KR20140071775A - Cryptography key management system and method thereof - Google Patents

Abstract

In the present invention, in a platform operating environment requiring reliability of a terminal by a server such as DRM, game, internet banking, online shopping, etc., a secret key of a user terminal By managing the keys by separating them into individual secret key fragments, malicious use by the terminal user or internal attacker can be prevented. Also, when updating the secret key due to a security policy and other reasons other than secret key exposures, the secret key module can be updated separately without revoking the public key certificate.

Description

TECHNICAL FIELD [0001] The present invention relates to an encryption key management system,

The present invention relates to the management of cryptographic keys, and more particularly to a method and apparatus for managing a cryptographic key using a terminal by a server such as digital rights management (DRM), game, internet banking, online shopping, In a platform operating environment requiring reliability, a secret key of a user terminal is separated and managed as separate secret key fragments for software-based secure key management on a cryptographic key used in a user terminal, The present invention relates to a cryptographic key management system and method for preventing malicious use by a user or an internal attacker.

In general, various cryptographic techniques are used to securely authenticate and exchange data between two entities (server-client communication or P2P communication) through a public channel on the network. Among these cryptographic techniques, the public key cryptographic technique has an advantage over the symmetric key cryptographic technique in terms of the key management, and has a merit that it can satisfy special requirements such as non-repudiation. At this time, such a public key encryption technique should be used in conjunction with a public key infrastructure (PKI) technology to confirm whether the public key of the specific entity is correct for the entity. PKI technology is used in electronic financial transaction, SSL communication, etc. Recently, OMA DRM is also used in copyright protection technology.

The security of these traditional password-based information security technologies depends on the secure management of keys. That is, even if both the encryption algorithm and the communication channel are open, the attacker can not cryptographically (or probabilistically) break the security unless the key is exposed to the attacker. This model has been recognized as valid for existing network security technologies. The attacker sees that he can attack only outside, not inside the system where cryptographic operations are performed. This type of attack is called black box attack.

In recent years, unlike black box attacks, attacks that can directly or indirectly check information inside a system where cryptographic operations are performed have appeared. For example, although an attacker can not identify the inside of security hardware, many studies have been conducted on subchannel attacks such as detecting partial or full cryptographic keys by monitoring additional information such as computation time, power consumption, In this way, an attack that indirectly checks information inside the system is called a gray box attack.

Another attack is called white box attack in which an attacker directly verifies information inside the system in which a cryptographic operation is performed. For example, a program such as a key logger that breaks in the form of a virus or malicious code inside a system when a user receives a service such as Internet banking, etc., can be said to be a kind of white box attack. The use of reverse engineering techniques to unlock locks on DRM content can also be seen as another white box attack on users who normally receive services from the same specific service.

On the other hand, in a content-based service, various stakeholders (content rights owner, content provider, etc.) can perform services only when the terminal providing the client software (DRM agent) guarantees that the terminal operates according to their intention will be. Thus, securing the reliability of the terminal by the server must be performed in both directions. First, the client software provided by the server to the terminal must be integrity-protected. Second, sensitive information that must be maintained by the client software in the terminal should not be exposed to the attacker (confidentiality).

For example, OMA DRM uses PKI technology to authenticate a terminal and to provide a secure rights object to the terminal. That is, if the terminal certificate and the secret key are stored in the terminal and the license management server encrypts the rights object that can access the encrypted content using the public key of the terminal certificate, the DRM agent of the terminal uses the secret key of the terminal The encrypted content can be used by using the decrypted information of the rights object.

At this time, if the DRM agent of the terminal is modulated by the attacker, illegal use such as bypassing a specific code, intentionally leaking secret key information or decrypted content is possible. Also, even if this DRM agent is not tampered, If there is a way to access key information, similar attacks will be possible.

Therefore, sensitive information such as a secret key, which should be maintained by the client software in the terminal, must be safely managed because the attacking effect when the information is leaked is very large. Also, this information should be stored in an encrypted form when stored in a storage device, and should be minimized in the case of being loaded in a plain text form or in a plain text form even when loaded in a memory during execution. For this purpose, hardware TPM chip that stores sensitive information securely and solves cryptographic operation internally, and TrustZone technology of arm series chip that guarantees secure execution environment can be utilized.

Korean Patent Laid-Open No. 10-2008-0031965 Disclosure Date Apr. 11, 2008 discloses a technology related to a network user authentication system and method.

