmitted to the activation terminal 120.

After receiving the random number, the genuine product authentication terminal 120 stores the random number and can request a signature from the product authentication means 110 .

Upon receiving the signature request, the genuine product authentication means 110 encrypts the random number with the N-th private key and transmits a random digital signature generated to the product authentication terminal 120, and the product authentication device 120 transmits the N-th digital signature. The random number electronic signature can be verified by decrypting the random number electronic signature with the Nth public key (BN) extracted by decrypting the digital certificate (CN).

In this way, the genuine product authentication terminal 120 can determine that the product P is genuine when the validity of both the certificate chain and the random number electronic signature is verified.

As described above, when using the certificate chain, various producers involved in the production of the product (P) configure the certificate chain through each private key and public key constituting a key pair, so that the production of the product (P) There is an advantage in that various producers involved can manufacture the genuine product authentication means 110, and that the producer who produces the product P and the manufacturer who manufactures the genuine product authentication means 110 can be different.

Meanwhile, the genuine product authentication server 130 receives confirmation information on whether or not the product P is genuine from the product authentication terminal 120, and manages the information related to the genuine product product P. there is.

Through this, the genuine authentication server 130 can track and manage the genuine product authentication means 110 through such information, and thus manage a list through a serial number.

3 is a conceptual diagram of a genuine product authentication system 200 according to another embodiment of the present invention.

Referring to FIG. 3, the activation system 200 according to another embodiment of the present invention transmits the activation means 210 and data through communication with the activation means 210 attached to or included in the product P. Includes an exchangeable genuine product authentication terminal 220, a genuine product authentication network 230 connected to the genuine product authentication terminal 220, and a registration server 240 that stores product feature data, which is data related to the product P. can do.

At this time, the genuine product authentication means 210 may store product authentication data, and the product product authentication network 230 may store product product validation data.

Here, it is possible to determine whether the product P is genuine by comparing the activation data stored in the activation network 230 with the activation data stored in the activation means 210 .

On the other hand, the genuine product authentication means 210 may be an NFC tag capable of NFC (Near Field Communication), and the genuine product authentication terminal 220 is connected to the genuine product authentication means 210 and short-range wireless communication. It may be an NFC terminal capable of exchanging data through (NFC, Near Field Communication).

In addition, the genuine product authentication means 210 may be a secure module provided as a chip, and at this time, the genuine product authentication device 220 uses serial communication to 110) and a terminal capable of exchanging data.

In addition, the product P is an electronic product including a central processing unit (CPU), and the activation means 210 may be a trust zone set inside the central processing unit.

At this time, the activation network 230 may be a blockchain network 230.

In this way, the genuine product authentication means 210 is provided as an NFC tag, a secure module, or a secure zone, and retrieves a block containing the genuine product confirmation data from the blockchain network 230. It can play the role of an electronic wallet that stores and creates the first private key, which is essential for safely finding and verifying.

Meanwhile, the registration server 240 may store product feature data related to the product (P). The product feature data is product differentiation data obtained by extracting and digitizing differentiated features of the product, or the product differentiation data is It may be a meta URL address representing an address stored on a network using a distributed file system (IPFS, Inter Planetary File System).

In other words, if the size of the product differentiation data is smaller than a certain level, it is directly stored in the registration server 240, and if the size of the product differentiation data is larger than a certain level, the distributed file system (IPFS, Inter Planetary File System) and stored on the network, and only the meta URL address indicating the address where the product differentiation data is stored can be stored in the registration server 240.

That is, the product characteristic data may be the product differentiation data or a meta URL address in which the product differentiation data is stored.

In addition, the registration server 240 may transmit the product characteristic data, the first public key, and the owner's address to the blockchain network 230, and the blockchain network 230 transmits the product characteristic data to the authentic product. Treated as verification data, a block including the authenticity verification data, the first public key, and the owner address may be created and stored.

In this case, the owner address may be an address of the owner of the block including the authenticity confirmation data.

Meanwhile, the activation unit 210 may store the first public key, a first private key forming a key pair with the first public key, and the owner's address.

