KR20090094716A - System and Method for Managing Certificate and Program Recording Medium - Google Patents

Abstract

A system and a method for managing certificate and a program recording medium are provided to prevent illegal transfer and occupation by storing the intrinsic information of the device and the certificate information in a certificate managing database. A customer terminal(125) receives a certificate effective authentication based service by accessing a certificate using server(120) through the certificate issued to the medium. The certificate using server is connected to the customer terminal through a communication network and processes the certificate usage request from the customer terminal. A certificate issuing server(100) is connected to the customer terminal through the communication network. The certificate issuing server confirms the intrinsic information of the device corresponding to the configuration device in relation to the certificate information issued to the medium and stores the confirmed information in a certificate managing database(105). A certificate managing server(110) is connected to the customer terminal through the communication network. The certificate managing server confirms the intrinsic information based validity about the medium. A certificate transfer server(115) verifies the validity about the intrinsic information equipped in the customer terminal. The certificate transfer server confirms the intrinsic information, links the certificate information transferred to the medium and stores the information in the certificate managing database.

Description

System and Method for Managing Certificate and Program Recording Medium}

1 is a view showing a system configuration for preventing illegal transfer and possession of a certificate according to an embodiment of the present invention.

2 is a diagram illustrating a configuration of a certificate issuing system for issuing a certificate to a medium 1 mounted or detached from a customer terminal according to an embodiment of the present invention.

3 is a diagram illustrating a process of issuing a certificate to a customer terminal according to one embodiment of the present invention.

4 is a diagram illustrating a process of issuing a certificate to a customer terminal according to another exemplary embodiment of the present invention.

5 is a diagram illustrating a certificate verification process issued to a customer terminal according to an embodiment of the present invention.

FIG. 6 is a diagram showing a configuration of a certificate management system for managing a certificate with a medium 1 mounted or detached from a customer terminal according to an embodiment of the present invention.

7 is a diagram illustrating a process of managing a certificate according to an embodiment of the present invention.

FIG. 8 is a diagram illustrating a certificate transfer system configuration for transferring a certificate to a medium 2 mounted or detached from a customer terminal according to an embodiment of the present invention.

9A and 9B illustrate a process of requesting a certificate transfer according to an embodiment of the present invention.

10 is a diagram illustrating a process of transferring a certificate according to one embodiment of the present invention.

11 is a diagram illustrating a process of transferring a certificate according to another exemplary embodiment of the present invention.

12 is a diagram illustrating a certificate verification process transferred according to an embodiment of the present invention.

<Description of main parts of drawing>

100: certificate issuing server 105: certificate management D / B

110: certificate management server 115: Inzuot old server

120: server using the certificate 125: customer terminal

According to the present invention, when a certificate is issued to a medium 1 mounted on or detached from a terminal through a communication network, an M (M>) is provided or detached from a terminal mounted or detached from the terminal through the communication network. 1) receiving device specific information (1) corresponding to m (1 <= m <= M) configuration devices among the configuration devices, m device identification information corresponding to the m configuration devices, and Storing m device-specific information (1) corresponding to each device identification information and certificate information issued to the terminal and storing them in a storage medium; and a medium (1) mounted or detached from the terminal through a communication network. When using the issued certificate, confirms the n (1 <= n <m) device identification information to be included in the validation target in connection with the storage medium, and transmits the identified n device identification information to the terminal through a communication network Step, and from the terminal Certificate information issued to the terminal through a communication network and n device-specific information (2) corresponding to the n device identification information provided or detached to the terminal, and receives the processed data through the certificate Extracting the certificate information and the n device-specific information (2) from the received data; and the received n devices of m device identification information matching the certificate information in association with the storage medium. Identifying n device specific information (1) matching the identification information, comparing the identified n device unique information (1) and the received n device specific information (2) of the received data; It relates to a certificate operating method comprising the step of authenticating validity.

Due to the continuous development of information and communication technology, financial transactions previously made through face-to-face authentication have recently been transferred to non-face-to-face financial transactions using non-face-to-face authentication based on wired communication networks or wired communication networks. Financial transactions amount to KRW 18 trillion a day.

The most representative of the non-face-to-face authentication methods for non-face-to-face financial transactions as described above is a method of authenticating non-face-to-face transactions through a certificate.

The non-face-to-face authentication based on the accredited certificate, first, issuing the accredited certificate to a medium (for example, a computer hard disk, a floppy disk, a universal serial bus (USB) memory, an integrated circuit (IC) card, etc.) designated by a customer from an accredited certification authority. In the financial transaction using the terminal operating the medium and the communication network connected to the terminal, a transaction between the terminal and the server using an encryption key (for example, a public key, a private key, or a symmetric key) included in the certificate. And encrypting the transaction data, or authenticating the non-face-to-face financial transaction through digital signature attachment / verification.

On the other hand, the official certificate is considered to be valid only one original certificate, the validity of the original certificate is secured through DRM (Digital Rights Management). That is, a copy of the original certificate is not recognized through DRM, and when the certificate is transferred from the first issued medium to another medium, it is transferred and used according to the certificate transfer procedure according to the DRM authentication procedure.

By the way, the transfer of the certificate is not only to recognize the copy certificate, but also to prevent the transfer of the original certificate by the hacker (for example, from the medium in which the public certificate is issued to the medium designated by the hacker). If the public certificate is transferred from the customer's medium to the medium designated by the hacker, and the PIN number for the public certificate is exposed, the hacker may be based on the public certificate and the PIN number. It includes a serious problem that can transfer the amount deposited in the account of the account to any account (for example, the account used by hackers), and recently there has been a case of such hacking.

An object of the present invention for solving the above problems, when issuing a certificate to the medium (1) that is mounted on or detached from the terminal through a communication network, to the terminal that is mounted or detached from the terminal through the communication network Means for receiving device-specific information (1) corresponding to a predetermined configuration device of the plurality of devices provided or detached, and the device-specific information (1) and the certificate information issued to the terminal in association with the storage medium Means for storing the certificate information issued to the terminal through the communication network and the certificate information issued to the terminal through the communication network and a plurality of devices provided or detached from the terminal Means for receiving device specific information (2) corresponding to a preset component among components, and matching the received certificate information in association with the storage medium; A certificate operating system comprising means for confirming unique information 1 and means for authenticating the validity of the received data by comparing the identified device specific information 1 with the received device specific information 2; In providing.

Certificate operation method according to the present invention, when the certificate is issued to the medium (1) mounted on or detached from the terminal via a communication network, provided or detached from the terminal via the communication network from the terminal 1 is mounted or detached Receiving device specific information (1) corresponding to m (1 <= m <= M) preset devices among M (M> 1) devices attached thereto, and corresponding to the m devices storing m device identification information and m device unique information (1) corresponding to each device identification information and certificate information issued to the terminal and storing the m device identification information in the storage medium in connection with the device identification information; When using the certificate issued to the medium (1), check the n (1 <= n <m) device identification information to be included in the validation target in connection with the storage medium, and the n confirmed by the terminal through the communication network Transmitting device identification information And n device specific information (2) corresponding to n device identification information provided to or detached from the terminal, and certificate information issued from the terminal to the terminal through a communication network. Receiving the processed data, extracting the certificate information and n device-specific information (2) from the received data, and m device identification information matched with the certificate information in association with the storage medium. Identifying n device specific information (1) matching the received n device identification information, and the identified n device unique information (1) and the received n device unique information (2) Comparing and authenticating the validity of the received data.

On the other hand, the certificate management method according to the present invention, when the certificate is issued to the medium (1) mounted on or detached from the terminal through a communication network, the terminal 1 is mounted or detached from the terminal through the communication network Or receiving device specific information (1) corresponding to a preset component among a plurality of detachable component devices, and storing the device specific information (1) in association with the device specific information (1) and certificate information issued to the terminal in a storage medium. And a plurality of components provided or detached from the terminal and certificate information issued to the terminal through the communication network from the terminal when using a certificate issued to the terminal 1 mounted or detached through the communication network. Receiving device-specific information (2) corresponding to a preset configuration device among the devices, and receiving the processed data through the certificate; Extracting the certificate information and the device specific information (2) from the data, identifying the device specific information (1) matching the certificate information in association with the storage medium, and the identified device unique information (1). And comparing the received device-specific information (2) and authenticating the validity of the received data.

According to the present invention, the certificate operation method, when the certificate is issued to the medium (1) that is mounted on or detached from the terminal via a communication network, provided or detached from the terminal on which the medium (1) is mounted or detached through the communication network Receiving M (M> 1) device information; and m (1 <= m <= M) device information of the M (M> 1) device information received from the received M (M> 1) device information. And confirming, and transmitting the m pieces of device information to the terminal through a communication network.

According to the present invention, the certificate operating method, when issuing a certificate to the medium (1) mounted on or detached from the terminal via a communication network, transmitting I (I> 1) authentication information input query information to the terminal through the communication network And i user authentication information 1 corresponding to i (1 <= i <= I) authentication information input query information, among the I authentication information input query information, is input by the terminal. Receiving i received user authentication information (1), and i input query information (or the i authentication information input) corresponding to the received i user authentication information (1) and user authentication information (1), respectively And storing the information on the storage medium in association with the query information corresponding to the query information) and the one or more device-specific information (1).

According to the present invention, the certificate operating method, when transferring the certificate issued to the medium (1) to be mounted or detached to the terminal via the communication network to the medium (2), input i authentication information in association with the storage medium Checking j (1 <= j <= i) authentication information input query information to be included in the certificate transfer verification target among the query information, and j user authentication information corresponding to the checked j authentication information input query information ( And transmitting user authentication information input interface for inputting 2) to the terminal, and j user authentication information 2 corresponding to the j authentication information input query information through the user authentication information input interface in the terminal. Receiving the input j user authentication information (2) when input, and using j number matching the j authentication information input query information in association with the storage medium Verifying authentication information (1), and comparing the checked user authentication information (1) with the received user authentication information (2) and certifying the validity of the certificate transfer. do.

According to the present invention, the certificate operating method, when transferring the certificate issued to the medium (1) to be mounted or detached to the terminal via a communication network to the medium (2), the medium (2) through the communication network from the terminal Receiving device specific information (1) corresponding to m (1 <= m <= M) component devices which are preset among M (M> 1) component devices provided or detached at a terminal mounted or detached And storing m device identification information corresponding to the m component devices, m device unique information (1) corresponding to each device identification information, and certificate information issued to the terminal and storing them in a storage medium. It is characterized in that it further comprises.

According to the present invention, the method for operating a certificate comprises the steps of: receiving M (M> 1) component information provided or detached from a terminal mounted or detached to a terminal 2 through a communication network; Confirming m (1 <= m <= M) component information among the M (M> 1) component information obtained, and verifying m (1 <= m <= M) component information to the terminal through a communication network; And transmitting the = M) component information.

According to the present invention, the certificate operating method, when transferring the certificate issued to the medium (1) to be mounted or detached to the terminal via a communication network to the medium (2), the medium (2) through the communication network from the terminal Receiving device specific information (1) corresponding to a preset component among a plurality of component devices provided or detached from the terminal mounted or detached from the terminal, and the device specific information (1) issued to the terminal. And storing the information in a storage medium in association with the certificate information.

According to the present invention, the medium 1 includes a hard disk medium, a floppy disk medium, a USB (Universal Serial Bus) medium, an integrated circuit (IC) card medium, a hardware security module (Hardware Security) mounted on or detached from the terminal. Module (HSM) media characterized in that it comprises one or more.

According to the present invention, the device-specific information (1), or device-specific information (2), the hard disk specific information provided or detached in the terminal, MAC (Media Access Control) address information for the communication device, USB ( Universal Serial Bus) characterized in that it comprises one or more of the media unique information, integrated circuit (IC) chip unique information, hardware security module (Hardware Security Module (HSM)) unique information.

On the other hand, the certificate management method according to the present invention, when the certificate is issued to a medium that is mounted on or detached from the terminal via a communication network, the terminal is mounted or detached with the issued certificate information and the unique information of the medium or the medium Co-processing the unique information of the medium and storing it in a storage medium, and when validating a certificate issued to a medium mounted or detached from the terminal, the unique information of the medium or the medium is mounted or detached through a communication network. Receiving the unique information of the terminal from the terminal or in association with the terminal, and the unique information of the received or confirmed medium or the unique information of the terminal on which the medium is mounted or detached to the storage medium It is different from the unique information of a previously stored medium or the unique information of a terminal on which the medium is mounted or detached. And the unique information of the received or confirmed medium or the unique information of the terminal on which the medium is mounted or detached from the comparison result, the unique information of the medium previously stored in the storage medium, or the medium is loaded or demounted. If it does not match the unique information of the terminal, characterized in that it comprises the step of processing a certificate error irrespective of the validity authentication result of the certificate.

According to the present invention, the medium may include a hard disk medium, a floppy disk medium, a USB (Universal Serial Bus) medium, an integrated circuit (IC) card medium, a hardware security module (HSM) mounted on or detached from the terminal. A) one or more media.

According to the present invention, the unique information of the medium or the unique information of the terminal on which the medium is mounted or detached may include unique information of a hard disk provided or detached from the terminal, and media access control (MAC) address information of a communication device. It comprises at least one, Universal Serial Bus (USB) media unique information, Integrated Circuit (IC) chip unique information, Hardware Security Module (Hardware Security Module; HSM) unique information.

On the other hand, the certificate management system according to the present invention, when issuing a certificate to the medium (1) mounted on or detached from the terminal via a communication network, provided in the terminal on which the medium (1) is mounted or detached through the communication network from the terminal Or means for receiving device specific information (1) corresponding to a preset component among a plurality of detachable component devices, and storing the device specific information (1) in association with the device specific information (1) and certificate information issued to the terminal in a storage medium. And a plurality of components provided or detached from the terminal and certificate information issued to the terminal through the communication network from the terminal when using a certificate issued to the medium 1 mounted or detached from the terminal through a communication network. Means for receiving device specific information (2) corresponding to a preset configuration device among the devices, and a device matching the received certificate information in association with the storage medium; Means for confirming unique information (1), and means for verifying validity of the received data by comparing the identified device specific information (1) with the received device specific information (2). do.

On the other hand, the certificate management system according to the present invention, when the certificate is issued to a medium that is mounted on or detached from the terminal through a communication network, the terminal is mounted or detached with the certificate information and the unique information of the medium or the medium Means for cooperatively processing the unique information of the medium and storing the information on the storage medium, and when validating a certificate issued to a medium mounted or detached from the terminal, the unique information of the medium or the medium is mounted or detached through a communication network. Means for receiving the unique information of the terminal from the terminal or in association with the terminal, and the unique information of the received or confirmed medium or the unique information of the terminal on which the medium is mounted or detached from the terminal. Unique information of a pre-stored medium or unique information of a terminal on which the medium is mounted or detached In addition, as a result of the comparison, the unique information of the received or confirmed medium or the unique information of a terminal on which the medium is mounted or demounted is unique information of a medium previously stored in the storage medium or the medium is loaded or detached. If it does not match the unique information of the terminal, characterized in that it comprises a means for processing a certificate error irrespective of the validity authentication result of the certificate.

Hereinafter, with reference to the accompanying drawings and description will be described in detail the operating principle of the preferred embodiment of the present invention. However, the drawings and the following description shown below are for the preferred method among various methods for effectively explaining the features of the present invention, the present invention is not limited only to the drawings and description below. In addition, in the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted. Terms to be described later are terms defined in consideration of functions in the present invention, which may vary according to intentions or customs of users or operators. Therefore, the definition should be made based on the contents throughout the present invention.

In addition, preferred embodiments of the present invention to be carried out below are provided in each system functional configuration to efficiently describe the technical components constituting the present invention, or system functions that are commonly provided in the technical field to which the present invention belongs. The configuration will be omitted, and described mainly on the functional configuration to be additionally provided for the present invention. If those skilled in the art to which the present invention pertains, it will be able to easily understand the function of the components that are conventionally used among the omitted functional configuration not shown below, and also the configuration omitted as described above The relationship between the elements and the components added for the present invention will also be clearly understood.

In addition, the following examples will be used to appropriately modify, integrate, or separate the terminology so that those skilled in the art to which the present invention pertains may clearly understand the present invention. The present invention is by no means limited thereto. In other words, each means constituting the present invention is a server (or terminal) provided on the system shown in the following embodiments, or a predetermined functional configuration provided in at least one or more servers (or terminals), or at least It may be an association of at least two or more functional components provided in one or more servers (or terminals). In addition, the server (or terminal) shown in the following embodiment is shown to include at least two or more functional components for achieving the technical features of the present invention for convenience, the functional component shown in the server (or terminal) Matched with the above-described means may be provided in two or more different servers (or terminals) according to the role and function of each functional component and the corresponding server (or terminal) operator (or operator), whereby the present invention is not limited No.

As a result, the technical spirit of the present invention is determined by the claims, and the following examples are one means for efficiently explaining the technical spirit of the present invention to those skilled in the art to which the present invention pertains. It is only.

1 is a view showing a system configuration for preventing illegal transfer and possession of a certificate according to an embodiment of the present invention.

In more detail, Figure 1 is a certificate using server 120 that provides a variety of services based on certificate-based non-face-to-face authentication through a communication network in the customer terminal 125 to mount or detach the medium (1) issued a certificate; (E.g., an internet banking server, a wireless banking server, an internet shopping server, etc.) when the certificate validity authentication based service is provided in connection with an authentication server (not shown), the user is mounted or detached to the terminal 125. The present invention relates to a system configuration for processing the issuance, management, and transfer of a certificate to prevent a certificate issued to the medium 1 from being illegally transferred to another medium. Persons having the present invention will be able to infer various implementation methods for the system for preventing the illegal transfer and possession of the certificate by referring to and / or modifying the drawing 1. However, the present invention includes all the implementation methods inferred above, the technical features are not limited only to the implementation method shown in FIG.

Referring to FIG. 1, a system for preventing illegal transfer and occupancy of the certificate includes mounting or detaching the medium 1 on which the certificate is issued, and using the certificate issued to the medium 1. A client terminal 125 receiving a certificate validity authentication based service and a certificate use server connected to the client terminal 125 through a communication network to process a certificate use request requested from the client terminal 125; 120 and the customer terminal 125 is connected through a communication network when issuing the certificate to the customer terminal 125, to prevent the certificate is illegally transferred to another medium to be occupied by the customer terminal 125 Check the device-specific information (1) corresponding to one or more of the plurality of components provided or detached in the) in conjunction with the certificate information issued to the medium (1) When the certificate issuing server 100 stored in the certificate management D / B 105 and the customer terminal 125 is connected through a communication network, the client terminal 125 when using the certificate through the certificate using server 120 In order to prevent the certificate from being illegally transferred and occupied by another medium, the device receives the device-specific information 2 provided in the customer terminal 125 and associates with the certificate management D / B 105. Check the device specific information 1 corresponding to at least one of the plurality of components provided or detached in the customer terminal 125 on which the medium 1 is mounted or detached, and the device specific information (1). And the certificate management server 110 for comparing the device-specific information (2) to check the device-specific information-based validity of the medium (1) in which the certificate is issued, and a medium in which the certificate is illegally different when the certificate is transferred. Has been moved to In order to prevent it from being used, the certificate of the device-specific information 2 provided in the customer terminal 125 on which the medium 1 is mounted or demounted is verified through the certificate, and the medium 2 is mounted or demounted. Certificate management D in association with certificate information transferred to the medium (2) by checking the device-specific information (1) corresponding to one or more of the plurality of components provided or detached to the customer terminal 125 to be attached It includes a certificate transfer server 115 to store in / B (105).

