TW201427367A - PKI authentication service system and method - Google Patents

Abstract

The present invention discloses a PKI (the Public Key Infrastructure) authentication service system and method. The system includes: a customer end element dispatching module connected with at least one client end for storing multiple types of PKI elements and dispatching a corresponding PKI element to the client end based on the type of the client end, thereby providing the client end with the PKI operation capability (such as signature); a management module connected with at least one application system for determining and selecting a verification procedure suitable for the application system; a common verification module connected with the management module and at least one application system, and further connected with a plurality of CA (Certificate Authority) units for selecting a suitable CA based on the verification procedure determined by the management module to perform a verification and thus generating a verification result; and a certification module connected with the common verification module for storing the verification result and related information.

Description

PKI authentication service system and method

The invention belongs to an authentication service system and method, in particular to a public key infrastructure (PKI) authentication service system and method by independently out of a general application system.

As network applications become more and more prosperous, the issue of network security will continue to be more and more important, and the network security solution is currently recognized as the strongest technology of Public Key Infrastructure (PKI). . On the one hand, for most non-PKI professional applications, the threshold for PKI import is high. The traditional PKI-enabled method often requires a lot of application technology and maintenance resources. Therefore, the application system needs a Simple PKI-enabled pipeline; on the other hand, password/breaking technology and various PKI security devices (such as IC cards) are changing with each passing day. Once the current PKI technology has security concerns, the application system will have the ability to quickly convert. Becoming a more advanced or higher security PKI technology; in addition, for each application system, it may be necessary to support various client platforms (requiring different PKI components), and to be able to process the certificates issued by each CA, and also need to have The ability to trade certificates or certificate deposits may also require different verification steps depending on the type of voucher. In the past, applications had to make or maintain these functions on their own. In summary, what is needed at this stage is the purpose and function that can achieve the above requirements, so that the application system can achieve the above functions more easily and flexibly, and since the previous PKI technology is implemented in the application system, The invention also relies on the independent PKI system to use the cloud-like concept to reduce the burden of the application system to transport PKI technology.

It is an object of the present invention to provide a system and method that enables each application system to achieve PKI-enabled in an easier and lower cost manner, and to achieve a customized verification requirement for each application system in an elastic manner. To achieve the above objective, the present invention adopts the following technical solution: a public key infrastructure (PKI) authentication service system, which includes: a client component distribution module, which is linked to at least one client, the client The end component distribution module stores a plurality of types of PKI components, and the client component distribution module delivers the corresponding PKI component to the client according to the client type, so that the client has the PKI operation capability (for example, signing a management module is coupled to at least one application system, the management module determines and selects a verification program applicable to the application system; a common verification module, and the management module and at least one application system And the common verification module further connects a plurality of certificate authority (CA), so as to select an applicable CA according to the verification program determined by the management module to verify a signature file to be verified, And generating a verification result and returning the notification to the application system for notification; and a deposit module connected to the common verification module, The certificate module stores the verification result and related information.

In the present invention, the verification program includes verification requirements of the application systems, voucher verification rules, and related parameters for registering the CAs.

In the present invention, the related information includes a signature file for verification and a signature record of the user logging into the application system.

In the present invention, a PKI security device is further included, and the PKI security device is coupled to the client to generate the signature file to be verified.

In the present invention, the relevant parameters of the CAs include an online certificate status protocol (Online Certificate Status Protocol (OCSP), the URL of the Uniform Resource Locator (URL), the Certificate Revocation List (CRL), and the download period.

A public key infrastructure (PKI) authentication service method includes at least the following steps: a client is connected to an application system, and if the client does not have a PKI component corresponding to the client type, The client is automatically connected to a client component distribution module of a PKI authentication service system to find and install the PKI component corresponding to the client type; the PKI component of the client type Operating a PKI security device to sign a document and generate a signature file, and then transmitting the signature file to the application system; after receiving the signature file, the application system transmits the signature file to the One of the PKI authentication service systems has a common verification module; after receiving the signature file, the common verification module connects the application system through a management module, and finds a certificate authority (Certificate Authority) applicable to the application system. CA) and the verification program; the common verification module searches for the signature file according to the CA and the verification program that the management module finds for the application system Verifying to generate a verification result and transmitting it to the application system to notify the application system whether the file is verified; and storing the verification result by one of the PKI authentication service system to provide backup or subsequent use .

