System and method of managing encryption key management system for mobile terminals

• US 20050144439A1
• Filed: 09/13/2004
• Published: 06/30/2005
• Est. Priority Date: 12/26/2003
• Status: Abandoned Application

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Park, Nam Je, Sohn, Sung Won, Moon, Ki Young, Park, Chee Hang
• Application Number:
  US10/940,090
• Publication Number:
  US 20050144439A1
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication

Abstract

An encryption key management method for mobile terminals for providing at least one mobile terminal which is connected to a network to use services with an encryption key required for issuing a certificate which is needed for the services and managed by a certification authority by using an encryption key management server is provided. The method includes operations of: a registration requesting operation where the mobile terminal generates an encryption key registration request; an encryption key managing operation where the encryption key management server generates and manages the encryption key in response to the encryption key registration request; a transferring operation of sending the generated encryption key to the mobile terminal; and a security service providing operation of receiving the certificate managed by the certification authority and providing selective security services specific to the content of the services provided to the mobile terminal. The method can relieve the hardware load of mobile terminals while providing a security service using various conventional certification authorities.

Claims

1. An encryption key management method for mobile terminals for providing at least one mobile terminal which is connected to a network to use services with an encryption key required for issuing a certificate which is needed for the services and managed by a certification authority by using an encryption key management server, the method comprising:

a) a registration requesting operation where the mobile terminal generates an encryption key registration request;

b) an encryption key managing operation where the encryption key management server generates and manages the encryption key in response to the encryption key registration request;

c) a transferring operation of sending the generated encryption key to the mobile terminal; and

d) a security service providing operation of receiving the certificate managed by the certification authority and providing selective security services specific to the content of the services provided to the mobile terminal.

2. The method of claim 1, wherein the a) registration requesting operation comprises:

a1) transferring unique identification information of the mobile terminal and a Hashed Message Authentication Code (HMAC) from the mobile terminal to the encryption key management server, and the b) encryption key managing operation comprises;

b1) when it is determined that the encryption key registration request from the mobile terminal is valid, generating and storing a public key and an encrypted secret key on the certification authority using the encryption key management server; and

b2) when the public key and the encrypted secret key are successfully stored, informing the mobile terminal of the result using the encryption key management server.

3. The method of claim 2, wherein the encryption key is generated using the unique identification information of the mobile terminal and the HMAC.

4. The method of claim 1, wherein the b) encryption key managing operation further comprises:

b3) retrieving an encryption key corresponding to the mobile terminal in response to the encryption key registration request;

b4) verifying the validity of the retrieved encryption key using the certification authority;

b5) updating/discarding the encryption key according to a user selection when the encryption key is expired; and

b6) restoring defective encryption keys.

5. The method of claim 1, wherein the method further comprises:

e) performing a digital signature and data encryption at the same time by using a predetermined non-linear algorithm based on extensible Markup Language (XML).

6. The method of claim 5, wherein the non-linear algorithm uses an XML Key Management Specification (XKMS)-Signcryption technique, and the XKMS-Signcryption adopts one or more XML-based security techniques.

7. The method of claim 5, wherein the e) performing a digital signature and data encryption operation comprises:

e1) a service subscriber registering the public key of the service subscriber on a predetermined certification authority;

e2) a service provider encrypting service content by reading the public key of the service subscriber;

e3) the service subscriber receiving and decrypting the service; and

e4) if information including the public key of the service subscriber is not present on the certification authority, then the encryption key management server retrieving the public key of the service subscriber from other certification authorities.

8. The method of claim 5, wherein the digital signature is performed by:

f1) the service subscriber registering the public key of the service subscriber on a predetermined certification authority;

f2) transferring a data message with a digital signature to the service subscriber;

f3) the service subscriber reading the public key and verifying the digital signature; and

f4) if information including the public key of the service subscriber is not present on the certification authority, then the encryption key management server retrieving the public key of the service subscriber from other certification authorities.

9. An encryption key management system for mobile terminals comprising:

at least one mobile terminal which is connected to a network to use services

a certification authority managing a certificate needed for using the services; and

an encryption key management server generating and managing the encryption key required for issuing the certificate according to a request from the mobile terminal, wherein the encryption key management server receives the certificate managed by the certification authority and provides selective security services specific to the content of the services provided to the mobile terminal.

10. The system of claim 9, wherein the mobile terminal transfers unique identification information of the mobile terminal and a Hashed Message Authentication Code (HMAC) to the encryption key management server, and the encryption key managing server generates and stores the public key and the encrypted secret key on the certification authority and informs the mobile terminal of the result when it is determined that an encryption key registration request from the mobile terminal is valid.

11. The system of claim 10, wherein the encryption key is generated using the unique identification information of the mobile terminal and the HMAC.

12. The system of claim 9, wherein the encryption key management server further comprises:

a module for retrieving an encryption key corresponding to the mobile terminal in response to the encryption key registration request;

a module for verifying the validity of the retrieved encryption key by using the certification authority;

a module for updating/discarding the encryption key according to a user selection when the encryption key is expired; and

a module for restoring defective encryption keys.

13. The system of claim 9, wherein mobile terminal performs a digital signature and data encryption at the same time by using a predetermined non-linear algorithm based on extensible Markup Language (XML).

14. The system of claim 13, wherein the non-linear algorithm uses an XML Key Management Specification (XKMS)-Signcryption technique, and the XKMS-Signcryption adopts one or more XML-based security techniques.

15. The system of claim 13, wherein the system comprises:

a storing module included in the certification authority for enabling the service subscriber to store the public key of the service subscriber registered by service subscriber;

an encrypting module which encrypts the service contents using the public key read by the service provider; and

a decrypting module which decrypts the service received by the service subscriber, and wherein if information including the public key of the service subscriber is not present on the certification authority, then the encryption key management server retrieves the public key of the service subscriber from other certification authorities.

16. The system of claim 13, wherein system comprises:

a storing module included in the certification authority for enabling the service subscriber to store the public key of the service subscriber registered by service subscriber;

a transferring module which transfers the data message with a digital signature to the service subscriber; and

a verifying module which verifies the digital signature by enabling the service subscriber to read the public key, and wherein if information including the public key of the service subscriber is not present on the certification authority, then the encryption key management server retrieves the public key of the service subscriber from other certification authorities.