Here, the certificate issuing server 100, the certificate management server 110 and the certificate transfer server 115 is implemented as one server, or a plurality of server groups for each functional configuration, or issuing the certificate The authentication server provided in the institution, or may be implemented in the form of the internal component provided in the certificate using server 120, the present invention is characterized in that it comprises all the above-described implementation method.

2 is a diagram showing the configuration of a certificate issuing system for issuing a certificate to the medium (1) mounted or detached in the customer terminal 125 in accordance with an embodiment of the present invention.

In more detail, FIG. 2 illustrates a case in which the certificate is issued to a medium 1 mounted or detached from the customer terminal 125 through a communication network in order to prevent the certificate from being illegally transferred and occupied. By using the certificate through the communication network by identifying the device-specific information (1) corresponding to one or more of the plurality of constituent devices that are equipped or detached and stored in association with the certificate information issued to the medium (1) Or, in the process of transferring the certificate to another medium (2) through the validation of the device-specific information (1) through the system configuration to prevent the illegally transferred and occupied certificate issued to the medium (1) As such, those of ordinary skill in the art to which the present invention pertains may refer to and / or modify the drawing 2 to the customer terminal 125 to the customer terminal. Various implementation methods for the system configuration for issuing a certificate to the medium 1 mounted or detached on 125 may be inferred, but the present invention includes all of the inferred implementation methods, as shown in FIG. It is not limited by the implemented method.

Hereinafter, in FIG. 2, the components on the system for issuing the certificate to the medium 1 mounted or detached from the customer terminal 125 are referred to as "certificate issuing server 100" for convenience.

Referring to FIG. 2 according to an embodiment of the present invention, the certificate issuing system interlocks with the medium 1 by mounting or detaching thereon, and accesses the certificate issuing server 100 through a communication network to issue the certificate. Receiving customer terminal 125, and connected to the customer terminal 125 and the communication network when issuing the certificate to the customer terminal 125, of the plurality of components provided or detached in the customer terminal 125 It comprises a certificate issuing server 100 to check the device-specific information (1) corresponding to one or more components and to store in the certificate management D / B 105 in association with the certificate information issued to the medium (1) Characterized in that, when using the certificate issued to the customer terminal 125, the medium (1) is issued the certificate is issued based on the device-specific information (1) in connection with the certificate management D / B (105) Or exit To authenticate the validity of the client terminal 125 further comprises a certificate management server 110 to prevent the certificate is transferred to the illegal possession which is characterized in that formed.

Here, the certificate issuing server 100 is provided on the certificate issuing system side as shown in FIG. 2 and mounted on the customer terminal 125 through a communication network to prevent the certificate from being illegally transferred and occupied. When issuing a certificate to the removable medium 1, the device 1 checks the device-specific information 1 corresponding to at least one of the plurality of device devices provided or detached from the customer terminal 125 and the medium 1. As a generic term for a functional configuration to be stored in association with certificate information issued by the, the certificate issuing server 100 is implemented in the form of one or more servers (or devices), or a functional component provided in the certificate issuing server 100 It is also possible to implement in the form, it will be clear that the present invention is not limited.

The customer terminal 125 is a wired communication network based on Transmission Control Protocol / Internet Protocol (TCP / IP) (eg, Asymmetric Digital Subscriber Line (ADSL) / Very High-data Rate Digital Subscriber Line (VDSL) or cable communication network). A mobile communication terminal including at least one wired terminal including a desktop computer or a laptop connected to the certificate issuing server 100 or a mobile communication network connected to a code division multiple access (CDMA) based mobile communication network, or IEEE. And at least one wireless terminal including at least one portable internet terminal connected to an 802.16x based high speed wireless internet, wherein the client terminal 125 is issued by the certificate issuing server 100. Output at least one certificate issuing interface, and prints the certificate through the certificate issuing interface It is preferable that a function configuration (eg, a browser program and a communication function) for inputting (or selecting) certificate issue request information for issuing a certificate and transmitting the certificate issue request information to the certificate issue server 100 is provided.

Those skilled in the art to which the present invention pertains will be able to easily infer the characteristics of the customer terminal 125 corresponding to at least one or more wired or wireless terminal, detailed description thereof is omitted for convenience. do.

According to an embodiment of the present invention, when the customer terminal 125 is a wired terminal, the communication network includes the TCP / IP based wired communication network, and when the customer terminal 125 is a wireless terminal, the communication network Preferably, the CDMA-based mobile communication network or IEEE 802.16x-based high-speed wireless Internet includes at least one or more.

According to the present invention, the certificate issuing server 100 is an interface unit for connecting and managing a communication channel with the customer terminal 125 through the communication network to provide a web interface corresponding to the customer terminal 125 and the communication network. Characterized in that it comprises a (200), whereby the certificate issuing server 100 has a function of a web server that is connected to communicate with the customer terminal 125 via a wired or wireless communication network.

According to an embodiment of the present invention, when the customer terminal 125 is a wired terminal to which a communication channel is connected through a TCP / IP based wired communication network, the interface unit 200 may connect the customer terminal 125 and HTTP ( Connecting a communication channel based on a Hyper-Text Transfer Protocol protocol, transmitting and outputting a certificate issuing interface in the form of a Hyper-Text Markup Language (HTML) compatible document to the customer terminal 125 through the communication channel; It is preferable to perform a function of receiving and processing certificate issuing request information input (or selected) through the certificate issuing interface from the customer terminal 125.

According to another exemplary embodiment of the present invention, when the customer terminal 125 is a wireless terminal to which a communication channel is connected through a CDMA based wireless communication network, the interface unit 200 is connected to the customer terminal 125 and a WAP (Wireless). Connect a communication channel or a full-browsing-based wireless Internet communication channel based on an Application Protocol (ME) or Mobile Explorer (ME) protocol, and use WML (Wireless Markup Language) or HTML compatible with the customer terminal 125 through the communication channel. It is preferable to perform a function of transmitting and outputting a certificate issuing interface in the form of a document, and receiving and issuing certificate issuing request information corresponding to the certificate issuing interface from the customer terminal 125.

According to another exemplary embodiment of the present invention, when the customer terminal 125 is a wireless terminal to which a communication channel is connected through an IEEE 802.16x based wireless communication network, the interface unit 200 may be connected to the customer terminal 125. Connect a communication channel based on a wireless protocol corresponding to the IEEE 802.16 standard, transmit a certificate issuing interface to the customer terminal 125 through the communication channel, and output the certificate issuing interface, and issue the certificate from the customer terminal 125. It is preferable to perform a function of receiving and processing predetermined certificate issuing request information corresponding to the interface.

According to the present invention, the certificate issuing server 100 when the customer terminal 125 is connected to the certificate issuing server 100 (or a certificate issuing request) through the interface unit 200, the interface unit 200 And an interface providing unit 205 for generating (or extracting) a certificate issuing interface for inputting (or selecting) certificate issuing request information from the client terminal 125 and transmitting the certificate issuing request information. .

The interface providing unit 205 has a function provided in the customer terminal 125 when the customer terminal 125 connects to the certificate issuing server 100 (or a certificate issuing request) through the interface unit 200. In response to a configuration (eg, a browser program provided in the customer terminal 125), the certificate issuance interface may be generated (or selected) and transmitted to the certificate issuing server 100 through the communication network. Or extract from a database (not shown) and provide the generated (or extracted) certificate issuing interface to the customer terminal 125 via the communication network in association with the interface unit 200.

Thereafter, the client terminal 125 inputs (or selects) certificate issuing request information based on the certificate issuing interface, and inputs (or selects) the certificate issuing request information to the certificate issuing server 100 through the communication network. To send).

Here, the certificate issuing request information is customer information requesting to issue the certificate to the medium 1 to be mounted or detached on the customer terminal 125, and the certificate is mounted or detached to the customer terminal 125 Preferably comprises at least one medium (1) information to be recorded, and at least one operating system (or platform) information for the customer terminal 125.

The customer information included in the certificate issuance request information includes at least one of customer member information including member ID information and password information of the customer who is issued the certificate, or the name, resident registration number, address, and contact information of the customer. It is preferable to include at least one customer personal information that includes.

The medium 1 information included in the certificate issuance request information includes information for identifying (or identifying) a medium in which the certificate is issued and stored among media loaded or detached from the customer terminal 125. It is preferable.

According to an embodiment of the present invention, the medium 1 information includes a hard disk medium mounted (eg, embedded) or detached (eg, external, or mounted via a network) on the customer terminal 125. It is preferable to make.

Alternatively, the medium 1 information may include a floppy disk medium detachable from the customer terminal 125 (eg, inserted into a floppy disk drive).

Alternatively, the medium 1 information may include a USB medium mounted on the customer terminal 125 (eg, mounted on a PCB through a USB terminal) or detached (eg, connected to a USB port). desirable.

Alternatively, the medium 1 information is mounted on the customer terminal 125 (e.g., using an IC card slot) or detached (e.g., connected via a contact IC card reader or a contactless IC card reader). It is preferred to include a card medium.

Alternatively, the media 1 information may be mounted on the customer terminal 125 (eg, inserting a card slot or mounted on a PCB) or detached (eg, connected through a communication port). It is preferred to include a Hardware Security Module (HSM) medium.

Those skilled in the art to which the present invention pertains will be able to infer various types of media mounted on or detached from the customer terminal 125 in addition to the media 1 described above. It is characterized in that it comprises all the medium (1).

The operating system (or platform) information included in the certificate issuance request information is information for identifying or confirming the operating system (or platform) of the customer terminal 125 on which the medium 1 on which the certificate is issued is mounted or detached. It is preferable to identify an operating system (or platform) on which program code corresponding to the certificate is executed.

According to the present invention, the certificate issuing server 100 is unique to the device corresponding to one or more preset device among a plurality of device provided or detached in the customer terminal 125 in conjunction with the interface unit 200 And an information receiving unit 225 (or information receiving means) for checking and receiving the information (1).

According to an exemplary embodiment of the present invention, the interface providing unit 205 includes M (M> 1) pieces provided or detached from the customer terminal 125 in a certificate issuing interface provided to the customer terminal 125. A function of checking device information and transmitting it to the certificate issuing server 100 through a communication network, and m (1 <= m) from the certificate issuing server 100 to the certificate verification target among the M (M> 1) pieces of device information. A function of receiving <= M) component information, and a function of checking device specific information (1) corresponding to the received m components and transmitting the same to the certificate issuing server 100 through the communication network. It is preferable to provide a script (or a terminal program), and correspondingly, the certificate issuing server 100 may be provided with or detached from the customer terminal 125 in association with the interface unit 200 ( M> 1) spheres Device information receiving unit 210 (or device information receiving means) for receiving device information, and m (1 <= m <= M) pieces of device information for the certificate verification target among the M (M> 1) pieces of device information. Device information confirming unit 215 (or device information confirming means) for confirming the device information transmission unit for transmitting the m information of the identified device to the customer terminal 125 in conjunction with the interface unit 200 And 220 (or device information transmission means), wherein the information receiver 225 is provided with or detached from the customer terminal 125 in association with the interface unit 200 ( And M &lt; 1 &gt; device specific information 1 corresponding to the set m (1 < = &lt; = &lt; M) constituent devices.

According to another exemplary embodiment of the present disclosure, the interface providing unit 205 may be configured among preset components provided or detached from the client terminal 125 to a certificate issuing interface provided to the client terminal 125. It is preferable to include a script (or a terminal program) for identifying the device-specific information (1) corresponding to one or more component devices and transmitting them through a communication network, and correspondingly, the information receiving unit 225 is the interface unit The device specific information 1 corresponding to at least one preset device among a plurality of device devices provided to or detached from the customer terminal 125 may be received in connection with the 200.

According to an embodiment of the present invention, the device specific information (1) preferably comprises at least one of unique information of the medium on which the certificate is issued or unique information of a terminal on which the medium is mounted or detached.

For example, the device specific information 1 may include device serial number information provided in a hard disk medium mounted (eg, embedded) or detached (eg, external, or mounted via a network) in the customer terminal 125, It is preferable that the identification number information, identification code information including at least one.

Alternatively, the device specific information 1 may include MAC (Media Access Control) address information provided in a communication device mounted (eg, embedded) or detached (eg, external) to the customer terminal 125. desirable.

Alternatively, the device specific information 1 may be mounted on the customer terminal 125 (e.g., mounted on a PCB via a USB terminal) or detached (e.g., connected to a USB port). Preferably, the serial number information, unique number information, and identification code information are included.

Alternatively, the device specific information 1 may be mounted (eg, using an IC card slot) or detached from the customer terminal 125 (eg, connected through a contact IC card reader or a contactless IC card reader). Preferably, the IC card includes one or more IC chip serial numbers, IC chip unique information, and IC chip identification information included in the IC card medium.

Alternatively, the device specific information 1 may be mounted on the customer terminal 125 (eg, a card slot is inserted or mounted on a PCB) or detached (eg, connected through a communication port). It is preferable that the hardware module includes one or more device serial number information, unique number information, and identification code information included in a hardware security module (HSM) medium.

According to the present invention, the certificate issuing server 100 stores at least one certificate program source (or certificate program file) and certificate data (eg, certificate profile information) corresponding to a certificate to be issued to the customer terminal 125. When the certificate issuance request information is received from the certificate D / B 250 and the client terminal 125, the certificate corresponding to the certificate issuance request information is extracted or dynamically generated from the certificate D / B 250. The certificate extracting / generating unit 230 (or certificate extracting / generating means) and the certificate issuing unit 235 (or certificate issuing means) issued to the customer terminal 125 through the interface unit 200, It is characterized by comprising.

According to an exemplary embodiment of the present invention, the certificate D / B 250 stores a certificate program file and certificate data that can be operated in an operating system (or terminal platform) provided in the customer terminal 125. If the certificate issuance request information is received from the customer terminal 125, the certificate extractor / generation unit 230 may include a certificate program file matching the certificate issuance request information from the certificate D / B 250. And extracting a certificate including the certificate data.

According to another exemplary embodiment of the present invention, the certificate D / B 250 stores a certificate program source and certificate data capable of operating in an operating system (or terminal platform) provided in the customer terminal 125. If the certificate issuance request information is received from the customer terminal 125, the certificate extraction / generation unit 230 is a certificate program source matching the certificate issuance request information from the certificate D / B (250) And extract the certificate data, and compile the extracted certificate program source to dynamically generate a certificate to be issued to the customer terminal 125.

Thereafter, the certificate issuing unit 235 transmits the extracted (or dynamically generated) certificate to the customer terminal 125 through the communication network and mounts the customer terminal 125 through the interface unit 200. Or is issued to the removable medium (1), if the person of ordinary skill in the art, the method of issuing the certificate to the medium (1) mounted or detached to the customer terminal (125) Since it will be familiar with, detailed description thereof will be omitted for convenience.

According to an embodiment of the present invention, the certificate program included in the certificate provided by the certificate issuer 235 to the customer terminal 125 includes a certificate-based non-face-to-face authentication function through a communication network, and the non-face-to-face In authentication, one or more device-specific information (2) corresponding to one or more preset device among a plurality of device devices provided or detached from the customer terminal 125 on which the medium 1 is mounted or detached is checked. Transmitting / receiving data of the at least one device-specific information 2 (for example, data transmitted from the customer terminal 125 through the communication network according to non-face-to-face authentication, or data received by the customer terminal 125 through the communication network) It is characterized in that it comprises a function to include (including in) the transmission.

When the certificate is issued to the medium 1 provided in the customer terminal 125 as described above, the customer terminal 125 executes the certificate diagnosis mode for authenticating the validity of the certificate by first executing the certificate. To this end, the certificate issuing server 100 is provided with a diagnostic unit 240 (or certificate diagnostic means) for diagnosing the validity of the certificate in cooperation with the certificate provided in the customer terminal 125 It is characterized by.

According to an exemplary embodiment of the present invention, the certificate diagnosis mode may include at least one device-specific information corresponding to one or more preset device among a plurality of device devices provided or detached from the customer terminal 125 through the certificate. 2) transmits, and compares one or more device-specific information (2) received through the certificate and one or more device-specific information (1) received through the information receiving unit 225, the device unique transmitted from the certificate It is preferable to include checking whether the information 2 is valid.

According to an embodiment of the present invention, the device specific information 2 preferably includes one or more pieces of unique information of a medium on which the certificate is issued or unique information of a terminal on which the medium is mounted or detached.

For example, the device specific information 2 may be provided with device serial number information provided in a hard disk medium mounted (eg, embedded) or detached (eg, external, or mounted via a network) in the customer terminal 125, It is preferable that the identification number information, identification code information including at least one.

Alternatively, the device specific information 2 may include MAC (Media Access Control) address information provided in a communication device mounted (eg, embedded) or detached (eg, external) to the customer terminal 125. desirable.

Alternatively, the device specific information 2 may be mounted on the customer terminal 125 (e.g., mounted on a PCB through a USB terminal) or detached (e.g., connected to a USB port). Preferably, the serial number information, the unique number information, and identification code information are included.

Alternatively, the device specific information 2 may be mounted (eg, using an IC card slot) or detached from the customer terminal 125 (eg, connected through a contact IC card reader or a contactless IC card reader). Preferably, the IC card includes one or more IC chip serial numbers, IC chip unique information, and IC chip identification information included in the IC card medium.

Alternatively, the device specific information 2 may be mounted on the customer terminal 125 (eg, inserted into a card slot or mounted on a PCB) or detached (eg, connected through a communication port). It is preferable that the hardware module includes one or more device serial number information, unique number information, and identification code information included in a hardware security module (HSM) medium.

According to the present invention, the certificate issuing server 100 is provided with the certificate information corresponding to the certificate issued to the medium (1) mounted on or detached from the customer terminal 125, or provided in the customer terminal 125 or And an information storage unit 255 for linking and processing one or more device-specific information 1 corresponding to one or more preset device among the plurality of detachable device devices and storing them in the certificate management D / B 105. It is characterized by.

