System for providing certification confirming agency service using double electronic signature

• US 20020056039A1
• Filed: 12/28/2000
• Published: 05/09/2002
• Est. Priority Date: 11/04/2000
• Status: Abandoned Application

• Current Assignee: Korea Telecom (KT Corporation)
• Original Assignee: Korea Telecom (KT Corporation)
• Inventors: Lee, Seung-Jae, Lim, Young Sook, Kang, Kyung Hee
• Application Number:
  US09/750,493
• Publication Number:
  US 20020056039A1
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Disclosed is a system for providing a sender certification service based on an end-to-end (EtoE) message security and public key infrastructure (PKI) between mobile terminals. The system performs by proxy a verification work of the user'"'"'s certificate that is difficult to be performed by the mobile terminal having a limited capacity. The system performs by proxy a certification removal list (CRL) check and a certificate validity check with respect to the certificate sent by a sender, and thus the mobile terminal having the limited capacity can directly use the certificate without any CRC check or validity check of the sender'"'"'s certificate, and effectively perform the PKI based electronic certification service. The system can be usefully applied to all fields that require a PKI based certification security service in the radio network environment in that messages are transmitted/received between the mobile terminals.

Claims

1. A system for providing a certification confirming agency service using a double electronic signature, comprising:

a transmitting mobile terminal for receiving a message from a user, performing a security function required for message encoding and electronic signature of a sender, and performing a message transmitting function;

an application service system for receiving the message transmitted from the transmitting mobile terminal, requesting a validity check of a sender'"'"'s certificate and a sender'"'"'s certification check to a certification confirming agency system, and receiving from the certification confirming agency system and transferring to a receiving mobile terminal a message of the certification confirming result;

the certification confirming agency system for receiving a request for confirming the validity of the sender'"'"'s certificate and a sender'"'"'s signature value from the application service system, extracting the validity of the sender'"'"'s certificate and the sender'"'"'s signature value by analyzing a statement transmitted from the transmitting mobile terminal through the application service system, performing the validity check with respect to the sender'"'"'s certificate and signature value, and transmitting a result of checking with its signature attached thereto back to the application service system;

the receiving mobile terminal for restoring the transmitted statement by receiving and decoding the message from the application service system, and outputting a restored statement so that a receiver can view it;

a certificate issuing system for issuing electronic certificates to mobile terminal users; and

a certificate directory system for noticing the electronic certificates issued by the certificate issuing system so that wire/wireless subscribers can peruse them through a wire network and a radio network.

2. The system as claimed in claim 1, further comprising a wire/radio gateway system connected between the radio network and the wire network, and having a communication protocol conversion function of transferring the message of the radio network to the wire network and transferring the message of the wire network to the radio network if the message transmitting protocol of the radio network is different from that of the wire network.

3. The system as claimed in claim 1, wherein the transmitting mobile terminal creates a terminal-to-terminal transmission statement composed of a message encoding statement, a session key encoding statement, and a first electronic signature by receiving and encoding the normal statement message from a terminal user and creating the first electronic signature for the normal statement message by a private key for signature of the sender, creates a terminal-to-certification confirming agency system transmission statement composed of the terminal-to-terminal transmission statement, a second electronic signature, and a certificate for signature of the sender by creating the second electronic signature by the private key for signature of the sender with respect to the terminal-to-terminal transmission statement, and transmitting the transmission statements to the application service system.

4. The system as claimed in claim 3, wherein in case of encoding the normal statement message, the transmitting mobile terminal creates a session key for one time that is effective only in a communication session where the transmitting mobile terminal is connected to the receiving mobile terminal, encodes the normal statement message to be transmitted by a message encoding/decoding algorithm using the session key, encoding the session key used for the message encoding by a public key for encoding of the receiver so that only the just receiver can decode the session key, and transmits both the message encoding statement and the session key encoding statement.

5. The system as claimed in claim 3, wherein in case of creating the first electronic signature of the sender, a message digest is created by applying a hash function to the normal statement message inputted by the sender, and an electronic signature value is created by encoding the message digest using the private key for signature of the sender.