However, as services using open platforms such as smart phones, tablets, and smart TVs are increasing, it becomes difficult to use specific hardware chips and it is required to solve them by software. It is known to be impossible. In this situation, although it is not possible to solve it perfectly, it is difficult to attack by applying techniques that increase attack cost and time of attacker.

There are various techniques such as Code Obfuscation, Code Diversity, and Code Encryption in order to make analysis of specific software codes difficult. However, And management techniques are not known beyond white-box cryptography, which is not fully secure. Therefore, in an environment where a white box attack is possible, such as a DRM service, there is a need to securely store and manage a secret key to be stored in the terminal software.

Accordingly, in a platform operating environment requiring reliability of a terminal by a server such as DRM, game, internet banking, online shopping, etc., the present invention provides a software- The present invention provides a cryptographic key management system and method for preventing a malicious use by a terminal user or an internal attacker by separating and managing a secret key of a terminal into individual secret key fragments.

A key issuing server for generating a secret key in response to the key issuing request when the key issuing request for encryption is received and transmitting the encrypted secret key by encrypting the secret key; Receiving the encrypted private key by transmitting the key issuance request to the issuing server, and decrypting the encrypted message using the packed private key when the encrypted message is received.

In addition, the user terminal may re-decrypt the decrypted message using a white box cryptography based library to recover the original message.

The white box cryptography based library is transmitted from the key issuing server to the user terminal together with the encrypted secret key.

In addition, the encrypted message is encrypted with the public key of the user terminal.

The key issuing server generates a public key together with the private key when generating the private key, and generates a public key certificate by combining the public key and the identification information of the user terminal.

The key issuing server may generate the secret key and the public key using the RSA scheme.

Also, the key issuing server performs authentication for the user terminal when a key update request is received from the user terminal, generates a new secret key to be provided to the user terminal, re-encrypts the new secret key, and transmits the new secret key .

In addition, the key issuing server may transmit a white box password based library when the new secret key is transmitted.

According to another aspect of the present invention, there is provided an encryption key management system, comprising: a key issuing server for generating a secret key in response to a key issuing request when a key issuing request for encryption is received and transmitting the encrypted secret key by encrypting the secret key; And transmits the key issuing request to the key issuing server to receive the encrypted private key. When the encrypted message is received, the message issuing unit decrypts the message using the packaged secret key, and transmits the decrypted message to the key issuing server And re-decodes the original message into the original message.

In addition, the decrypted message includes the certificate of the user terminal and is transmitted to the key issuing server.

According to another aspect of the present invention, there is provided an encryption key management method in a cryptographic key management system including a user terminal and a key issuing server, the method comprising: requesting a key issuance server for encryption from the user terminal to the key issuing server; Generating a secret key in response to the key issuing request; encrypting the secret key again to generate an encrypted secret key and providing the encrypted secret key to the user terminal; Decrypting the message using the encrypted secret key upon receipt of the message, and re-decrypting the decrypted message using the white box cryptography based library to recover the original message.

The white box cryptography based library is transmitted from the key issuing server to the user terminal together with the encrypted secret key.

In addition, in the step of generating the secret key, the key issuing server may generate a public key together with the secret key, and generate a public key certificate by combining the identification information of the user terminal and the public key .

Also, the secret key and the public key are generated using the RSA method.

The key issuing server may further include a step in which the key issuing server performs authentication with respect to the user terminal when a key update request is received from the user terminal, a new secret key to be provided to the user terminal from the key issuing server, And encrypting and transmitting the encrypted data.

In addition, the key issuing server may transmit the white box password based library when the new secret key is transmitted from the key issuing server to the user terminal.

According to another aspect of the present invention, there is provided an encryption key management method in a cryptographic key management system including a user terminal and a key issuing server, the method comprising: requesting a key issuance server for encryption from the user terminal to the key issuing server; Generating a secret key in response to the key issuing request; encrypting the secret key again to generate an encrypted secret key and providing the encrypted secret key to the user terminal; Decrypting the message using the encrypted secret key upon receipt of the message, and transmitting the decrypted message to the key issuing server and re-decrypting the decrypted message into an original message.

In a platform operating environment requiring reliability of a terminal by a server such as DRM, game, Internet banking, online shopping, etc., a secret key of a user terminal Keys are separated and managed by individual secret key fragments, thereby preventing malicious use by a terminal user or an internal attacker. Also, when the secret key is updated due to a security policy and other reasons other than a secret key exposure, there is an advantage that only the secret key module can be updated separately without revoking the public key certificate.