At this time, the first public key and the first private key may be generated and transmitted from the registration server 240 or may be directly generated by the activation means 210 .

In other words, the first public key and the first private key are generated by the registration server 240 and transmitted to the activation means 210, or generated by the activation means 210 and transmitted to the registration server ( 240) can be transmitted.

Meanwhile, the registration server 240 may transmit the product feature data to the activation unit 210, and the activation device 210 may store the product feature data as the product authentication data.

In addition, the registration server 240 may transmit the manager identification number to the activation means 210 so that the activation means 210 stores the manager identification number.

Here, the genuine product authentication terminal 220 may request the owner's address from the genuine product authentication means 210 in order to check whether the product P is genuine. Upon receiving the owner's address from the genuine product authentication means 210, the genuine product confirmation data registered in the corresponding block on the blockchain network 230 can be called and transmitted to the genuine product authentication means 210.

At this time, the genuine product authentication terminal 220 transmits a personal identification number (PIN, Personal Identification Number) together with the genuine product confirmation data to the genuine product authentication means 210, and the genuine product authentication device 210 transmits the personal identification number. It is possible to check whether the number matches the manager identification number.

Through this, it is possible to further strengthen security by allowing only a specific manager to check whether the product is genuine or not.

On the other hand, if the personal identification number matches the manager identification number, the genuine product authentication means 210 may compare the genuine product verification data with the genuine product authentication data and transmit whether or not dflcl to the genuine product authentication terminal 220. .

At this time, the genuine product authentication terminal 220 having received the fact that the genuine product confirmation data matches the genuine product authentication data may request a random number electronic signature from the product product authentication means 210 .

The genuine product authentication means 210, which has received a request for a random number electronic signature from the product authentication terminal 220, generates a random number and transmits it to the product authentication device 220, then encrypts the random number with the first private key and encrypts the random number electronic signature. A signature may be generated and transmitted to the activation terminal 220 .

The genuine product authentication terminal 220 receiving the random number stores the random number, receives the random number electronic signature, and decrypts the random number electronic signature with the first public key to verify the random number electronic signature.

At this time, the genuine product authentication terminal 220 may determine the product P as genuine when the genuine product authentication data and the genuine product authentication data match and the random number electronic signature is verified.

On the other hand, the registration server 240 may encrypt and store the product characteristic data, the first private key, and the first public key, through which genuine product registration and genuine product certification history can be tracked and managed.

Hereinafter, a genuine authentication method according to an embodiment of the present invention will be described in detail.

4 is a flowchart of a genuine product authentication method (S100) according to an embodiment of the present invention.

The activation method (S100) according to an embodiment of the present invention may be a activation method using the activation system 100 according to an embodiment of the present invention described above.

Referring to FIG. 4, in the activation method (S100) according to an embodiment of the present invention, the activation data issuing step (S110) of generating activation data and storing them in the activation means (110), activation terminal (120) ) requests the activation data from the activation means 110 (S120), and the activation means 110 transmits the activation data to the activation terminal 120. Authentication data transmission step (S130), and activation data verification step (S140) in which the activation terminal 120 verifies the activation data through the activation data transmitted through the activation server, and private key validation Step S150 may be included.

Here, the genuine product verification data may be an electronic certificate encrypted with a first private key. At this time, the genuine product verification data may include a first public key forming a key pair with the first private key and a hash value of the electronic certificate. The activation data issuance step (S110) may be a step of issuing the electronic certificate and storing it in the activation means, and storing the activation confirmation data in the activation server.

In addition, in the genuine product authentication data verification step (S140), the product product authentication terminal 120 decrypts the electronic certificate with the first public key and compares hash values of the electronic certificate to verify the validity of the electronic certificate. can be

On the other hand, the activation data may be a certificate chain in which the first to Nth electronic certificates are encrypted and connected by the first to N−1th private keys.

