Optical storage medium for storing, a public key infrastructure (pki)-based private key and certificate, a method and system for issuing the same and a method for using

A method for issuing an optical storage medium having a PKI-based private key and digital certificate stored therein, using a user information database server for storing user information, a certification authority server for creating a PKI-based user certificate by attaching a digital signature to the user certificate using its private key, and a registration authority computer for issuing said optical storage medium by communicating with said user information database server and certification authority server over a computer communication network, said method comprising the steps of:

• a), by said registration authority computer, checking a user's identity in response to a digital certificate issuance request from the user, authenticating the user in accordance with the checked result, inputting user information entered by said user, transferring the inputted user information to said user information database server and registering it therein;
• b), by said registration authority computer, forming a temporary storage area related to said user in its storage unit;
• c), by said registration authority computer, creating a PKI-based public key and private key pair;
• d), by said registration authority computer, encrypting the created private key with a digital signature password memorized by said user on the basis of a password-based encryption standard (PKCS#5) and storing the encrypted private key in said temporary storage area;
• e), by said registration authority computer, producing a digital certificate request message containing the created public key and transferring the produced message to said certification authority server;
• f), by said registration authority computer, receiving a user certificate issued from said certification authority server and storing the received certificate in said temporary storage area;
• g), by said registration authority computer, reading the user certificate and private key stored in said temporary storage area and at least one certification authority certificate prestored in said storage unit and writing the read user certificate, private key and certification authority certificate on said optical storage medium;
• and
• h), by said registration authority computer, erasing said temporary storage area in said storage unit.

A system for issuing an optical storage medium having a PKI-based private key and digital certificate stored therein, using a user information database server for storing user information, a certification authority server for creating a PKI-based user certificate by attaching a digital signature to the user certificate using its private key, and a computer communication network, said system comprising:

• storage means for storing a program for control of processing means and information regarding the entire system operation;
• said processing means connected to said storage means for operating according to the control program stored therein;
• and
• optical storage medium writing means connected to said storage means and processing means;
• said processing means being interoperable with said control program to input said user information, register it in said user information database server, form a temporary storage area related to a user in said storage means, create a public key and private key pair for production of a PKI-based digital certificate request message, encrypt the created private key with a digital signature password memorized by the user on the basis of a password-based encryption standard, store the encrypted private key in said temporary storage area, produce the digital certificate request message containing the created public key, transfer the produced message to said certification authority server, receive a user certificate issued from said certification authority server, store the received certificate in said temporary storage area, read the user certificate and private key stored in said temporary storage area and a certification authority certificate prestored in said storage means, write the read user certificate, private key and certification authority certificate on said optical storage medium and then erase said temporary storage area in said storage means.

A method for using an optical storage medium having a PKI-based private key and digital certificate stored therein, comprising the steps of:

• a) gaining access to a Web server requiring a user certification and security, using a computer equipped with an optical storage medium reader;
• b) receiving a digital signature request message from said Web server;
• c) running in said computer a certificate management program for performing a user certificate/private key-based digital signature function, and user certificate/private key management, discard and reissuance application functions;
• d) inserting said optical storage medium into said optical storage medium reader if said medium has not been yet inserted into said reader;
• e) decrypting a user private key encrypted and stored in said optical storage medium with a digital signature password from a user;
• f) performing a digital signature with the decrypted private key;
• and
• g) sending the digital signature to said Web server.

A method for using an optical storage medium having a PKI-based private key and digital certificate stored therein, comprising the steps of:

• a) gaining access to a Web server requiring a user certification and security, using a computer equipped with an optical storage medium reader;
• b) receiving a digital signature request message from said Web server;
• c) running in said computer a certificate management program for performing a user certificate/private key-based digital signature function, and user certificate/private key management, discard and reissuance application functions, and communicating with a security key management server to download an optical storage medium security key from said management server, store it in a storage unit of said computer and use it, said management server storing and managing said optical storage medium security key;
• d) determining whether said optical storage medium has been inserted into said optical storage medium reader, and inserting said optical storage medium into said optical storage medium reader if it is determined not to have been inserted into said reader;
• e) determining whether said optical storage medium security key is present in said storage unit, and reading said security key from said storage unit if it is determined to be present in said storage unit;
• f) decrypting a user private key encrypted and stored in said optical storage medium with the read security key;
• g) performing a digital signature with a digital signature password from a user and sending the digital signature to said Web server;
• h) receiving a security key certificate from said security key management server if it is determined at said step e) that said optical storage medium security key is not present in said storage unit;
• i) verifying the received security key certificate according to said certificate management program;
• j), according to said certificate management program, creating a session key for communication data encryption, encrypting unique security key request information from said user and the created session key with a public key contained in said security key certificate from said security key management server and then sending the encrypted security key request information and session key to said management server;
• and
• k) allowing said security key management server to encrypt said security key with said session key and send the resulting security key back to said computer, and storing said security key sent from said management server in said storage unit according to said certificate management program.