KR100601405B1 - Certificate information management system using communication terminal and thereof method - Google Patents

Abstract

The present invention relates to an authentication information management system and method for moving a private key and certificate installed in a terminal (PC, notebook, etc.) to another terminal (PC, notebook, mobile communication terminal, etc.) in an existing online (Internet) environment.

In particular, it does not use existing portable storage devices (floppy disks, USB storage, etc.), but stores them in mobile communication terminals (PDAs, mobile phone terminals, etc.) and stores them in other terminals (PCs, laptops, etc.) if necessary. It relates to an authentication information management system and method for moving to.

Accordingly, the present invention provides an authentication information management system using a communication terminal, comprising: a first terminal provided with authentication information having a private key and a certificate; A second terminal for encrypting authentication information transmitted from the first terminal; And a third terminal that decrypts the authentication information transmitted from the second terminal and executes an electronic signature.

Authentication information, private key, certificate, key relay server, mobile communication terminal, storage device

Description

Certification information management system using communication terminal and method method}

1 is a diagram illustrating a process of moving authentication information to a terminal B using a key relay server according to an embodiment of the present invention.

2 is a diagram illustrating a process of moving authentication information to a terminal B using wireless communication according to an embodiment of the present invention.

3 is a diagram illustrating a process of moving authentication information to a wired communication terminal using a key relay server according to an embodiment of the present invention.

4 is a diagram illustrating a process of moving authentication information to a wireless communication terminal using a key relay server according to an embodiment of the present invention.

5 is a diagram illustrating a process of moving authentication information to terminal C using wireless communication according to an embodiment of the present invention.

6 is a diagram illustrating a process of moving a wireless certificate to a wired communication terminal using a key relay server according to an embodiment of the present invention.

7 is a diagram illustrating a process of moving a wireless certificate to a mobile communication terminal using a key relay server according to an embodiment of the present invention.

8 is a diagram illustrating a process of moving authentication information from a key relay server to a terminal device using URL email according to an embodiment of the present invention.

9 is a detailed configuration diagram of a key relay server of the authentication information management system according to the present invention.

<Description of Symbols for Major Parts of Drawings>

100: terminal A 200: key relay server

210: web server module 211: wired interlocking module

212: wireless interworking module 220: authentication information management module

230: notification server 231: email sending module

232: SMS sending module 300: terminal B

400: terminal C

The present invention relates to an authentication information management system and method for moving a private key and certificate installed in a terminal (PC, notebook, etc.) to another terminal (PC, notebook, mobile communication terminal, etc.) in an existing online (Internet) environment. In particular, it does not use existing portable storage devices (floppy disks, USB storage, etc.), but stores them in mobile communication terminals (PDAs, mobile phone terminals, etc.) and stores them in other terminals (PCs, laptops, etc.) if necessary. It relates to an authentication information management system and method for moving to.

To move the private key and certificate in the existing wired internet environment, encrypt the private key and certificate installed in the terminal (PC, notebook, etc.) and transfer it to a portable storage device (floppy disk, USB storage, etc.) I am using a method of moving from a device to another terminal.

In addition, after encrypting the installed private key and certificate sent by e-mail (e-mail), another method of receiving an e-mail (e-mail) to install the certificate is used.

However, such a prior art causes the following problems.

First, it is necessary to purchase and carry a portable storage device.

Floppy disks, which are used as portable storage devices, are very inexpensive means, but because they are bulky, rigid, and low in storage capacity, storage systems that are gradually exiting the market have recently been released such as PCs and laptops without floppy disk drivers. Means.

In addition, USS storage is a portable storage means, which is in the spotlight recently, but it is expensive as a means for simply carrying a certificate because it is required to pay and purchase tens of thousands of won.

In particular, the portable storage device has the disadvantage that it must be carried at all times.

Second, portable storage devices can only be used in limited terminals.

Floppy disk as a portable storage device is a very simple device and can be used by anyone since it is basically provided by a wired terminal.

However, in the case of USS storage, it is impossible to move the private key and certificate to a terminal without a USB port (PDA, mobile phone terminal, etc.) because the system must have a USB port. In order to use USS storage, there are many restrictions on using USS storage, such as installing a separate driver program.

Third, in case of sending by e-mail, it is necessary to send by e-mail in advance in the system where the private key and certificate are installed.

In the case of using e-mail, the private key and certificate should be encrypted in the terminal where the private key and certificate are installed and sent in advance to the e-mail that can be received by the system requiring the private key and certificate.

Therefore, when an electronic signature is required for internet banking and cyber trading with a PC of another person such as a PC room, such as in a business trip or going out, there is a problem of generating a new private key and certificate.

And when a new private key and certificate is issued, the previously used private key and certificate can no longer be used, so there is a problem that a new certificate must be issued again in the PC.

