KR102449817B1 - Multiple Implicit Certificates Issuing System Using Extension Functions and Issuing Method Therefor - Google Patents

Abstract

The certificate issuing system includes: a first user terminal, wherein the first user terminal calculates N inverse encryption function values using a random number p and a second expansion function, and the N inverse encryption function values Using , reverse-encrypt the encrypted N certificates and N private key reproduction information values to calculate N certificate and N private key reproduction information values, wherein the N private key reproduction information values are 2 Calculated using the server's private key value information.

Description

Multiple Implicit Certificates Issuing System Using Extension Functions and Issuing Method Therefor

The present invention relates to a system for issuing a plurality of implicit certificates using an extension function and a method for issuing the same.

In a general public key encryption method, a key pair is generated using an elliptic curve equation and used to generate a final public key. Here, a key pair refers to a random number and a value obtained by multiplying the random number by the base point, which is the coordinate of a point on the elliptic curve. In addition, the public key is included in the certificate issued by the public certification authority.

When a plurality of certificates are issued by generating a plurality of public keys, it may not be smooth in a limited communication environment. In order to issue a plurality of certificates, a butterfly key extension is used. In butterfly key extension, an extension function is used, and the element description of the extension function is block encryption technology.

Korean Patent Publication No. 10-2018-0053066 discloses a method and system for issuing an implicit certificate to which a key extension method is applied. However, in the case of Korean Patent Application Laid-Open No. 10-2018-0053066, since the certificate is issued between the host, which is the certificate requester, and the server of the higher-level certification authority that finally issues a plurality of certificates, the higher-level certification authority provides the identification information of the certificate requester. and the corresponding certificate information, it may indicate a vulnerability in terms of personal information protection.

The present invention is an invention for the purpose of solving the technical problems as described above, without acquiring the identification information of the certificate requester from the higher level certification authority, and only the certificate requester can know the final private key information, so personal information An object of the present invention is to provide a system for issuing a plurality of implicit certificates using an extension function capable of enhancing protection and an issuance method thereof.

The certificate issuing system of the present invention includes: a first user terminal, wherein the first user terminal calculates N inverse encryption function values using a random number p and a second expansion function, and the N inverse Using the encryption function value, the encrypted N certificates and N private key reproduction information are reverse-encrypted to calculate N certificates and N private key reproduction information. In addition, the N pieces of information for reproducing the private key are values used by the first user terminal to calculate the final private key.

Specifically, the second expansion function is calculated by dividing the first second internal function value by the order value of the elliptic curve equation as the first second expansion function value, wherein the first and second internal function values are, The second symmetric key, which is a random number, and the value obtained by adding 1 to 3 to the first second information value are encrypted by the first encryption function, respectively, and then to the value obtained by adding 1 to 3 to the first first information value and X- It is a value output by concatenating the result of an OR operation and X-OR operation. In addition, the first and second information values are values calculated using first index information and second index information, which are information corresponding to indexes for N certificates. Preferably, the second expansion function is calculated by dividing a w-th second internal function value by the order value of the elliptic curve equation as a w-th second expansion function value, and the w-th second internal function value is, after encrypting the value obtained by adding 1 to 3 to the w-th second information value calculated using the second symmetric key and the w-1 second information value by the first encryption function, the w-th It is a value outputted by performing X-OR operation with a value obtained by adding 1 to 3 to 2 information values, and linking the results of the X-OR operation, wherein w is a natural number equal to or greater than 2 and less than or equal to N.

In addition, the encryption by the first encryption function includes the steps of (S100) calculating the k-th round key (R _k ) using the S value; and (S200) generating an encrypted output using the k-th round key (R _k ) calculated in step S100 and the value T. Here, the S value is the second symmetric key value. In addition, the T value is a value obtained by adding one of the first and second information values to the N-th second information value and one of 1 to 3.

Specifically, in step S100, (S110) S is divided into 32-bit word units S _b0 , S _b0+1 , S _b0+2 and S _b0+3 , and S _b0 , S _b0+1 , S _b0 By calculating each of ₊₂ and S _b0+3 and preset values F _b0 , F _b0+1 , F _b0+2 and F _b0+3 , respectively, the initial four keys U _b0 , U _b0+1 , U _b0+2 are calculated. and outputting U _b0+3 ; (S120) sequentially X-ORing U _k+1 , U _k+2 and U _k+3 and a constant V _k ; (S130) converting the result of step S120 by a nonlinear function; (S140) converting the result of step S130 by a linear function; and (S150) performing an X-OR operation on the results of steps U _k and S140 to calculate U _k+4 ; including, while increasing k by 1 from b0 to (b0+31), steps S120 to S150 The steps are repeatedly performed, and U _k+4 of step S150 is calculated as the k-th round key (R _k ), wherein b0 is a preset integer.

In addition, the step S200 may include (S210) dividing T into 32-bit word units T _d0 , T _d0+1 , T _d0+2 and T _d0+3 ; (S220) sequentially X-ORing T _k+1 , T _k+2 and T _k+3 and the k-th round key (R _k ); (S230) converting the result of step S220 by a nonlinear function; (S240) converting the result of step S230 by a linear function; and (S250) performing an X-OR operation on T _k and the result of step S240 to calculate T _k+4 ; Step S250 is repeatedly performed, and finally (T _d0+31+4 , T _d0+31+3 , T _d0+31+2 , T _d0+31+1 ) is outputted, wherein d0 is a preset integer. characterized in that

In addition, it is preferable that the first user terminal calculates the final private key by using the random number a, the first expansion function, the hash function values of the N certificates, and the N pieces of information for reproducing the private key. In addition, the first user terminal is characterized in that it transmits one certificate to the second user terminal.