According to the method of the present invention, the information storage unit 255 is a medium (1) that is mounted or detached to the customer terminal 125, if the validity of the certificate is confirmed as a result of the diagnosis of the diagnosis unit 240 Certificate management by linking the issued certificate information and one or more device-specific information (1) received through the information receiving unit 225 of a plurality of components provided or detached to the customer terminal 125 Preferably stored in the D / B 105, and then the certificate information and one or more device-specific information 1 stored in the certificate management D / B 105 prevent the certificate from being illegally transferred and occupied. It is characterized by being used.

According to the present invention, the certificate issuing server 100 is a medium (1) mounted on or detached from the customer terminal 125 when the certificate is issued, in order to check the validity of the certificate transfer, the customer terminal 125 I) including I (I> 1) authentication information input query information, and i users respectively corresponding to i (1 <= i <= I) authentication information input query information among the I authentication information input query information. And an interface providing unit 205 for generating (or extracting) a user authentication information registration interface for inputting and transmitting the authentication information 1.

The interface providing unit 205 has a function provided in the customer terminal 125 in order to check the validity of the certificate transfer when the certificate is issued to the medium 1 mounted or detached from the customer terminal 125. In response to a configuration (e.g., a browser program provided in the customer terminal 125), the client terminal 125 includes I (I> 1) authentication information input query information, and among the I authentication information input query information. Input the i (1 <= i <= I) authentication information input query information to each of the i user authentication information (1) to generate a user authentication information registration interface that can be transmitted to the certificate issuing server 100 or Or extracting from a database (not shown) and providing the generated user authentication information registration interface to the customer terminal 125 through the communication network in association with the interface unit 200. And a gong.

Thereafter, the customer terminal 125 inputs (or selects) i user authentication information 1 based on the user authentication information registration interface, and inputs the input (or selected) i user authentication information 1. The certificate issuing server 100 is transmitted through the communication network.

According to the present invention, i user authentication information 1 corresponding to i (1 <= i <= I) authentication information input query information among the I authentication information input query information is received by the customer terminal 125. When inputted and transmitted, the certificate issuing server 100 is connected to the interface unit 200, the authentication information receiving unit 245 (or authentication information receiving means) for receiving i user authentication information (1), and the reception I input query information (or query identification codes respectively corresponding to the i authentication information input query information) corresponding to the i user authentication information 1 and the user authentication information 1 and the one or more device-specific information. And (1) an authentication information storage unit 260 (or authentication information storage means) which is stored in the certificate management D / B 105.

When the user terminal 125 inputs and transmits i user authentication information 1 corresponding to i (1 <= i <= I) authentication information input query information among the I authentication information input query information, The authentication information receiver 245 receives i user authentication information 1 in cooperation with the interface unit 200.

According to an embodiment of the present invention, when the user authentication information 1 is processed (for example, encrypted or digitally signed) through a certificate issued to the medium 1, the certificate information is attached and received. Preferably, the authentication information receiver 245 further includes the device-specific information 2 from the customer terminal 125. In this case, the information receiver 225 receives the device-specific information 2. It is preferable to perform device-specific information validity authentication through.

When the i user authentication information 1 is received from the customer terminal 125 through the authentication information receiver 245, the authentication information storage unit 260 may receive the i user authentication information 1 and the user. Confirm i input query information (or query identification codes corresponding to the i authentication information input query information) corresponding to each of the authentication information 1, and check the received i user authentication information 1 and the confirmation. The stored i input query information (or query identification codes corresponding to the i authentication information input query information) and the one or more device-specific information 1 and store them in the certificate management D / B 105. It is done.

According to another exemplary embodiment of the present invention, the authentication information receiving unit 245 corresponds to the received i user authentication information 1 and the confirmed i input query information (or the i authentication information input query information, respectively). Query identification code) and the certificate information in association with the certificate management can be stored in the D / B 105, whereby the present invention is not limited.

3 is a diagram illustrating a process of issuing a certificate to the customer terminal 125 according to an embodiment of the present invention.

In more detail, FIG. 3 illustrates that the certificate issued by the certificate issuing server 100 is illegally transferred and occupied when the certificate issuing request is made by the customer terminal 125 through the certificate issuing system shown in FIG. After checking the device-specific information (1) corresponding to one or more components of the plurality of components provided or detached in the customer terminal 125 to prevent, and then the issued certificate to the customer terminal 125 As a process for issuing to the medium 1 mounted or detached, the certificate issuing server (M> 1) of the device information provided or detached from the customer terminal 125 is checked in advance. After checking m (1 <= m <= M) constituent devices among the M (M> 1) constituent devices at 100), the m device-specific information identified from the customer terminal 125 is confirmed. Number 1 After, with the issue the requested certificate to the client terminal 125 or leaving nice of is a diagram showing an exemplary method of issuing a medium (1).

Those skilled in the art to which the present invention pertains may refer to various embodiments of the process of issuing a certificate to the customer terminal 125 by referring to and / or modifying the drawing 3, but the present invention can be inferred. The invention includes all the inferred implementation methods, and is not limited by the implementation method shown in FIG.

Hereinafter, in FIG. 3, the customer terminal 125 shown in FIG. 2 is referred to as a "terminal" for convenience, and the certificate issuing server 100 shown in FIG. 2 is referred to as a "server" for convenience.

Referring to FIG. 3, the terminal accesses the server through a communication network and requests 300 to issue the certificate to the server, and correspondingly, the server issues a certificate issue interface for issuing the certificate to the terminal. Extract (or generate) to provide to the terminal (305).

According to an exemplary embodiment of the present invention, the certificate issuing interface has a function of checking M (M> 1) component information provided or detached from the terminal and transmitting the information to the certificate issuing server 100 through a communication network. And receiving m (1 <= m <= M) configuration device information from a certificate issuing server 100 to the certificate verification target among the M (M> 1) configuration device information, and receiving the m configuration elements. It is preferable to include a script (or terminal program) including a function for identifying the device-specific information (1) corresponding to the device and transmits to the certificate issuing server 100 through the communication network.

Thereafter, the terminal inputs (or selects) certificate issue request information through the certificate issue interface (310), and transmits the input (or selected) certificate issue request information to the server through the communication network (315). .

Here, the certificate issuing request information includes customer information requesting to issue the certificate to the medium 1 mounted or detached from the terminal, and information on the medium 1 to be mounted or detached from the terminal to record the certificate. And one or more operating system (or platform) information about the terminal.

The customer information included in the certificate issuance request information includes at least one of customer member information including member ID information and password information of the customer who is issued the certificate, or the name, resident registration number, address, and contact information of the customer. It is preferable to include at least one customer personal information that includes.

Preferably, the medium 1 information included in the certificate issuing request information includes information for identifying (or identifying) a medium in which the certificate is issued and stored among media loaded or detached from the terminal.

According to an embodiment of the present invention, the medium (1) information preferably comprises a hard disk medium that is mounted (e.g., embedded) or detached (e.g., external, or mounted via a network) in the terminal. .

Alternatively, the medium (1) information preferably comprises a floppy disk medium that is detached from the terminal (eg, inserted into a floppy disk drive).

Alternatively, the medium 1 information preferably includes a USB medium mounted on the terminal (e.g., mounted on a PCB via a USB terminal) or detached (e.g., connected to a USB port).

Alternatively, the medium 1 information includes an IC card medium mounted on or detached from the terminal (eg, using an IC card slot) or detached (eg, connected via a contact IC card reader or a contactless IC card reader). It is preferable to make it.

Alternatively, the media 1 information may be mounted on the terminal (eg, inserted into a card slot or mounted on a PCB) or detached (eg, connected through a communication port). Module (HSM) medium is preferably included.

Those skilled in the art to which the present invention pertains can infer various types of media mounted or demounted in the terminal in addition to the above-described medium 1, and the present invention can be inferred from all the inferred media ( It characterized by comprising 1).

The operating system (or platform) information included in the certificate issuing request information is information for identifying or confirming the operating system (or platform) of the terminal on which the medium 1 on which the certificate is issued is mounted or detached. It is desirable to identify the operating system (or platform) on which the corresponding program code is executed.

Subsequently, the server requests to identify and transmit M (M> 1) device information provided or detached to the terminal by a script (or terminal program) provided to the terminal through a communication network (320). The terminal checks M (M> 1) pieces of device information provided or detached from the terminal and transmits the information to the server through the communication network (325).

Thereafter, the server checks m (1 <= m <= M) device information of the certificate verification target among the received M (M> 1) device information (330).

If m pieces of device information are confirmed to the certificate verification target (335), the server transmits the identified m pieces of device information to the terminal through a communication network (340), and the terminal correspondingly the m The m device-specific information 1 corresponding to the two component devices are checked and transmitted to the server through a communication network (345).

According to an embodiment of the present invention, the device specific information 1 preferably includes one or more pieces of unique information of a medium on which the certificate is issued or unique information of a terminal on which the medium is mounted or detached.

For example, the device specific information 1 may include device serial number information provided in a hard disk medium mounted (eg, embedded) or detached (eg, external, or mounted via a network) in the customer terminal 125, It is preferable that the identification number information, identification code information including at least one.

Alternatively, the device specific information 1 may include MAC (Media Access Control) address information provided in a communication device mounted (eg, embedded) or detached (eg, external) to the customer terminal 125. desirable.

Alternatively, the device specific information 1 may be mounted on the customer terminal 125 (e.g., mounted on a PCB via a USB terminal) or detached (e.g., connected to a USB port). Preferably, the serial number information, the unique number information, and identification code information are included.

Alternatively, the device specific information 1 may be mounted (eg, using an IC card slot) or detached from the customer terminal 125 (eg, connected through a contact IC card reader or a contactless IC card reader). Preferably, the IC card includes one or more IC chip serial numbers, IC chip unique information, and IC chip identification information included in the IC card medium.

Alternatively, the device specific information 1 may be mounted on the customer terminal 125 (eg, a card slot is inserted or mounted on a PCB) or detached (eg, connected through a communication port). The hardware security module (HSM) preferably comprises at least one device serial number information, unique number information, identification code information provided in the medium.

If m device-specific information 1 is received from the terminal (350), the server extracts (or dynamically generates) a certificate matching the certificate issue request information from the certificate D / B 250 (355). ).

According to an embodiment of the present invention, the certificate D / B 250 is characterized in that for storing the certificate program file and certificate data that can be operated in the operating system (or terminal platform) provided in the terminal, the terminal When the certificate issuing request information is received from the server, it is preferable that the server extracts a certificate including a certificate program file and certificate data matching the certificate issuing request information from the certificate D / B 250.

According to another exemplary embodiment of the present invention, the certificate D / B 250 stores a certificate program source and certificate data capable of operating in an operating system (or terminal platform) provided in the terminal. When the certificate issuance request information is received from the terminal, the server extracts a certificate program source and certificate data matching the certificate issuance request information from the certificate D / B 250, and compiles the extracted certificate program source. (Compile) it is preferable to dynamically generate a certificate to be issued to the terminal.

In addition, the server provides the extracted (or dynamically generated) certificate to the terminal through the communication network and issues it to the medium 1 mounted or detached from the terminal (360).

4 is a diagram illustrating a process of issuing a certificate to the customer terminal 125 according to another embodiment of the present invention.

In more detail, Figure 4 shows that when the certificate issuance request is issued from the client terminal 125 through the certificate issuing system shown in Figure 2, the certificate issued by the certificate issuing server 100 is illegally transferred and occupied. After checking the device-specific information (1) corresponding to one or more components of the plurality of components provided or detached in the customer terminal 125 to prevent, and then the issued certificate to the customer terminal 125 Regarding the process of issuing to the mounted or detached medium 1, in particular, receiving one or more preset device-specific information 1 from among a plurality of device information provided or detached in the customer terminal 125. After that, it is a diagram showing an implementation method for issuing the issued certificate to the medium (1) mounted or detached to the customer terminal (125).

Those skilled in the art to which the present invention pertains can refer to various embodiments of the process of issuing a certificate to the customer terminal 125 by referring to and / or modifying the drawing 4, but the present invention can be inferred. The present invention includes all the inferred implementation methods, and is not limited by the implementation method shown in FIG.

Hereinafter, in FIG. 4, the customer terminal 125 illustrated in FIG. 2 is referred to as a “terminal” for convenience, and the certificate issuing server 100 illustrated in FIG. 2 is referred to as a “server” for convenience.

Referring to FIG. 4, the terminal accesses the server through a communication network and requests to issue the certificate to the server (400). In response, the server issues a certificate issue interface for issuing the certificate to the terminal. Extract (or generate) to provide to the terminal (405).

According to an embodiment of the present invention, the certificate issuing interface may be configured to transmit device-specific information (1) corresponding to at least one preset device among a plurality of device devices provided to or detached from the terminal and transmitted through a communication network. It is preferable to include a script (or terminal program).

Thereafter, the terminal inputs (or selects) certificate issue request information through the certificate issue interface (410), and transmits the input (or selected) certificate issue request information to the server through the communication network (415). .

Here, the certificate issuing request information includes customer information requesting to issue the certificate to the medium 1 mounted or detached from the terminal, and information on the medium 1 to be mounted or detached from the terminal to record the certificate. And one or more operating system (or platform) information about the terminal.

The customer information included in the certificate issuance request information includes at least one of customer member information including member ID information and password information of the customer who is issued the certificate, or the name, resident registration number, address, and contact information of the customer. It is preferable to include at least one customer personal information that includes.

Preferably, the medium 1 information included in the certificate issuing request information includes information for identifying (or identifying) a medium in which the certificate is issued and stored among media loaded or detached from the terminal.

According to an embodiment of the invention, the medium (1) information preferably comprises a hard disk medium mounted (e.g., embedded) or detached (e.g., external, or mounted via a network) in the terminal. Do.

Alternatively, the medium (1) information preferably comprises a floppy disk medium that is detached from the terminal (eg, inserted into a floppy disk drive).

Alternatively, the medium 1 information preferably includes a USB medium mounted on the terminal (e.g., mounted on a PCB via a USB terminal) or detached (e.g., connected to a USB port).

Alternatively, the medium 1 information includes an IC card medium mounted on or detached from the terminal (eg, using an IC card slot) or detached (eg, connected via a contact IC card reader or a contactless IC card reader). It is preferable to make it.

Alternatively, the media 1 information may be mounted on the terminal (eg, inserted into a card slot or mounted on a PCB) or detached (eg, connected through a communication port). Module (HSM) medium is preferably included.

Those skilled in the art to which the present invention pertains can infer various types of media mounted or demounted in the terminal in addition to the above-described medium 1, and the present invention can be inferred from all the inferred media ( It characterized by comprising 1).

The operating system (or platform) information included in the certificate issuing request information is information for identifying or confirming the operating system (or platform) of the terminal on which the medium 1 on which the certificate is issued is mounted or detached. It is desirable to identify the operating system (or platform) on which the corresponding program code is executed.

Subsequently, the server may provide one or more device-specific information (1) about one or more preset device among the plurality of device information provided or detached to the terminal by a script (or a terminal program) provided to the terminal through a communication network. In operation 420, the terminal verifies one or more device-specific information 1 corresponding to the one or more configuration devices, and transmits the information to the server through the communication network.

According to an embodiment of the present invention, the device specific information (1) preferably comprises at least one of unique information of the medium on which the certificate is issued or unique information of a terminal on which the medium is mounted or detached.

For example, the device specific information 1 may include device serial number information provided in a hard disk medium mounted (eg, embedded) or detached (eg, external, or mounted via a network) in the customer terminal 125, It is preferable that the identification number information, identification code information including at least one.

Alternatively, the device specific information 1 may include MAC (Media Access Control) address information provided in a communication device mounted (eg, embedded) or detached (eg, external) to the customer terminal 125. desirable.

Alternatively, the device specific information 1 may be mounted on the customer terminal 125 (e.g., mounted on a PCB via a USB terminal) or detached (e.g., connected to a USB port). Preferably, the serial number information, the unique number information, and identification code information are included.

Alternatively, the device specific information 1 may be mounted (eg, using an IC card slot) or detached from the customer terminal 125 (eg, connected through a contact IC card reader or a contactless IC card reader). Preferably, the IC card includes one or more IC chip serial numbers, IC chip unique information, and IC chip identification information included in the IC card medium.

Alternatively, the device specific information 1 may be mounted on the customer terminal 125 (eg, a card slot is inserted or mounted on a PCB) or detached (eg, connected through a communication port). The hardware security module (HSM) preferably comprises at least one device serial number information, unique number information, identification code information provided in the medium.

If m device unique information 1 is received from the terminal (430), the server extracts (or dynamically generates) a certificate matching the certificate issuing request information from the certificate D / B 250 (435). ).

According to an embodiment of the present invention, the certificate D / B 250 is characterized in that for storing the certificate program file and certificate data that can be operated in the operating system (or terminal platform) provided in the terminal, the terminal When the certificate issuing request information is received from the server, it is preferable that the server extracts a certificate including a certificate program file and certificate data matching the certificate issuing request information from the certificate D / B 250.

According to another exemplary embodiment of the present invention, the certificate D / B 250 stores a certificate program source and certificate data capable of operating in an operating system (or terminal platform) provided in the terminal. When the certificate issuance request information is received from the terminal, the server extracts a certificate program source and certificate data matching the certificate issuance request information from the certificate D / B 250, and compiles the extracted certificate program source. (Compile) it is preferable to dynamically generate a certificate to be issued to the terminal.

In addition, the server provides the extracted (or dynamically generated) certificate to the terminal through the communication network and issues it to the medium 1 mounted or detached from the terminal (440).

5 is a diagram illustrating a certificate verification process issued to the customer terminal 125 according to the embodiment of the present invention.

More specifically, Figure 5 is issued to the medium (1) when issuing a certificate to the medium (1) mounted or detached to the customer terminal 125 through the certificate issuing process shown in Figure 3 or 4 The certificate relates to a process of verifying that a function for preventing illegal transfer and occupancy of the certificate is normally operated. Those skilled in the art to which the present invention pertains may refer to and / or modify the present invention. Various implementation methods for the certificate verification process issued to the customer terminal 125 may be inferred, but the present invention includes all the inferred implementation methods and is not limited by the implementation method shown in FIG.

Hereinafter, in FIG. 5, the customer terminal 125 illustrated in FIG. 2 is referred to as a “terminal” for convenience, and the certificate issuing server 100 illustrated in FIG. 2 is referred to as a “server” for convenience.

Referring to FIG. 5, when a certificate is issued to a medium 1 mounted or detached to the customer terminal 125 through the certificate issuing process illustrated in FIG. 3 or 4, the server is mounted or detached from the terminal. It is checked whether the certificate is issued to the attached medium 1 (500).