1 is a configuration diagram of an encryption key management system according to an embodiment of the present invention;
2 is a configuration diagram of an encryption key management system according to another embodiment of the present invention;

Hereinafter, the operation principle of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions of the present invention, and may be changed according to the intentions or customs of the user, the operator, and the like. Therefore, the definition should be based on the contents throughout this specification.

Public-key cryptography algorithms widely used in PKI environments include RSA and ECC technologies. Among them, RSA is very intuitive, and it is used extensively because it has the advantage of being able to process encryption and signature with the same algorithm. OMA DRM also securely decrypts the decryption key for the encrypted rights object with RSA public key / I am doing encryption and decryption. The RSA public key algorithm is based on the assumption that it is difficult to decompose a very large number of prime numbers. The basic key generation and encryption / decryption methods are as follows.

One. RSA  Password Technology (1024 bit RSA )

1) Key generation

- Select random prime numbers p and q of 512 bits

(n) = (p-1) * (q-1) (by Euler Totient Function)

- Select a random e with Φ (n)

- Calculate d that satisfies the condition of [Equation 1] below

[Equation 1]

e * d = 1 mod? (n)

Here, the RSA public key is (e, n) and the secret key is (d).

2) Encryption

For a given message M, if M is larger than n, it is divided into blocks of size n to make 0 <M <n. On the other hand, the message C encrypted with M is calculated as shown in the following equation (2).

&Quot; (2) &quot;

C = M ^e mod n

3) Decryption

For a given encrypted message C, its original message M is computed as in Equation (3) below using the secret key.

&Quot; (3) &quot;

M = C ^d mod n

At this time, digital signature for a specific message can be reversely applied to encryption decryption.

2. Whitebox Cryptography

White-box cryptography is a technology that has been studied to counter attacks in which an attacker directly verifies information inside a system where cryptographic operations are performed, like the above-mentioned white box attack. In white-box cryptography, cryptographic keys are blended into software-implemented cryptographic algorithms and it is difficult to find cryptographic keys even when looking at cryptographic algorithms and intermediate data values generated during execution.

In other words, white-box cryptography makes keys and algorithms correspond to tables of plaintext and ciphertext, making it difficult to easily guess the ciphertext even through internal operations. The ideal form is to make one big correspondence table, but this is not practically possible because the size of the table is very large. Therefore, the table is appropriately separated by a cryptographic technique, and an encoding / decoding process is performed so that the intermediate value is not exposed.

For details, see "White-box DES implementation for DRM application" by S. Chow et al., "White-box cryptography and an AES implementation".

However, the white-box cryptographic technology disclosed through the paper to date is mainly limited to symmetric key cryptography such as DES and AES.

Hereinafter, the encryption key management method of the present invention will be described in detail based on the RSA encryption technique and the white box encryption technology described above.

First, when using a cryptographic algorithm and a security protocol based on the encryption algorithm, the most important thing is to make sure that the secret key d of the user is not easily known by the attacker (including the user). When the secret key d is exposed, the rights object encrypted with the public key of the terminal can be easily decrypted, which is very dangerous.

There may be a way to store the secret key on a specific server and have the cryptographic operation performed on this server. However, it is necessary to access this server whenever a cryptographic operation is required. In this case, the terminal or the user must be authenticated in order to confirm the access authority. In this case, the terminal needs to be issued a certificate twice or another authentication method It is very uncomfortable.

In order to solve the problem of key management, the present invention constitutes an encryption key management system as shown in FIG.

Referring to FIG. 1, the user terminal 100 issues a key issuance request to the key issuing server 110 (S1). This work can be done at the platform installation stage such as firmware and OS in the production process of the terminal, or online. However, when requesting a key issuance online, it is necessary to be able to request a key issuance after a separate authentication procedure.

The key issuing server 110 receives the request and generates an RSA secret key and a public key pair. This value is identical to the traditional RSA key generation. Let PK _device {e, n} be the generated public key and SK _device {d} be the secret key. First, the public key certificate CERT _device is created by combining the identity of the terminal and the public key. Then, the secret key is wrapped or encrypted so that the secret key is not exposed (S2).

At this time, a method of encrypting the secret key in step S2 is as follows.

First, since the key issuing server 110 knows the two prime numbers p and q that are needed when generating n, which is a part of the RSA public key, the key issuing server 110 uses the same method as generating the secret key and the public key pair, The two random numbers e ₁ and d ₁ satisfying Eq. 4 are extracted.

&Quot; (4) &quot;

e ₁ * d ₁ = 1 mod 陸 (n)

Then, the secret key of the terminal is hidden using e ₁ as shown below and in Equation (5).