Preferably, the second user terminal calculates one final public key by using one certificate received from the first user terminal and a public key value of the second server known in advance. In addition, the one final public key is a value obtained by multiplying the hash function value of the one certificate by a value calculated by decoding the one certificate; and the public key value of the second server. do.

In addition, the certificate issuance system of the present invention further includes the second server, wherein the second server multiplies the base point G on the elliptic curve equation by a random number c, and the N data received from the first server It is preferable to calculate N third keys by adding the 2-1 keys, respectively.

In addition, the second server converts the values of the N third keys into N octet strings that are N certificates by encoding, and the hash function value of each of the N certificates and the value of the second server. It is characterized in that by using the private key value, the N pieces of information values for reproducing the private key are calculated. In addition, each of the N private key reproduction information values is a value obtained by multiplying each hash function value of each of the N certificates by a random number c and adding the private key value of the second server.

The method for issuing a certificate according to the present invention includes the steps of: (S13) calculating, by a first user terminal, N inverse encryption function values using a random number p and a second expansion function; and (S14) the first user terminal reverse-encrypts the encrypted N certificates and N private key reproduction information using the N inverse encryption function values to obtain N certificates and N private key reproduction information. Calculating; includes. Here, the N pieces of information for reproducing the private key are values used by the first user terminal to calculate the final private key.

In addition, in the certificate issuance method of the present invention, after step (S14), (S15) the first user terminal performs a random number a, a first extension function, hash function values of N certificates, and the N private keys. calculating a final private key by using the reproduction information; (S16) transmitting, by the first user terminal, one certificate to the second user terminal; (S42) using, by the second user terminal, one certificate received from the first user terminal and a public key value of the second server known in advance, calculating one final public key; further comprising characterized in that Specifically, the one final public key is a value obtained by multiplying the hash function value of the one certificate by a value calculated by decoding the one certificate; and the public key value of the second server.

In addition, in the certificate issuance method of the present invention, before the step (S13), (S32) the second server multiplies the base point G on the elliptic curve equation by a random number c, and the N received from the first server calculating N third keys by adding the 2-1 keys, respectively; and (S33) the second server converts the values of the N third keys into N OCTET STRINGs that are N certificates by encoding, and the hash function values of each of the N certificates and the second It characterized in that it further comprises; using the private key value of the server, calculating the N number of private key reproduction information values. Here, each of the N private key reproduction information values is a value obtained by multiplying each hash function value of each of the N certificates by a random number c and adding the private key value of the second server.

According to the system for issuing a plurality of implicit certificates using the extension function of the present invention and the issuance method thereof, the identity information of the certificate requester is not obtained from the upper certificate authority, and only the certificate requester can know the final private key information, Information protection can be strengthened.

1 is a block diagram of a system for issuing a plurality of implicit certificates using an extension function according to a preferred embodiment of the present invention;
Fig. 2 is a flowchart of an operation by a first encryption function;
3 is a detailed flowchart of step S100.
4 is a detailed flowchart of step S200.

Hereinafter, a system for issuing a plurality of implicit certificates using an extension function and an issuance method thereof according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

Of course, the following examples of the present invention are not intended to limit or limit the scope of the present invention only to embody the present invention. What can be easily inferred by an expert in the technical field to which the present invention belongs from the detailed description and examples of the present invention is construed as belonging to the scope of the present invention.

The system 100 for issuing a plurality of implicit certificates using an extension function using an extension function according to an embodiment of the present invention and an issuance method thereof use a butterfly key extension method.

First, FIG. 1 shows a configuration diagram of a plurality of implicit certificate issuance systems 100 using an extension function according to a preferred embodiment of the present invention.

As can be seen from FIG. 1 , the system 100 for issuing a plurality of implicit certificates using an extension function according to an exemplary embodiment of the present invention includes a first user terminal 10 , a first server 20 , and a second It may be configured to include the server 30 and the second user terminal 40 .

The first user terminal 10 , the first server 20 , the second server 30 , and the second user terminal 40 are computing devices each having a memory and a communication function.

Briefly describing the operation of the plurality of implicit certificate issuing system 100 using the extension function according to the preferred embodiment of the present invention, the first user terminal 10 generates N final private keys, and the second user terminal (40) generates one final public key.

In the process of issuing the final public key and N final private keys, the first server 20 is interposed between the first user terminal 10 and the second server 30 in order to strengthen the security of personal information. There is a feature of the present invention.

The first user terminal 10 may be, for example, a personal terminal such as a smart phone or a computer, and a vehicle terminal installed inside the vehicle.

The first user terminal 10 generates an arbitrary random number a in a range greater than an arbitrary 1 and less than an integer n, which can be said to be an initial private key value for signature. In addition, the first user terminal 10 generates an arbitrary random number p in a range greater than an arbitrary 1 and less than an integer n, which is an initial private key value for data encryption.

The first server 20 uses aG that forms a pair with the random number a by multiplying the base point G as the coordinate of any one point on the elliptic curve equation determined by the elliptic curve encryption algorithm for each of the random numbers a and p, We use pG that is paired with a random number p. For reference, since the random numbers a and p use the same elliptic curve equation, their base points are also the same value.

Here, random numbers a and p are private keys because they are used by the first user terminal 10 , and aG and pG are public keys because they are used by the first server 20 . In addition, since the private key and the public key have different values, they correspond to an asymmetric key.

The base point information is information known to all of the first user terminal 10 , the first server 20 , and the second server 30 .

In addition, the first user terminal 10 generates a first symmetric key and a second symmetric key.

The generated first symmetric key and the second symmetric key are transmitted to the first server 20 and used to generate a plurality of final private keys and a plurality of final public keys for key expansion, and are random numbers. Each of the first symmetric key and the second symmetric key is transmitted to the first server 20 so that the first user terminal 10 and the first server 20 use the same first symmetric key and the second symmetric key. It is called a symmetric key.

Also, the first user terminal 10 generates first index information and second index information.