Here, the first electronic certificate is generated by encrypting data including a first public key with the first private key, and the second electronic certificate to the second electronic certificate to the Nth electronic certificate are respectively second to Nth electronic certificates. Data including the Nth public key is encrypted by first private keys to N−1th private keys, respectively, and the first to Nth public keys form a key pair with the first to Nth private keys, respectively. it could be

At this time, the subject that issues the first to Nth electronic certificates in the genuine data issuing step (S110) may be different.

Through this, various producers involved in the production of the product (P) configure the certificate chain through each private key and public key constituting a key pair, so that various producers involved in the production of the product (P) can verify the genuine product. In addition to being able to manufacture the means 110, there is an advantage in that the producer who produces the product P and the manufacturer who manufactures the activation means 110 can be different.

In addition, the genuine product verification data may include a hash value of the first electronic certificate and a first public key forming a key pair with the first private key. In this case, the genuine product verification data verification step (S140) It may be a step of receiving a certificate chain from the genuine authentication means and verifying the certificate chain through a hash value of the first public key and the first electronic certificate.

More specifically, in the activation data verification step (S140), the activation terminal 120 can decrypt the first electronic certificate (C1) with the first public key (B1), and after decryption hash The validity of the first electronic certificate (C1) can be verified by generating a value and comparing it with the hash value of the first electronic certificate (C1) included in the genuineness confirmation data.

Thereafter, the validity of the second electronic certificate C2 may be verified by decrypting the second electronic certificate C2 using the first public key B1.

At this time, the second public key (B2) can be extracted by decrypting the second electronic certificate (C2), and then the third electronic certificate (C3) is decrypted with the second public key (B2) to obtain the third certificate. (C3) can be validated.

That is, the N-1th public key (BN-1) can be extracted by decrypting the N-1th electronic certificate (CN-1), and the N-th electronic certificate (CN-1) can be extracted using the extracted N-1th public key. ), the validity of the fraudulent Nth electronic certificate (CN) can be continuously verified.

Through this process, the validity of the certificate chain can be verified.

Meanwhile, the private key verification step (S150) may be a step of verifying whether the Nth private key is valid.

5 is a flowchart illustrating the private key verification step (S150).

Referring to FIG. 5, the private key verification step (S150) includes a random number transmission step (S151) in which the genuine product authentication means 110 generates a random number and transmits it to the product authentication terminal 120, and the product product authentication device 120 ) stores the random number and requests a random number electronic signature to the activation means 110 (S152), the activation means 110 encrypts the random number with the Nth private key stored A random number digital signature generating step (S153) of generating a random number electronic signature and transmitting the random number electronic signature to the genuine product authentication terminal 120, and the genuine product authentication terminal 120 decrypting the random number digital signature with the Nth public key to obtain the random number electronic signature It may include a random number digital signature verification step (S154) of verifying.

6 is a flow chart of a genuine product authentication method (S200) according to another embodiment of the present invention.

The activation method (S200) according to another embodiment of the present invention may be a activation method using the activation system 200 according to another embodiment of the present invention described above.

Referring to FIG. 6, in the activation method (S200) according to another embodiment of the present invention, product differentiation data storage step (S205), activation data storage step (S210), key generation step (S220), block formation step (S230), owner address request step (S240), genuine product verification data transmission step (S250), genuine product authentication data verification step (S260), random number transmission step (S270), random number digital signature request step (S280), random digital signature generation It may include step S290 and random number electronic signature verification step S295.

In the product differentiation data storage step (S205), the registration server 240 extracts the differentiated features of the product and stores the digitized product differentiation data on the network using a distributed file system (IPFS, Inter Planetary File System). may be a step.

Here, if the size of the product differentiation data is smaller than a predetermined level, the product differentiation data storing step (S205) may not be performed.

In the activation data storage step (S210), the registration server 240 transmits product characteristic data, which is data related to the product, to the activation means 210, and the activation means 210 transmits the product feature data to the genuine product. It may be a step of storing as authentication data.