If the certificate is issued to the medium 1 mounted or detached from the terminal (505), the terminal executes the certificate to initiate a diagnostic mode for the certificate (510), the terminal correspondingly Through the certificate transmits one or more device-specific information (2) corresponding to one or more of the predetermined configuration device of the plurality of devices provided or detached to the customer terminal 125 (515), and correspondingly The server reads the received one or more device-specific information (2) to verify the validity of the certificate (520)

According to an exemplary embodiment of the present invention, the validity of the certificate may include at least one device corresponding to at least one preset device among a plurality of device devices provided or detached from the customer terminal 125 through the certificate. Send the unique information (2), and compare the at least one device specific information (2) received through the certificate with the at least one device specific information (1) received, and the device specific information (2) transmitted from the certificate. Is preferably included.

If the validity of the certificate is not verified (525), the server generates certificate diagnostic error information and transmits the certificate diagnostic error information to the terminal through the communication network (530).

On the other hand, if the validity of the certificate is confirmed (525), the server associates the certificate information corresponding to the certificate mounted on the terminal with the received at least one or more device-specific information (1) certificate management D / The certificate information and one or more device-specific information 1 stored in the B 105 (535) and then stored in the certificate management D / B 105 are used to prevent the certificate from being illegally transferred and occupied. .

In addition, the server includes I (I> 1) authentication information input query information to the terminal for validation of the certificate transfer, i (1 <= i <of the I authentication information input query information; (I) generating (or extracting) a user authentication information registration interface for inputting and transmitting i user authentication information (1) corresponding to the authentication information input query information (I) (540), and correspondingly, the terminal. The i checks whether i user authentication information 1 corresponding to i (1 <= i <= I) authentication information input query information is input from the authentication information input query information through the user authentication information registration interface ( 545).

If the i user authentication information 1 is input (550), the terminal transmits the input i user authentication information (1) to the server (555).

According to an embodiment of the present invention, when the user authentication information 1 is processed (for example, encrypted or digitally signed) through a certificate issued to the medium 1, the certificate information is attached and received. The terminal further includes receiving the device specific information 2 in the user authentication information 1, in which case the server performs device specific information validity authentication through the received device specific information 2. It is preferable to carry out more.

Thereafter, the server receives i input query information corresponding to the received i user authentication information 1 and user authentication information 1 (or a query identification code corresponding to the i authentication information input query information, respectively). I), the received i user authentication information (1) and the identified i input query information (or query identification codes corresponding to the i authentication information input query information respectively) and the one or more device-specific information ( 1) is stored in the certificate management D / B 105 in association with (560).

According to another exemplary embodiment of the present invention, the server may include the received i user authentication information 1 and the checked i input query information (or query identification codes corresponding to the i authentication information input query information, respectively). And storing the certificate information in the certificate management D / B 105 in association with the certificate information, and the present invention is not limited thereto.

FIG. 6 is a diagram illustrating a configuration of a certificate management system for managing a certificate by a medium 1 mounted on or detached from a customer terminal 125 according to an embodiment of the present invention.

In more detail, FIG. 6 is a diagram of FIG. 2 in order to prevent the certificate from being illegally transferred and occupied when using a certificate issued to the medium 1 mounted or detached to the customer terminal 125 through a communication network. The device-specific information-based validation of the medium 1 on which the certificate is issued is performed through the certificate information provided in the certificate management D / B 105 and one or more device-specific information 1 through a certificate issue system. As a certificate management system configuration, those of ordinary skill in the art to which the present invention pertains, refer to and / or modify the present Figure 6 mounted on the customer terminal 125 to the customer terminal 125 or Although various implementation methods for a system configuration for managing a certificate with a removable medium 1 may be inferred, the present invention includes all the inferred implementation methods. It is not limited by the implementation method shown in FIG.

For example, those skilled in the art to which the present invention pertains can use various types of certificate usage systems (eg, non-face-to-face financial transaction systems, non-face-to-face authentication systems, online) to which the certificate management system shown in FIG. 6 is applied. Payment system, etc.), and the present invention is characterized by including all the implementation methods inferred.

Hereinafter, the components on the system for managing the certificate issued to the medium 1 to be mounted or detached from the customer terminal 125 in this Figure 6 is referred to as "certificate management server 110" for convenience.

Referring to FIG. 6 according to an embodiment of the present invention, the certificate management system interoperates by mounting or detaching the medium 1 on which the certificate is issued through the certificate issuing system shown in FIG. The client terminal 125 accesses the certificate management server 110 and requests the use of a certificate through a certificate issued to the medium 1 (eg, a non-face-to-face financial transaction request, a non-face-to-face authentication request, and an online payment request). A certificate use server 120 connected to the customer terminal 125 through a communication network to process a certificate use request requested from the customer terminal 125, and a customer network 125 connected to the customer terminal 125; When using the certificate through the certificate using server 120 in the customer terminal 125, and receives the device-specific information (2) provided in the customer terminal 125, the medium 1 is mounted or detached through the certificate, Prize At least one of a plurality of components provided or detached at the customer terminal 125 in which the medium 1 is mounted or detached in association with the certificate management D / B 105 on the certificate issuing system shown in FIG. Check the device specific information (1) corresponding to the configuration device, and compare the device specific information (1) and the device specific information (2) to confirm the validity of the device specific information based on the medium (1) issued the certificate Characterized in that it comprises a certificate management server 110.

Here, the certificate management server 110 is a generic term of a functional configuration provided on the certificate management system side as shown in FIG. 6 to prevent the certificate from being illegally transferred and occupied. The certificate management server 110 ) May be implemented in the form of one or more servers (or devices), or in the form of functional components provided in the certificate-using server 120, whereby it is apparent that the present invention is not limited.

The customer terminal 125 is a wired communication network based on Transmission Control Protocol / Internet Protocol (TCP / IP) (eg, Asymmetric Digital Subscriber Line (ADSL) / Very High-data Rate Digital Subscriber Line (VDSL) or cable communication network). A mobile communication terminal comprising at least one wired terminal including a desktop computer or a notebook computer connected to the certificate management server 110 or connected to a code division multiple access (CDMA) based mobile communication network, or IEEE And at least one wireless terminal including at least one portable internet terminal connected to an 802.16x based high speed wireless internet, wherein the client terminal 125 is provided by the certificate using server 120. Output one or more certificate usage interfaces, and send the certificate through the certificate usage interface. The certificate use server 120 (or the certificate management server 110) may be input (or selected) by using certificate use request information (for example, non-face-to-face financial transaction request information, non-face-to-face authentication request information, and online payment request information). It is desirable to have a functional configuration (e.g., a browser program and a communication function) for transmission to the network.

Those skilled in the art to which the present invention pertains will be able to easily infer the characteristics of the customer terminal 125 corresponding to at least one or more wired or wireless terminal, detailed description thereof is omitted for convenience. do.

According to an embodiment of the present invention, when the customer terminal 125 is a wired terminal, the communication network includes the TCP / IP based wired communication network, and when the customer terminal 125 is a wireless terminal, the communication network Preferably, the CDMA-based mobile communication network or IEEE 802.16x-based high-speed wireless Internet includes at least one or more.

According to the present invention, the certificate management server 110 provides a web interface corresponding to the communication network with the customer terminal 125 to connect a communication channel for receiving certificate use request information from the customer terminal 125 and Or an interface unit 600 for connecting and managing a communication channel for relaying and receiving certificate use request information received from the client terminal 125 from the certificate use server 120. .

According to an embodiment of the present invention, the customer terminal 125 is a wired terminal to which a communication channel is connected through a TCP / IP based wired communication network, and the certificate use request information from the customer terminal 125 corresponding to the wired terminal. When receiving the interface unit 600 connects the communication channel based on the customer terminal 125 and the Hyper-Text Transfer Protocol (HTTP) protocol, and the HTML to the customer terminal 125 through the communication channel (Hyper-Text Markup Language) transmits and outputs a certificate use interface in the form of a compatible document, and receives and processes certificate use request information input (or selected) through the certificate use interface from the client terminal 125. It is desirable to.

According to another exemplary embodiment of the present invention, the customer terminal 125 is a wireless terminal to which a communication channel is connected through a CDMA-based wireless communication network, and receives the certificate use request information from the customer terminal 125 corresponding to the wireless terminal. When receiving, the interface unit 600 connects a communication channel or a full-browsing-based wireless Internet communication channel with the customer terminal 125 based on a WAP (Wireless Application Protocol) or a ME (Mobile Explorer) protocol. A certificate use interface in the form of a WML (Wireless Markup Language) or HTML compatible document is transmitted to the customer terminal 125 through the communication channel, and the certificate use interface corresponding to the certificate use interface is requested from the customer terminal 125. It is desirable to perform a function of receiving and processing information.

According to another exemplary embodiment of the present invention, the customer terminal 125 is a wireless terminal to which a communication channel is connected through an IEEE 802.16x based wireless communication network, and uses the certificate from the customer terminal 125 corresponding to the wireless terminal. When receiving the request information, the interface unit 600 connects the communication channel with the customer terminal 125 based on a wireless protocol corresponding to the IEEE 802.16 standard, and the customer terminal 125 through the communication channel. It is preferable to perform a function of transmitting and outputting a certificate use interface, and receiving and processing predetermined certificate use request information corresponding to the certificate use interface from the customer terminal 125.

When receiving the certificate use request information from the certificate use server 120 according to another embodiment of the present invention, the interface unit 600 for receiving the certificate use request information from the certificate use server 120 It is characterized by connecting and managing the communication channel.

According to the present invention, when the certificate management server 110 receives the certificate use request information from the customer terminal 125, the customer terminal 125 through the interface unit 600, the certificate management server 110 ) (Or extract) a certificate use interface for inputting (or selecting) certificate use request information from the client terminal 125 in connection with the interface unit 600 when connecting (or requesting a certificate use). It characterized by comprising an interface providing unit 605 to provide.

The interface providing unit 605 is provided to the customer terminal 125 when the customer terminal 125 connects to the certificate management server 110 through the interface unit 600 (or uses a certificate). In response to a configuration (eg, a browser program provided in the customer terminal 125), the certificate usage interface may be generated (or selected) and transmitted to the certificate management server 110 through the communication network. Or extracting from a database (not shown) and providing the generated certificate usage interface (or extracted) to the customer terminal 125 through the communication network in association with the interface unit 600.

Thereafter, the client terminal 125 inputs (or selects) certificate use request information based on the certificate use interface, and transmits the input (or selected) certificate use request information to the certificate management server 110 through the communication network. To send).

According to another exemplary embodiment of the present invention, the certificate using server 120 is connected to the customer terminal 125 through a communication network when requesting the use of a certificate, the functional configuration provided in the customer terminal 125 (for example, the customer terminal) In response to the browser program provided at 125, certificate usage request information may be input (or selected) and transmitted to the certificate management server 110 through the communication network, or a database may be generated. ) And provide the generated (or extracted) certificate use interface to the customer terminal 125 through the communication network. In response, the customer terminal 125 is based on the certificate use interface. Enter (or select) certificate use request information, and transmit the certificate use request information to the communication network. To be sent to the certificate using the server 120 (or the certificate management server 110).

If the certificate use request information is received by the certificate use server 120, the certificate use server 120 may relay the received certificate use request information to the certificate management server 110.

Here, the certificate use request information is non-face-to-face financial transaction request information for non-face-to-face financial transactions (eg, non-face-to-face account inquiry transaction request information, non-face-to-face transfer transaction request information, non-face-to-face credit accumulation request information, non-face-to-face utility bill payment Request information, etc.), non-face-to-face authentication request information for processing non-face-to-face authentication (e.g., various passwords, certificate information, security card information, OTP information, etc.), online payment request information for processing online payment (e.g., online credit) Card payment request information, online check card payment request information, online prepaid card payment request information, online debit card payment request information, etc.) is preferably made, and those skilled in the art to which the present invention belongs. If it is, it is possible to infer a variety of information configuration for the certificate use request information, The light is characterized in that it comprises all the inference method.

According to the present invention, the certificate use request information is processed (for example, encrypted or digitally signed) through a certificate issued to the medium 1 mounted on or detached from the customer terminal 125, and the certificate information is Characterized in that it is attached, and includes one or more device-specific information (2) corresponding to one or more component devices provided or detached to the customer terminal 125 through the certificate to prevent illegal transfer and possession of the certificate It is desirable to.

According to an embodiment of the present invention, the device specific information 2 preferably includes one or more pieces of unique information of a medium on which the certificate is issued or unique information of a terminal on which the medium is mounted or detached.

For example, the device specific information 2 may be provided with device serial number information provided in a hard disk medium mounted (eg, embedded) or detached (eg, external, or mounted via a network) in the customer terminal 125, It is preferable that the identification number information, identification code information including at least one.

Alternatively, the device specific information 2 may include MAC (Media Access Control) address information provided in a communication device mounted (eg, embedded) or detached (eg, external) to the customer terminal 125. desirable.

Alternatively, the device specific information 2 may be mounted on the customer terminal 125 (e.g., mounted on a PCB through a USB terminal) or detached (e.g., connected to a USB port). Preferably, the serial number information, the unique number information, and identification code information are included.

Alternatively, the device specific information 2 may be mounted (eg, using an IC card slot) or detached from the customer terminal 125 (eg, connected through a contact IC card reader or a contactless IC card reader). Preferably, the IC card includes one or more IC chip serial numbers, IC chip unique information, and IC chip identification information included in the IC card medium.

Alternatively, the device specific information 2 may be mounted on the customer terminal 125 (eg, inserted into a card slot or mounted on a PCB) or detached (eg, connected through a communication port). It is preferable that the hardware module includes one or more device serial number information, unique number information, and identification code information included in a hardware security module (HSM) medium.

According to the present invention, the certificate management server 110 is connected to the interface unit 600, the information receiving unit 610 (or information receiving means) for receiving the certificate use request information, and the certification authority that issued the certificate. Certificate-based validity of the certificate use request information based on the certificate information attached to the certificate use request information in association with a certificate server (not shown) provided in (or by reading a copy of a certificate included in the certificate information). Certificate verification unit 615 (or certificate verification means) to verify, and at the time of certificate-based validation of the certificate use request information, the certificate information included in the certificate use request information and one or more device-specific information (2) is extracted An information extraction unit 620 (or information extraction means) and one stored in the certificate management D / B 105 based on the extracted certificate information. The certificate using request is made by comparing the information identifying unit 625 (or information checking means) confirming the device specific information 1 with the checked device unique information 1 and the extracted device unique information 2. Validation unit 630 (or validation means) for checking the device-specific information-based validity of the information, and the certificate using server (CV) using the certificate-based request information for which the certificate-based validity is verified and the device-specific information-based validity is verified. And an information processing unit 635 (or information processing means) for providing a certificate-based service corresponding to the certificate use request information.

According to an exemplary embodiment of the present invention, the client terminal 125 may encrypt the certificate use request information through one or more encryption keys (eg, a private key, a public key, a symmetric key / secret key) included in the certificate. Attach the electronic signature, encrypt the device-specific information (2) with one or more encryption keys provided in the certificate, and then attach and transmit the certificate information, the certificate information is omitted according to the intention of those skilled in the art ( For example, it can be omitted if the certificate information can be confirmed through the authentication server (not shown) provided in the certification authority, by which the present invention is not limited.

Alternatively, the client terminal 125 encrypts the certificate use request information and the device-specific information 2 through one or more encryption keys (eg, private key, public key, symmetric key / secret key) included in the certificate. It is preferable to attach the electronic signature and attach the certificate information, and to transmit the certificate information. The certificate information is omitted according to the intention of the person skilled in the art (for example, the certificate information can be confirmed through a certificate server (not shown) provided in the certification authority). If omitted), whereby the present invention is not limited.

Alternatively, the client terminal 125 may include one or more encryption keys (eg, private key, public key, symmetric key / secret key) provided with the certificate using request information, device-specific information 2, and certificate information. It is preferable to transmit an encrypted or digital signature through the transmission, and the certificate information is omitted according to the intention of the person skilled in the art (for example, if the certificate information can be confirmed through an authentication server (not shown) provided in the certification authority). The present invention is not limited thereto.

According to another exemplary embodiment of the present invention, the customer terminal 125 first encrypts the certificate use request information by using the device-specific information 2 as an encryption key, and includes one or more encryption keys included in the certificate ( For example, it is preferable to attach the second encryption to the digital signature through a private key, a public key, a symmetric key / secret key, and to transmit (attach) the certificate information.

Alternatively, the client terminal 125 first encrypts the certificate use request information and the certificate information using the device-specific information 2 as an encryption key, and includes one or more encryption keys (eg, a private key, Public key, symmetric key / secret key) is preferably transmitted with the second encryption or digital signature attached.

According to another exemplary embodiment of the present invention, the client terminal 125 transmits the certificate use request information through one or more encryption keys (eg, private key, public key, symmetric key / secret key) provided in the certificate. After attaching the first encryption to the electronic signature, attaching the certificate information (can be omitted), it is preferable to transmit the second encryption using the device-specific information 2 as an encryption key.

Alternatively, the client terminal 125 may use the certificate request information and the certificate information through first encryption or electronic signature through one or more encryption keys (eg, private key, public key, symmetric key / secret key) included in the certificate. Is attached, and it is preferable to transmit the second encrypted by using the device-specific information (2) as an encryption key.

According to another exemplary embodiment of the present invention, encryption or electronic signature attachment through one or more encryption keys (eg, private key, public key, symmetric key / secret key) included in the certificate may be omitted, and the device specific information (2) may be omitted. ) Can be encrypted using the encryption key, and the present invention is not limited thereto.

In using the device-specific information 2 as an encryption key according to an embodiment of the present invention, when the device-specific information 2 includes an encryption key structure, the customer terminal 125 may display the device-specific information (2). Is preferably used as an encryption key, and if the device-specific information 2 does not include an encryption key structure, the customer terminal 125 may hash the device-specific information 2 into an encryption key structure. It is preferable to generate an encryption key corresponding to the device specific information 2 by hashing it through a function and use it as the encryption key.

According to an exemplary embodiment of the present invention, the customer terminal 125 includes (or uses) the device-specific information 2 and processes (eg, encrypts or attaches to, or attaches to, an electronic signature) any one of the above methods. 1, after the encryption, the second encryption to the digital signature attached, or the first encryption to the digital signature after the second encryption) transmits the certificate use request information to the certificate management server, and correspondingly, the information receiving unit 610 is the interface In connection with the unit 600, characterized in that for receiving the certificate use request information from the customer terminal (125).

According to another exemplary embodiment of the present invention, the customer terminal 125 includes (or uses) the device-specific information 2 and processes (eg, encrypts or attaches to an electronic signature) any of the above methods. After the first encryption and the second encryption to the digital signature attached, or the first encryption to the digital signature after the second encryption) transmits the certificate use request information to the certificate using server, the information receiving unit 610 in response to the In connection with the interface unit 600, it characterized in that for relaying the certificate use request information from the certificate using server 120.