Fourth, the existing technology cannot move the wireless certificate of the mobile communication terminal to another mobile communication terminal or a terminal such as a PC or a notebook.

In recent years, the mobile communication terminal has been able to issue a wireless certificate and to use the wireless electronic signature. However, since the mobile communication terminal does not yet have an interface for connecting a portable storage device, it is not possible to transmit a private key and certificate to another mobile communication terminal or a terminal such as a PC or a notebook.

The present invention is to solve the above problems, the present invention is to move the personal key and certificate installed in the terminal (PC, notebook, etc.) to another terminal (PC, notebook, mobile communication terminal, etc.) by using a mobile communication terminal Its purpose is to enable digital signatures to be performed on terminals that do not have keys and certificates installed.

As the technical idea for achieving the above object of the present invention

In the authentication information management system using a communication terminal,

A first terminal provided with authentication information having a private key and a certificate;

A second terminal for encrypting authentication information transmitted from the first terminal; And

And a third terminal for decrypting the authentication information transmitted from the second terminal and executing an electronic signature.

Hereinafter, with reference to the accompanying drawings, the configuration and operation of the embodiment of the present invention will be described in detail.

The method proposed in the present invention encrypts and stores the private key and certificate in use in the Internet environment in the mobile communication terminal, and moves the encrypted private key and certificate to the required terminal wirelessly whenever necessary.

The overall service process provided by the present invention is divided into two stages. Step 1 of moving the private key and certificate installed in the terminal A (PC, notebook, etc.) to the terminal B (PDA, mobile communication terminal, such as a mobile phone); It consists of two steps to move from the terminal B to the terminal C (PC, notebook, other mobile communication terminal, etc.) to perform the electronic signature.

Looking at the definition of the terminals A, B, C in more detail before the description of the present invention, the terminal A represents a wired communication terminal used in a fixed position, such as a PC, a laptop (not equipped with a wireless LAN), the terminal B is Represents a mobile communication terminal such as a personal digital assistant (PDA), a mobile phone terminal, etc., and terminal C represents not only a PC and a notebook but also a whole communication terminal such as a PDA and a mobile phone terminal.

In the first step, the method for moving the encrypted private key and certificate from the terminal A (PC, notebook, etc.) to the terminal B (mobile communication terminal) 1) using a key relay server; 2) When direct wireless communication (infrared communication (IrDA), RF channel, Bluetooth, etc.) is possible to terminal A and terminal B, there is a method of using direct wireless communication.

1) The process of moving authentication information to the terminal B using a key relay server will be described (see FIG. 1).

First, the user inputs the identification number (MIN) of the terminal B (300) and the password (PW) required for the encryption and decryption of the certificate to the terminal A (100) (S11).

The terminal A 100 encrypts the private key and the certificate based on the input password (S12), and transmits the encrypted authentication information (private key, certificate) together with the identification number to the key relay server 200 (S13). ).

The key relay server 200 transmits the storage location (URL) of the authentication information to the identification number of the terminal B (300) by using a short message (SMS) (S14).

The terminal B 300 is connected to the authentication information storage location of the received key relay server 200 (S15). Thereafter, the terminal B 300 receives the authentication information from the key relay server 200, and decrypts the authentication information in the terminal B 300, if necessary, installs a private key and a certificate in the terminal B 300 itself. It is possible to perform the electronic signature (S16).

2) The process of moving authentication information to the terminal B using wireless communication will be described (see FIG. 2).

First, the terminal A 100 configures a wireless communication channel (IrDA, RF, Bluetooth, etc.) with the terminal B 300 (S21). The user inputs a password (PW) necessary for decryption and decryption of the private key and the certificate in the terminal A (100).

The terminal A 100 encrypts the private key and the certificate based on the input password (S23).

The terminal B 300 receives and stores the encrypted private key and certificate from the terminal A 100 and, if necessary, decrypts the authentication information in the terminal B 300 and installs it in the mobile communication terminal itself to perform an electronic signature. It becomes possible (S24).

Subsequently, the method for moving the encrypted private key and certificate from the terminal B to the terminal C in step 2 includes: 1) using a key relay server; 2) It can transmit by using direct wireless communication method (IrDA, RF, Bluetooth, etc.) between terminal B and terminal C without key relay server.

In particular, by applying the two-step method, the private key and the wireless certificate installed in the mobile communication terminal can be moved to the terminal C (PC, notebook, mobile communication terminal, etc.).

1) Look at the process of moving the authentication information to the wired communication terminal using the key relay server (see Figure 3).

First, the terminal B 300 is connected to the key relay server 200 (S31). The e-mail address and encrypted authentication information (private key, certificate) that can be received by the terminal C 400 is transmitted to the key relay server 200 (S32).

The key relay server 200 transmits the authentication information to the e-mail address received from the terminal B (300) (S33), and the user inputs a password for decrypting the authentication information to the terminal C (400) (S34).