The first index information and the second index information indicate information corresponding to an index for a plurality of certificates requested by the first user terminal 10, that is, index information, and the first index information issued at 11 o'clock on March 8, 2019 A value that gives the same meaning as the 1st certificate and the 2nd certificate. That is, the first index information and the second index information use certificate issuance time information. In this case, the first index information may correspond to the issuance date, date and time information, and the second index information may correspond to information indexing the order of the certificates issued on the corresponding issue date and time, and a serial number. That is, the first index information is upper index information, and the second index information indicates lower index information indexing the first index information more specifically.

The first user terminal 10 includes identification information of the first user terminal 10, aG, pG, a first symmetric key, a second symmetric key, first index information, second index information, and the number of required certificates. The N value, which is information, is transmitted to the first server 20 .

The first server 20 provides the identification information of the first user terminal 10 from the first user terminal 10, a value aG obtained by multiplying the random number a by the base point G on the elliptic curve equation, and the random number p and the elliptic curve equation. The value pG multiplied by the base point G of the phase, the first symmetric key, the second symmetric key, the first index information, the second index information, and the N value, which is information on the number of certificates, are received.

Specifically, the first server 20 may include: a first extension function inputting the first symmetric key, the first index information, the second index information, and the N value, which is information on the number of certificates; and aG value; to generate N 2-1 keys. In addition, the first server 20 may include a second extension function inputting the second symmetric key, the first index information, the second index information, and the N value, which is information on the number of certificates; and pG value; to generate N 2-2 keys.

The first expansion function f1(m) may be expressed as in Equation 1 below.

The meaning of the (A)mod(B) function in [Equation 1] is a modular operation function that calculates the remainder of dividing A by B as a result value. In addition, Y is the order value of the elliptic curve equation used by the first user terminal 10 to generate the key pair of a and aG, and the same elliptic curve equation is used in the first server 20 . That is, Y is also an order value of the elliptic curve equation used by the first server 20 . This order value is a constant value that can be easily obtained from the elliptic curve equation defined by the first user terminal 10 and the first server 20 . Also, f11(m) denotes the first internal function. Here, when m is set from 1 to N, N private keys are generated by the N first expansion functions of the first first expansion function f1(1) to the N-th first expansion function f1(N). can be created

Specifically, the first internal function f11(m) may be expressed as in Equation 2 below.

는 X-OR(Exclusive OR, 배타적 논리합) 연산을 나타낸다. 아울러, ||는 연결 기능을 나타내며, 일례로 A||B||C 는 A, B, C 값을 차례로 연결한 하나의 값을 나타낸다. 또한, ck는 제 1 대칭키를 의미한다. In [Equation 2], Enc means the first encryption function. The first encryption function will be described later. here

represents an X-OR (Exclusive OR) operation. In addition, || indicates a connection function, and for example, A||B||C indicates a single value obtained by sequentially connecting the values of A, B, and C. Also, ck means the first symmetric key.

As can be seen from [Equation 1] and [Equation 2], the first expansion function is the first expansion function value by dividing the remainder of the first first internal function value by the order value of the elliptic curve equation is calculated as Here, the first first internal function value is a value obtained by adding 1 to 3 to the first symmetric key and the first first information value, which are random numbers, respectively, after encryption by the first encryption function, the first first information value A value obtained by adding 1 to 3 to a value obtained by performing an X-OR operation, and linking the result of the X-OR operation to an output value.

In addition, the first expansion function calculates a residual value obtained by dividing the w-th first internal function value by the order value of the elliptic curve equation as the w-th first expansion function value. Here, the w-th first internal function value is obtained by adding 1 to 3 to the w-th first information value calculated using the first symmetric key and the w-1st first information value by the first encryption function, respectively. After encryption, an X-OR operation is performed with a value obtained by adding 1 to 3 to the w-th first information value, and the result of the X-OR operation is concatenated to become an output value. In addition, w is a natural number of 2 or more and N or less, it is characterized in that it is.

In addition, o1(1) and o1(m) are first information values, and may be expressed as follows [Equation 3] and [Equation 4].

For reference, o1(1) is an o1(m) value when m=1, and represents an initial value of o1(m). In addition, i and j represent first index information and second index information, respectively.

That is, o1(1) is defined by [Equation 3], and o1[2] to o1[N] are defined by [Equation 4]. In addition, 0 ³² represents a value of 32-bit 0.

The second expansion function f2(m) may be expressed as in Equation 5 below.

The meaning of the (A)mod(B) function in [Equation 5] is a modular operation function that calculates the remainder of dividing A by B as a result value. In addition, Y is the order value of the elliptic curve equation used by the first user terminal 10 to generate the key pair of p and pG, and the same elliptic curve equation is used in the first server 20 as well. That is, Y is also an order value of the elliptic curve equation used by the first server 20 . This value is the same as the Y value in [Equation 1]. Also, f21(m) denotes the second internal function. Here, when m is set from 1 to N, N public keys are generated by the N second expansion functions of the first and second expansion functions f2(1) to the N-th second expansion function f2(N). can be created

Specifically, the second internal function f21(m) may be expressed as in Equation 6 below.

는 X-OR(Exclusive OR, 배타적 논리합) 연산을 나타낸다. 아울러, ||는 연결 기능을 나타내며, 일례로 A||B||C 는 A, B, C 값을 차례로 연결한 하나의 값을 나타낸다. 또한, ek는 제 2 대칭키를 의미한다. In [Equation 6], Enc means the first encryption function. The first encryption function will be described later. here

represents an X-OR (Exclusive OR) operation. In addition, || indicates a connection function, and for example, A||B||C indicates a single value obtained by sequentially connecting the values of A, B, and C. Also, ek means the second symmetric key.

