KR101686167B1 - Apparatus and Method for Certificate Distribution of the Internet of Things Equipment - Google Patents

Abstract

A certificate distribution apparatus and method are disclosed. The certificate distribution apparatus according to an embodiment of the present invention includes a registration unit for receiving product information and a public key of a to-be-watermarked Internet device from a manufacturer server of a to-be-watermarked Internet device, and registering the received product information and a public key, A certificate acquisition unit for receiving certificate request information including device identification information, acquiring a certificate based on previously registered product information and a public key corresponding to the device identification information, And transmitting the request information to the object Internet device or the authentication terminal that has transmitted the request information.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an apparatus and a method for distributing a certificate of an Internet appliance,

And more particularly to an apparatus and method for acquiring and distributing a certificate for authenticating an object Internet device and for authenticating data digitally signed by the object Internet device.

Recently, with the development of information technology, it is becoming easier and easier to use internet technology, and certification technology is also developing. The underlying technologies for authenticating devices in object communication environments include ID / PW authentication technology, MAC address authentication technology, encryption protocol based authentication technology, challenge / response authentication technology, certificate based authentication technology and ID based encryption.

ID / PW authentication technology is the most basic authentication technology. It is easy to apply to any device and takes up less resources. However, when performing authentication for various subjects, all ID / PW should be stored. If ID / PW list is exposed Authentication can be easily disabled. In addition, it is difficult to store and manage large-scale systems, and a load may be generated when a large amount of authentication is simultaneously processed.

The MAC address based authentication technique is mainly used for network access control in an intranet environment. When a MAC address of a proper terminal connected to a network is registered in an authentication server and a MAC address of the terminal is registered in the server It is a way to approve connections. MAC address based authentication technology is relatively simple and speedy than ID / PW authentication technology, but MAC address can be falsified, so security is weak and MAC address table should be managed. There may be difficulties. In addition, MAC address-based authentication techniques are inappropriate in human communication environments where human intervention is eliminated or minimized.

The Challenge / Response authentication technique is a method of authenticating a user by generating a one-time hash value similar to OTP. This method is safe from Rainbow Attack or intrusion attack because it generates a random number every time it is authenticated. However, if the password itself is exposed in the same way as keyboard hooking, authentication may be disabled.

The certificate-based authentication technology is a method of authenticating through a digital signature using a public key-based cryptographic technique and provides a high security by providing a strong authentication function. Since the digital signature can be signed only by the user The non-repudiation function can be provided. On the other hand, key exchange is required in advance, and certificate management such as issuance, renewal, and revocation of certificates is necessary. Also, device certificate processing S / W and algorithms are difficult to apply to object internet appliances with large computational throughput and difficult to be compatible with different environments, different authentication technologies, and different domains.

The ID-based cryptosystem is a public key cryptosystem in which a user's ID such as a user's e-mail address, name, and IP address is used as a public key. Such ID-based cryptographic techniques do not require dictionary key distribution, have a small amount of computation, have a relatively short key length, and can provide a non-repudiation function. On the other hand, it is vulnerable to ID-based attacks due to the use of publicly available IDs. Much research is still lacking due to relatively new concepts and technologies compared to other authentication technologies.

Korean Patent Publication No. 10-2013-0019358 (Feb.

It is an object of the present invention to provide an apparatus and method for acquiring and distributing a certificate for authenticating object Internet devices and for authenticating data digitally signed by object Internet devices.

According to an aspect of the present invention, there is provided a certificate distribution apparatus for a thing Internet device, the certificate distribution apparatus comprising: a registration unit for receiving product information and a public key of the object Internet apparatus from a manufacturer server of the object internet apparatus, , Receives the certificate request information including the device identification information from the authentication terminal that performs authentication of the object Internet device or the object Internet device, acquires the certificate based on the previously registered product information corresponding to the device identification information and the public key And a certificate distribution unit for transmitting the obtained certificate to the object Internet device or the authentication terminal that has transmitted the certificate request information.

The certificate obtaining unit may request the certificate authority server to issue the certificate based on the obtained product information and the public key, and may receive the certificate issued from the certificate authority server.

The certificate distribution apparatus may further include a registration information DB storing product information and a public key of the object Internet device, and a certificate DB storing a certificate of the object Internet apparatus issued from the certificate authority server. If the certificate does not exist in the certificate DB, or if the obtained certificate is invalid, the certificate authority server can request issuance of a new certificate to the server.