&Quot; (5) &quot;

WrappedSKdevice {d '} = d * e ₁ mod? (N)

d ₁ to create a whitebox cryptography-based library DEC_d ₁ () that is applicable at the time of decryption or signing at the user terminal 100 so that this value is not exposed. Or you can use another way of obfuscation, but you should not be able to find d ₁ easily from this library. This library is an operation that performs a d ₁ exponentiation on a given input value.

The encrypted public key value WrappedSK _device {d '} and the white box password based library DEC_d ₁ () are transmitted to the user terminal 100 in the generated public key certificate CERTdevice (including the public key of the terminal in this) (S3). Here, since the private key d is not directly stored in the user terminal 100, the value is not directly exposed to the internal attacker.

Later, the message C (= M _e mod n) if received (S4), the user terminal 100 are encrypted secret key to the message WrappedSK _device {d '} value encrypted with the public key of the user terminal 100 And decodes it first. At this time, the decoded result is restored to C 'instead of the original message, which is expressed by Equation (6) below.

&Quot; (6) &quot;

If this message is re-decrypted using the white box password based library DEC_d ₁ (), the original message M can be recovered as shown in Equation (7) below (S5).

&Quot; (7) &quot;

An advantage of this technique is that when a secret key update is required in the security policy (for example, a key stored in the software is required to be updated once a month in the security policy) except for the case where the secret key d is exposed, And easily update the secret key without changing the public key certificate. In other words, if the secret key d itself is hidden by the white box cryptosystem, d may not be revealed. However, when updating the secret key, the public key certificate of the terminal is revoked and a new certificate is installed. It can be very inconvenient because it affects all services.

In order to have this advantage, when the secret key update is required according to the security policy of the user terminal 100 or the key management service, the user terminal 100 performs the key update through the following procedure.

First, the user terminal 100 sends a key update request to the key issuing server 110 (S6). At this time, a separate authentication process may be performed, or authentication may be performed through signature using the encrypted secret key of the user. Since the key issuing server 110 knows e and d ₁ , it can perform verification even if the user signs it using d '.

After the authentication is completed, the key issuing server 110 carries out a re-wrapping operation (S7) for the key update through the following procedure. This can be accomplished through the following process, similar to the first key packaging operation. First, two random numbers e ₂ and d ₂ satisfying the following equation (8) are selected.

&Quot; (8) &quot;

e ₂ * d ₂ = 1 mod? (n)

Then, the existing encrypted secret key of the user terminal 100 is hidden using e ₂ as in the following equation (9).

&Quot; (9) &quot;

WrappedSKdevice {d ''} = d * e ₂ mod Φ (n)

Next, as in the key generation and packaging process S2 of FIG. 1, the terminal generates a white box password based library DEC_d ₂ () that can be applied at the time of decryption or signing so that the value is not revealed using d ₂ . This library is an operation that performs a d ₂ exponentiation on a given input value.

The repacked secret key value WrappedSK _device {d ''} and the white box password based library DEC_d ₂ () thus generated are transmitted to the user terminal 100 (S8).

When an encryption message arrives, the decryption, signature, and key update procedures can be continuously performed in the same manner.

Instead of giving WrappedSKdevice {d '} to the user terminal 100 in the above description, this can also be transmitted in the form of a library using the white box encryption technique. However, in general, the performance of the white box cryptosystem is relatively slow and the size of the module is relatively large as compared with the case where the key is applied as it is. Therefore, it is more preferable to apply the white box cryptosystem through the method described with reference to FIG.

If it is difficult to recognize the security of the white box cryptographic technology, or if it is difficult to transfer and run the library, you can think of a way to avoid using the white box cryptography based library by applying the method described above.

Here, the principle is that the server does not store the white-box password-based library DEC_d ₂ () in the terminal, but performs the operation of exponentiation of d ₂ on the server. This process will be described in detail with reference to FIG.

First, when receiving the key issuance request from the user terminal (100) (S11), the key issuing server 110 stores, instead of generating DEC_d d _{2 2} () in the key generation and packaging step (S12). And, when delivering the packaged key (S13) steps (S3) in FIG. 1 and otherwise does not store DEC_d ₂ () to the user terminal 100.

Next, when the encryption message is received in the user terminal 100 (S14), the re-decryption process using the DEC_d ₁ () in the decryption process (S5) of FIG. ₁ is omitted and the wrapped secret key WrappedSK _device {d '} Value (S15). At this time, the decoded result is restored to C 'instead of the original message, which is shown in Equation (10) below.