As can be seen from [Equation 5] and [Equation 6], the second expansion function is the first and second expansion function value by dividing the first and second internal function value by the order value of the elliptic curve equation. is calculated as Here, the first and second internal function values are the first and second information values after encrypting the values obtained by adding 1 to 3 to the second symmetric key and the first second information value, which are random numbers, respectively, by the first encryption function. A value obtained by adding 1 to 3 to a value obtained by performing an X-OR operation, and linking the result of the X-OR operation to an output value.

In addition, the second expansion function calculates a remainder value obtained by dividing the w-th second internal function value by the second symmetric key as the w-th second expansion function value. Here, the w-th second internal function value is a value obtained by adding 1 to 3 to the w-th second information value calculated using the second symmetric key and the w-1 second information value to the first encryption function, respectively. It is a value output by linking the result of X-OR operation with a value obtained by adding 1 to 3 to the w-th second information value after encryption by means of an X-OR operation. In addition, w is a natural number of 2 or more and N or less, it is characterized in that it is.

In addition, o2(1) and o2(m) are second information values, and may be expressed as in the following [Equation 7] and [Equation 8].

For reference, o2(1) is a value of o2(m) when m=1, and represents the initial value of o2(m). In addition, i and j represent first index information and second index information, respectively.

That is, o2(1) is defined by [Equation 7], and o2[2] to o2[N] are defined by [Equation 8]. In addition, 1 ³² represents a value of 32-bit 1, and 0 ³² represents a value of 32-bit 0.

The N 2-1 keys (B2(m)) generated by the first server 20 may be calculated as in the following [Equation 9].

As can be seen from [Equation 9], each of the N 2-1 keys is on the elliptic curve determined by the elliptic curve encryption algorithm in each of the first first expansion function value to the N-th first expansion function value. It can be expressed as a value obtained by adding a value obtained by multiplying the base point, which is the coordinate of a point; and a value obtained by multiplying a random number a and the base point.

The N 2-2 keys Q2(m) generated by the first server 20 may be calculated as in Equation 10 below.

As can be seen from [Equation 10], each of the N 2-2 keys is on the elliptic curve determined by the elliptic curve encryption algorithm in each of the first and second expansion function values to the N-th second expansion function values. It can be expressed as a value obtained by adding a value obtained by multiplying the base point, which is the coordinates of a point; and a value obtained by multiplying a random number p by the base point.

The first server 20 transmits the N 2-1 keys and the N 2-2 keys to the second server 30 .

The second server 30 is a server of a higher level certification authority of the first server 20 and is a server that issues a certificate. The second server 30 generates N third keys D3(m) by the following [Equation 11].

As can be seen from [Equation 11], the second server 30 multiplies the base point, which is the coordinate of any one point on the elliptic curve determined by the elliptic curve encryption algorithm, by a random number c, and N second By adding each -1 key, N third keys are calculated.

The second server 30 converts the values of the N third keys into N OCTET STRINGs by encoding. These N octek strings are N implicit certificates. That is, N implicit certificates are generated by the N third keys.

Let's define a hash (HASH) function that outputs digest information e when message information (Msg) is input as H(Msg). That is, the hash function result (e(m)) obtained by inputting the implicit certificate value (C-U) as the message information (Msg) value can be expressed by the following [Equation 12].

When m is set from 1 to N in [Equation 12], N hash function values are obtained. The second server 30 uses the hash function value of each of the N certificates and the private key value of the second server 30 to calculate the N private key reproduction information values.

Specifically, the second server 30 uses the hash function result value (e(m)), the random number c value, and the second server's own private key value (d _CA ) to obtain the public key built-in value (I_Q _CA ) It can be calculated as in the following [Equation 13].

In addition, the second server 30 adds the private key value (d _CA ) of the second server 30 to the value obtained by multiplying the hash function value of each of the N certificates by a random number c to reproduce the N pieces of private key reproduction information. The value r(m) can be calculated by the following [Equation 14].

As can be seen from [Equation 14], the N private key reproduction information values use the private key value information of the second server 30 .

The second server 30 encrypts the N implicit certificates and the N private key reproduction information values using the N 2-2 keys and transmits them to the first server 20 . In addition, the first server 20 transmits the encrypted N implicit certificates and N private key reproduction information values received from the second server 30 to the first user terminal 10 .

The first user terminal 10 calculates N inverse encryption function values Q4(m) by using the random number p and the second expansion function as shown in Equation 15 below.

In addition, the first user terminal 10 uses the N reverse encryption function values to reverse-encrypt the encrypted N certificates and N private key reproduction information to generate N certificates and N private key reproduction information. Calculate.

In addition, the first user terminal 10 includes a random number a, a first extension function f1(m), a hash function value of N certificates (e(m)), and N pieces of private key reproduction information r( m)), the final private key (B(m)) is calculated as in the following [Equation 16].

The value obtained by multiplying the final private key value of [Equation 16] by the base point G becomes the public key built-in value (I_Q _CA ) of [Equation 13]. That is, as can be seen from [Equation 16], the final private key value is a hash function value of N implicit certificates received from the second server 40, and the first user terminal 10 for N implicit certificates. It is a new private key value obtained from the initially generated random number a value and N pieces of private key reproduction information.

[Equation 13] becomes a public key built-in value issued by the second server 40 in response to the final private key of [Equation 16]. That is, I_Q _CA = B(m) × G, and B(m) is the only private key value that the first user terminal 10 calculates and owns with respect to the value m, which is an extension function variable.

As can be seen from [Equation 15] and [Equation 16], the first user terminal 10 may also calculate the first extension function and the second extension function. The first extension function and the second extension function calculated by the first user terminal 10 represent the same functions as the first extension function and the second extension function operated by the first server 20, respectively.

As shown in [Equation 15] and [Equation 16], the first user terminal 10 receives the requested number of final implicit certificates and final private keys from the second server 30, which is a higher authentication authority, while ensuring privacy. issuance can be completed.

