• Journal of the Korea Society of Computer and Information
• /
• v.11 no.1 s.39
• /
• pp.35-44
• /
• 2006

As the E-commerce and E-business are developed actively, using certificate is incremented rapidly. The certificate validation must be confirmed at first in E-commerce and the OCSP Responder can offer CSI to the client using OCSP. With the rapid development of the E-commerce based on the Internet, a lot of clients request CSI to OCSP Responder. So, the load to OCSP Responder is increased and the OCSP Responder may be overloaded. Therefore, for distributing the load to an OCSP Responder, D-OCSP is introduced. As the CRL has a lot of information about revoked certificates and have a high exposure Possibility of information in the process of distribution, the confidentiality as well as integrity are required in the process of distribution. So, we propose a CRL distributing method based on group key agreement in D-OCSP. The proposed method can distribute effectively a published CRL to OCSP Responders with confidentiality as well as integrity and offer concurrency that each OCSP Responder can start CSI servicing of new CRL to clients at the same time.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.15 no.4
• /
• pp.83-92
• /
• 2005

D-OCSP-KIS proposed by Koga and Sakurai not only reduces the number or OCSP Responder's certificate but also criers the certificate status validation about OCSP Responder to the client. Therefore, D-OCSP-KIS is an effective method that can reduce the communication cost, computational time and storage consumption in client, but it has some problems. In case an attacker accidentally acquires an OCSP Responder's session private key in a time period (e.g., one day), she can disguise as the OCSP Responder in the time period unless the OCSP Responder recognizes. She can offer the wrong response to the client using the hash value intercepted. And the server and user on I-commerce can have a serious confusion and damage. And the computation and releasing of hash chain can be a load to CA. Thus, we propose a method detecting immediately the exposure of an OCSP Responder's session private key and the abuse of hash value in D-OCSP-KIS.

• Proceedings of the Korea Multimedia Society Conference
• /
• 2004.05a
• /
• pp.33-36
• /
• 2004

공개키기반구조(Public Key Infrastructure, PKI)는 인터넷상에서의 안전한 전자거래를 위한 보안기술의 핵심적인 요소이며, OCSP(Online Certificate Status Protocol)는 PKI에서 공개키 인증서의 상태를 검증하기 위한 프로토콜이다. 최근 단일 OCSP 서버의 업무 부담을 줄이고 OCSP 서버의 개인키 노출에 대한 영향을 최소화시킬 수 있는D-OCSP(Distributed OCSP) 시스템이 제안 되었다. 본 논문에서는 신원기반의 암호기법을 이용하여 효율적인 D-OCSP 시스템을 설계하기 위한 방안을 제안한다.