The terminal C 400 decrypts the authentication information of the received e-mail based on the decryption password and installs the terminal C 400 in the terminal C 400 (S35).

2) The process of moving authentication information to a wireless communication terminal using a key relay server will be described (see FIG. 4).

First, the terminal B 300 is connected to the key relay server 200 (S41). The identification number of the terminal C 400 and the encrypted authentication information (private key, certificate) is transmitted to the key relay server 200 (S42), and in the key relay server 200 to the identification number of the terminal C 400. The storage location (URL) of the authentication information is transmitted using a short message (SMS) (S43).

The terminal C 400 is connected to the authentication information storage location of the received key relay server 200 (S44), and receives authentication information from the key relay server 200 (S45).

The user inputs a password for decrypting the authentication information to the terminal C 400 (S46), and the terminal C 400 decrypts the authentication information received from the key relay server 200 based on the decryption password. 400) (S47).

3) The process of moving authentication information to the terminal C using wireless communication will be described (see FIG. 5).

First, the terminal B 300 configures a wireless communication channel (IrDA, RF, Bluetooth, etc.) with the terminal C (400) (S51), and transmits the encrypted authentication information to the terminal C (400) (S52).

The user inputs a password for decrypting authentication information into the terminal C 400 (S53), and decrypts the authentication information based on the input password and installs it in the terminal C 400 (S54).

4) The moving process of the wireless certificate using the key relay server to the wired communication terminal will be described (see FIG. 6).

The user inputs an e-mail address, a private key and a password to be used for encryption of the certificate in the mobile communication terminal 300 (S61). The terminal B 300 encrypts the private key and the certificate based on the input password (S62) and wirelessly connects to the key relay server 200 (S63).

Sending the e-mail address and encrypted authentication information (private key, certificate) that can be received from the terminal C 400 to the key relay server 200 (S64), along with the e-mail address received from the terminal B (300) The authentication information is transmitted (S65).

The user inputs a password for decrypting the authentication information to the terminal C (400) (S66). The terminal C 400 decrypts the received authentication information of the received e-mail based on the input decryption password and installs the terminal C 400 in the terminal C 400 (S67).

5) A description will be given of a process of moving a wireless certificate to a mobile communication terminal using a key relay server (see FIG. 7).

First, the user inputs the identification number of the terminal C 400 and the password to be used for encryption of the certificate in the mobile communication terminal 300 (S71).

The terminal B 300 encrypts the private key and the certificate based on the input password (S72) and wirelessly connects to the key relay server 200 (S73).

The identification number of the terminal C 400 and the encrypted authentication information (private key, certificate) are transmitted to the key relay server 200 (S74), and in the key relay server 200 to the identification number of the terminal C 400. The storage location (URL) of the authentication information is transmitted using a short message (SMS) (S75).

The terminal C 400 is connected to the authentication information storage location of the received key relay server 200 (S76), and receives authentication information from the key relay server 200 (S77).

The user inputs a password for decrypting the authentication information to the terminal C (400) (S78). The terminal C 400 decrypts the authentication information received from the key relay server 200 based on the decryption password and installs it in the terminal C 400 (S79).

As described above, when the authentication information is sent from the key relay server 200 to the terminal C (PC, notebook, etc.) 400, authentication is performed as in the first method (Fig. 3) and the fourth method (Fig. 6). It is also possible to send an e-mail containing the information, as in the second method (Fig. 4), the authentication information storage location (URL) in the key relay server 200 may be sent to the terminal C (400) by e-mail.

In this case, as shown in FIG. 8, the terminal C (PC, notebook, etc.) 400 is connected to the key relay server 200 via the web (S81 ~ S82) to download the authentication information from the authentication information storage location. (S83).

Subsequently, a configuration of the key relay server of the present invention will be described with reference to FIG. 9.

Key relay server 200 of the present invention is largely composed of a web server module 210, authentication information management module 220 and notification server module 230.

The web server module 210 is a wireless interworking module for interworking with a terminal B (300), such as a wired linking module (211) for interworking with the terminal A (100), such as a PC, a laptop again, and a PDA, a mobile phone terminal ( 212).

The authentication information management module 220 temporarily manages the received encrypted authentication information until it is transmitted to the terminal C (PC, notebook, mobile communication terminal, etc.) 400. The notification server module 230 is composed of an email sending module 231 for sending an email to the terminal C 400 and an SMS sending module 232 for sending a short message.

According to the authentication information management system and method using a mobile communication terminal according to the present invention as described above has the following advantages.

First, there is no need for a separate portable storage device and software.

In the present invention, since a user uses a mobile communication terminal such as a PDA or a mobile phone terminal as a storage device for a private key and a certificate, there is no need for a separate portable storage device such as a floppy disk or a USB storage device.