Processed through a certificate issued to the medium 1 through the information receiving unit 610 (for example, encryption or digital signature attached), the certificate information is attached, provided or detached from the customer terminal 125 When the certificate use request information including one or more device-specific information 2 corresponding to one or more component devices is received, the certificate verification unit 615 receives the certificate information through the certificate information attached to the certificate use request information. Verify the certificate authority that issued the certificate, decrypt the certificate use request information in association with a certificate server (not shown) provided in the certificate authority (or read a copy of the certificate included in the certificate information) or verify the digital signature. By processing, characterized in that to verify the certificate-based validity of the certificate use request information.

Those skilled in the art to which the present invention pertains, the certificate verification unit 615 in conjunction with the authentication server (not shown) provided in the certification authority that issued the certificate (or included in the certificate information By reading a copy of the certificate) will be familiar with the technical features for verifying the certificate-based validity of the certificate use request information based on the certificate information attached to the certificate use request information, a detailed description thereof will be omitted for convenience. do.

When the certificate-based validity is verified by the certificate verifying unit 615, the information extracting unit 620 may verify the certificate information and one or more device-specific information (2) from the certificate use request information decrypted by the certificate-based validity. It is characterized in that the extraction.

When the certificate information and one or more device-specific information 2 are extracted through the information extracting unit 620, the information checking unit 625 based on the extracted certificate information, the certificate issuing system shown in FIG. At least one device-specific information (1) associated with the certificate information in association with the certificate management D / B (105) for storing the certificate information issued to the medium (1) and the device-specific information (1) in association with It is characterized by checking.

According to an embodiment of the present invention, the device specific information (1) preferably comprises at least one of unique information of the medium on which the certificate is issued or unique information of a terminal on which the medium is mounted or detached.

For example, the device specific information 1 may include device serial number information provided in a hard disk medium mounted (eg, embedded) or detached (eg, external, or mounted via a network) in the customer terminal 125, It is preferable that the identification number information, identification code information including at least one.

Alternatively, the device specific information 1 may include MAC (Media Access Control) address information provided in a communication device mounted (eg, embedded) or detached (eg, external) to the customer terminal 125. desirable.

Alternatively, the device specific information 1 may be mounted on the customer terminal 125 (e.g., mounted on a PCB via a USB terminal) or detached (e.g., connected to a USB port). Preferably, the serial number information, the unique number information, and identification code information are included.

Alternatively, the device specific information 1 may be mounted (eg, using an IC card slot) or detached from the customer terminal 125 (eg, connected through a contact IC card reader or a contactless IC card reader). Preferably, the IC card includes one or more IC chip serial numbers, IC chip unique information, and IC chip identification information included in the IC card medium.

Alternatively, the device specific information 1 may be mounted on the customer terminal 125 (eg, a card slot is inserted or mounted on a PCB) or detached (eg, connected through a communication port). It is preferable that the hardware module includes one or more device serial number information, unique number information, and identification code information included in a hardware security module (HSM) medium.

When one or more device-specific information 1 associated with the certificate information is confirmed, the validity confirming unit 630 compares the identified device-specific information 1 and the extracted device-specific information 2 to the certificate. It is characterized by checking the validity of the device-specific information based on the use request information.

According to the exemplary embodiment of the present invention, when the identified device specific information 1 and the extracted device specific information 2 match, the validity confirming unit 630 based on the device specific information on the certificate use request information. It is desirable to confirm that the validity is confirmed.

When the certificate use request information (or the certificate use request information and the certificate information) is encrypted using the device-specific information 2 as an encryption key according to an embodiment of the present invention, the encrypted certificate use request information (or the The certificate use request information and the certificate information) are decrypted using the identified device-specific information 1 as a decryption key, and the decryption process using the device-specific information 1 as the decryption key is normally performed. ) Preferably confirms that the device-specific information-based validity of the certificate use request information is confirmed.

In using the device-specific information 1 as a decryption key according to an embodiment of the present invention, when the device-specific information 1 includes an encryption key structure, the validity checking unit 630 may include the device-specific information ( 2) is preferably used as the decryption key, and when the device-specific information 1 does not include a decryption key structure, the validity checker 630 is configured to display the device-specific information (2) in the customer terminal 125. Hashes the device-specific information (1) through the same hash function (or hash algorithm) that hashed) to generate a decryption key corresponding to the device-specific information (1) and use it as a decryption key. It is desirable to.

According to an embodiment of the present invention, when the identified device specific information 1 and the extracted device specific information 2 do not match (eg, when the validity based on the device specific information is not confirmed), the validity is determined. The verification unit 630 preferably processes the error in the certificate use request information regardless of the certificate-based validation result through the certificate verification unit 615.

When the certificate-based validity is verified by the certificate verification unit 615, and the device-specific information-based validity is confirmed by the validity verification unit 630, the information processing unit 635 reads the certificate use request information. It provides to the certificate using server 120, characterized in that the processing to provide a certificate-based service corresponding to the certificate use request information.

Those skilled in the art to which the present invention pertains, the certificate using server 120 is a technical feature of processing one or more non-face-to-face financial transactions, non-face-to-face authentication, online payment based on the certificate use request information Since it will be familiar with, the detailed description thereof will be omitted for convenience.

7 is a diagram illustrating a process of managing a certificate according to an embodiment of the present invention.

In more detail, Figure 7 prevents the certificate from being illegally transferred and occupied by the certificate management server 110 when a certificate use request is made by the customer terminal 125 through the certificate management system shown in Figure 6. To perform the certificate-based validation of the certificate use request information and the device-specific information-based validation of the plurality of components provided or detached in the customer terminal 125 that is mounted or detached to the medium (1) As a process, one of ordinary skill in the art will be able to infer various implementation methods for the process of managing the certificate by referring to and / or modifying the present invention. Includes all the inferred implementation methods and is not limited by the implementation method illustrated in FIG.

For example, those of ordinary skill in the art to which the present invention pertains may use various types of certificate application processes (eg, non-face-to-face financial transaction systems, non-face-to-face authentication systems, online) to which the certificate management process illustrated in FIG. 7 is applied. Payment system, etc.), and the present invention is characterized by including all the implementation methods inferred.

In addition, although FIG. 7 illustrates that the client terminal 125 transmits the certificate use request information directly to the certificate management server 110 for convenience, it will be apparent that the present invention is not limited thereto. .

Hereinafter, in FIG. 7, the customer terminal 125 shown in FIG. 6 is referred to as "terminal" for convenience, and the certificate management server 110 shown in FIG. 6 is referred to as "server" for convenience.

Referring to FIG. 7, the terminal accesses the server through a communication network and requests the server to use a certificate including one or more non-face-to-face financial transactions, non-face-to-face authentication, and online payment by using the certificate. 700, correspondingly, the server extracts (or generates) a certificate using interface for using the certificate to the customer terminal 125 and provides the terminal to the terminal (705).

Thereafter, the terminal inputs (or selects) certificate use request information through the certificate use interface (710), and processes the input (or selected) certificate use request information through the certificate issued to the medium (1). (For example, encrypting or attaching to an electronic signature) and attaching the certificate information to the server through the communication network (715).

Here, the certificate use request information is non-face-to-face financial transaction request information for non-face-to-face financial transactions (eg, non-face-to-face account inquiry transaction request information, non-face-to-face transfer transaction request information, non-face-to-face credit accumulation request information, non-face-to-face utility bill payment Request information, etc.), non-face-to-face authentication request information for processing non-face-to-face authentication (e.g., various passwords, certificate information, security card information, OTP information, etc.), online payment request information for processing online payment (e.g., online credit) Card payment request information, online check card payment request information, online prepaid card payment request information, online debit card payment request information, etc.) is preferably made, and those skilled in the art to which the present invention belongs. If it is, it is possible to infer a variety of information configuration for the certificate use request information, It is characterized in that it comprises all the exemplary method of the inference.

According to the present invention, the certificate use request information is processed (for example, encrypted or digitally signed) through a certificate issued to the medium 1 mounted on or detached from the customer terminal 125, and the certificate information is Characterized in that it is attached, and includes one or more device-specific information (2) corresponding to one or more component devices provided or detached to the customer terminal 125 through the certificate to prevent illegal transfer and possession of the certificate It is desirable to.

According to an embodiment of the present invention, the device specific information 2 preferably includes one or more pieces of unique information of the medium on which the certificate is issued or unique information of a terminal on which the medium is mounted or detached.

For example, the device specific information 2 may be provided with device serial number information provided in a hard disk medium mounted (eg, embedded) or detached (eg, external, or mounted via a network) in the customer terminal 125, It is preferable that the identification number information, identification code information including at least one.

Alternatively, the device specific information 2 may include MAC (Media Access Control) address information provided in a communication device mounted (eg, embedded) or detached (eg, external) to the customer terminal 125. desirable.

Alternatively, the device specific information 2 may be mounted on the customer terminal 125 (e.g., mounted on a PCB through a USB terminal) or detached (e.g., connected to a USB port). Preferably, the serial number information, the unique number information, and identification code information are included.

Alternatively, the device specific information 2 may be mounted (eg, using an IC card slot) or detached from the customer terminal 125 (eg, connected through a contact IC card reader or a contactless IC card reader). Preferably, the IC card includes one or more IC chip serial numbers, IC chip unique information, and IC chip identification information included in the IC card medium.

Alternatively, the device specific information 2 may be mounted on the customer terminal 125 (eg, inserted into a card slot or mounted on a PCB) or detached (eg, connected through a communication port). It is preferable that the hardware module includes one or more device serial number information, unique number information, and identification code information included in a hardware security module (HSM) medium.

According to an embodiment of the present invention, the terminal attaches the certificate to the digital signature through at least one encryption key (eg, a private key, a public key, a symmetric key / secret key) provided in the certificate. And encrypting the device-specific information 2 with one or more encryption keys provided in the certificate, and then attaching and transmitting the certificate information, and omitting the certificate information according to the intention of a person skilled in the art (for example, a certification authority). Certificate server (not shown) provided in the can be omitted if the certificate information can be confirmed), whereby the present invention is not limited.

Alternatively, the terminal attaches the certificate use request information and the device-specific information (2) to the digital signature through encryption of one or more encryption keys (eg, a private key, a public key, a symmetric key / secret key) included in the certificate. In addition, the certificate information is preferably attached and transmitted, and the certificate information is omitted according to the intention of a person skilled in the art (for example, when the certificate information can be confirmed through an authentication server (not shown) provided in the authentication institution). The present invention is not limited thereto.

Alternatively, the terminal encrypts or uses the certificate use request information, the device specific information (2), and the certificate information through one or more encryption keys (eg, a private key, a public key, a symmetric key / secret key) included in the certificate. It is preferable to transmit by attaching a signature, and according to the intention of a person skilled in the art, the certificate information may be omitted (for example, if the certificate information can be confirmed through an authentication server (not shown) provided in a certification authority), The present invention is not limited by this.

According to another exemplary embodiment of the present invention, the terminal first encrypts the certificate use request information using the device-specific information 2 as an encryption key, and at least one encryption key (eg, a private key) included in the certificate. , Public key, symmetric key / secret key), attaching the second encryption to the digital signature, and attaching (or omitting) the certificate information is preferable.

Alternatively, the terminal first encrypts the certificate use request information and the certificate information using the device-specific information 2 as an encryption key, and at least one encryption key (eg, private key, public key, symmetric) included in the certificate. Key / secret key) with a second encryption or digital signature attached.

According to another exemplary embodiment of the present invention, the terminal transmits the certificate using request information to the first encryption through one or more encryption keys (eg, a private key, a public key, a symmetric key / secret key) included in the certificate. After attaching the electronic signature, attaching the certificate information (can be omitted), it is preferable to transmit the second encryption using the device-specific information 2 as an encryption key.

Alternatively, the terminal attaches the first encryption or digital signature to the certificate use request information and the certificate information through one or more encryption keys (eg, private key, public key, symmetric key / secret key) included in the certificate, Preferably, the device-specific information 2 is used as an encryption key for second encryption and transmission.

According to another exemplary embodiment of the present invention, encryption or electronic signature attachment through one or more encryption keys (eg, private key, public key, symmetric key / secret key) included in the certificate may be omitted, and the device specific information (2) may be omitted. ) Can be encrypted using the encryption key, and the present invention is not limited thereto.

In using the device-specific information 2 as an encryption key according to an embodiment of the present invention, when the device-specific information 2 includes an encryption key structure, the terminal encrypts the device-specific information 2 as it is. It is preferable to use as a key, and if the device-specific information 2 does not include an encryption key structure, the terminal hashes it through a hash function that converts the device-specific information 2 into an encryption key structure. It is preferable to generate an encryption key corresponding to the unique information 2 and use it as the encryption key.

Thereafter, the server receives the certificate use request information through a communication network, and checks the certificate authority that issued the certificate through the certificate information attached to the certificate use request information, and the certificate server provided in the certificate authority. In operation 720, the certificate-based validity of the certificate use request information is verified by decrypting the certificate use request information or processing a digital signature verification in association (or by reading a copy of a certificate included in the certificate information).

Those skilled in the art to which the present invention pertains use the certificate in association with a server (or by reading a copy of a certificate included in the certificate information) provided by the server in the certificate authority that issued the certificate. Since it will be familiar with the technical features for verifying the certificate-based validity of the certificate use request information based on the certificate information attached to the request information, a detailed description thereof will be omitted for convenience.

If the certificate-based validity is not verified (725), the server generates certificate-based validity error information and transmits it to the terminal (730), and terminates the certificate use process.

On the other hand, if the certificate-based validity is verified (725), the server extracts the certificate information and one or more device-specific information (2) from the certificate use request information decrypted by the certificate-based validity (735), the extracted Based on the certificate information in connection with the certificate management D / B 105 for storing the certificate information issued to the medium (1) and the device-specific information (1) in association with the certificate issuing system shown in FIG. At least one device-specific information (1) associated with the certificate information is identified (740).

According to an embodiment of the present invention, the device specific information (1) preferably comprises at least one of unique information of the medium on which the certificate is issued or unique information of a terminal on which the medium is mounted or detached.

For example, the device specific information 1 may include device serial number information provided in a hard disk medium mounted (eg, embedded) or detached (eg, external, or mounted via a network) in the customer terminal 125, It is preferable that the identification number information, identification code information including at least one.

Alternatively, the device specific information 1 may include MAC (Media Access Control) address information provided in a communication device mounted (eg, embedded) or detached (eg, external) to the customer terminal 125. desirable.

Alternatively, the device specific information 1 may be mounted on the customer terminal 125 (e.g., mounted on a PCB via a USB terminal) or detached (e.g., connected to a USB port). Preferably, the serial number information, the unique number information, and identification code information are included.

Alternatively, the device specific information 1 may be mounted (eg, using an IC card slot) or detached from the customer terminal 125 (eg, connected through a contact IC card reader or a contactless IC card reader). Preferably, the IC card includes one or more IC chip serial numbers, IC chip unique information, and IC chip identification information included in the IC card medium.

Alternatively, the device specific information 1 may be mounted on the customer terminal 125 (eg, a card slot is inserted or mounted on a PCB) or detached (eg, connected through a communication port). It is preferable that the hardware module includes one or more device serial number information, unique number information, and identification code information included in a hardware security module (HSM) medium.

If one or more device-specific information (1) associated with the certificate information is confirmed (745), the server compares the identified device-specific information (1) and the extracted device-specific information (2) the certificate The device-specific information-based validity of the use request information is checked (750).

According to an embodiment of the present invention, if the identified device-specific information 1 and the extracted device-specific information 2 match, the server determines that device-based information-based validity of the certificate use request information is confirmed. It is desirable to confirm.

Alternatively, when the identified device specific information 1 and the extracted device specific information 2 do not match (eg, when the device specific information based validity is not checked), the server performs the certificate based validation. Regardless of the result, it is preferable to treat it as an error about the certificate use request information.

When the certificate use request information (or the certificate use request information and the certificate information) is encrypted using the device-specific information 2 as an encryption key according to an embodiment of the present invention, the encrypted certificate use request information (or the The certificate use request information and the certificate information) are decrypted using the identified device-specific information 1 as a decryption key, and the decryption process using the device-specific information 1 as a decryption key is normally performed, the server uses the certificate. It is desirable to confirm that the device-specific information-based validity of the request information is confirmed.

In using the device-specific information 1 as a decryption key according to an embodiment of the present invention, when the device-specific information 1 includes an encryption key structure, the server decrypts the device-specific information 2 as it is. It is preferable to use as a key, and when the device specific information 1 does not include a decryption key structure, the server hashes the device specific information 2 in the customer terminal 125 (or a hash algorithm). It is preferable to generate the decryption key corresponding to the device-specific information 1 by hashing the device-specific information 1 through the same hash function (or hash algorithm)).

Alternatively, when the certificate use request information (or the certificate use request information and the certificate information) is not decrypted using the verified device specific information 1 as a decryption key, the server is irrelevant to the certificate based validation result. It is preferable that an error occurs with respect to the certificate use request information.

If the device-specific information-based validity is not confirmed (755), the server generates device-specific information-based validity error information and transmits it to the terminal (760), and terminates the certificate using process.

If the device-specific information based validity is confirmed (755), the server provides the certificate use request information to the certificate using server 120 based on the certificate-based validation result and the device-specific information based validation result. The certificate using server 120 processes to provide one or more non-face-to-face financial transactions, non-face-to-face authentication, and online payment based on the certificate use request information (765).

Those skilled in the art to which the present invention pertains, the certificate using server 120 is a technical feature of processing one or more non-face-to-face financial transactions, non-face-to-face authentication, online payment based on the certificate use request information Since it will be familiar with, the detailed description thereof will be omitted for convenience.

8 is a diagram illustrating a certificate transfer system configuration for transferring a certificate to a medium 2 mounted or detached on a customer terminal 125 according to an embodiment of the present invention.

In more detail, FIG. 8 illustrates the transfer of a certificate to the customer terminal 125 when the certificate is transferred to the medium 2 mounted or detached from the customer terminal 125 through a communication network to prevent the certificate from being illegally transferred and occupied. By using the certificate through the communication network by identifying the device-specific information (1) corresponding to one or more of the plurality of constituent devices that are equipped or detached and stored in association with the certificate information issued to the medium (2) Or, in the process of transferring the certificate to another medium (2) through the validation of the device-specific information (1) through the system configuration to prevent the illegally transferred and occupied certificate issued to the medium (2) As such, those of ordinary skill in the art to which the present invention pertains may refer to and / or modify this drawing 8 to the customer terminal 125 to the customer terminal. Various implementation methods for the system configuration for transferring the certificate to the medium 2 mounted or detached on the horse 125 may be inferred, but the present invention includes all of the inferred implementation methods, as shown in FIG. It is not limited by the implementation method shown.