6. The system as claimed in claim 3, wherein in case of creating the second electronic signature of the sender, a message digest is created by applying a hash function to the message encoding statement and the first electronic signature of the sender as one message, and creates the electronic signature value by encoding the message digest using the private key for signature of the sender in order to perform verification of the message encoding statement and the first signature value created in the transmitting mobile terminal and certification of the sender.

7. The system as claimed in claim 1, wherein the certification confirming agency system extracts a terminal-to-terminal transmission statement, a second electronic signature value of the sender, and a certificate of the sender by analyzing the terminal-to-certification confirming agency system transmission statement from the application service system, performs the validity check for the certificate of the sender, verifies the sender certification and the terminal-to-terminal transmission statement through confirmation of the second signature value of the sender, constructing the certification confirming agency system-to-terminal transmission statement by creating the message for verifying the validity of the certificate and the electronic signature of the certification confirming system, and transmitting the transmission statement to the application service system.

8. The system as claimed in claim 7, wherein in case of checking the validity of the certificate, the certification confirming agency system checks a validity time of the certificate of the sender, and if it is checked that the certificate is in the validity time, it brings a certificate removal list for the certificate of the sender from the certificate directory system, the certification confirming agency system finally judging whether the certificate is effective by performing the certificate confirming check with respect to an issuer of the certificate of the sender if it is checked that the certificate is not in the certificate removal list.

9. The system as claimed in claim 7, wherein in case of confirming the second electronic signature value of the sender, the message digest is restored by extracting the public key for signature of the sender after completion of the validity check of the sender'"'"'s certificate and decoding the second electronic signature value, a message digest is created by applying a hash function to the terminal-to-terminal message, it is judged that the electronic signature value is true and the terminal-to-terminal message is guaranteed if the two message digests are identical, and the message for verifying the validity of the certificate is created.

10. The system as claimed in claim 7, wherein in case of creating the electronic signature, the certification confirming agency system creates the message digest by applying a hash function to the terminal-to-terminal transmission statement and the whole message for verifying the validity of the certificate, and creates the electronic signature value by encoding the message digest using the private key for signature of the certification confirming agency system.

11. The system as claimed in claim 1, wherein the receiving mobile terminal receives and separates the certification confirming agency system-to-terminal message from the application service system into the terminal-to-terminal transmission statement, sender'"'"'s certificate, message for verifying the validity of the certificate, electronic signature of the certification confirming agency system, and certificate of the certification confirming agency system, and restores and outputs the normal statement message by checking the electronic signature of the certification confirming agency system and analyzing the terminal-to-terminal transmission statement.

12. The system as claimed in claim 11, wherein in case of confirming the electronic signature of the certification confirming agency system, the message digest is restored by extracting the public key for signature from the certificate of the certification confirming agency system, a message digest is created by applying a hash function to the terminal-to-terminal message and the message for certifying the validity of the certificate, and if the two messages are identical, it is judged that the electronic signature value is true and the terminal-to-terminal message is not modulated.

13. The system as claimed in claim 11, wherein in case of analyzing the terminal-to-terminal message, the encoding message, encoding session key, and first electronic signature of the sender are separated, the normal statement message is restored by decoding the encoding message, and the sender certification and the message completeness are confirmed by verifying the first electronic signature of the sender.

14. The system as claimed in claim 13, wherein in case of restoring the normal statement message, the session key is restored from the encoding session key using the private key for encoding for the receiver, and the normal statement message inputted by the sender is restored by decoding the encoding message by the session key using the message encoding/decoding algorithm.

15. The system as claimed in claim 13, wherein in case of verifying the first electronic signature of the sender, the message digest is created by extracting the public key for signature of the sender from the certificate of the sender and restoring the first signature value of the sender, a message digest is created by applying a hash function to the decoded normal statement message, and judging that the electronic signature value is true if the two message digests are identical.