• Proceedings of the Korean Society of Computer Information Conference
• /
• 2015.07a
• /
• pp.283-284
• /
• 2015

본 논문에서는 기존 인증체계의 문제점을 살펴보고 이를 개선하기 위한 방안을 제안한다. 현재 국내에서 금융관련 서비스에서 공인인증서를 사용하는 서비스가 대부분이나 실용성 및 보안 문제로 인해 최근 정부에서는 공인인증서 사용 의무제도를 폐지하기에 이르렀지만 현재 공인인증서를 대체할만한 안전한 수단을 확보하지 못했고 기존의 OTP나 보안카드로 공인인증서의 공백을 메우기에는 역부족이다. 따라서 공인인증서를 대체할 수 있는 인증방안에 대해 제안하고 이를 통해 보다 안전한 인터넷 전자상거래를 유도하고자 한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2010.11a
• /
• pp.1134-1137
• /
• 2010

공인인증서를 사용하는 스마트폰 응용에서는 공인인증서를 스마트폰의 내부 메모리에 내장하거나 SD 메모리에 저장하여 스마트폰에 설치된 응용 프로그램이 이를 접근하는 방법을 사용한다. 그러나 공인인증서를 스마트폰의 메모리에 저장하여 사용하는 경우, 공인인증서의 암호만 알면 타인의 공인인증서를 임의의 스마트폰에 설치하여 사용할 수 있다는 문제점을 안고 있다. 이와 같은 문제점을 해결하고 메모리에 저장되는 공인인증서의 보안성을 높이기 위하여 본 논문에서는 스마트폰의 IMEI와 USIM의 IMSI를 키로 사용하여 스마트폰과 사용자를 식별함으로써 특정한 개인의 스마트폰에서만 해당 개인의 공인인증서를 사용할 수 있도록 하는 방법을 제안하고, 그 효율성을 분석하였다.

• The Journal of the Korea Contents Association
• /
• v.17 no.6
• /
• pp.32-38
• /
• 2017

Despite the opinion that certificate is useless, half of the population in Korea (approx. 35 million) get an certificate, and use it for internet banking, internet shopping, stock trading, and so on. Most users store their certificates on a usb memory or smartphone, and certificates or passwords stored on such storage media can be easily attacked and used to disguise as legitimate users. Due to these security problem of certificate, a various authentication technologies has been proposed such as smartphone owner authentication using SMS, and a personal authentication using biometric authentication. However, a safe technique is not presented yet without user password, and certificate. In this paper, I proposed a method to secure certificate/private key without a user password using a combination of USIM card and smartphone's information. Even if a hacker gets the user password, the certificate, and the private key, he can not use the certificate. User do not need to remember complex password which is a combination of alphabetic / numeric / special characters, and use his certificate safely.

• Journal of the Korean Data and Information Science Society
• /
• v.28 no.1
• /
• pp.163-171
• /
• 2017

With the advance of function of smart phone system and internet services, mobile trade grows more popular in the area of e-business or banking. These environmental changes, it makes the needs of authorized certificates. Authorized certificate is not only important in these days but also future society. In 2015, 27 millions of Korean people used public key certificate, but most of them does not know the details on the public key certificate. Therefore, in this paper, we explain and investigate the characteristics on the public certificate and explain the relation ship between authorized certificate and public key encrytion. By investigating several papers, internet data, newspapers and books, we found the historical changes, substantial aspects, the encryption systems on the authorized certificate. Also we study the pros and cons of authorized certificate. Finally we predict the number of issued authorized certificate for the future society based on nonparametric statistical method.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.04a
• /
• pp.832-835
• /
• 2011

공인인증서의 사용은 꾸준히 증가하고 있으나 증가하는 사용량에 비례하여 하드디스크에 저장된 공인인증서 해킹으로 인한 피해 사례가 증가하고 있다. 이에 따라 정부는 하드디스크 내 공인인증서 저장을 금지하고 이동형 저장매체에 저장하도록 하는 방침을 내놓았다. 또한 모바일 클라우드 컴퓨팅 환경에서는 중앙의 스토리지에 데이터가 저장되기 때문에 공인인증서를 중앙 스토리지에 저장하는 것은 매우 위험한 일이다. 이러한 방침으로 인해 앞으로 USB 메모리 및 스마트폰과 같은 이동형 저장매체에 대한 중요성이 높아질 것이며, 분실 위험이 높은 USB 메모리 및 스마트폰의 특징에 따라 인증서가 저장된 저장매체 없이도 인증서를 사용할 수 있는 방안이 필요하게 될 것이다. 본 논문은 일회용 인증서에 대한 요구사항 분석 및 형식을 설계하고, PKI 인증서를 기반으로 경량화된 일회용 인증서를 발급받아 인증서를 사용할 수 있도록 하였다. 또한 모바일 클라우드 컴퓨팅 환경에서 일회용 인증서를 이용한 권한 관리 기술을 제안하여 안전성과 효율성을 제공하도록 하였다.