&Quot; (10) &quot;

Since the original message has not yet been completely decrypted, the user terminal 100 requests the key issuing server 110 to decrypt the message (S16). This message must include the certificate and C 'of the terminal and may be added to the WrappedSK _device {d'} to authenticate the user. Also, the session created through authentication must be securely protected.

Then, the key issuing server 110 can extract the original message M by decrypting the message using d1 (S17). When the message is securely transmitted to the user terminal 100, the decryption is completed (S18).

As described above, in the present invention, software-based secure key management is performed on a cryptographic key used in a user terminal in a platform operating environment requiring reliability of a terminal by a server such as DRM, game, Internet banking, It is possible to prevent the malicious use by the terminal user or the internal attacker by separating and managing the secret key of the user terminal into individual secret key fragments. Also, when updating the secret key due to a security policy and other reasons other than secret key exposures, the secret key module can be updated separately without revoking the public key certificate.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention. Accordingly, the scope of the invention should not be limited by the described embodiments but should be defined by the appended claims.

100: user terminal 110: key issuing server

Claims (13)

A key issuing server for generating a secret key in response to the key issuing request when the key issuing request for encryption is received and transmitting the encrypted secret key by encrypting the secret key;
Transmits the key issuance request to the key issuing server to receive the encrypted secret key, decrypts the message using the packed secret key when the encrypted message is received, and transmits the decrypted message back to the white- A user terminal for restoring an original message by re-decrypting using a password-based library
The encryption key management system comprising:
The method according to claim 1,
The white box password based library includes:
And is transmitted from the key issuing server to the user terminal together with the encrypted secret key.
The method according to claim 1,
The key issuing server comprises:
Generating a public key together with the secret key when generating the secret key, and generating a public key certificate by combining the identification information of the user terminal and the public key.
The method according to claim 1,
The key issuing server comprises:
And a new secret key to be provided to the user terminal, and re-encrypts and transmits the new secret key after authenticating the user terminal when the key update request is received from the user terminal.
5. The method of claim 4,
The key issuing server comprises:
And transmits the white-box password-based library together when the new secret key is transmitted.
A key issuing server for generating a secret key in response to the key issuing request when the key issuing request for encryption is received and transmitting the encrypted secret key by encrypting the secret key;
And transmits the key issuance request to the key issuing server to receive the encrypted secret key. When the encrypted message is received, the message issuing server decrypts the message using the packed secret key, and transmits the decrypted message to the key issuing server And re-decodes the message into an original message
The encryption key management system comprising:
The method according to claim 6,
Wherein the decrypted message comprises:
Wherein the key issuing server includes the certificate of the user terminal and is transmitted to the key issuing server.
A method for managing an encryption key in an encryption key management system including a user terminal and a key issuing server,
Requesting the user terminal to issue a key for encryption to the key issuing server;
Generating a secret key in response to the key issuing request at the key issuing server;
Re-encrypting the secret key to generate an encrypted secret key and providing the encrypted secret key to the user terminal;
Decrypting the message using the encrypted secret key upon receipt of an encrypted message to the user terminal;
Decrypting the decrypted message again using the white box cryptography based library to restore the original message
The method comprising the steps of:
9. The method of claim 8,
The white box password based library includes:
And the encrypted secret key is transmitted from the key issuing server to the user terminal together with the encrypted secret key.
9. The method of claim 8,
In the step of generating the secret key,
Generating a public key together with the secret key in the key issuing server, and combining the identification information of the user terminal and the public key to generate a public key certificate.
9. The method of claim 8,
Performing authentication for the user terminal in the key issuing server when a key update request is received from the user terminal;
Generating a new secret key to be provided to the user terminal by the key issuing server, re-encrypting it, and transmitting
Further comprising the steps of:
12. The method of claim 11,
And transmitting the white-box password-based library together with the transmission of the new secret key from the key issuing server to the user terminal.
A method for managing an encryption key in an encryption key management system including a user terminal and a key issuing server,
Requesting the user terminal to issue a key for encryption to the key issuing server;
Generating a secret key in response to the key issuing request at the key issuing server;
Re-encrypting the secret key to generate an encrypted secret key and providing the encrypted secret key to the user terminal;
Decrypting the message using the encrypted secret key upon receipt of an encrypted message to the user terminal;
Transmitting the decrypted message to the key issuing server and re-decrypting the decrypted message into an original message
The method comprising the steps of:

Images