It also eliminates the need to carry driver software to access and use USB storage.

Second, you can send your private key and certificate anytime and anywhere to any communication terminal that requires digital signatures.                     

Since the mobile communication terminal storing the private key and certificate according to the present invention can always access the network, the user can also transmit the private key and certificate stored in the mobile communication terminal to PDAs and mobile phones as well as other PCs and laptops anytime, anywhere. It is possible.

That is, even if a personal certificate is not installed in a PC such as a company, a home, a PC room, a certificate-based digital signature service can be used in a PC by transmitting a certificate from a mobile communication terminal to a PC.

Third, no additional costs are required.

In the present invention, since the mobile communication terminal is used as a storage device for a private key and a certificate, a cost for purchasing a portable storage device such as a separate USB storage is not required.

Fourth, it is easy to use.

In order to move the existing portable storage device from the terminal to the portable storage device, the driver for the portable storage device must be installed on the terminal, the private key and the certificate move from the portable storage device, and the private key and the certificate from the portable storage device to the terminal again. In order to move, driver installation must be done again.

That is, in a terminal that does not recognize the portable storage device, the portable storage device must be connected to the terminal every time and a driver for operating the portable storage device must be installed.

However, in the present invention, the private key and the certificate are basically moved using the network, and thus, the private terminal and the certificate can be moved anywhere in the network without a separate operation such as software installation.

Fifth, it can be used to move the wireless certificate of the mobile communication terminal.

Recently, the issue of a wireless certificate and electronic signature using the same has become possible in mobile communication terminals. However, since there is no interface for connecting a portable storage device due to the characteristics of a mobile communication terminal, it is impossible to move a private key and a certificate using the portable storage device.

However, in the present invention, the private key and certificate used in the Internet environment are encrypted and stored in the mobile communication terminal, and the encrypted private key and certificate can be moved to the required terminal wirelessly whenever necessary.

Claims (18)

In the authentication information management system using a communication terminal, A first terminal provided with authentication information having a private key and a certificate; A second terminal for encrypting authentication information transmitted from the first terminal; And And a third terminal that decrypts the authentication information transmitted from the second terminal and executes an electronic signature. The authentication information management system according to claim 1, wherein the first terminal is a wired communication terminal, and the second terminal is a mobile communication terminal. The authentication information management system according to claim 1 or 2, wherein the third terminal is a communication terminal including a wired communication terminal and a mobile communication terminal. The authentication information management system according to claim 1, wherein the authentication information installed in the first terminal is transmitted to the second terminal using a key relay server. The authentication information management system according to claim 1, wherein the authentication information installed in the first terminal is transmitted to the second terminal using wireless communication. The authentication information management system of claim 5, wherein the wireless communication method includes an infrared communication (IrDA), an RF channel, and a Bluetooth. The system of claim 1, wherein the encrypted authentication information of the second terminal is transmitted to the third terminal using a key relay server. The system of claim 7, wherein a wired communication terminal or a mobile communication terminal is used as the third terminal. The system of claim 1, wherein the encrypted authentication information of the second terminal is transmitted to the third terminal using wireless communication. The authentication information management system according to claim 9, wherein the wireless communication method comprises an infrared communication (IrDA), an RF channel, and a Bluetooth. The authentication information management system according to claim 7 or 8, wherein the second terminal wirelessly accesses the key relay server and transmits encrypted authentication information to a third terminal which is a wired communication terminal. The system of claim 11, wherein an email address information is further included in addition to the encrypted authentication information transmitted to the third terminal, which is the wired communication terminal.  The authentication information management system according to claim 7 or 8, wherein the second terminal wirelessly accesses the key relay server and transmits encrypted authentication information to a third terminal which is a mobile communication terminal. The authentication information management system according to claim 13, wherein the identification number information of the terminal is further included in addition to the encrypted authentication information transmitted to the third terminal, which is the mobile communication terminal. The system of claim 7, wherein the encrypted authentication information of the second terminal is transmitted from the key relay server to the third terminal via an email including a storage location (URL). The method according to claim 4, wherein the key relay server A web server module having a wired interworking module for interworking with the first terminal and a wireless interworking module for interworking with the second terminal; An authentication information management module for temporarily managing the encrypted authentication information received from the second terminal until being transmitted to the third terminal; And And a notification server module having an email sending module for sending an email to the third terminal and an SMS sending module for sending a short message. In the authentication information management method using a communication terminal, A first step of installing authentication information with a private key and a certificate in a first terminal; A second step of encrypting the authentication information received from the first terminal and moving to the second terminal; And a third step of decrypting the authentication information received from the second terminal and moving to the third terminal to perform the electronic signature. The method according to claim 17, wherein the first terminal is a wired communication terminal, the second terminal is a mobile communication terminal, and the third terminal is a communication terminal including a wired and mobile communication terminal.

Images