KR20100066286A - Method and apparatus for verifying a number of public key - Google Patents

Abstract

PURPOSE: A system and a method thereof are provided to rapidly verify a plurality of public keys by verifying the validity of a public key by executing only summation calculation of points without scalar product calculation. CONSTITUTION: A public key verification part(120) receives a plurality of public keys transferred from a plurality of authorized devices(200,300,400). The public key verification part generates public key points about the public keys by applying an elliptic curve cryptography algorithm technique to the public keys. The public key verification part determines the validity of the public keys according to the accordance status between the public authentication values which have the number of the public keys and the public key point. A public key authentication value generating part(130) generates the public key authentication values by using the public keys.

Description

System and method for verifying multiple public keys {METHOD AND APPARATUS FOR VERIFYING A NUMBER OF PUBLIC KEY}

The present invention relates to a system and method for verifying a plurality of public keys, and more particularly, to a system and method for verifying a plurality of public keys using an elliptic curve cryptographic algorithm technique.

The present invention is derived from research conducted as part of the IT growth engine technology development project of the Ministry of Knowledge Economy and the Ministry of Information and Communication Research and Development. [Task management number: 2005-S-088-04, Task name: Information for secure RFID / USN] Protection technology development].

Symmetric key authentication and public key authentication methods are used to authenticate devices through communication between devices in a network environment.

The symmetric key authentication method requires a separate configuration that can safely transmit the symmetric key, while the public key authentication method uses a certificate, so it is not necessary to provide the public key of the device to be authenticated through a separate configuration. This public key authentication method verifies the public key by obtaining the public keys for the devices to be authenticated and generating information necessary for secure communication using the obtained public key. Here, to verify the validity of the public key, a certificate for the public key is generally used. A certificate is issued by a trusted public authority and is a digital signature that includes device information such as a public key and a device identifier.

In particular, when the elliptic curve cryptographic algorithm is used as the public key authentication method, the public key Q determined by the scalar product (Q = p * G) of the scalar value p, which is a private key, and the published base point G, is determined. It uses a feature that it can know but cannot find the private key (p). However, there is a disadvantage in that a large amount of computational cost is required to perform operations such as scalar values and point sums.

The public key authentication method is more complicated and time consuming than the symmetric key operation method. However, in a computing environment such as a PC, the cost of the association of the public key is relatively low, so it is used without any problem.

However, in a network environment, when the resources of the devices are limited such as the CPU speed is limited and the size of the memory used, it is relatively time consuming and energy to verify the multiple public keys by performing the elliptic curve cryptographic algorithm. There is a problem.

Therefore, a technique for verifying a plurality of public keys at once without verifying a certificate for each public key is required.

An object of the present invention is to provide a system and method for verifying a plurality of public keys that can verify a plurality of public keys at once using an elliptic curve cryptographic algorithm.

In the system for verifying a plurality of public keys by receiving a public key from each of a plurality of devices to be authenticated in accordance with a feature of the present invention for achieving the above object,

Receive the plurality of public keys delivered from the plurality of authenticated devices, apply an elliptic curve cryptographic algorithm to the plurality of public keys to generate public key points for the plurality of public keys, and the plurality of public keys. A public key verification unit that determines the validity of the plurality of public keys according to the number of keys and whether the public key point matches a pre-stored public key authentication value, and the public key authentication using the plurality of public keys It includes a public key authentication value generation unit for generating a value and store in advance.

In addition, in a method for verifying a plurality of public keys by passing a public key from each of a plurality of authenticated devices according to another aspect of the present invention,

Communicating with the plurality of authenticated devices to receive the plurality of public keys, applying an elliptic curve cryptographic algorithm to the plurality of public keys, and generating public key points for the plurality of public keys; And determining the validity of the plurality of public keys by determining whether the number of the plurality of public keys and the public key points match a pre-stored public key authentication value.

According to an exemplary embodiment of the present invention, the validity of the public key is verified by only sum operation of a point without a scalar operation, which requires a long time in verifying a plurality of public keys using an elliptic curve cryptographic algorithm. You can quickly verify your public key.

In addition, according to an exemplary embodiment of the present invention, an initial execution time of a secure communication for verifying a public key between devices may be reduced by quickly verifying a plurality of public keys.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise.

1 is a diagram schematically illustrating a public key verification system for verifying a plurality of public keys according to an embodiment of the present invention, and FIG. 2 is a public key authentication device and an authentication device of the public key verification system shown in FIG. 1. It is a figure which shows schematically the structure of this.

As shown in FIG. 1, the public key verification system 1 according to an embodiment of the present invention includes a public key authentication device 100 and an authentication device 200, 300, and 400.

In the exemplary embodiment of the present invention, three public keys Q1, Q2, and Q3 are verified by showing three authenticated devices 200, 300, and 400, but the present invention is not limited thereto. The public key for the authenticated device can also be verified at once. Herein, the public keys Q1, Q2, and Q3 according to the embodiment of the present invention are generated using the scalar values P1, P2, and P3 and the base point G, which are private keys, respectively. Has a value. A specific generation method for generating public keys Q1, Q2, and Q3 will be described later.