In the present invention, before the client wants to perform the PKI authentication service method, the following steps are first performed: the client submits a registration application to the management module; and the management module sets according to the information of the registration application. The CA and the verification program applicable to the application system, and after completing the registration application, the application system is open to provide services to the client.

The present invention is applicable to the PKI technology in each application system only corresponding to the application system itself. The authentication not only increases the burden of the application system but also lacks the flexibility of the function. Therefore, the present invention proposes a PKI authentication service system and method. In summary, the present invention has the following advantages:

(1) Independent operation: The invention applies the concept similar to the cloud system, separates the PKI authentication system, and only sends out messages and receiving results on the client and application systems, without having to invest resources to carry out operations, reducing additional resources. .

(2) Certification planning flexibility: Through its own management module, various CA certification and certification processes can be performed according to different application system types, and applicable PKI components can be assigned according to different clients to perform PKI authentication system operations. .

(3) Multi-party operation: In the past, the PKI system was combined with the application system, and only the application system authentication procedure was performed, and thus the capability was limited. Through the PKI authentication service system and method of the present invention, different clients and different clients can be simultaneously The application system performs certification operations, greatly improving compatibility and operational efficiency.

To sum up, this case is not only innovative in terms of technical thinking, but also has many of the above-mentioned functions that are not in the traditional methods of the past. It has fully complied with the statutory invention patent requirements of novelty and progressiveness, and applied for it according to law. Approved this invention patent application, in order to invent invention, to the sense of virtue.

The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

Hereinafter, the present invention will be further described with reference to the accompanying drawings: Please refer to FIG. 1 , which is a block diagram of the PKI authentication service system of the present invention. As shown in the figure, the PKI authentication service system 1 of the present invention is independent of the application system, just like the concept of the cloud system, and the PKI authentication service system 1 of the present invention comprises: a client component distribution module 11 and a The management module 12, a common verification module 13 and a deposit module 14 are provided. The client component distribution module 11 can simultaneously connect multiple client sources. When multiple clients need to distribute files to the corresponding application system and need to perform signature authentication, the client will first determine whether there is a corresponding one. Its client-type PKI component, this is because the PKI component is the main component that provides the client to authenticate through the application system to connect to the PKI authentication service system 1. Currently, there are many types of clients on the market, such as Internet Explorer, Firefox or For Google Chrome, etc., different types of clients require different PKI components to support, so when the client finds that there is no corresponding PKI component available, the client will connect to the client component distribution module in the PKI authentication service system 1. 11 to extract and install the required PKI components, and these PKI components can be separately produced and stored in the client component distribution module 11 for the client to download and install. The application system type can be PHP, ASP, ASP.net or JAVA, and so on. The management module 12 can be connected to a plurality of application systems. The management module 12 determines and selects a certificate authority (CA) and a verification program applicable to the connected application system. When the authentication is to be performed, the management module 12 can The management module 12 finds the applicable CA and the verification program for authentication. The management module 12 can register parameters of multiple CAs, for example, a CA certificate file and an online certificate status protocol (OCSP). Web address (Uniform Resource Locator, URL), URL of the Certificate Revocation List (CRL) and its download cycle. In addition, you can set the verification procedures and requirements of various application systems. For example, which CAs are trusted by the application system and used during verification. OCSP or CRL, based on different credential categories Determine the verification steps or which voucher fields need to be specifically verified. The common verification module 13 performs related authentication on a signature file according to the CA and the verification program found by the management module 12, for example, whether the verification file is tampered with, whether the customer's certificate is issued by the trusted CA, and through the OCSP. Or the CRL verifies the voucher status and checks whether the voucher meets a certain guarantee level, etc., and finally produces the relevant verification result and transmits it to the application system to notify whether it has passed the verification. The deposit certificate module 14 stores information about the verification result and various information of the signature file in the authentication process.