Here, the N final private keys are private keys because they are keys used by the first user terminal 10 itself, and the N final implicit certificates are used in devices other than the first user terminal 10, so they are information for public key extraction. . For example, when the first user terminal 10 signs a document with the private key, the second user terminal 40, which is another user terminal that has received the document, provides an implicit certificate paired with the corresponding private key and the second server. extracts a public key corresponding to the private key of the first user terminal 10 using the public key of can be judged

When the first user terminal 10 transmits one implicit certificate, authentication content information, and signature information by the final private key to the second user terminal 40, the second user terminal 40 uses the public key from these information. should be extracted. Examples of the information of the authenticated content include documents, music, and the like. The second user terminal 40 generates one final public key (E_Q _CA ) using one certificate received from the first user terminal 10 and the public key information of the second server 30 known in advance. It is calculated as in the following [Equation 17].

In [Equation 17], e(n) is the hash function value of the certificate at m=n, D3(n) is the third key value at m=n, Q _CA is the public key value of the second server 30 indicates. In addition, the third key value becomes a coordinate value obtained by decoding the implicit certificate. That is, one final public key is a value obtained by multiplying the hash function value of one certificate by a value calculated by decoding one certificate; and the public key value of the second server.

In the system 100 for issuing a plurality of implicit certificates using an extension function according to a preferred embodiment of the present invention, for issuance of an implicit certificate, the third key value is converted into an octek string through an encoding process, and into the converted octek string One implicit certificate was created. Accordingly, when the implicit certificate in the form of an octek string is decoded again, it is converted into an information value for the third key. After multiplying the converted third key value by the hash function value for the implicit certificate, the public key information value (Q _CA ) of the second server 30 is added to extract the final public key value. Most of the second user terminals 40 have the public key certificate of the second server 30 and can extract the public key of the second server 30 from the public key certificate. Accordingly, the second user terminal 40 can easily calculate the public key of the first user terminal 10 after receiving the implicit certificate from the first user terminal 10 to communicate with. This method has an advantage in that the network load can be reduced because the implicit certificate does not contain the signature information of the second server 30 and thus a certificate issuing system having a small amount of information can be created. Even if there is no public key certificate of the second server 30 in the implicit certificate, the public key certificate of the second server 30 in order for the second user terminal 40 to extract the public key of the second user terminal 10 Since it can be stored and used, the signature authentication of the second server 30 for the extracted public key can be performed.

Hereinafter, the first encryption function calculated by the first user terminal 10 and the first server 20 will be described in detail.

2 shows a flowchart of an operation by the first encryption function.

As can be seen from FIG. 2 , the encryption by the first encryption function includes the steps of (S100) calculating the k-th round key (R _k ) using the S value; and (S200) generating an encrypted output using the k-th round key (R _k ) calculated in step S100 and the value T.

As can be seen from [Equation 2], when the first expansion function uses the first encryption function, the S value is the first symmetric key value, and the T value is the first first information value to the N-th first information value. One of; and one of 1 to 3; Similarly, as can be seen from [Equation 6], when the second expansion function uses the first encryption function, the S value is the second symmetric key value, and the T value is the first second information value to the N-th second information value. It is a value obtained by adding one of the information values and one of 1 to 3. That is, the S and T values are given as inputs.

3 is a detailed flowchart of step S100.

As can be seen from FIG. 3 , in step S100, (S110) S is divided into 32-bit word units S _b0 , S _b0+1 , S _b0+2 and S _b0+3 , and S _b0 , S _{b0 +1} , S _b0+2 and S _b0+3 , respectively, and preset values F _b0 , F _b0+1 , F _b0+2 and F _b0+3 are calculated, respectively, and the initial four keys U _b0 , U _b0+1 , U _b0+2 and U _b0+3 output; (S120) sequentially X-ORing U _k+1 , U _k+2 and U _k+3 and a constant V _k ; (S130) converting the result of step S120 by a non-linear function; (S140) converting the result of step S130 by a linear function; and (S150) performing an X-OR operation on the results of U _k and S140 to calculate U _k+4 . In step S100, steps S120 to S150 are repeatedly performed while increasing k by 1 from b0 to (b0+31) by steps S115, S160 and S170.

In addition, U _k+4 of step S150 is calculated as the corresponding k-th round key (R _k ). In addition, it is preferable that b0 is a preset integer. For example, b0 may be set to 0.

The initial four keys U _b0 , U _b0+1 , U _b0+2 and U _b0+3 in step S110 are respectively S _b0 , S _b0+1 , S _b0+2 and S _b0+3 and preset values, respectively. It is characterized in that it is calculated by X-OR operation of F _b0 , F _b0+1 , F _b0+2 and F _b0+3 . The nonlinear function of step S130 may use, for example, a preset correspondence table. In addition, the linear function of step S140 may be a shift operation as an example.

In step S100, after the transformation by the non-linear function in the step S130, the transformation by the linear function in the step S140 is performed to exhibit stronger encryption performance.

4 is a detailed flowchart of step S300.

As can be seen from FIG. 4 , step S200 includes (S210) separating T into 32-bit word units T _d0 , T _d0+1 , T _d0+2 and T _d0+3 ; (S220) sequentially X-ORing T _k+1 , T _k+2 and T _k+3 and the k-th round key (R _k ); (S230) converting the result of step S220 by a non-linear function; (S240) converting the result of step S230 by a linear function; and (S250) performing an X-OR operation on the results of T _k and S240 to calculate T _k+4 . In addition, in step S200, while increasing k by 1 from d0 to (d0+31) by steps S215, S260 and S270, steps S220 to S250 are repeatedly performed, and finally (T _{d0+31+ 4} , T _d0+31+3 , T _d0+31+2 , T _d0+31+1 ). d0 is a preset integer, and may be set to, for example, 0.