For example, a person of ordinary skill in the art may refer to and / or modify a certificate transfer system shown in FIG. 8 and a certificate issue system shown in FIG. 2 to illegally transfer the certificate. It will be possible to infer a certificate reissue system configuration for relocating a certificate so as to prevent it from being occupied, and the present invention is characterized by including all the inferred implementation methods.

Hereinafter, the components on the system for transferring the certificate to the medium 2 mounted or detached from the customer terminal 125 are referred to as "certificate transfer server 115" in FIG.

Here, the customer terminal 125 may be the same terminal as the customer terminal 125 that mounts or detaches the medium 1 on which the certificate is issued through the certificate issuing system shown in FIG. It is apparent that the present invention is not limited thereto and is not limited thereto.

If the client terminal 125 is the same terminal as the client terminal 125 that mounts or detaches the medium 1 on which the certificate is issued through the certificate issuing system shown in FIG. The device specific information 1 to be confirmed is the same as or different from the device specific information 1 stored in the certificate management D / B 105 on the certificate issuing system shown in FIG. In the case where the terminal is different from the customer terminal 125 that mounts or detaches the medium 1 on which the certificate is issued through the issued certificate issuing system, the device-specific information 1 confirmed for the certificate transfer is shown in FIG. It is preferable to include device specific information 1 and other device specific information stored in the certificate management D / B 105 on the illustrated certificate issuing system, thereby clearly indicating that the present invention is not limited. Bayida leave.

However, the medium 2 to which the certificate is transferred is characterized by including a medium different from the medium 1 in which the certificate is issued through the certificate issuing system shown in FIG. 2.

Hereinafter, FIG. 8 illustrates that, for convenience, the medium 1 on which the certificate is issued is mounted or detached from the customer terminal 125 through the certificate issuing system shown in FIG. The technical features of the present invention will be described in detail through an implementation method in which the medium 2, which is transferred thereto, is also mounted or detached. However, the technical features of the present invention are not limited to the implementation method illustrated in FIG. 8, and the medium 1 and the medium 2 may be provided in different terminals, and the technical field to which the present invention belongs. If one of ordinary skill in the art with reference to Figure 8 and / or modified to the medium (1) and the medium (2) when provided in different terminals, to prevent the certificate is illegally transferred and occupied Various implementation methods of transferring a certificate from the medium 1 to the medium 2 may be inferred, and the present invention is characterized by including all the inferred implementation methods.

Referring to FIG. 8 according to an embodiment of the present invention, the certificate transfer system includes a medium 1 in which the certificate is issued through the certificate issuing system shown in FIG. 2 and a medium 2 in which the certificate is transferred. The customer terminal 125 and the client terminal 125 for connecting to the certificate transfer server 115 through a communication network and transferring the certificate from the medium 1 to the medium 2 by interlocking with or dismounting the device. Connected with a communication network to verify the validity of the device-specific information (2) provided in the customer terminal 125, the medium 1 is mounted or detached through the certificate when transferring the certificate, and the medium (2) Check the device-specific information (1) corresponding to one or more components of the plurality of components provided or detached in the customer terminal 125, which is mounted or detached) and certificate information transferred to the medium (2) and In conjunction with the certificate And a certificate transfer server 115 stored in the management D / B 105, and when using the certificate transferred to the customer terminal 125 in which the medium 2 is mounted or detached, the certificate management is performed. The certificate is illegally authenticated by authenticating the validity of the customer terminal 125 in which the medium 2 to which the certificate is transferred is mounted or detached based on the device specific information 1 in connection with the D / B 105. Characterized in that it further comprises a certificate management server 110 to prevent being transferred to occupy.

Here, the certificate transfer server 115 is provided on the certificate transfer system side as shown in FIG. 8 and mounted on the customer terminal 125 through a communication network to prevent the certificate from being illegally transferred and occupied. When transferring the certificate to the removable medium 2, the device (2) by checking the device-specific information (1) corresponding to one or more components of the plurality of components provided or detached in the customer terminal (125) As a generic term for a functional configuration that is stored in association with certificate information transferred to the certificate information, the certificate transfer server 115 is implemented in the form of one or more servers (or devices), or is provided in the certificate transfer server 115. It is also possible to implement in the form, it will be clear that the present invention is not limited.

The customer terminal 125 is a wired communication network based on Transmission Control Protocol / Internet Protocol (TCP / IP) (eg, Asymmetric Digital Subscriber Line (ADSL) / Very High-data Rate Digital Subscriber Line (VDSL) or cable communication network). A mobile communication terminal comprising at least one wired terminal including a desktop computer or a notebook computer connected to the certificate transfer server 115 or connected to a code division multiple access (CDMA) based mobile communication network, or IEEE And at least one wireless terminal including at least one portable internet terminal connected to an 802.16x based high speed wireless internet, wherein the client terminal 125 is transferred from the certificate transfer server 115. Output at least one certificate transfer interface, and via the certificate transfer interface It is provided with a functional structure for a certificate to the information transfer request to transfer a certificate of the input (or selected) to be transmitted to the certificate before the server 115 (e.g., a browser program and communication function) is preferred.

Those skilled in the art to which the present invention pertains will be able to easily infer the characteristics of the customer terminal 125 corresponding to at least one or more wired or wireless terminal, detailed description thereof is omitted for convenience. do.

According to an embodiment of the present invention, when the customer terminal 125 is a wired terminal, the communication network includes the TCP / IP based wired communication network, and when the customer terminal 125 is a wireless terminal, the communication network Preferably, the CDMA-based mobile communication network or IEEE 802.16x-based high-speed wireless Internet includes at least one or more.

According to the present invention, the certificate transfer server 115 is an interface for connecting and managing a communication channel with the customer terminal 125 through the communication network to provide a web interface corresponding to the communication terminal and the customer terminal 125. Characterized in that it comprises a part 800, whereby the certificate transfer server 115 has a function of a web server that is connected to the customer terminal 125 and the communication via a wired or wireless communication network.

According to an embodiment of the present invention, when the customer terminal 125 is a wired terminal to which a communication channel is connected through a TCP / IP-based wired communication network, the interface unit 800 may connect with the customer terminal 125 and HTTP ( Connecting a communication channel based on a Hyper-Text Transfer Protocol protocol, and transmitting and outputting a certificate transfer interface in the form of a Hyper-Text Markup Language (HTML) compatible document to the customer terminal 125 through the communication channel; It is preferable to perform a function of receiving and processing certificate transfer request information input (or selected) through the certificate transfer interface from the customer terminal 125.

According to another exemplary embodiment of the present invention, when the customer terminal 125 is a wireless terminal to which a communication channel is connected through a CDMA-based wireless communication network, the interface unit 800 is connected to the customer terminal 125 and a WAP (Wireless). Connect a communication channel or a full-browsing-based wireless Internet communication channel based on an Application Protocol (ME) or Mobile Explorer (ME) protocol, and use WML (Wireless Markup Language) or HTML compatible with the customer terminal 125 through the communication channel. It is preferable to perform a function of transmitting and outputting a certificate transfer interface in the form of a document, and receiving and processing certificate transfer request information corresponding to the certificate transfer interface from the customer terminal 125.

According to another exemplary embodiment of the present invention, when the customer terminal 125 is a wireless terminal to which a communication channel is connected through an IEEE 802.16x based wireless communication network, the interface unit 800 may be connected to the customer terminal 125. Connect a communication channel based on a wireless protocol corresponding to the IEEE 802.16 standard, transmit a certificate transfer interface to the customer terminal 125 through the communication channel, output the certificate transfer interface, and transmit the certificate transfer interface from the customer terminal 125. It is preferable to perform a function of receiving and processing predetermined certificate transfer request information corresponding to.

According to the present invention, the certificate transfer server 115 is connected to the certificate transfer server 115 (or certificate transfer request) when the customer terminal 125 is connected to the certificate transfer server 115 through the interface unit 800. And an interface provider 805 for generating (or extracting) a certificate transfer interface for inputting (or selecting) certificate transfer request information from the client terminal 125 and transmitting the certificate transfer request information. .

The interface providing unit 805 has a function provided to the customer terminal 125 when the customer terminal 125 accesses (or requests for certificate transfer) the certificate transfer server 115 through the interface unit 800. In response to a configuration (for example, a browser program provided in the customer terminal 125), the certificate transfer request information may be input (or selected) and generated to transfer the certificate transfer interface to the certificate transfer server 115 through the communication network. Or extract from a database (not shown) and provide the generated (or extracted) certificate transfer interface to the customer terminal 125 via the communication network in association with the interface unit 800.

Thereafter, the client terminal 125 inputs (or selects) certificate transfer request information based on the certificate transfer interface, and transmits the input (or selected) certificate transfer request information to the certificate transfer server 115 through the communication network. To send).

Here, the certificate transfer request information includes customer information requesting the transfer of the certificate to the medium 2 mounted or detached from the customer terminal 125 and the certificate mounted or detached from the customer terminal 125. And at least one operating system (or platform) information for the customer terminal 125 on which the medium 2 is mounted or detached.

The customer information included in the certificate transfer request information includes at least one of customer member information including member ID information and password information of the customer who is transferred the certificate, or the name, resident registration number, address, and contact information of the customer. It is preferable to include one or more customer personal information included above.

The medium 2 information included in the certificate transfer request information includes information for identifying (or identifying) a medium in which the certificate is transferred and stored among the mediums mounted on or detached from the customer terminal 125. It is preferable.

According to an embodiment of the present invention, the medium 2 information includes a hard disk medium mounted (eg, embedded) or detached (eg, external, or mounted via a network) in the customer terminal 125. It is preferable to make.

Alternatively, the medium 2 information may include a floppy disk medium detachable from the customer terminal 125 (eg, inserted into a floppy disk drive).

Alternatively, the medium 2 information includes a USB medium mounted on the customer terminal 125 (eg, mounted on a PCB via a USB terminal) or detached (eg, connected to a USB port). desirable.

Alternatively, the medium 2 information is mounted on the customer terminal 125 (e.g., using an IC card slot) or detached (e.g., connected via a contact IC card reader or a contactless IC card reader). It is preferred to include a card medium.

Alternatively, the media 2 information may be mounted on the customer terminal 125 (eg, inserting a card slot or mounted on a PCB) or detached (eg, connected through a communication port). It is preferred to include a Hardware Security Module (HSM) medium.

Those skilled in the art to which the present invention pertains will be able to infer various types of media mounted on or detached from the customer terminal 125 in addition to the media 2 described above, and the present invention infers the above. It is characterized in that it comprises all the media (2).

The operating system (or platform) information included in the certificate transfer request information is information for identifying or confirming the operating system (or platform) of the customer terminal 125 on which the medium 2 to which the certificate is transferred is mounted or detached. It is preferable to identify an operating system (or platform) on which program code corresponding to the certificate is executed.

According to an embodiment of the present invention, the certificate transfer request information is processed (eg, encrypted or with an electronic signature) through a certificate issued to the medium 1 mounted or detached from the customer terminal 125. Preferably, the certificate information is attached and transmitted, and one or more device-specific information corresponding to one or more component devices provided or detached from the customer terminal 125 through the certificate to prevent illegal transfer and occupancy of the certificate. 2) characterized in that transmitted.

According to the present invention, the certificate transfer server 115 is an information receiving unit 810 (or information receiving means) for receiving the certificate transfer request information in association with the interface unit 800, and the certification authority that issued the certificate. Certificate-based validity of the certificate transfer request information based on the certificate information attached to the certificate transfer request information in association with a certificate server (not shown) provided in (or by reading a copy of the certificate included in the certificate information). Certificate verification unit 815 (or certificate verification means) for verifying, and during certificate-based validation of the certificate transfer request information, the certificate information included in the certificate transfer request information and one or more device-specific information (2) is extracted An information extraction unit 820 (or information extraction means) and one stored in the certificate management D / B 105 based on the extracted certificate information. The certificate transfer request is made by comparing the device identification information 825 (or information verification means) for confirming the device specific information 1 described above with the checked device specific information 1 and the extracted device specific information 2. It is characterized in that it comprises a validating unit 830 (or validating means) for confirming the device-specific information-based validity of the information.

When the certificate transfer request information is processed (eg, encrypted or digitally signed) in the client terminal 125 through a certificate issued to the medium 1, and the certificate information is attached and transmitted, the information receiving unit 810 ) Is characterized in that for receiving the certificate transfer request information in association with the interface unit (800).

When the certificate transfer request information is processed (for example, encrypted or attached to an electronic signature) through the certificate issued to the medium 1 through the information receiving unit 810 and the certificate information is attached, the certificate verification unit ( 815 confirms the certificate authority that issued the certificate through the certificate information attached to the certificate transfer request information, and associates with the certificate server (not shown) provided in the certificate authority (or included in the certificate information). The certificate-based validity of the certificate transfer request information may be verified by reading the copy of the certificate and decrypting the certificate transfer request information or processing the digital signature verification.

Those skilled in the art to which the present invention belongs, the certificate verification unit 815 in conjunction with the authentication server (not shown) provided in the certification authority that issued the certificate (or included in the certificate information Since it will be familiar with the technical features of validating the certificate-based validity of the certificate transfer request information based on the certificate information attached to the certificate transfer request information) by reading a copy of the certificate, a detailed description thereof will be omitted for convenience. do.

When the certificate-based validity is verified by the certificate validator 815, the information extractor 820 may generate the certificate information and one or more device-specific information 2 from the certificate transfer request information that is validated and decrypted. It is characterized in that the extraction.

When the certificate information and one or more device-specific information 2 are extracted through the information extracting unit 820, the information checking unit 825 is based on the extracted certificate information, the certificate issuing system shown in FIG. At least one device-specific information (1) associated with the certificate information in association with the certificate management D / B (105) for storing the certificate information issued to the medium (1) and the device-specific information (1) in association with It is characterized by checking.

When one or more device-specific information 1 associated with the certificate information is confirmed, the validity confirming unit 830 compares the checked device-specific information 1 and the extracted device-specific information 2 to the certificate. It is characterized by checking the validity of the device-specific information based on the previous request information.

According to the present invention, the certificate transfer server 115, at least one or more corresponding to the certificate to be transferred to the customer terminal 125 when the certificate-based validity and the device-specific information-based validity of the certificate transfer request information is confirmed Certificate D / B 880 for storing a certificate program source (or certificate program file) and certificate data (e.g., certificate profile information), and certificate D, when the certificate transfer request information is received from the customer terminal 125, Certificate extraction / generation unit 855 (or certificate extraction / generation means) for extracting or dynamically generating a certificate corresponding to the certificate transfer request information from / B 880 and through the interface unit 800. Characterized in that it comprises a certificate transfer unit (or certificate transfer means) for transferring to the customer terminal 125.

According to an embodiment of the present invention, the certificate D / B 880 is characterized in that for storing the certificate program file and certificate data that can be operated in the operating system (or terminal platform) provided in the customer terminal 125 When the certificate transfer request information is received from the customer terminal 125, the certificate extractor / generation unit 855 may include a certificate program file matching the certificate transfer request information from the certificate D / B 880. And extracting a certificate including the certificate data.

According to another exemplary embodiment of the present invention, the certificate D / B 880 stores a certificate program source and certificate data capable of operating in an operating system (or terminal platform) provided in the customer terminal 125. When the certificate transfer request information is received from the customer terminal 125, the certificate extracting / generating unit 855 matches the certificate transfer request information from the certificate D / B 880. And extract certificate data, and dynamically generate the certificate to be transferred to the customer terminal 125 by compiling the extracted certificate program source.

Thereafter, the certificate transfer unit invalidates and discards the certificate issued to the medium 1 through the interface unit 800, and discards the extracted (or dynamically generated) certificate through the communication network. Transfers the certificate from the medium (1) to the medium (2), which is recorded on a medium (2) mounted on or detached from the customer terminal (125), and is commonly known in the art. If you have this, because you will be familiar with how to transfer the certificate to the medium (2) mounted or detached on the customer terminal 125, a detailed description thereof will be omitted for convenience.

According to an embodiment of the present invention, the certificate program included in the certificate provided to the customer terminal 125 by the certificate transfer unit includes a certificate-based non-face-to-face authentication function through a communication network. Confirm one or more device-specific information (2) corresponding to one or more preset device among a plurality of device devices provided or detached from the customer terminal 125 on which the medium 2 is mounted or detached, and confirming Transmit or receive data (e.g., data transmitted from the customer terminal 125 through the communication network or data received from the customer terminal 125 through the communication network) according to the non-face-to-face authentication. It is characterized in that it comprises a function including the transmission.

According to an exemplary embodiment of the present invention, the certificate transfer unit may be provided with or detached from the customer terminal 125 in a certificate provided to the customer terminal 125 on which the medium 2 is mounted or detached. 1) checks the information of the component devices and transmits to the certificate transfer server 115 through the communication network, m (M> 1) of the M (M> 1) device information from the certificate transfer server 115 to the certificate verification target A function of receiving information of 1 <= m <= M) components, and identifying device-specific information 1 corresponding to the received m components and transmitting the same to the certificate transfer server 115 through the communication network. It is preferable to provide a script (or terminal program) including a function.

According to another exemplary embodiment of the present invention, the certificate transfer unit includes a plurality of components provided or detached from the customer terminal 125 in a certificate provided to the customer terminal 125 on which the medium 2 is mounted or detached. It is preferable to include a script (or terminal program) for identifying the device-specific information (1) corresponding to one or more components of a preset device and transmitting the same through a communication network.

According to another exemplary embodiment of the present invention, the certificate transfer unit transfers the certificate to the customer terminal 125 before providing the certificate to the customer terminal 125 on which the medium 2 is mounted or detached. After providing the device-specific information (1) corresponding to one or more of the preset configuration device of the plurality of components provided or detached to the customer terminal 125 before the validity diagnosis provided by the script (or terminal) Program) to the customer terminal 125 is preferred.

According to the present invention, the certificate transfer server 115 is unique to the device corresponding to one or more preset device among a plurality of device provided or detached in the customer terminal 125 in connection with the interface unit 800 And an information receiving unit 850 (or information receiving means) for checking and receiving information (1).

According to an embodiment of the present invention, the certificate transfer server 115 through the communication network to check the information M (M> 1) components provided or detached to the customer terminal 125 to the customer terminal 125 A function of receiving information of the m (1 <= m <= M) components of the M (M> 1) configuration apparatus information from the certificate transfer server 115 to the certificate verification target, the reception If a script (or terminal program) including a function for checking the device-specific information (1) corresponding to the m components of the device and transmits to the certificate transfer server 115 through the communication network is provided, the certificate transfer server ( 115, the device information receiving unit 835 (or device information receiving means) for receiving the M (M> 1) component information provided or detached to the customer terminal 125 in association with the interface unit 800; ) And the information of the M (M> 1) components Device information confirmation unit 840 (or device information confirmation means) for confirming m (1 <= m <= M) spherical growth value information to the verification target, and the customer terminal in connection with the interface unit 800. And a device information transmitting unit 845 (or device information transmitting means) for transmitting the identified m pieces of device information to 125. The information receiving unit 850 may include the interface unit ( Device specific information (1) corresponding to the set m (1 <= m <= M) constituent devices among the M (M> 1) constituent devices provided to or detached from the customer terminal 125 in association with 800; ) To receive.