At this time, when the product differentiation data storage step (S205) is not performed, the product differentiation data may be the product characteristic data, and when the product differentiation data storage step (S205) is performed, the distributed file system ( A meta URL address indicating an address where the product differentiation data is stored on a network using IPFS (Inter Planetary File System) may be product characteristic data.

Meanwhile, in the activation data storage step (S210), the registration server 240 transmits the manager identification number to the activation means 210 so that the activation means 210 stores the manager identification number. can

The key generation step (S220) may be a step of generating a first private key and a first public key forming a key pair with the first private key and storing them in the registration server 240 and the activation means 210.

At this time, the first private key and the first public key may be generated by the registration server 240 or the activation unit 210 .

In the block formation step (S230), the registration server 240 transmits the first public key and the product characteristic data to the blockchain network 230, and the blockchain network 230 transmits the product characteristic data to the genuine product. It is treated as verification data to form a block including the genuineness verification data, the first public key, and an owner address, which is an address for the block, and the registration server 240 and the genuine product authentication means 210 operate on the owner address It may be a step of storing.

The owner's address request step (S240) may be a step in which the activation terminal 220 requests the owner's address from the activation means 210.

In the genuine product verification data transmission step (S250), the genuine product verification terminal 220 retrieves the genuine product verification data included in the block corresponding to the owner's address from the blockchain network 230, and the genuine product verification means 210 It may be a step of transmitting to.

At this time, in the authenticity confirmation data transmission step (S250), the genuine product authentication terminal 220 may transmit a personal identification number (PIN) together with the genuine product confirmation data to the product authenticator.

The activation data verification step (S260) may be a step in which the activation means 210 compares the activation data with the activation data and transmits a match to the activation terminal 220.

Meanwhile, the genuine product authentication means 210 may perform the product authentication data verification step (S250) only when the personal identification number and the manager identification number match.

Through this, it is possible to further strengthen security by allowing only a specific administrator to check whether the product is genuine or not.

The random number transmitting step (S270) may be a step in which the genuine product authentication unit 210 generates a random number and transmits the random number to the genuine product authentication terminal 220.

The random number electronic signature request step (S280) may be a step in which the genuine product authentication terminal 220 stores the random number and requests the genuine product authentication means 210 for a random number electronic signature.

The random number electronic signature generation step (S290) may be a step in which the genuine product authentication means 210 encrypts the random number with the stored first private key to generate a random number digital signature and transmits the random number digital signature to the product authentication terminal 220. .

The random number electronic signature verification step (S295) may be a step in which the genuine product authentication terminal 220 verifies the random number digital signature by decoding the random number electronic signature with the first public key.

The activation means 210 may be an NFC tag capable of near field communication (NFC), and the activation terminal 220 may include the activation means 210 and near field communication (NFC). , Near Field Communication) may be an NFC terminal capable of exchanging data.

In addition, the genuine product authentication means 210 may be a secure module provided as a chip, and at this time, the genuine product authentication device 220 uses serial communication to 110) and a terminal capable of exchanging data.

In addition, the product P is an electronic product including a central processing unit (CPU), and the activation means 210 may be a trust zone set inside the central processing unit.

As described above, according to the genuine product authentication system and the genuine product authentication method using the same according to an embodiment of the present invention, security can be strengthened, thereby increasing reliability of authenticity.

In the above, although the embodiments of the present invention have been described in detail, the scope of the present invention is not limited thereto, and various modifications and variations are possible within the scope without departing from the technical spirit of the present invention described in the claims. It will be obvious to those of ordinary skill in the art.

