KR20020006985A - Certification service method in two different certifying system using certification gate way - Google Patents

Abstract

The present invention provides an authentication service using an authentication gateway that can be used as in the same environment even if the information security system and algorithms provided when exchanging / sharing information through electronic commerce or a network of the Internet are different.

To this end, the present invention installs an authentication gateway 60 that connects them between certification authorities 20 and 40 configured to authenticate users from a security system that is directly or indirectly connected to the Internet 10 or another network. By the authentication gateway 60 to mediate the algorithms and protocols used by both certification bodies in the middle, the authentication gateway 60 can check the database and the certificate of the certification authority to store and manage the use history And a module capable of exchanging certificates and encryption keys of both certificate authorities, and a module capable of encrypting / decrypting them.

As described above, the present invention can be easily used for electronic commerce because authentication services between heterogeneous systems having different authentication schemes on the Internet or a plurality of networks can be easily authenticated by the authentication gateway as in the same environment.

Description

Certification service method in two different certifying system using certification gate way}

The present invention provides an authentication service between heterogeneous authentication systems and a method using an authentication gateway that can be easily authenticated between different types of authentication services having different authentication schemes directly or indirectly connected to the Internet or a plurality of networks in the same environment. It is in

The Internet started from the wired internet and recently developed into the satellite internet using the wireless internet and the satellite communication network. Due to its nature, its openness and ease of information sharing and exchange dominate the e-commerce.

Since the Internet is not exposed to users in the case of long-distance communication using open network environment and distributed system environment, especially e-commerce, appropriate security measures are required.

In order to settle electronic commerce on the Internet, separate certification services are used from these certification bodies by establishing a certification body that verifies the user, confirms the identity between the trading parties, and verifies that the sender and receiver are legitimate users.

It is intended to protect the legitimate users who use it by preventing masquerading, message tempering, and disclosure of personal privacy.

Conventionally, the following information security services are provided for user authentication services.

First, authentication: identification between parties, preventing masquerading

Second, confidentiality: prevent exposure of transactions and prevent eavesdropping

Third, Integrity: Prevents message tempering and prevents unauthorized transaction text generation

Fourth, Nonrepudiation: Preventing Unfair Turnover, Transmitting and Receiving Transactions

The above authentication services are not interworked due to differences in cryptographic algorithms and authentication mechanisms used between the authentication systems.

Therefore, each trading party is the biggest obstacle to the global commerce, the direction of the development of the Internet, because the authentication solution that they receive from each other and the authentication service system of the other party (the encryption algorithm and the authentication service mechanism) are different from each other.

As such, the conventional authentication system has its usefulness only in a section using one authentication system mechanism and one encryption algorithm, and thus there is a problem in that authentication services between users using different authentication systems are not performed.

On the other hand, in order to share with each other, they can change one authentication solution specification to another authentication solution specification among different authentication solutions, manage the data, manage the data, and prove the transaction fact in the information security incident that may occur later. Separate services are required.

The present invention has been made in view of the above-mentioned conventional problems, and an object of the present invention is to provide an authentication gateway that can perform authentication service by connecting between heterogeneous authentication systems, even if anyone in the world uses a different authentication system. I would like to implement commerce safely and freely without any extra effort.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing a schematic configuration of an authentication service between heterogeneous authentication systems using an authentication gateway of the present invention;

2 is a flowchart illustrating a service method according to the present invention;

Explanation of symbols on the main parts of the drawings

10: Internet

20: certification authority A

30: Certificate Authority A user

40: certification authority B

50: Certificate Authority B user

60: authentication gateway

70: database

1 is a block diagram schematically illustrating a configuration according to a specific embodiment of a heterogeneous authentication service using an authentication gateway of the present invention.

In the present invention, two or more certification bodies (20, 40) for authenticating users (30, 50) from a security system directly or indirectly connected to the Internet (10) or another network are different. In addition, by installing a separate medium that connects the certification authority (20, 40), that is, the authentication gateway 60 to the algorithm and protocol used by both certification authorities (20, 40) via the authentication gateway (60) It is characterized by mediation in the middle.

The authentication gateway 60 is again equipped with a database 70 for proof of use and proof thereof, all of which are to be stored in the database.

In addition, the gateway 60 may mutually communicate with both certification bodies, and may exchange a module and a encryption key of both certification bodies 20 and 40 with a module capable of checking the certificates of the certification bodies 20 or 40. Modules that can be used to encrypt / decrypt them.

In addition, the public key of one authentication system and another authentication system is provided to the authentication gateway in advance, and the exchange of the public key is all managed by a module that can communicate with different authentication systems at the authentication gateway. When new facts or changes are made, it is configured to automatically upgrade to a system that works with all applicable certification authorities.

In addition, the authentication gateway 60 has both encryption algorithms used by two certification authorities.