The public key authentication device 100 receives the public keys Q1, Q2, and Q3 from each of the devices 200, 300, and 400, and verifies the validity of the transmitted public key public keys Q1, Q2, and Q3. do.

Referring to FIG. 2, the public key authentication apparatus 100 includes a public key authentication communication unit 110, a public key verification unit 120, and a public key authentication value generation unit 130.

The public key authentication communication unit 110 receives the public key Q1 from the device 200 by performing communication with each of the devices 200, 300, and 400, and receives the public key from the device 300. Q2) is received, and the public key Q3 is received from the device 400 to be authenticated. The public key authentication communication unit 110 transmits the transmitted public keys Q1, Q2, and Q3 to the public key verification unit 120.

The public key verification unit 120 verifies the validity of the public keys Q1, Q2, and Q3 transmitted from each of the authenticated devices 200, 300, and 400 using an elliptic curve cryptographic algorithm as a public key authentication method.

In detail, the public key verification unit 120 detects a point value for each of the public keys Q1, Q2, and Q3 by applying an elliptic curve cryptographic algorithm to the public keys Q1, Q2, and Q3. The public key verification unit 120 generates a public key point PT by adding point values for each of the detected public keys Q1, Q2, and Q3. The public key verification unit 120 receives a public key authentication value for each of the authenticated devices 200, 300, and 400 stored in advance from the public key authentication value generation unit 130. Public key authentication value according to an embodiment of the present invention is the number of public keys (Q1, Q2, Q3) and each point value of the public keys (Q1, Q2, Q3) of each device 200, 300, 400 In addition, it includes a hash value for the generated point PT. The public key verification unit 120 determines whether the number of the generated public key point PT and the public keys Q1, Q2, and Q3 matches a pre-stored public key authentication value.

If the number of the public key point PT and the public key public keys Q1, Q2, and Q3 matches a pre-stored public key authentication value, the public key verification unit 120 performs authentication of the device 200, 300, or 400. It is determined that all public keys Q1, Q2, and Q3 are valid. On the other hand, when the number of the public key point PT and the public key public keys Q1, Q2, and Q3 does not match the pre-stored public key authentication value, the public key verifying unit 120 performs the authentication device 200 or 300. The public key of some of the authenticated devices is determined to be missing or invalid.

The public key authentication value generation unit 130 uses the public keys Q1, Q2, and Q3 to add the public key points PT and the public keys Q1, Q2 to each point value of the public keys Q1, Q2, and Q3. , Public key authentication value having a hash value of the number of Q3) is generated and stored in advance. In addition, the public key authentication value generation unit 130 transmits the public key authentication value generated at the request of the public key verification unit 120 to the public key verification unit 120.

1 and 2, the apparatus 200, 300, and 400 generate and store public keys Q1, Q2, and Q3, respectively, and communicate the generated public keys Q1, Q2, and Q3. It performs and transmits to the public key authentication apparatus 100.

The device 200 to be authenticated includes an authenticated communication unit 210 and a public key generator 220.

The authenticated communication unit 210 receives the public key Q1 from the public key generation unit 220 and performs communication to transfer the public key Q1 to the public key authentication device 100.

The public key generation unit 220 generates and stores a public key Q1 = P1 * G by multiplying a scalar value P1, which is a private key of the apparatus 200 to be authenticated, with a published base point G. When the public key generation unit 220 requests the authenticated communication unit 210, the public key generator 220 transmits the generated public key Q1 to the authenticated communication unit 210.

The device 300 to be authenticated includes an authenticated communication unit 310 and a public key generation unit 320.

The authenticated communication unit 310 receives the public key Q2 from the public key generator 320, and communicates the public key Q2 to the public key authentication device 100.

The public key generation unit 320 generates and stores a public key (Q2 = P2 * G) by multiplying a scalar value (P2), which is a private key of the device to be authenticated, with the published base point (G). When the public key generation unit 320 requests the authenticated communication unit 310, the public key generator 320 transmits the generated public key Q2 to the authenticated communication unit 310.

The device 400 to be authenticated includes an authenticated communication unit 410 and a public key generator 420.

The authenticated communication unit 410 receives the public key Q3 from the public key generation unit 420, and communicates the public key Q3 to the public key authentication device 100.

The public key generation unit 420 multiplies the scalar value P3, which is the private key of the device 400 to the public base point G, and generates and stores the public key Q3 = P3 * G. If there is a request from the authenticated communication unit 410, the public key generator 420 transmits the generated public key Q3 to the authenticated communication unit 410.

3 is a diagram illustrating a procedure of verifying a plurality of public keys in the public key verification system shown in FIG. 1.

As shown in FIG. 3, the public key authentication communication unit 110 of the public key authentication device 100 according to an embodiment of the present invention communicates with each of the devices 200, 300, and 400 to public key ( Q1, Q2, and Q3) are received (S300). The public key authentication communication unit 110 transmits the transmitted public keys Q1, Q2, and Q3 to the public key verification unit 120.