100: activation system according to an embodiment of the present invention
200: activation system according to another embodiment of the present invention
110, 210: activation means 120, 220: activation terminal
130, 230: activation network 240: registration server
S100: Authentication method according to an embodiment of the present invention
S110: Activation data issuance step S120: Activation data request step
S130: activation data transmission step S140: activation data verification step
S150: private key verification step S151: random number transmission step
S152: Random Number Digital Signature Request Step S153: Random Number Digital Signature Generation Step
S154: Random Number Electronic Signature Verification Step
S200: Authentication method according to another embodiment of the present invention
S205: product differentiation data storage step S210: activation data storage step
S220: Key generation step S230: Block formation step
S240: Owner's address request step S250: Authentication confirmation data transmission step
S260: activation data verification step S270: random number transmission step
S280: Random Number Digital Signature Request Step S290: Random Number Digital Signature Generation Step
S295: Random Number Electronic Signature Verification Step

Claims (28)

an activation means attached to or included in the product and storing activation data to confirm whether the product is genuine;
an activation terminal exchanging data with the activation means through communication; and
A genuine product authentication network connected to the genuine product authentication terminal and storing genuine product confirmation data for confirming that the product is genuine through the product product authentication data;
The activation terminal receives the activation data from the activation network, receives the activation data from the activation means, and determines whether the product is genuine through the activation data and the activation data. Activation system, characterized in that. According to claim 1,
The genuine product authentication network is a genuine product authentication server connected through a network communication network;
The activation data is an electronic certificate encrypted with a first private key,
The authenticity confirmation data includes a hash value of a first public key forming a key pair with the first private key and the electronic certificate,
The genuine product authentication terminal determines whether the product is genuine by receiving the electronic certificate from the product authenticating means and verifying the electronic certificate through the first public key and the hash value of the electronic certificate. Authentication system. According to claim 1,
The genuine product authentication network is a genuine product authentication server connected through a network communication network;
The activation data is a certificate chain in which the first to Nth electronic certificates are encrypted and connected by the first to N−1th private keys,
The authenticity confirmation data includes a hash value of the first electronic certificate and a first public key forming a key pair with the first private key,
The genuine product authentication terminal determines whether the product is genuine by receiving the certificate chain from the genuine product authentication means and verifying the certificate chain through a hash value of the first public key and the first electronic certificate. Authentication system with According to claim 3,
The first electronic certificate is generated by encrypting data including a first public key with the first private key,
The second electronic certificate to the Nth electronic certificate encrypt data including the second to Nth public keys, respectively, by the first private key to the N−1th private key, respectively;
Wherein the first to Nth public keys form a key pair with the first to Nth private keys, respectively. According to claim 4,
The genuine product authentication means stores the Nth private key, generates a random number, and transmits it to the product authentication terminal;
After storing the random number, the activation terminal requests a signature from the activation means;
The genuine product authentication means receiving the signature request encrypts the random number with an Nth private key to generate a random digital signature and transmits it to the product authentication terminal;
Wherein the genuine product authentication terminal receiving the random number digital signature decrypts the random number electronic signature with the Nth public key to verify the random number electronic signature. According to claim 3,
The genuine product authentication server receives confirmation information on whether or not the product is genuine from the product authenticating terminal and manages information related to the genuine product authentication. According to claim 1,
The activation network is a blockchain network,
The genuine product verification data and the genuine product verification data are the data of the differentiated characteristics of the product,
The genuine product authentication means stores a first private key and a first public key that form a key pair with each other, and an owner address, which is an address for a block in which the genuine product confirmation data is stored in the blockchain network,
The genuine product authentication terminal receives the owner's address from the genuine product authentication means, retrieves the genuine product confirmation data included in the block corresponding to the owner's address from the blockchain network, and transmits it to the genuine product authentication device;
The genuine product authentication means compares the genuine product verification data with the genuine product authentication data, transmits whether or not they match to the genuine product authentication terminal, generates a random number, and transmits it to the product product authentication terminal;
After storing the random number, the activation terminal requests a signature from the activation means;
The genuine product authentication means receiving the signature request encrypts the random number with the first private key to generate a random number electronic signature and transmits it to the product authentication terminal;
Wherein the genuine product authentication terminal receiving the random number digital signature decrypts the random number digital signature with the first public key to verify the random number electronic signature. According to claim 7,