Similar to the step S100, the step S200 can exhibit stronger encryption performance by performing the transformation by the linear function in the step S240 after the transformation by the non-linear function in the step S230.

The nonlinear function of step S230 may use, for example, a preset correspondence table. In addition, the linear function of step S240 may be a shift operation as an example.

Hereinafter, a method for issuing a plurality of implicit certificates using an extension function according to a preferred embodiment of the present invention will be described.

The method for issuing a plurality of implicit certificates using an extension function according to a preferred embodiment of the present invention uses the plurality of implicit certificate issuance systems 100 using the above-described extension function. Of course, it includes all the features of the implicit certificate issuing system 100 of

In the method for issuing a plurality of implicit certificates using an extension function according to a preferred embodiment of the present invention, (S11) the first user terminal 10 includes the identification information of the first user terminal 10, the random number a and the elliptic curve The value aG multiplied by the base point G in the equation, the random number p multiplied by the base point G in the elliptic curve equation, pG, the first symmetric key, the second symmetric key, the first index information, the second index information, and the number of certificates and transmitting the N value of , to the first server 20 .

In addition, in the method for issuing a plurality of implicit certificates using an extension function according to a preferred embodiment of the present invention, (S21) the first server 20, the first user terminal 10 from the first user terminal 10 identification information, a value aG multiplied by a random number a and a base point G on the elliptic curve equation, a value pG multiplied by a random number p and a base point G on the elliptic curve equation, first symmetric key, second symmetric key, first index information; receiving second index information and an N value that is information on the number of certificates; (S22) a first extension function in which the first server 20 inputs the first symmetric key, the first index information, the second index information, and the N value, which is information on the number of certificates; and aG value; generating N 2-1 keys; (S23) a second extension function in which the first server 20 receives the second symmetric key, the first index information, the second index information, and the N value, which is information on the number of certificates; and pG value; generating N 2-2 keys; and (S24) transmitting, by the first server 20, the N 2-1 keys and the N 2-2 keys to the second server 30;

In addition, in the method for issuing a plurality of implicit certificates using an extension function according to a preferred embodiment of the present invention, (S31) the second server 30 receives the N 2-1 keys and N numbers from the first server 20 receiving a 2-2 key; (S32) The second server 30 adds N 2-1 keys to a value obtained by multiplying a base point, which is a coordinate of a point on an elliptic curve determined by an elliptic curve encryption algorithm, by a random number c, calculating a third key; (S33) The second server 30 converts the values of the N third keys into N OCTET STRINGs that are N certificates by encoding, and the hash function values of each of the N certificates and the second server using the private key value of (30) to calculate N private key reproduction information values; and (S34) the second server 30 encrypting the N implicit certificates and N private key reproduction information values using the N 2-2 keys and transmitting them to the first server 20; characterized in that

In addition, the N number of private key reproduction information values is a value obtained by multiplying the hash function value of each of the N certificates by a random number c, and it is characterized in that it is a value obtained by adding the private key value of the second server 30 .

Preferably, in the method for issuing a plurality of implicit certificates using an extension function according to an embodiment of the present invention, (S25) the first server 20 includes N implicit certificates encrypted from the second server 30 and receiving N private key reproduction information values; and (S26) transmitting, by the first server 20, encrypted N implicit certificates and N private key reproduction information values to the first user terminal 10;

In addition, in the method for issuing a plurality of implicit certificates using an extension function according to a preferred embodiment of the present invention, (S12) the first user terminal 10 obtains encrypted N implicit certificates and N private key reproduction information values. receiving from the first server 20; (S13) calculating, by the first user terminal 10, N inverse encryption function values using the random number p and the second expansion function; (S14) The first user terminal 10 reverse-encrypts the encrypted N certificates and N private key reproduction information by using the N inverse encryption function values to reproduce N certificates and N private key reproduction information. calculating ; (S15) calculating, by the first user terminal 10, the final private key by using the random number a, the first expansion function, the hash function values of the N certificates, and the N pieces of information for reproducing the private key; and (S16) transmitting, by the first user terminal 10 to the second user terminal 40, one certificate.

In addition, the method for issuing a plurality of implicit certificates using an extension function according to a preferred embodiment of the present invention includes the steps of (S41) receiving, by the second user terminal 40, one certificate from the first user terminal 10 ; and (S42) the second user terminal 40 generates one final public key using the one certificate received from the first user terminal 10 and the known public key information of the second server 20 in advance. It is preferable to further include a step of calculating;

The features of the plurality of implicit certificate issuance system 100 and the issuance method using the extension function of the present invention will be summarized below.

In the present invention, the second server 30, which is a higher level authentication authority, which has received the N 2-1 keys and the N 2-2 keys keys, serves to issue a plurality of final public key certificates. The second server 30 is in a situation where it cannot distinguish which first user terminal 10 has requested the certificate issuance.

On the other hand, the first server 20 can know the identification information of the first user terminal 10 requesting the certificate issuance, the first symmetric key and the second symmetric key using the first extension function and the second extension function, It is a situation in which important information about the first user terminal 10 is secured. Accordingly, since a security problem in the first server 20 may occur, the second server 30 assigns a random number c to the base point, which is the coordinate of any one point on the elliptic curve, to the received N 2-1 keys. By adding the multiplied value, a third key, which is a new public key, is set to enhance security for the first server 20 . That is, by setting the third key, which is a new public key, a new public key certificate different from the 2-2 key, which is a public key known by the first server 20 , may be transmitted to the first user terminal 10 . Accordingly, the first server 20 cannot know the public key information finally issued by the first user terminal 10, and the second server 30 is the second server 30 that is the public key transmitted by the first server 20. Because the correlation between the -2 key and the identification number of the first user terminal 10 is unknown, it is impossible to know which certificate corresponds to the first user terminal 10 . In other words, the protection of personal information can be strengthened.