According to another exemplary embodiment of the present invention, the device specific information 1 corresponding to at least one preset device among a plurality of device devices provided to or detached from the customer terminal 125 is identified by the customer terminal 125. When a script (or terminal program) for transmitting through a communication network is provided, the information receiving unit 850 is provided with or detached from the plurality of components provided to or detached from the customer terminal 125 in association with the interface unit 800. Receive device specific information (1) corresponding to the at least one configured device.

According to an embodiment of the present invention, the device specific information (1) preferably comprises at least one of unique information of the medium on which the certificate is issued or unique information of a terminal on which the medium is mounted or detached.

For example, the device specific information 1 may include device serial number information provided in a hard disk medium mounted (eg, embedded) or detached (eg, external, or mounted via a network) in the customer terminal 125, It is preferable that the identification number information, identification code information including at least one.

Alternatively, the device specific information 1 may include MAC (Media Access Control) address information provided in a communication device mounted (eg, embedded) or detached (eg, external) to the customer terminal 125. desirable.

Alternatively, the device specific information 1 may be mounted on the customer terminal 125 (e.g., mounted on a PCB via a USB terminal) or detached (e.g., connected to a USB port). Preferably, the serial number information, the unique number information, and identification code information are included.

Alternatively, the device specific information 1 may be mounted (eg, using an IC card slot) or detached from the customer terminal 125 (eg, connected through a contact IC card reader or a contactless IC card reader). Preferably, the IC card includes one or more IC chip serial numbers, IC chip unique information, and IC chip identification information included in the IC card medium.

Alternatively, the device specific information 1 may be mounted on the customer terminal 125 (eg, a card slot is inserted or mounted on a PCB) or detached (eg, connected through a communication port). The hardware security module (HSM) preferably comprises at least one device serial number information, unique number information, identification code information provided in the medium.

When the certificate is transferred to the medium 2 provided in the customer terminal 125 as described above, the customer terminal 125 starts the certificate diagnosis mode for authenticating the validity of the certificate by first executing the certificate. To this end, the certificate transfer server 115 is provided with a diagnostic unit 865 (or certificate diagnostic means) for diagnosing the validity of the certificate in cooperation with the certificate provided in the customer terminal 125. It features.

According to an exemplary embodiment of the present invention, the certificate diagnosis mode may include at least one device-specific information corresponding to one or more preset device among a plurality of device devices provided or detached from the customer terminal 125 through the certificate. 2) transmits, and compares one or more device-specific information (2) received through the certificate and one or more device-specific information (1) received through the information receiving unit 850 and unique device transmitted from the certificate It is preferable to include checking whether the information 2 is valid.

According to an embodiment of the present invention, the device specific information 2 preferably includes one or more pieces of unique information of a medium on which the certificate is issued or unique information of a terminal on which the medium is mounted or detached.

For example, the device specific information 2 may be provided with device serial number information provided in a hard disk medium mounted (eg, embedded) or detached (eg, external, or mounted via a network) in the customer terminal 125, It is preferable that the identification number information, identification code information including at least one.

Alternatively, the device specific information 2 may include MAC (Media Access Control) address information provided in a communication device mounted (eg, embedded) or detached (eg, external) to the customer terminal 125. desirable.

Alternatively, the device specific information 2 may be mounted on the customer terminal 125 (e.g., mounted on a PCB through a USB terminal) or detached (e.g., connected to a USB port). Preferably, the serial number information, the unique number information, and identification code information are included.

Alternatively, the device specific information 2 may be mounted (eg, using an IC card slot) or detached from the customer terminal 125 (eg, connected through a contact IC card reader or a contactless IC card reader). Preferably, the IC card includes one or more IC chip serial numbers, IC chip unique information, and IC chip identification information included in the IC card medium.

Alternatively, the device specific information 2 may be mounted on the customer terminal 125 (eg, inserted into a card slot or mounted on a PCB) or detached (eg, connected through a communication port). It is preferable that the hardware module includes one or more device serial number information, unique number information, and identification code information included in a hardware security module (HSM) medium.

According to the present invention, the certificate transfer server 115 is provided with or separated from the certificate information corresponding to the certificate transferred to the medium (2) that is mounted on or detached from the customer terminal 125, and the customer terminal 125 It comprises an information storage unit 885 for cooperatively processing one or more device-specific information (1) corresponding to the preset one or more of the plurality of configuration devices to be stored in the certificate management D / B (105) It features.

According to an embodiment of the present invention, the information storage unit 885 is a medium 2 mounted or detached from the customer terminal 125 when the validity of the certificate is confirmed as a result of the diagnosis of the diagnosis unit 865. The certificate information is processed by linking the transferred certificate information with one or more device-specific information 1 received through the information receiving unit 850 among a plurality of component devices provided or detached from the customer terminal 125. Preferably stored in the management D / B 105, and then the certificate information and one or more device-specific information 1 stored in the certificate management D / B 105 prevent the certificate from being illegally transferred and occupied. It is characterized by being used to.

Referring to FIG. 8 according to the embodiment of the present invention, the certificate issuing server 100 transfers the certificate issued to the medium 1 to be mounted or detached from the customer terminal 125 to the medium 2. In order to confirm the validity of the certificate transfer, input j (1 <= j <= i) authentication information to be included in the certificate transfer verification target among i authentication information input query information in connection with the certificate management D / B 105. User authentication information input interface for inputting the authentication information confirmation unit 890 (or authentication information checking means) for checking the query information, and j user authentication information (2) corresponding to the checked j authentication information input query information To the j authentication information input query information through an interface providing unit 805 (or an interface providing means) for transmitting to the customer terminal 125 and a user authentication information input interface in the customer terminal 125, respectively. If the j user authentication information (2) is input and transmitted, the authentication information receiving unit 870 (or authentication information receiving means) for receiving the j user authentication information (2) and the j in association with the storage medium An authentication information extracting unit 895 (or authentication information extracting means) for checking and extracting j user authentication information 1 matching the authentication information input query information, and the checked and extracted user authentication information 1; Characterized in that it further comprises an authentication information authentication unit 875 (or authentication information authentication means) for comparing the received user authentication information (2) to authenticate the validity of the certificate transfer.

When transferring the certificate issued to the medium 1 mounted or detached to the customer terminal 125 to the medium 2, to verify the validity of the certificate transfer, the authentication information verification unit 890 is the certificate Checking j (1 <= j <= i) authentication information input query information to be included in the certificate transfer verification target among the i authentication information input query information in connection with the management D / B 105, the interface The providing unit 805 may transmit the user authentication information input interface for inputting the j user authentication information 2 corresponding to the checked j authentication information input query information to the customer terminal 125.

Subsequently, when the user terminal 125 inputs and transmits j user authentication information 2 corresponding to the j authentication information input query information through the user authentication information input interface, the authentication information receiving unit 870 receives The j user authentication information (2) is received from the customer terminal (125).

According to an embodiment of the present invention, when the user authentication information 2 is processed (for example, encrypted or digitally signed) through a certificate issued to the medium 1, the certificate information is attached and received. Preferably, the authentication information receiver 870 further includes the device-specific information 2 from the customer terminal 125. In this case, the information receiver 810 receives the device-specific information 2. It is preferable to perform device-specific information validity authentication through.

The authentication information extracting unit 895 checks and extracts j user authentication information 1 matching the j authentication information input query information provided to the customer terminal 125 in association with the storage medium. .

When j pieces of user authentication information 2 are received through the authentication information receiving unit 870 and j pieces of user authentication information 1 are extracted and verified through the authentication information extracting unit 895, the authentication information authentication unit 875 compares the checked and extracted user authentication information 1 with the received user authentication information 2 to authenticate validity of the certificate transfer.

9A and 9B illustrate a process of requesting a certificate transfer according to an embodiment of the present invention.

In more detail, FIGS. 9A and 9B show that when a certificate transfer request is made from the client terminal 125 through the certificate transfer system shown in FIG. 8, the certificate is illegally transferred and occupied by the certificate transfer server 115. Certificate-based validation of the certificate transfer request information and device-specific information-based validation of a plurality of component devices provided or detached at the customer terminal 125 in which the medium 1 is mounted or detached to prevent the certificate transfer request information. (Fig. 9a), and the process of performing the user authentication information authentication for the certificate transfer registered through the certificate issuing system shown in Figure 2 (Fig. 9b), which is common in the art Those skilled in the art can refer to and / or modify the drawings 9a and 9b to implement various methods for requesting the transfer of the certificate. It may be inferred from the law, but the present invention includes all of the inferred implementation methods, and is not limited by the implementation methods shown in FIGS. 9A and 9B.

In the following Figures 9a and 9b, the customer terminal 125 shown in Figure 8 is referred to as "terminal" for convenience, and the certificate transfer server 115 shown in Figure 8 is referred to as "server" for convenience.

9A and 9B, the terminal accesses the server through a communication network, requests to transfer the certificate to the server (900), and correspondingly, the server transmits the certificate to the customer terminal 125. The certificate transfer interface for transferring to the service is extracted (or generated) and provided to the terminal (905).

Thereafter, the terminal inputs (or selects) certificate transfer request information through the certificate transfer interface (910), and processes the input (or selected) certificate transfer request information through a certificate issued to the medium (1). (E.g., encrypt or attach an electronic signature) and attach the certificate information to the server through the communication network (915).

Here, the certificate transfer request information includes customer information requesting to transfer the certificate to the medium 2 mounted or detached from the terminal, and information on the medium 2 to which the certificate is transferred by being mounted or detached from the terminal. And one or more operating system (or platform) information about the terminal on which the medium 2 is mounted or detached.

The customer information included in the certificate transfer request information includes at least one of customer member information including member ID information and password information of the customer who receives the certificate, or the name, resident registration number, address, and contact information of the customer. It is preferable to include at least one customer personal information that includes.

Preferably, the medium 2 information included in the certificate transfer request information includes information for identifying (or identifying) a medium in which the certificate is transferred and stored among media loaded or detached from the terminal.

According to an embodiment of the invention, the medium 2 information preferably comprises a hard disk medium mounted (eg, embedded) or detached (eg, external, or mounted via a network) in the terminal. Do.

Alternatively, the medium 2 information preferably includes a floppy disk medium detachable from the terminal (eg, inserted into a floppy disk drive).

Alternatively, the medium 2 information may preferably include a USB medium mounted on the terminal (eg, mounted on a PCB via a USB terminal) or detached (eg, connected to a USB port).

Alternatively, the medium 2 information includes an IC card medium mounted on or detached from the terminal (eg, using an IC card slot) or detached (eg, connected via a contact IC card reader or a contactless IC card reader). It is preferable to make it.

Alternatively, the media 2 information may be mounted on the terminal (eg, inserted into a card slot or mounted on a PCB) or detached (eg, connected through a communication port). Module (HSM) medium is preferably included.

Those skilled in the art to which the present invention pertains can infer various types of media mounted or detached from the terminal in addition to the above-described medium 2, and the present invention can be inferred from all the media inferred. And 2).

The operating system (or platform) information included in the certificate transfer request information is information for identifying or confirming the operating system (or platform) of the terminal on which the medium 2 to which the certificate is transferred is mounted or detached. It is desirable to identify the operating system (or platform) on which the corresponding program code is executed.

Thereafter, the server receives the certificate transfer request information through a communication network, and checks the certificate authority that issued the certificate through the certificate information attached to the certificate transfer request information, and the certificate server provided in the certificate authority. In operation 920, the certificate-based validity of the certificate transfer request information is verified by decrypting the certificate transfer request information or processing digital signature verification in association (or by reading a copy of a certificate included in the certificate information).

Those skilled in the art to which the present invention belongs, the server transfers the certificate in association with the authentication server provided in the certification authority that issued the certificate (or by reading a copy of the certificate included in the certificate information) Since you will be familiar with the technical features of verifying the certificate-based validity of the certificate transfer request information based on the certificate information attached to the request information, a detailed description thereof will be omitted for convenience.

If the certificate-based validity is not verified (925), the server generates certificate-based validity error information and transmits it to the terminal (930), and terminates the certificate transfer process.

On the other hand, if the certificate-based validity is verified (925), the server extracts the certificate information and one or more device-specific information (2) from the certificate transfer request information decrypted by the certificate-based validity (935), the extracted Based on the certificate information in connection with the certificate management D / B 105 for storing the certificate information issued to the medium (1) and the device-specific information (1) in association with the certificate issuing system shown in FIG. At least one device-specific information (1) associated with the certificate information is identified (940).

If one or more device-specific information (1) associated with the certificate information is confirmed (945), the server compares the identified device-specific information (1) and the extracted device-specific information (2) to transfer the certificate The device-specific information-based validity of the request information is checked (950).

If the device-specific information-based validity is not confirmed (955), the server generates device-specific information-based validity error information and transmits it to the terminal (960), and terminates the certificate transfer process.

On the other hand, if the device-specific information-based validity is confirmed (955), the server transfers the certificate from the medium (1) to the medium (2) based on the certificate-based validation results and device-specific information-based validation results Perform the process.

In addition, when transferring the certificate issued to the medium (1) mounted on or detached from the customer terminal 125 to the medium (2), in order to check the validity of the certificate transfer, the certificate management D / B (105) Checking j (1 <= j <= i) authentication information input query information to be included in the certificate transfer verification target among i authentication information input query information in association with (965), and checking the j authentication information input query information In step 970, a user authentication information input interface for inputting j user authentication information 2 corresponding to the terminal is provided.

Thereafter, the terminal determines whether j user authentication information 2 corresponding to the j authentication information input query information is input through the user authentication information input interface (975), and if the user authentication information input interface is inputted. When the j pieces of user authentication information 2 are input (980), the terminal transmits the j pieces of user authentication information (2) to the server (985).

According to an embodiment of the present invention, when the user authentication information 2 is processed (for example, encrypted or digitally signed) through a certificate issued to the medium 1, the certificate information is attached and received. It is preferable that the server further receives the device specific information 2 from the customer terminal 125, and in this case, the server further performs device specific information validity authentication through the received device specific information 2. It is desirable to.

Thereafter, the server checks and extracts j user authentication information 1 matching j authentication information input query information provided to the customer terminal 125 in association with the storage medium (990), and confirming and extracting. The user authentication information 1 is compared with the received user authentication information 2 to authenticate the validity of the certificate transfer (992).

If the certificate transfer validity is not confirmed (994), the server generates certificate transfer validity error information and transmits it to the terminal (996), and terminates the certificate transfer process.

On the other hand, if the certificate transfer validity is confirmed (994), the server performs a process of transferring the certificate from the medium (1) to the medium (2).

10 is a diagram illustrating a process of transferring a certificate according to an embodiment of the present invention.

In more detail, FIG. 10 illustrates a request for a certificate transfer request through the certificate transfer request process shown in FIGS. 9A and 9B by requesting a certificate transfer from the client terminal 125 on the certificate transfer system shown in FIG. When the certificate-based validity is verified and the device-specific information-based validity is verified, the certificate transfer server 115 shown in FIG. 8 transfers the certificate from the medium 1 to the medium 2, and then the certificate is Device-specific information (1) corresponding to one or more components of a plurality of components provided or detached from the customer terminal 125 in which the medium 2 is mounted or detached in order to prevent it from being illegally transferred and occupied. As for the process of confirming, after confirming the M (M> 1) component information provided or detached to the customer terminal 125 in detail, the certificate is After confirming m (1 <= m <= M) components of the M (M> 1) components among the M (M> 1) components in all servers 115, the identified m components are identified from the customer terminal 125. After receiving the device-specific information (1), it is a diagram showing an implementation method for transferring the transferred certificate to the medium (2) mounted or detached to the customer terminal (125).

Persons of ordinary skill in the art to which the present invention pertains may infer various implementation methods for the process of transferring the certificate by referring to and / or modifying the drawing 10, but the present invention may be inferred from the above-described embodiment. It includes all methods, and is not limited by the embodiment shown in FIG.

Hereinafter, in FIG. 10, the customer terminal 125 shown in FIG. 8 is referred to as "terminal" for convenience, and the certificate transfer server 115 shown in FIG. 8 is referred to as "server" for convenience.

Referring to FIG. 10, the certificate-based validation of the certificate transfer request is verified through the certificate transfer request process shown in FIGS. 9A and 9B by requesting a certificate transfer from the terminal on the certificate transfer system shown in FIG. 8. When the device-specific information-based validity is confirmed, the server invalidates and discards the certificate issued to the medium 1 through the certificate issuing system shown in FIG. 2 through a communication network (1000).

If the certificate issued to the medium 1 is invalidated and discarded (1005), the server extracts (or dynamically generates) a certificate matching the certificate transfer request information from the certificate D / B 880 ( 1010).

According to an embodiment of the present invention, the certificate D / B 880 is characterized in that for storing the certificate program file and certificate data that can be operated in the operating system (or terminal platform) provided in the terminal, the terminal When the certificate transfer request information is received from the server, the server preferably extracts a certificate including a certificate program file and certificate data matching the certificate transfer request information from the certificate D / B 880.

According to another exemplary embodiment of the present invention, the certificate D / B 880 stores a certificate program source and certificate data capable of operating in an operating system (or terminal platform) provided in the terminal. When the certificate transfer request information is received from the terminal, the server extracts a certificate program source and certificate data matching the certificate transfer request information from the certificate D / B 880 and compiles the extracted certificate program source. (Compile), it is preferable to dynamically generate a certificate to be transferred to the medium (2).

In addition, the server transfers the certificate by providing the extracted (or dynamically generated) certificate to the terminal through the communication network and storing the extracted certificate in the medium 2 mounted or detached from the terminal (1015).

If the certificate is transferred to the medium 2 (1020), the terminal checks the M (M> 1) of the device information provided or detached to the terminal and transmits to the server through the communication network (1025) ).

Thereafter, the server checks m (1 <= m <= M) pieces of device information on the certificate verification target among the received M (M> 1) pieces of device information (1030).

If m pieces of device information is confirmed in the certificate verification object (1035), the server transmits the identified m pieces of device information to the terminal through a communication network (1040), and the terminal correspondingly the m The m device-specific information 1 corresponding to the two device devices are checked and transmitted to the server through a communication network (1045).

According to an embodiment of the present invention, the device specific information (1) preferably comprises at least one of unique information of the medium on which the certificate is issued or unique information of a terminal on which the medium is mounted or detached.