Please refer to FIG. 2, which is a block diagram of the implementation of the PKI authentication service system of the present invention. As shown, the first client 31 is coupled to the first PKI security device 21, and the second client 32 is coupled to the second PKI security device 22, and the first client 31 is intended to transmit a file to the first application system 41. At this time, the first PKI security device 21 copies the file into the first signature file 311 and transmits it to the first application system 41, and the first application system 41 verifies the first signature file 311. Similarly, when the second client 32 wants to transfer another file to the second application system 42, the second PKI security device 22 makes the other file into the second signature file 321 and transmits the file to the second application system. 42. The second application system 42 will verify the second signature file 321 . First, if the first client 31 and the second client 32 do not have a PKI component corresponding to their own type, the client first automatically boots to the client component distribution module 11 of the PKI authentication service system 1, and the client component The distribution module 11 downloads the PKI components (indicators 312, 322) of their respective types and installs them to support the authentication process. After the first application system 41 and the second application system 42 receive the first signature file 311 and the second signature file 321 respectively, the first application system 41 and the second application system 42 respectively respectively use the first signature file 311. And the second signature file 321 is sent to the common verification module 13 in the PKI authentication service system 1 to prepare for verification. The management module 12 first registers the plurality of CA parameters and various verification requirements, so the management module 13 first applies to the first application. The system 41 and the second application system 42 perform the determination to select the CA and the verification requirements respectively suitable for the first application system 41 and the second application system 42. In the embodiment, the first application system 41 applies the first credential unit 51. And the second application system 42 applies the second credential unit 52. The common verification module 13 is connected to the certificate unit (CA) of each family. Therefore, when the common signature module 13 receives the first signature file 311 and the second signature file 321, the management module 12 The selected certificate unit category and the voucher verification requirement, the program, etc., the first signature file 311 is verified by the voucher unit 51 and related procedures, and the second signature file 321 is verified by the voucher unit 52 and related procedures. Finally, the respective verification results are obtained, and the verification results of the first signature file 311 and the second signature file 321 are respectively transmitted back to the first application system 41 and the second application system 42 to indicate whether the authentication is passed, and The verification results, the signature files, and the authentication processing history are stored in the certificate module 14 of the PKI authentication service system 1 as a backup, and can be provided as a basis for future certification.

In summary, in order to more clearly express the entire process, please refer to FIG. 3, which is a flowchart of the PKI authentication service method of the present invention. The steps are as follows: First, refer to step S11, the client connected to the PKI security device. First connect to the application system to access the application service, where the client can be plural and can be different types, and the application system selected by each can also adopt or trust various different certification units (CA); Referring to step S12, the client determines whether the PKI component corresponding to the client type is not installed. If the client does not install the PKI component corresponding to the client type, proceed to step S13, and the client automatically connects to the client. a client component distribution module of the PKI authentication service system to find and install the PKI component corresponding to the client type, if there is originally a PKI component supported by the PKI, then proceed directly to step S14; Next, referring to step S14, each of the clients operates their own PKI security device by their own type of PKI component, so as to sign the file to be sent and generate a separate signature file, and then sign the signatures. The file is transferred to the corresponding application system; then, refer to step S15, after receiving the respective signature files, the application files are transmitted to the common verification module in the PKI authentication service system; then, please Referring to step S16, the application system is connected by a management module, and the certificate authority (CA) and the verification program applicable to the application systems are searched; then, referring to step S17, the common verification module receives the signatures. After the chapter file, the management module finds the CA and the verification program applicable to the application systems to verify the respective signature files and generate respective verification results, and then transmits them to the respective application systems to notify the signatures. Whether the file has passed the verification; then, referring to step S18, the verification result, the signature documents and the certification are stored by the certificate module of the PKI authentication service system. Science course as a backup, it can provide evidence as the basis for future progressive.

However, before the client wants to perform the PKI authentication service of the present invention, the steps as shown in FIG. 4 must be performed to facilitate the CA and the verification program applicable to the application system in the management system: First, refer to step S21. The application system needs to first submit a registration application to the management module. Then, referring to step S22, the management module sets the CA and the verification program applicable to the application system according to the application information of the application system registration, and completes the registration application. After that, the application system is open to provide services for this type of client.

The above is only the preferred embodiment of the present invention, and is not intended to limit the scope of implementation of the present invention; Modifications or equivalents of the invention are intended to be included within the scope of the invention.