That is, according to the present invention, the following objects can be achieved.

(1) The first user terminal 10, which initially requested a plurality of public key certificates, may receive a final plurality of public key certificates from the second server 30, which is a higher-level certification authority.

(2) Also, the first user terminal 10 may calculate and secure a plurality of corresponding private keys from a plurality of public key certificates.

(3) In addition, only the first user terminal 10 has information about the final private key.

(4) The first server 20, which is a registered certification authority, cannot know the public key value of the final public key certificate.

(5) The second server 30, which is a higher-level certification authority, cannot distinguish the first user terminals 10 requested for each of the plurality of certificates requested from several first user terminals 10 . That is, the privacy of the first user terminal 10 is guaranteed.

As described above, according to the plurality of implicit certificate issuance system 100 and its issuance method using the extension function of the present invention, the identification of the first user terminal 10, which is the certificate requester, in the second server 30, which is a higher level certification authority. Without acquiring information, only the certificate requestor can know the final private key information, so it can be seen that the protection of personal information can be strengthened.

100: Certificate issuance system
10: first user terminal
20: first server
30: second server
40: second user terminal

Claims (26)

In the certificate issuance system,
A first user terminal; including,
The first user terminal,
Using the random number p and the second expansion function, N number of inverse encryption function values are calculated,
Using the N de-encryption function values, reverse-encrypt the encrypted N certificates and N private key reproduction information values to calculate N certificate and N private key reproduction information values,
The N private key reproduction information values are,
The certificate issuance system, characterized in that it is a value used by the first user terminal to calculate the final private key. According to claim 1,
The second extension function is
The remainder of dividing the first and second internal function values by the order value of the elliptic curve equation is calculated as the first and second expansion function values,
The first and second internal function values are,
The second symmetric key, which is a random number, and the value obtained by adding 1 to 3 to the first second information value are encrypted by the first encryption function, respectively, and then to the value obtained by adding 1 to 3 to the first first information value and X- It is a value output by concatenating the result of OR operation and X-OR operation,
The first and second information values are,
A system for issuing certificates, characterized in that the values are calculated using first index information and second index information, which are information corresponding to indexes for N certificates. 3. The method of claim 2,
The second extension function is
The residual value obtained by dividing the w-th second internal function value by the order value of the elliptic curve equation is calculated as the w-th second extension function value,
The w-th second internal function value is,
After each value obtained by adding 1 to 3 to the w-th second information value calculated using the second symmetric key and the w-1 second information value is encrypted by the first encryption function, the w-th second information It is a value outputted by performing X-OR operation with the value added 1 to 3, and linking the result of the X-OR operation,
wherein w is,
A certificate issuance system, characterized in that it is a natural number that is greater than or equal to 2 and less than or equal to N. 4. The method of claim 3,
Encryption by the first encryption function,
(S100) calculating the k-th round key (R _k ) by using the S value; and
(S200) generating an encrypted output using the k-th round key (R _k ) and T value calculated in step S100;
The S value is
the second symmetric key value,
The T value is
one of the first second information value to the N-th second information value; and
One of 1 to 3; Certificate issuing system, characterized in that the value added. 5. The method of claim 4,
The step S100 is,
(S110) Separating S into 32-bit word units S _b0 , S _b0+1 , S _b0+2 and S _b0+3 , S _b0 , S _b0+1 , S _b0+2 and S _b0+3 respectively and preset values F _b0 , F _b0+1 , F _b0+2 and F _b0+3 , respectively, to output the initial four keys U _b0 , U _b0+1 , U _b0+2 and U _b0+3 . step;
(S120) sequentially X-ORing U _k+1 , U _k+2 and U _k+3 and a constant V _k ;
(S130) converting the result of step S120 by a nonlinear function;
(S140) converting the result of step S130 by a linear function; and
(S150) performing an X-OR operation on the results of steps U _k and S140 to calculate U _k+4 ;
Repeat steps S120 to S150 while increasing k by 1 from b0 to (b0+31),
Calculate U _k+4 of step S150 as the corresponding k-th round key (R _k ),
wherein b0 is a preset integer. 5. The method of claim 4,
The step S200 is,
(S210) separating T into 32-bit word units T _d0 , T _d0+1 , T _d0+2 and T _d0+3 ;
(S220) sequentially X-ORing T _k+1 , T _k+2 and T _k+3 and the k-th round key (R _k );
(S230) converting the result of step S220 by a nonlinear function;
(S240) converting the result of step S230 by a linear function; and
(S250) performing an X-OR operation on T _k and the result of step S240 to calculate T _k+4 ;
Repeat steps S220 to S250 while increasing k by 1 from d0 to (d0+31),
Finally, output (T _d0+31+4 , T _d0+31+3 , T _d0+31+2 , T _d0+31+1 ),
wherein d0 is a preset integer. According to claim 1,
The first user terminal,
A system for issuing a certificate, characterized in that the final private key is calculated by using the random number a, the first extension function, the hash function values of the N certificates, and the N pieces of information for reproducing the private key. According to claim 1,
The first user terminal,
A certificate issuance system, characterized in that one certificate is transmitted to the second user terminal. 9. The method of claim 8,
The second user terminal,
and calculating one final public key by using the one certificate received from the first user terminal and the public key value of the second server known in advance. 10. The method of claim 9,
The one final public key is,
A value obtained by multiplying the hash function value of the one certificate by a value calculated by decoding the one certificate; and
The certificate issuance system, characterized in that it is a value obtained by adding the public key value of the second server. According to claim 1,
The certificate issuance system,
A second server; further comprising,
The second server,
A certificate issuance system, characterized in that the N third keys are calculated by adding the N number 2-1 keys received from the first server to the value obtained by multiplying the base point G on the elliptic curve equation by the random number c. 12. The method of claim 11,