The operation and effects of the present invention configured as described above will be described in detail with reference to FIG. 2.

If user 30 using certification authority A 20 and user 50 of certification authority B 40 wish to communicate with each other via the Internet or a similar network, user 30 of certification authority A 20 ) Requests and receives the public key of the authentication gateway 60 from the certification authority A 20.

At this time, the user 30 of the certification authority A 20 first checks whether the counterpart 50 is the user of the certification authority B 40.

If the transaction counterpart 50 is a user of the certification authority B 40, the transaction counterpart 50 shares the session key with the authentication gateway 60, and encrypts it and delivers the encrypted document to the authentication gateway 60.

If it is determined that the counterparty is not a user of the certification body B 40, the counterparty informs the user 30 of the certification body A 20 that the counterparty is not a user of the certification body B 40, and simultaneously indicates the fact. Store in the base 70.

At this time, before the encrypted document is decrypted by the authentication gateway 60, the authentication gateway 60 requests and receives the public key of the counterparty, which is a user of the certification authority B 40, to the certification authority B 40.

The session key is then exchanged between the certification authority B 40 and the user 50. Thereafter, the authentication gateway 60 decrypts the original text of the user 30 of the certification authority A 20 with the session key of the authentication gateway 60 and the user 30 of the certification authority A, and again, the authentication gateway 60 and the certification authority. Encrypt with the session key of user 50 in B.

Thereafter, the authentication gateway 60 encrypts the encrypted text to the user 50 of the certification authority B 40 and transmits the cipher text, and stores the transaction results in the database 70.

The user 50 of the certification authority B 40 having received the encrypted text decrypts the transmission text with the session key with the authentication gateway 60 to confirm the original text.

As described above, the present invention can induce active transactions of electronic commerce between countries through the Internet by providing the authentication service of the same type by the authentication gateway between the different types of authentication services that are connected to each certification body having different mutual authentication systems. This will greatly contribute to increasing the credibility of e-commerce between countries.

As described above, the present invention enables electronic commerce between users using different authentication systems through an authentication gateway, so that electronic commerce through the Internet can be made safe and sound regardless of any authentication system in the world. Make sure

The provision of such services has the advantage of greatly reducing the inconvenience of e-commerce, which can greatly contribute to the development of a safe, healthy and convenient e-commerce industry.

Claims (4)

In the configuration of two or more certification bodies for authenticating users from a security system directly or indirectly connected to the Internet 10 or another network, An authentication gateway 60 is provided between the certification authorities 20 and 40 to connect them, so that the authentication gateway 60 arbitrates intermediately the algorithms and protocols used by both certification authorities. Authentication service method of this model authentication system. The method of claim 1, wherein the authentication gateway (60) includes a database (70) for storing and managing the performance of the authentication system users using the corresponding authentication gateway. The module of claim 1, wherein the authentication gateway 60 is capable of mutual communication with both certificate authorities, a module capable of checking a certificate of a corresponding certificate authority, a module capable of exchanging certificates and encryption keys of both certificate authorities, An authentication service method of a heterogeneous authentication system using an authentication gateway including a module capable of encrypting / decrypting each other. In the configuration of two or more certification bodies for authenticating users of the Internet 10 or a network, The user 30 using the certification authority A 20 installs an authentication gateway between the certification bodies 20 and 40 to arbitrate between the algorithms and protocols used by both certification bodies. If you want to communicate with user 50, Requesting, by the user 30 of the certification authority A 20, the certification authority A 20 the public key of the authentication gateway 60; Checking, by the user 30 of the certification authority A 20, whether the transaction counterpart 50 is a user of the certification authority B 40; If the transaction counterpart 50 is a user of the certification authority B 40, sharing the session key with the authentication gateway 60 and transferring the session key to the authentication gateway 60 as an encrypted document; If the counterparty is not a user of the certification body B (40), the counterparty informs the user 30 of the certification body A (20) that the counterparty is not a user of the certification body B (40) and stores the fact in the transaction performance database. Steps; Requesting, by the authentication gateway 60, the authentication partner B 40 the public key of the counterparty, the user of the authentication authority B 40, before the encrypted and transmitted document is decrypted by the authentication gateway 60; Exchanging a session key between Certificate Authority B (40) and its user (50); The original text of the user 30 of the certification authority A 20 is decrypted by the session key of the authentication gateway 60 and the user 30 of the certification authority A, and then again by the authentication gateway 60 and the user 50 of the certification authority B. Encrypting with a session key; Transmitting the cipher text to the user 50 of the certification authority B 40 and storing the transaction results in the database; Verifying the original text by decrypting the transmission text by the user 50 of the certification authority B 40 having received the encrypted message with the session key with the authentication gateway 60; Authentication service method of a heterogeneous authentication system using an authentication gateway, characterized in that consisting of.