• The KIPS Transactions:PartC
• /
• v.10C no.4
• /
• pp.433-440
• /
• 2003

According as the real economic activities are carried out in the cyber world and the identity problem of a trade counterpart emerges, digital signature has been diffused. Due to the weakness for real-time validation using the validation method of digital signature, Certificate Revocation List, On-line Certificate Status Protocol was introduced. In this case, every transaction workload requested to verify digital signature is concentrated of a validation server node. Currently this method has been utilized on domestic financial transactions, but sooner or later the limitation will be revealed. In this paper, the validation method will be introduced which not only it can guarantee real-time validation but also the requesting node of certificate validation can maintain real-time certificate status information. This method makes the revocation management node update the certificate status information in real-time to the validation node while revoking certificate. The characteristic of this method is that the revocation management node should memorize the validation nodes which a certificate holder uses. If a certificate holder connects a validation node for the first time, the validation node should request its certificate status information to the above revocation management node and the revocation management node memorizes the validation node at the time. After that, the revocation management node inform the revocation information in real-time to all the validation node registered when a request of revocation happens. The benefits of this method are the fact that we can reduce the validation time because the certificate validation can be completed at the validation node and that we can avoid the concentration of requesting certificate status information to a revocation node.

• The Journal of the Korea Contents Association
• /
• v.5 no.2
• /
• pp.95-105
• /
• 2005

As a research on PKI is being very popular, the study relating to certificate status validation is being grown with aim to reduce an overhead of the protocol and to provide an efficient operation. The OCSP of the standard protocol related to the study enables applications to determine the revocation state of an identified certificate. However, the OCSP server can not service millions of certificate status validation requests from clients in a second on E-commerce because of the computational time for signature and verification. So, we propose the Real-time Certificate Status Validation Protocol(RCSVP) that has smaller computational time than OCSP. RCSVP server reduce the computational time of certificate status validation using hash function and common secret value. Also RCSVP client does not need the computational time of certificate verification to acquire the public key from an identified certificate. Therefore, the proposed protocol enables server to response millions of certificate status validation requests from clients in a second on E-commerce.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.13 no.6
• /
• pp.45-54
• /
• 2003

A public key certificate may be revoked before its validity period due to causes like the owner identification information change or the private key damage. Since a certificate has long valid time relatively, it is possible to become revoked during lifetime of certificate. The main technical issue in the public key infrastructure is how to handle the status of the certificate. We propose a simple mechanism for online certificate status validation that is suited to the financial network The characteristic of the proposed method is to broadcast certificate revocation information by using verifier list. The experimental results provide the same realtime as OCSP(Online Certificate Status Protocol). The proposed mechanism reduces the network load for certificate status validation in highly concentrated unbearable network.

• The KIPS Transactions:PartC
• /
• v.13C no.2 s.105
• /
• pp.147-154
• /
• 2006

The certificate status validation mechanism is a critical component of a public key infrastructure based on certificate system. The most generally mechanisms used these days are the use of the certificate revocation list and the real-time certificate status protocol. But the certificate revocation list can not give the real-time certificate status because the certificate is being delivered periodically, and the real-time certificate status protocol method will generate a concentrated load to the server because the protocol in the central server will be accessed whenever a certification is necessary. It will also take a long time to validate the certificate because each trade has to send mass information through the network. This paper will present that real-time validation is guaranteed as the real-time certificate status protocol method and the traffic congestion in the network Is reduced in a way that the certification would be requested using the user information hash value and would be validated using the user information kept in the certification authorities and the service providers. Based on the this study, we suggest a real-time certificate status validation mechanism which can reduce the certificate status validation time using the signed user information hash value. And we confirm speed of certificate status verification faster than existing CRL(Certificate Revocation List) and OCSP(Online Certificate Status Protocol) method by test.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.13 no.1
• /
• pp.99-113
• /
• 2003

As a research on PKI(Public Key Infrastructure) is being very popular, the study relating to certificate status and path validation is being grown with aim to reduce an overhead of the protocol and to provide an efficient operation. But in spite of a lot of related research there is still almost no protocol that we can use for real-time based client-server environment with large scale like internet banking. In this paper, we shows that the existing standards or protocols are not suitable to be used for such a real-time based client-server environment with large scale, and then proposes an efficient certificate status and path validation system.

• Journal of the Korea Computer Industry Society
• /
• v.5 no.5
• /
• pp.721-728
• /
• 2004

OCSP (Online Certificate Status Protocol) server which checks the certificate status provides the real time status verification in the PKI (Public Key Infrastructure) system which is the essential system of certificate. However, OCSP server need the message authentication with the server and client, so it has some shortcomings that has slow response time for the demands of many clients concurrently and has complexity of the mathematical process in the public encryption system. In this research, simulation model of the certificate status vertification server is constructed of the DEVS (Discrete EVent system Specification) formalism. This sever model is constructed to practice the authentication with hash function when certificate is checked. Simulation results shows the results of increase of the certificate status verification speed and decrease of the response time to the client.