1‧‧‧PKI Certification Service System

11‧‧‧Client component distribution module

12‧‧‧Management module

13‧‧‧Common Verification Module

14‧‧‧Certificate module

21‧‧‧First PKI Safety Device

22‧‧‧Second PKI security device

31‧‧‧First client

311‧‧‧ First signature document

312‧‧‧ First PKI component

32‧‧‧Second client

321‧‧‧Second signature document

322‧‧‧Second PKI components

41‧‧‧First Application System

42‧‧‧Second application system

51‧‧‧First voucher unit

52‧‧‧Second voucher unit

1 is a block diagram of a PKI authentication service system of the present invention; FIG. 2 is a block diagram of a PKI authentication service system of the present invention; FIG. 3 is a flowchart of a PKI authentication service method of the present invention; Before applying the system to the PKI authentication service method of the present invention, a flow chart of the registration application is required.

1‧‧‧PKI Certification Service System

11‧‧‧Client component distribution module

12‧‧‧Management module

13‧‧‧Common Verification Module

14‧‧‧Certificate module

Claims (10)

A public key infrastructure (PKI) authentication service system includes: a client component distribution module, which is coupled to at least one client, and the client component distribution module stores a plurality of types. a PKI component, wherein the client component distribution module delivers the corresponding PKI component to the client according to the client type, so that the client has PKI operation capability; and a management module is coupled to at least one application system, The management module determines and selects a certificate authority (CA) and a verification program applicable to the application system; a common verification module is coupled to the management module and the at least one application system, and the common verification mode The group further connects a plurality of CAs to select a valid CA according to the verification procedure determined by the management module to verify a signature file to be verified, and generate a verification result and return it to the application system; The certificate module is coupled to the common verification module, and the certificate module stores the verification result and related information. The PKI authentication service system of claim 1, wherein the verification program includes verification requirements of the application systems, voucher inspection rules, and related parameters for registering the CAs. For example, the PKI authentication service system described in claim 1 includes the signature document in the verification and the signature record of the user logging into the application system. The PKI authentication service system of claim 1, further comprising a PKI security device, the PKI security device connecting the client to generate the signature file to be verified. For example, the PKI authentication service system described in claim 1 of the patent scope, wherein the CAs are related The parameters include the Online Certificate Status Protocol (OCSP) web address (Uniform Resource Locator, URL), the URL of the Certificate Revocation List (CRL), and the download period. A public key infrastructure (PKI) authentication service method includes at least the following steps: connecting to an application system by a client, and determining, by the client, whether the client type is not installed a PKI component; if the client does not have a PKI component corresponding to the client type, the client automatically connects to a client component distribution module of a PKI authentication service system to find a corresponding client type a PKI component is installed on the client; the PKI component of the client type operates a PKI security device to sign a file and generate a signature file, and then transmit the signature file to the application system After receiving the signature file, the application system transmits the signature file to a common verification module of the PKI authentication service system; the application system is connected by a management module, and the application system is searched for a certificate authority (CA) and a verification program; the common verification module finds the CA applicable to the application system according to the management module and the test The program verifies the signature file to generate a verification result and transmit it back to the application system to notify the application system whether the file is verified; and store the verification by one of the PKI authentication service system The result is to provide a backup or subsequent use. For example, the PKI authentication service method described in claim 6 of the patent scope, wherein the client wants to perform Before the PKI authentication service method, the following steps are required: the client submits a registration application to the management module; and the management module sets the CA and the verification program applicable to the application system according to the information of the registration application. After the registration application is completed, the application system is open to provide services to the client. The PKI authentication service method according to claim 6, wherein the verification program includes verification requirements of the application systems, voucher inspection rules, and related parameters for registering the CAs. The PKI authentication service method of claim 6, wherein the certificate module further stores a related information, where the related information includes a signature file for verification and a signature record of the user logging into the application system. The PKI authentication service method described in claim 6, wherein the related parameters of the CA include an Online Certificate Status Protocol (OCSP) web address (Uniform Resource Locator, URL), and a voucher revocation list. (Certificate Revocation List, CRL) URL and its download cycle.