Further comprising a registration server for storing product characteristic data, which is data related to the product,
The registration server transmits the product characteristic data, the first public key, and the owner address to the blockchain network;
The blockchain network treats the product characteristic data as the product identification data, and generates a block including the product identification data, the owner address, and the first public key,
wherein the registration server transmits the product characteristic data, the first private key, the first public key, and the owner's address to the genuine product authentication means. According to claim 8,
The registration server transmits the manager identification number to the activation means so that the activation means stores the manager identification number;
The activation terminal transmits a personal identification number (PIN) together with the validation data to the activation means,
Wherein the genuine product authentication means compares the genuine product verification data with the genuine product authentication data only when the personal identification number matches the manager identification number, and transmits a match to the genuine product authentication terminal. According to claim 8,
The registration server extracts the differentiated features of the product and stores the digitized product differentiation data on a network using a distributed file system (IPFS, Inter Planetary File System),
Wherein the product characteristic data is a meta URL address in which product differentiation data is stored. According to claim 8,
The registration server encrypts and stores the genuine product characteristic data, the first private key, and the first public key. According to claim 7,
Further comprising a registration server for storing product characteristic data, which is data related to the product,
The genuine product authentication means generates the first private key and the first public key and transmits them to the registration server;
The registration server transmits the product characteristic data, the first public key, and the owner address to the blockchain network;
The blockchain network treats the product characteristic data as the product identification data, and generates a block including the product identification data, the owner address, and the first public key,
The registration server transmits the product characteristic data and the owner's address to the genuine product authentication means. According to claim 12,
The registration server transmits the manager identification number to the activation means so that the activation means stores the manager identification number;
The activation terminal transmits a personal identification number (PIN) together with the validation data to the activation means,
Wherein the genuine product authentication means compares the genuine product verification data with the genuine product authentication data only when the personal identification number matches the manager identification number, and transmits a match to the genuine product authentication terminal. According to claim 12,
The registration server extracts the differentiated features of the product and stores the digitized product differentiation data on a network using a distributed file system (IPFS, Inter Planetary File System),
Wherein the product characteristic data is a meta URL address in which product differentiation data is stored. According to claim 12,
The registration server encrypts and stores the product characteristic data, the first private key, and the first public key. According to any one of claims 1 to 15,
The activation means is an NFC tag,
The activation system, characterized in that the activation terminal is an NFC terminal connected to the NFC tag (Tag) and non-contact (Contactless) communication. According to any one of claims 1 to 15,
The product is an electronic product including a central processing unit (CPU),
The genuine product authentication system, which immediately implies that the genuine product authentication means is a security zone (TrustZone) set inside the central processing unit. A genuine product authentication means attached to or included in a product and storing a first private key and a first public key forming a key pair with the first private key, a genuine product authentication terminal that exchanges data with the genuine product authentication means through communication, and the genuine product In the activation method using an activation system including an activation server connected to an authentication terminal,
a genuine product authentication data issuing step of generating and storing the product product authentication data in the product authentication means;
a genuine product authentication data request step of requesting the product product authentication data from the product product authentication means by the product product authentication terminal;
an activation data transmission step in which the activation means transmits the activation data to the activation terminal; and
and an activation data verification step in which the activation terminal verifies the activation data through the activation data transmitted through the activation server. According to claim 18,
The activation data is an electronic certificate encrypted with a first private key,
The authenticity confirmation data includes a first public key forming a key pair with the first private key and a hash value of the electronic certificate,
The issuing of the activation data is a step of issuing the electronic certificate and storing it in the activation means, and storing the activation confirmation data in the activation server;
The genuine product authentication data verification step is a step in which the genuine product authentication terminal decrypts the electronic certificate with the first public key and compares hash values of the electronic certificate to verify the electronic certificate. According to claim 18,
The activation data is a certificate chain in which 1st to Nth electronic certificates are encrypted and connected by 1st to N-1th private keys,
The first electronic certificate is generated by encrypting data including a first public key with the first private key,
The second electronic certificate to the Nth electronic certificate encrypt data including the second to Nth public keys, respectively, by the first private key to the N−1th private key, respectively;