• The Journal of the Korea Contents Association
• /
• v.5 no.1
• /
• pp.45-53
• /
• 2005

With the rapid progress of research to offer a convenience of mobile communication, the mobile users can use not only the services of voice call but also the variety services of data communication using Internet. These include Internet Searching, Internet Shopping and Internet banking and Internet stock exchange and electronic payment and so on, based on PKI. Also, the need of data communication between the mobile users has been increased. As it is possible for mobile users to do user authentication, key distribution, encryption, decryption and so on, it is needed the certificate status validation between the mobile users. However due to the PCS(Personal Communication System) had been only designed and implemented for voice call between the mobile users, it is not easy to apply data communication between the mobile users on PKI. Therefore the study of for the data communication between the mobile users in PCS is a few. It is for the data transfer between the mobile users to communicate using call processing of PCS. So, we propose how to process the certificate status validation during call processing for data communication between the mobile users in the PCS.

• Journal of the Korea Society of Computer and Information
• /
• v.13 no.1
• /
• pp.161-167
• /
• 2008

As the authentication and the integrity methods based on the hash chain are popular, several certificate status validation methods based on the same function are proposd at the moment. In NOVOMODO, a CA generates and releases the hash value to each user. In Jianying Zhou's framework and Jong-Phil Yang's framework, a user generates and releases the hash value to verifier. Therefore, the CA loads are distributed to each user. However, these frameworks are based on the assumption that the CA's secret key is not lost or compromised and the certificates issued by the CA are error-free. Therefore, these frameworks are not suitable in real PKI environments. In this paper, as one hash value generated by CA is included in the user's certificate in addition, the certificate revocation published by CA using that value can be managed. The hash value included in user's certificate is the same for all users. The computation costs, the storage amounts and the release costs are small in the CA. And we modify the procedure for the signature and its validation in Jong-Phil Yang's framework. Our solution is more suitable than those frameworks in real PKI environments.

• Proceedings of the Korea Society for Simulation Conference
• /
• 2004.05a
• /
• pp.7-12
• /
• 2004

공개키 기반 구조(PKI; Public Key Infrastructure)에 필수적인 요소인 인증서의 상태 검증에 있어서 인증서 상태 검증 서버인 OCSP (Online Certificate Status Protocol) 서버는 실시간 상태 검증을 제공한다. 그러나, 서버와 클라이언트의 메시지 인증을 위해 전자 서명을 수행해야 하며, 이 때 사용되는 공개 암호 연산 과정의 복잡성은 동시에 많은 클라이언트의 요청이 발생할 경우에 응답 시간을 크게 지연시킨다는 단점을 가지고 있다. 본 논문에서는 이러한 문제를 해결하기 위한 인증서 상태 검증 서버의 시뮬레이션 모델을 DEVS (Discrete Event system Specification) 방법론을 이용하여 설계하였다. 이 모델은 인증서의 상태 검증을 요청하는 영역에 위치하여 해쉬 함수를 적용한 인증을 수행하도록 구성되었으며, 시뮬레이션 결과는 제시한 방법이 인증서 상태 검증 속도를 증대시켜 결과적으로 사용자의 응답 시간이 감소되는 것을 보여준다.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2002.11a
• /
• pp.381-384
• /
• 2002

현재 인증서의 상태 검증을 실시간으로 제공하기 위해 각 CA(Certificate Authority)들은 고전적 방법인 CRL(Certificate Revocation List) 배포보다는 OCSP(Online Certificate Status Protocol)을 통하여 인증서의 상태에 대한 정보를 실시간으로 제공한다. 그러나, 경로검증 및 인증서 정책 맵핑 및 정책검증과 인증서 상태검증을 제공하는 SCVP(Simple Certificate Validation Protocol)는 CRL을 사용하는 한계로 인하여 실시간 검증을 제공하지 못하고 있다. 또한 OCSP는 인증서의 실시간 상태검증만을 제공할 뿐, 인증서의 경로검증과 인증서 정책 맵핑 및 정책검증에 대한 서비스는 제공하지 못하고 있다. 따라서, 이러한 두 프로토콜의 단점을 보안하고, 인증서 검증서버가 제공해야 하는 모든 서비스를 제공하기 위해 OCSP와 SCVP의 연동방안에 대한 연구를 통하여 SCVP에서의 실시간 검증을 제공할 수 있도록 한다.