The second server,
The N third key values are converted into N OCTET STRINGs that are N certificates by encoding, and using the hash function value of each of the N certificates and the private key value of the second server, the N A system for issuing a certificate, characterized in that it calculates an information value for reproducing the private key. 13. The method of claim 12,
Each of the N private key reproduction information values,
and a value obtained by multiplying each hash function value of each of the N certificates by a random number c and adding the private key value of the second server. In the certificate issuance method,
(S13) calculating, by the first user terminal, N inverse encryption function values using the random number p and the second expansion function; and
(S14) The first user terminal reverse-encrypts the encrypted N certificates and N private key reproduction information values by using the N inverse encryption function values to reproduce N certificates and N private key reproduction information values. Including;
The N private key reproduction information values are,
A method for issuing a certificate, characterized in that the first user terminal is a value used to calculate the final private key. 15. The method of claim 14,
The second extension function is
The remainder of dividing the first and second internal function values by the order value of the elliptic curve equation is calculated as the first and second expansion function values,
The first and second internal function values are,
The second symmetric key, which is a random number, and the value obtained by adding 1 to 3 to the first second information value are encrypted by the first encryption function, respectively, and then to the value obtained by adding 1 to 3 to the first second information value and X- It is a value output by concatenating the result of OR operation and X-OR operation,
The first and second information values are,
A method for issuing certificates, characterized in that the values are calculated using first index information and second index information, which are information corresponding to indexes for N certificates. 16. The method of claim 15,
The second extension function is
The residual value obtained by dividing the w-th second internal function value by the order value of the elliptic curve equation is calculated as the w-th second extension function value,
The w-th second internal function value is,
After each value obtained by adding 1 to 3 to the w-th second information value calculated using the second symmetric key and the w-1 second information value is encrypted by the first encryption function, the w-th second information It is a value outputted by performing X-OR operation with the value added 1 to 3, and linking the result of the X-OR operation,
wherein w is,
A method of issuing a certificate, characterized in that it is a natural number that is greater than or equal to 2 and less than or equal to N. 17. The method of claim 16,
Encryption by the first encryption function,
(S100) calculating the k-th round key (R _k ) by using the S value; and
(S200) generating an encrypted output using the k-th round key (R _k ) and T value calculated in step S100;
The S value is
the second symmetric key value,
The T value is
one of the first second information value to the N-th second information value; and
One of 1 to 3; certificate issuance method, characterized in that the added value. 18. The method of claim 17,
The step S100 is,
(S110) Separating S into 32-bit word units S _b0 , S _b0+1 , S _b0+2 and S _b0+3 , S _b0 , S _b0+1 , S _b0+2 and S _b0+3 respectively and preset values F _b0 , F _b0+1 , F _b0+2 and F _b0+3 , respectively, to output the initial four keys U _b0 , U _b0+1 , U _b0+2 and U _b0+3 . step;
(S120) sequentially X-ORing U _k+1 , U _k+2 and U _k+3 and a constant V _k ;
(S130) converting the result of step S120 by a nonlinear function;
(S140) converting the result of step S130 by a linear function; and
(S150) performing an X-OR operation on the results of steps U _k and S140 to calculate U _k+4 ;
Repeat steps S120 to S150 while increasing k by 1 from b0 to (b0+31),
Calculate U _k+4 of step S150 as the corresponding k-th round key (R _k ),
wherein b0 is a preset integer. 19. The method of claim 18,
The step S200 is,
(S210) separating T into 32-bit word units T _d0 , T _d0+1 , T _d0+2 and T _d0+3 ;
(S220) sequentially X-ORing T _k+1 , T _k+2 and T _k+3 and the k-th round key (R _k );
(S230) converting the result of step S220 by a nonlinear function;
(S240) converting the result of step S230 by a linear function; and
(S250) performing an X-OR operation on T _k and the result of step S240 to calculate T _k+4 ;
Repeat steps S220 to S250 while increasing k by 1 from d0 to (d0+31),
Finally, output (T _d0+31+4 , T _d0+31+3 , T _d0+31+2 , T _d0+31+1 ),
wherein d0 is a preset integer. 15. The method of claim 14,
The certificate issuance method, after the step (S14),
(S15) calculating, by the first user terminal, a final private key by using a random number a, a first extension function, hash function values of N certificates, and the N pieces of information values for reproducing the private key; A method for issuing a certificate, comprising: 21. The method of claim 20,
The certificate issuance method, after the step (S15),
(S16) transmitting, by the first user terminal to the second user terminal, one certificate; 22. The method of claim 21,
The certificate issuance method, after the step (S16),
(S42) calculating, by the second user terminal, one final public key by using the one certificate received from the first user terminal and the public key value of the second server known in advance; A method for issuing a certificate. 23. The method of claim 22,
The one final public key is,
A value obtained by multiplying the hash function value of the one certificate by a value calculated by decoding the one certificate; and
A method for issuing a certificate, characterized in that it is a value obtained by adding the public key value of the second server. 15. The method of claim 14,
The certificate issuance method, before the step (S13),
(S32) the second server calculating the N third keys by adding the N number 2-1 keys received from the first server to the value obtained by multiplying the base point G on the elliptic curve equation by the random number c, respectively ; Certificate issuance method, characterized in that it further comprises. 25. The method of claim 24,
The certificate issuance method is:
(S33) The second server converts the values of the N third keys into N octet strings that are N certificates by encoding, and the hash function values of each of the N certificates and the second server The method of issuing a certificate, characterized in that it further comprises; calculating the N number of private key reproduction information values by using the private key value. 26. The method of claim 25,
Each of the N private key reproduction information values,
and a value obtained by multiplying each hash function value of each of the N certificates by a random number c and adding the private key value of the second server.

Images