The public key verification unit 120 generates a public key point PT by adding each point value of the public keys Q1, Q2, and Q3 (S310). The public key verification unit 120 receives a public key authentication value for each of the authenticated devices 200, 300, and 400 stored in advance from the public key authentication value generation unit 130 (S320). The public key verification unit 120 determines whether the number of the generated public key point PT and the public keys Q1, Q2, and Q3 matches a pre-stored public key authentication value (S330).

If the number of the public key point PT and the public key public keys Q1, Q2, and Q3 matches a pre-stored public key authentication value, the public key verification unit 120 performs authentication of the device 200, 300, or 400. It is determined that all public keys Q1, Q2, and Q3 are valid (S340). On the other hand, when the number of the public key point PT and the public key public keys Q1, Q2, and Q3 does not match the pre-stored public key authentication value, the public key verifying unit 120 is the device 200, 300 to be authenticated. In step S350, it is determined that the public key of some of the authenticated devices is missing or invalid.

As such, the public key authentication device 100 of the public key verification system 1 according to the embodiment of the present invention has a certificate for each public key Q1, Q2, Q3 of the device 200, 300, 400 to be authenticated. Using the number of public key points (PT) and public keys (Q1, Q2, Q3) generated by adding each point value of public keys (Q1, Q2, Q3) using the elliptic curve cryptographic algorithm, As a plurality of public keys are verified, a plurality of public keys can be quickly verified at a time, unlike the conventional elliptic curve encryption algorithm, which requires a large amount of time and cost by authenticating a public key by scalar operation.

The embodiments of the present invention described above are not implemented only through the apparatus and the method, but may be implemented through a program for realizing a function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded. Implementation may be easily implemented by those skilled in the art from the description of the above-described embodiments.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

1 is a diagram schematically illustrating a public key verification system for verifying a plurality of public keys according to an embodiment of the present invention.

FIG. 2 is a diagram schematically showing the configuration of a public key authentication device and a device under authentication of the public key verification system shown in FIG. 1.

3 is a diagram illustrating a procedure of verifying a plurality of public keys in the public key verification system shown in FIG. 1.

Claims (11)

A system for verifying a plurality of public keys by receiving public keys from a plurality of authenticated devices, respectively, Receive the plurality of public keys delivered from the plurality of authenticated devices, apply an elliptic curve cryptographic algorithm to the plurality of public keys to generate public key points for the plurality of public keys, and the plurality of public keys. A public key verification unit that determines the validity of the plurality of public keys according to the number of keys and whether or not the public key point matches a pre-stored public key authentication value, and A public key authentication value generation unit that generates and stores the public key authentication value in advance using the plurality of public keys. Public key verification system comprising a. The method of claim 1, The public key verification unit, If the number of the plurality of public keys and the public key point match the public key authentication value, it is determined that the plurality of public keys is valid, And when the number of the plurality of public keys and the public key point do not coincide with the public key authentication value, determining that some public keys of the authenticated device are missing or invalid. The method of claim 2, The public key verification unit, The elliptic curve cryptographic algorithm is applied to the plurality of public keys to detect point values for each of the plurality of public keys, and the point values for each of the plurality of public keys are added to generate the public key points. Public key verification system. The method of claim 2, The public key authentication value generation unit, And generating and storing the public key authentication value having a hash value of the public key point and the number of the plurality of public keys in advance using the plurality of public keys. The method of claim 1, And a public key authentication communication unit configured to communicate with the plurality of authenticated devices to receive the plurality of public keys. 6. The method according to any one of claims 1 to 5, And the plurality of public keys are generated using a scalar value and a base point, which are private keys of the corresponding authentication device. A method for verifying a plurality of public keys by passing public keys from a plurality of authenticated devices, respectively, Communicating with the plurality of authenticated devices to receive the plurality of public keys; Generating an public key point for the plurality of public keys by applying an elliptic curve cryptographic algorithm to the plurality of public keys; and Determining the validity of the plurality of public keys by determining whether the number of the plurality of public keys and the number of the public key points match a pre-stored public key authentication value. Public key verification method comprising a. The method of claim 7, wherein Validating the step, Determining that the plurality of public keys is valid when the number of the plurality of public keys and the public key point match the public key authentication value, and If the number of the plurality of public keys and the public key point do not match the public key authentication value, determining that some public keys of the authenticated device are missing or invalid; . The method of claim 8, Generating the public key point, Detecting a point value for each of the plurality of public keys by applying the elliptic curve cryptographic algorithm to the plurality of public keys; and And generating the public key point by adding point values for each of the plurality of public keys. 10. The method of claim 9, Generating the public key point, Generating the public key authentication value having a hash value of the number of the public key points and the plurality of public keys by using the plurality of public keys and storing the public key authentication value in advance. The method according to any one of claims 7 to 10, And the plurality of public keys are generated by using a scalar value and a base point, which are private keys of the respective authenticated devices.

Images