• The Journal of Society for e-Business Studies
• /
• v.16 no.4
• /
• pp.1-16
• /
• 2011

A digital certificate mandated by the Electronic Signature Act has become familiar in our daily lives as 95% of the economically active population hold certificates. Due to upgrades to 256 bit level security that have become effective recently, the security and reliability of digital certificates are expected to increase. Digital certificates based on Public Key Infrastructure (PKI) have been known as "no big problem," but the possibility of password exposure in cases of leaked digital certificates still exists. To minimize this vulnerability, various existing studies have introduced alternative password methods, expansion of certificate storage media, and multiple certification methods. These methods perform enhanced functions but also have limitations including the fact that the secureness of passwords is not guaranteed. This study suggests an alternative method for enhancing the level of password secureness as a way to improve password security. This new method improves security management and enhances the convenience of using digital technologies. The results may be used for developing digital certificate related security technologies and research in the future.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2010.11a
• /
• pp.1229-1232
• /
• 2010

공인인증서는 10여 년 간 국내 인터넷 뱅킹이나 전자상거래에서 본인인증 수단으로 긴요하게 이용되어 왔다. 그러나 공인인증서는 처음 발급받았던 저장매체에서 사용이 가능하며, 재발급 시에 기존 인증서를 폐기한 후 새로운 인증서를 발급받아야 하는 불편함이 있다. 2010년 행정안전부에서는 2013년부터 하드디스크 내 공인인증서 저장을 금지한다는 방안을 발표하였다. 이에 따라 사용자들은 공인인증서를 이동형 저장매체에 저장한 후 사용이 가능하게 되어 이동형 저장매체의 중요성이 높아지게 되었으며, 분실 위험에 노출되어 있는 이동형 저장매체가 없을 시에도 안전하게 인증서를 사용할 수 있는 시스템이 필요하게 되었다. 본 논문에서는 위와 같은 불편함을 줄이고자 기존에 발급받았던 인증서를 토대로 경량화 된 일회용 인증서를 발급받음으로써 안전하고 효율적인 결제가 가능하도록 하는 시스템을 설계 및 구현하였다.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.20 no.3
• /
• pp.543-548
• /
• 2016

Public electronic certificates, as an important means for identification, have been used as the main economic transactions, including banking, e-government, e-commerce. identification. However, damage cases of certificates have been increased by Illegally issued and by hacking practices. Also the users have a difficult in ensuring that their certificates when and where to use. Therefore, the proposed system gives the organization code for the Institutions using OCSP services in advance, the organization code embedded in extensions of OCSP request message structure when institutions ask the validation of certificate to CA(Certificate Authority). Also, OCSP server can extract the organization code from OCSP request message, confirm the institution, and record it in certificate history management table of DB. In this paper, we presented a system that could determine the certificate history check using OCSP service, public electronic certificate validation service, and implemented to prevent and cope immediately with financial incidents.

• Journal of Digital Convergence
• /
• v.15 no.8
• /
• pp.183-193
• /
• 2017

Digital accredited certificates issued under the Digital Signature Act provide essential functionalities for online service, so certificates are used for various services such as online banking, e-government. However, certificates can be stolen by hackers and users need to install separate software to use certificates. Recently FIDO, which aims to solve the problems of password-based authentication and the lack of interoperability between authentication methods, is used for biometric authentication and TrustZone, hardware-based secure environment, is used for safe smartphone usage. In this paper, the new service method is suggested which uses FIDO-based biometric authentication and stores certificates in TrustZone. This method can not only improve security and convenience but also be easily applied to the service because it uses built-in functionalities of new smartphones such as biometric sensors and TrustZone. It is expected that people can use certificates in a safe and convenient way with this method.

• KDI Journal of Economic Policy
• /
• v.37 no.sup
• /
• pp.1-32
• /
• 2015

Korea witnesses continued debate over the policy that mandates the use of the public authentication certificate (electronic certificate) in electronic financing. The debate mainly centers on the rationale of the government compelling, as a standard, a public electronic certificate based on a specific technology, among several user authentication technologies. This paper looks into the impacts of both adoption and abolition of this mandatory policy and thereby analyzes the effects of government intervention in technology standardization. To that end, two main questions are presented: what conditions would enable a single technology to serve as a standard in the market without government intervention; and what conditions would make the standard determined in the market contribute to maximizing social welfare. This paper demonstrates that the attitude and preference of market participants towards each technology determine the level of market equilibria and social welfare caused by the adoption and abolition of the mandatory policy on electronic certificate.