For example, the device specific information 1 may include device serial number information provided in a hard disk medium mounted (eg, embedded) or detached (eg, external, or mounted via a network) in the customer terminal 125, It is preferable that the identification number information, identification code information including at least one.

Alternatively, the device specific information 1 may include MAC (Media Access Control) address information provided in a communication device mounted (eg, embedded) or detached (eg, external) to the customer terminal 125. desirable.

Alternatively, the device specific information 1 may be mounted on the customer terminal 125 (e.g., mounted on a PCB via a USB terminal) or detached (e.g., connected to a USB port). Preferably, the serial number information, the unique number information, and identification code information are included.

Alternatively, the device specific information 1 may be mounted (eg, using an IC card slot) or detached from the customer terminal 125 (eg, connected through a contact IC card reader or a contactless IC card reader). Preferably, the IC card includes one or more IC chip serial numbers, IC chip unique information, and IC chip identification information included in the IC card medium.

Alternatively, the device specific information 1 may be mounted on the customer terminal 125 (eg, a card slot is inserted or mounted on a PCB) or detached (eg, connected through a communication port). It is preferable that the hardware module includes one or more device serial number information, unique number information, and identification code information included in a hardware security module (HSM) medium.

11 is a diagram illustrating a process of transferring a certificate according to another exemplary embodiment of the present invention.

In more detail, FIG. 11 shows a request for a certificate transfer request through the certificate transfer request process shown in FIGS. 9A and 9B by requesting a certificate transfer from the client terminal 125 on the certificate transfer system shown in FIG. When the certificate-based validity is verified and the device-specific information-based validity is verified, the certificate transfer server 115 shown in FIG. 8 transfers the certificate from the medium 1 to the medium 2, and then the certificate is Device-specific information (1) corresponding to one or more components of a plurality of components provided or detached from the customer terminal 125 in which the medium 2 is mounted or detached in order to prevent it from being illegally transferred and occupied. Regarding the process of confirming, one or more preset chapters among a plurality of component information provided or detached in the customer terminal 125 After receiving the unique information 1, it is a diagram showing an implementation method for transferring the transferred certificate to the medium 2 mounted or detached from the customer terminal 125.

Those skilled in the art to which the present invention pertains will be able to infer various implementation methods for the process of transferring the certificate by referring to and / or modifying the drawing 11, but the present invention can be inferred from the practice It includes all the methods and is not limited by the embodiment shown in FIG.

Hereinafter, in FIG. 11, the customer terminal 125 shown in FIG. 8 is referred to as "terminal" for convenience, and the certificate transfer server 115 shown in FIG. 8 is referred to as "server" for convenience.

Referring to FIG. 11, the certificate-based validation of the certificate transfer request is verified through the certificate transfer request process shown in FIGS. 9A and 9B by requesting a certificate transfer from the terminal on the certificate transfer system shown in FIG. 8. If the device-specific information-based validity is confirmed, the server invalidates and discards the certificate issued to the medium 1 through the certificate issuing system shown in FIG. 2 through a communication network (1100).

If the certificate issued to the medium 1 is invalidated and discarded (1105), the server extracts (or dynamically generates) a certificate matching the certificate transfer request information from the certificate D / B 880 ( 1110).

According to an embodiment of the present invention, the certificate D / B 880 is characterized in that for storing the certificate program file and certificate data that can be operated in the operating system (or terminal platform) provided in the terminal, the terminal When the certificate transfer request information is received from the server, the server preferably extracts a certificate including a certificate program file and certificate data matching the certificate transfer request information from the certificate D / B 880.

According to another exemplary embodiment of the present invention, the certificate D / B 880 stores a certificate program source and certificate data capable of operating in an operating system (or terminal platform) provided in the terminal. When the certificate transfer request information is received from the terminal, the server extracts a certificate program source and certificate data matching the certificate transfer request information from the certificate D / B 880 and compiles the extracted certificate program source. (Compile), it is preferable to dynamically generate a certificate to be transferred to the medium (2).

In addition, the server transfers the certificate by providing the extracted (or dynamically generated) certificate to the terminal through the communication network and storing the extracted certificate in the medium 2 mounted or detached from the terminal (1115).

If the certificate is transferred to the medium 2 (1120), the terminal checks one or more device-specific information (1) corresponding to the at least one configured device and transmits it to the server through a communication network (1125). .

According to an embodiment of the present invention, the device specific information (1) preferably comprises at least one of unique information of the medium on which the certificate is issued or unique information of a terminal on which the medium is mounted or detached.

For example, the device specific information 1 may include device serial number information provided in a hard disk medium mounted (eg, embedded) or detached (eg, external, or mounted via a network) in the customer terminal 125, It is preferable that the identification number information, identification code information including at least one.

Alternatively, the device specific information 1 may include MAC (Media Access Control) address information provided in a communication device mounted (eg, embedded) or detached (eg, external) to the customer terminal 125. desirable.

Alternatively, the device specific information 1 may be mounted on the customer terminal 125 (e.g., mounted on a PCB via a USB terminal) or detached (e.g., connected to a USB port). Preferably, the serial number information, the unique number information, and identification code information are included.

Alternatively, the device specific information 1 may be mounted (eg, using an IC card slot) or detached from the customer terminal 125 (eg, connected through a contact IC card reader or a contactless IC card reader). Preferably, the IC card includes one or more IC chip serial numbers, IC chip unique information, and IC chip identification information included in the IC card medium.

Alternatively, the device specific information 1 may be mounted on the customer terminal 125 (eg, a card slot is inserted or mounted on a PCB) or detached (eg, connected through a communication port). The hardware security module (HSM) preferably comprises at least one device serial number information, unique number information, identification code information provided in the medium.

12 illustrates a certificate verification process transferred according to an embodiment of the present invention.

In more detail, in FIG. 12, the certificate is transferred to the medium 2 mounted or detached from the customer terminal 125 through the certificate transfer process illustrated in FIG. 10 or 11, and from the customer terminal 125. When at least one device-specific information (1) is received, the certificate transferred to the medium (2) is a process for verifying that the function for preventing illegal transfer and possession of the certificate is operating normally, the present invention belongs to Those skilled in the art will be able to infer various implementation methods for the transferred certificate verification process by referring to and / or modifying the drawing 12, but the present invention includes all the inferred implementation methods, It is not limited by the implementation method shown in FIG.

Hereinafter, in FIG. 12, the customer terminal 125 shown in FIG. 8 is referred to as "terminal" for convenience, and the certificate transfer server 115 shown in FIG. 8 is referred to as "server" for convenience.

Referring to FIG. 12, a certificate is transferred to a medium 2 mounted or detached from the terminal through the certificate transfer process illustrated in FIG. 10 or 11, and one or more device-specific information 1 is transferred from the terminal. When received, the server checks 1200 whether the certificate is transferred to the medium 2 mounted or detached from the terminal.

If the certificate is transferred to the medium 2 mounted or detached from the terminal (1205), the terminal executes the certificate to initiate a diagnostic mode for the certificate (1210), and the terminal correspondingly The at least one device specific information 2 corresponding to at least one preset device among a plurality of device devices provided to or detached from the customer terminal 125 may be transmitted through the certificate (1215). The server reads the received one or more device-specific information (2) to verify the validity of the certificate (1220)

According to an exemplary embodiment of the present invention, the validity of the certificate may include at least one device corresponding to at least one preset device among a plurality of device devices provided or detached from the customer terminal 125 through the certificate. Send the unique information (2), and compare the at least one device specific information (2) received through the certificate with the at least one device specific information (1) received and the device specific information (2) transmitted from the certificate. It is preferable to include checking whether is valid.

According to an embodiment of the present invention, the device specific information 2 preferably includes one or more pieces of unique information of a medium on which the certificate is issued or unique information of a terminal on which the medium is mounted or detached.

For example, the device specific information 2 may be provided with device serial number information provided in a hard disk medium mounted (eg, embedded) or detached (eg, external, or mounted via a network) in the customer terminal 125, It is preferable that the identification number information, identification code information including at least one.

Alternatively, the device specific information 2 may include MAC (Media Access Control) address information provided in a communication device mounted (eg, embedded) or detached (eg, external) to the customer terminal 125. desirable.

Alternatively, the device specific information 2 may be mounted on the customer terminal 125 (e.g., mounted on a PCB through a USB terminal) or detached (e.g., connected to a USB port). Preferably, the serial number information, the unique number information, and identification code information are included.

Alternatively, the device specific information 2 may be mounted (eg, using an IC card slot) or detached from the customer terminal 125 (eg, connected through a contact IC card reader or a contactless IC card reader). Preferably, the IC card includes one or more IC chip serial numbers, IC chip unique information, and IC chip identification information included in the IC card medium.

Alternatively, the device specific information 2 may be mounted on the customer terminal 125 (eg, inserted into a card slot or mounted on a PCB) or detached (eg, connected through a communication port). It is preferable that the hardware module includes one or more device serial number information, unique number information, and identification code information included in a hardware security module (HSM) medium.

If the validity of the certificate is not confirmed (1225), the server generates certificate diagnosis error information and transmits the certificate diagnosis error information to the terminal through the communication network (1230).

On the other hand, if the validity of the certificate is confirmed (1225), the server associates the certificate information corresponding to the certificate mounted on the terminal with the received one or more device-specific information (1) by certificate management D / The certificate information and one or more device-specific information 1 stored in B 105 (1235) and then stored in the certificate management D / B 105 are used to prevent the certificate from being illegally transferred and occupied. .

According to the present invention, when the original certificate is first issued to the customer-designated medium 1, one or more components corresponding to one or more of the device devices provided or detached in the terminal on which the medium 1 is mounted or detached are provided. Security problem of non-face-to-face financial transactions caused by illegal transfer and possession of original certificate by authenticating the device-specific information during non-face-to-face financial transaction through the original certificate after storing device-specific information in association with the certificate information. There is an advantage to solve.

According to the present invention, after issuing the original certificate to the customer-designated medium (1), when transferring the original certificate to the medium (2), one or more of the device provided or detached in the mounting or detachable terminal device One or more of the configuration devices provided with or detached from the terminal that the validity of the original certificate transfer through the at least one device-specific information corresponding to the configuration device, the medium (2) to which the original certificate is transferred is mounted or detached By storing one or more device-specific information corresponding to the above configuration device in association with the certificate information, there is an advantage to solve the problem that the original certificate is illegally transferred and occupied.

Claims (15)

When issuing a certificate to a medium 1 mounted or detached from a terminal through a communication network, M (M> 1) pieces are provided or detached from the terminal via the communication network. Receiving device specific information 1 corresponding to m (1 <= m <= M) preset configuration devices among the configuration devices; Storing m device identification information corresponding to the m component devices, m device unique information (1) corresponding to each device identification information, and certificate information issued to the terminal in a storage medium; When using a certificate issued to the medium 1 mounted on or detached from the terminal through a communication network, the device identification information of n (1 <= n <m) to be included in the validation target is checked in connection with the storage medium, and the communication network Transmitting the identified n pieces of device identification information to the terminal through; Certificate information issued to the terminal through the communication network from the terminal and n device-specific information (2) corresponding to the n device identification information provided or detached from the terminal, and the data processed through the certificate Receiving; Extracting the certificate information and n device-specific information (2) from the received data; Identifying n device-specific information (1) matching the received n device identification information among m device identification information matching the certificate information in association with the storage medium; And comparing the checked n device specific information (1) with the received n device unique information (2) and authenticating validity of the received data. When issuing a certificate to a medium 1 mounted or detached to a terminal through a communication network, a predetermined set of a plurality of constituent devices provided or detached from the terminal is mounted or detached from the terminal via the communication network. Receiving device specific information 1 corresponding to the configuration device; Storing the device specific information (1) in association with certificate information issued to the terminal in a storage medium; When using a certificate issued to the terminal 1 mounted on or detached from the terminal through a communication network, the certificate information issued from the terminal to the terminal through the communication network and a plurality of components provided or detached from the terminal are preset. Receiving device-specific information (2) corresponding to a component and processing the data through the certificate; Extracting the certificate information and the device specific information (2) from the received data; Identifying device-specific information (1) matching the certificate information in association with the storage medium; And comparing the identified device specific information (1) with the received device specific information (2) and authenticating validity of the received data. The method of claim 1, When issuing a certificate to a medium 1 mounted or detached to a terminal through a communication network, M (M> 1) component information provided or detached to a terminal mounted or detached through the communication network. Receiving; Confirming m (1 <= m <= M) device information of a certificate verification target among the received M (M> 1) device information; And transmitting the m pieces of device information to the terminal through a communication network. The method according to claim 1 or 2, When issuing a certificate to a medium (1) mounted on or detached from a terminal through a communication network, transmitting I (I> 1) authentication information input query information to the terminal through a communication network; If i user authentication information 1 corresponding to i (1 <= i <= I) authentication information input query information among the I authentication information input query information is inputted from the terminal, the input i users Receiving authentication information (1); I input query information (or query identification codes corresponding to the i authentication information input query information) corresponding to the received i user authentication information 1 and user authentication information 1, respectively, and the one or more devices. Storing the information on the storage medium in association with the unique information (1). The method according to claim 1 or 2, When the certificate issued to the medium 1 mounted or detached from the terminal through the communication network is transferred to the medium 2, j (included in the certificate transfer verification object) among the i authentication information input query information in connection with the storage medium, Checking 1 <= j <= i) authentication information input query information; Transmitting a user authentication information input interface for inputting j user authentication information (2) corresponding to the checked j authentication information input query information to the terminal; Receiving j user authentication information (2) when the j user authentication information (2) corresponding to the j authentication information input query information is input through the user authentication information input interface at the terminal; Identifying j user authentication information (1) matching the j authentication information input query information in association with the storage medium; And comparing the checked user authentication information (1) with the received user authentication information (2) and authenticating the validity of the certificate transfer. The method according to claim 1 or 2, When transferring a certificate issued to the medium 1 to be mounted or detached to the terminal through a communication network to the medium 2, the terminal 2 is mounted or detached from the terminal through the communication network. Receiving device specific information (1) corresponding to m (1 <= m <= M) preset configuration devices among M (M> 1) configuration devices; Storing m device identification information corresponding to the m component devices, m device unique information (1) corresponding to each device identification information, and certificate information issued to the terminal, and storing the m device identification information corresponding to the m device; Certificate operating method characterized in that the made. The method of claim 6, Receiving M (M> 1) component information provided or detached from a terminal on which the medium (2) is mounted or detached through a communication network; Confirming m (1 <= m <= M) device information of a certificate verification target among the received M (M> 1) device information; And transmitting the m (1 <= m <= M) pieces of device information to the terminal through a communication network. The method according to claim 1 or 2, When transferring a certificate issued to the medium 1 to be mounted or detached to the terminal through a communication network to the medium 2, the terminal 2 is mounted or detached from the terminal through the communication network. Receiving device specific information (1) corresponding to a predetermined configuration device among a plurality of configuration devices; And storing the device specific information (1) in association with the certificate information issued to the terminal and storing the information in a storage medium. The medium according to claim 1, wherein the medium 1 One or more hard disk media, floppy disk media, USB (Universal Serial Bus) media, IC (Integrated Circuit) card media, hardware security module (HSM) media mounted on or detached from the terminal. Characterized by operating method. The device specific information (1) or device specific information (2) according to claim 1, Hard disk specific information provided or detached from the terminal, Media Access Control (MAC) address information of a communication device, Universal Serial Bus (USB) media unique information, Integrated circuit (IC) chip unique information, Hardware security module (Hardware) Security Module (HSM) Certificate operation method characterized in that it comprises one or more of the unique information. When a certificate is issued to a medium that is mounted on or detached from a terminal through a communication network, the certificate information and the unique information of the medium or the unique information of the terminal on which the medium is mounted or detached are linked and stored in a storage medium. Making; Upon authenticating the validity of a certificate issued to a medium mounted or detached from the terminal, receiving unique information of the medium or unique information of the terminal on which the medium is mounted or detached from the terminal through a communication network or is associated with the terminal. Confirming by; The unique information of the received or confirmed medium or the unique information of the terminal on which the medium is mounted or detached is compared with the unique information of the medium previously stored in the storage medium or the unique information of the terminal on which the medium is mounted or detached. Making; As a result of the comparison, the unique information of the received or confirmed medium or the unique information of the terminal on which the medium is mounted or demounted is unique information of a medium previously stored in the storage medium or the terminal on which the medium is mounted or detached. If it does not match the unique information, processing the certificate error irrespective of the validity authentication result of the certificate; certificate management method comprising a. The method of claim 11, wherein the medium, One or more hard disk media, floppy disk media, USB (Universal Serial Bus) media, IC (Integrated Circuit) card media, hardware security module (HSM) media mounted on or detached from the terminal. Characterized by operating method. The method of claim 11, wherein the unique information of the medium or the unique information of the terminal on which the medium is mounted or detached, Hard disk specific information provided to or detached from the terminal, Media Access Control (MAC) address information for a communication device, Universal Serial Bus (USB) media unique information, Integrated circuit (IC) chip unique information, Hardware security module ( Hardware Security Module (HSM) Certificate operation method characterized in that it comprises one or more of the unique information. When issuing a certificate to a medium 1 mounted or detached to a terminal through a communication network, a predetermined set of a plurality of constituent devices provided or detached from the terminal is mounted or detached from the terminal via the communication network. Means for receiving device specific information (1) corresponding to the configuration device; Means for storing the device specific information (1) and the certificate information issued to the terminal in association with the storage medium; When using a certificate issued to the terminal 1 mounted on or detached from the terminal through a communication network, the certificate information issued from the terminal to the terminal through the communication network and a plurality of components provided or detached from the terminal are preset. Means for receiving device specific information (2) corresponding to the configuration device; Means for confirming device specific information (1) that matches the received certificate information in association with the storage medium; And means for authenticating the validity of the received data by comparing the identified device specific information (1) with the received device specific information (2). When a certificate is issued to a medium that is mounted on or detached from a terminal through a communication network, the certificate information and the unique information of the medium or the unique information of the terminal on which the medium is mounted or detached are linked and stored in a storage medium. Means for doing so; Upon authenticating the validity of a certificate issued to a medium mounted or detached from the terminal, receiving unique information of the medium or unique information of the terminal on which the medium is mounted or detached from the terminal through a communication network or is associated with the terminal. Means for checking by; The unique information of the received or confirmed medium or the unique information of the terminal on which the medium is mounted or detached is compared with the unique information of the medium previously stored in the storage medium or the unique information of the terminal on which the medium is mounted or detached. And, as a result of the comparison, the unique information of the received or confirmed medium or the unique information of a terminal on which the medium is mounted or demounted is loaded with or without the unique information of a medium previously stored in the storage medium or the medium. And means for processing a certificate error irrespective of the validity authentication result of the certificate when it does not match the unique information of the terminal.

Images