The first to Nth public keys form a key pair with the first to Nth private keys, respectively;
Subjects issuing the first through Nth electronic certificates in the activation data issuance step are different,
The authenticity confirmation data includes a first public key forming a key pair with the first private key and a hash value of the first electronic certificate,
The activation data verification step is a step of receiving the certificate chain from the activation means and verifying the certificate chain through a hash value of the first public key and the first electronic certificate. . According to claim 20,
Further comprising a private key verification step of verifying whether the Nth private key is valid,
The private key verification step,
a random number transmission step in which the genuine product authentication unit generates a random number and transmits the random number to the product authentication terminal;
a random number electronic signature request step of storing the random number in the genuine product authentication terminal and requesting a random number electronic signature from the genuine product authentication means;
a random number electronic signature generation step of generating a random number electronic signature by encrypting the random number with the Nth private key stored in the genuine product authentication unit and transmitting the random number electronic signature to the genuine product authentication terminal; and
and a random number electronic signature verification step of verifying the random number electronic signature by decoding the random number electronic signature with the Nth public key, by the genuine product authentication terminal. Product activation means attached to or included in the product and storing a first private key and a first public key forming a key pair with the first private key, an activation terminal exchanging data with the activation means through communication, and the activation authentication In the genuine product authentication method using a genuine product authentication system including a blockchain network connected to a terminal and a registration server,
an activation data storage step in which the registration server transmits product feature data, which is data related to the product, to the activation means, and the activation means stores the product feature data as activation data;
a key generation step of generating the first private key and the first public key and storing them in the registration server and the activation means;
The registration server transmits the first public key and the product characteristic data to the blockchain network, and the blockchain network treats the product characteristic data as the genuine product verification data, and the genuine product verification data and the first public key , and a block forming step of forming a block including an owner address, which is an address for the block, and storing the owner address in the registration server and the genuine authentication means;
an owner address request step in which the genuine product authentication terminal requests the owner address from the genuine product authentication means;
a genuine authentication data transmission step in which the genuine product authentication terminal retrieves the genuine product validation data included in the block corresponding to the owner's address from the blockchain network and transmits the product to the product authenticator;
a genuine authentication data verification step in which the genuine product authentication unit compares the genuine product confirmation data with the genuine product authentication data and transmits a match or not to the genuine product authentication terminal;
a random number transmission step in which the genuine product authentication unit generates a random number and transmits the random number to the product authentication terminal;
a random number electronic signature request step of storing the random number in the genuine product authentication terminal and requesting a random number electronic signature from the genuine product authentication means;
a random number electronic signature generation step of generating a random number electronic signature by encrypting the random number with a first private key stored in the genuine product authentication unit and transmitting the random number digital signature to the genuine product authentication terminal; and
and a random number digital signature verification step in which the genuine product authentication terminal verifies the random number digital signature by decoding the random number digital signature with the first public key. The method of claim 22,
Product differentiation data in which the registration server extracts the differentiated features of the product and stores the digitized product differentiation data on the network before the activation data storage step, using a distributed file system (IPFS, Inter Planetary File System). A storage step; further comprising,
Wherein the product characteristic data is a meta URL address in which product differentiation data is stored. The method of claim 22,
The first private key and the first public key are generated by the registration server. The method of claim 22,
The first private key and the first public key are generated by the activation means. The method of claim 22,
The activation data storage step is. The registration server transmits the manager identification number to the activation means so that the activation means stores the manager identification number;
The authenticity verification data transmission step is a step of transmitting a personal identification number (PIN, Personal Identification Number) together with the genuineness verification data to the genuine product verification means;
The genuine product authentication means performs the product authentication data verification step only when the personal identification number matches the manager identification number. The method of any one of claims 18 to 26,
The activation means is an NFC tag,
The activation method, characterized in that the activation terminal is an NFC terminal connected to the NFC tag (Tag) and non-contact (Contactless) communication. The method of any one of claims 18 to 26,
The product is an electronic product including a central processing unit (CPU),
The genuine product authentication method, characterized in that the genuine product authentication means is a security zone (TrustZone) set inside the central processing unit.

Images