When receiving a request for providing universally unique identifier (UUID) information to be transmitted from a manufacturer server to a manufacturer's server, the registration unit generates UUID information, registers the generated UUID information together with the product information and the public key, .

The certificate request information may further include at least one of time information, a PIN, and a time-based one time password (T-OTP), and the certificate obtaining unit may obtain at least one of the time information, the PIN, and the T- Validity can be verified, and a certificate can be obtained based on the verification result.

Authentication of the object Internet device performed by the authentication terminal may include at least one of authentication of the object Internet device itself and authentication of the digital signature data by the object Internet device.

The certificate obtaining unit obtains the first certificate of the first object Internet appliance and the second certificate of the second object internet appliance upon receiving the certificate request information for the interconnection from the first object internet appliance and the second object internet appliance, The first and second Internet devices and the first and second Internet devices may mutually authenticate the first and second Internet devices and the first and second Internet devices, respectively.

According to another aspect of the present invention, there is provided a method of distributing a certificate of a thing Internet device, the certificate distribution method comprising the steps of: receiving product information and a public key of the object Internet device from a manufacturer server of the object internet device, , Receives the certificate request information including the device identification information from the authentication terminal that performs authentication of the object Internet device or the object Internet device, acquires the certificate based on the previously registered product information corresponding to the device identification information and the public key And transmitting the obtained certificate to the object Internet device or the authentication terminal that has transmitted the certificate request information.

The obtaining of the certificate may request the certificate authority server to issue the certificate based on the obtained product information and the public key, and may receive the certificate issued from the certificate authority server.

The certificate request information may further include at least one of time information, a PIN, and a time-based one time password (T-OTP), and the step of acquiring the certificate may further include receiving at least one of time information, PIN and T- Validate the certificate request, and obtain the certificate based on the verification result.

The certificate management function such as storing, renewing and distributing the certificate is performed in the certificate distribution device, thereby reducing the implementation complexity of the object Internet device, operating the certificate distribution device in the authorized certification authority, and distributing the certificate By enforcing, the registered owner can be designated as the subject of responsibility.

1 is a block diagram of an object Internet system according to an exemplary embodiment of the present invention.
2 is a configuration diagram of a certificate distribution apparatus according to an embodiment.
FIG. 3 is a flowchart illustrating a method of registering a public key according to an embodiment.
4 is a flowchart illustrating a method of registering a public key according to another embodiment.
FIG. 5 is a flowchart illustrating a method of registering a public key according to another embodiment.
FIG. 6 is an exemplary diagram illustrating a method for distributing a certificate to an authentication terminal according to an embodiment.
7 is an exemplary view for explaining a certificate distribution method for an interconnection according to an embodiment.
8 is an exemplary diagram illustrating a certificate distribution method for authenticating a user authentication token according to an embodiment.
9 is a flowchart illustrating a certificate distribution method according to an embodiment.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. In addition, the terms described below are defined in consideration of the functions of the present invention, which may vary depending on the intention of the user, the operator, or the custom. Therefore, the definition should be based on the contents throughout this specification.

Hereinafter, embodiments of the certificate distribution apparatus and method will be described in detail with reference to the drawings.

1 is a block diagram of an object Internet system according to an exemplary embodiment of the present invention.

Referring to FIG. 1, the object Internet system may include an object Internet apparatus 10, a certification authority server 30, a manufacturer server 50, and a certificate distribution apparatus 100.

According to one embodiment, the object Internet means a technique of connecting sensors and communication functions to various objects and connecting them to the Internet. Here, the object Internet device 10 may be a variety of embedded systems such as household appliances, mobile devices, and wearable computers. In addition, the object Internet device 10 may have an IP address for identifying itself to be connected to the object Internet, and may incorporate a sensor for data acquisition from the external environment.

According to an example, the object Internet device 10 may have a private key for receiving authentication when it is connected to the object Internet and transmits data or connects to another object Internet device. For example, the object Internet device 10 may receive the private key from the manufacturer of the corresponding object Internet device 10 or may directly generate and embed the private key. In this case, the object Internet device 10 can be used to digitally sign its data or to encrypt device identification information for authenticating itself when connected to the object Internet.

According to one example, the matter Internet device 10 can receive a certificate for use in authentication from an external server. For example, the external server may be the certificate distribution apparatus 100. The object Internet device 10 can request and use a certificate to the certificate distribution apparatus 100, if necessary, without having to import and store the certificate in advance. At this time, the object Internet device 10 may encrypt the certificate request information including the device identification information of the object Internet device 10 with the private key to request the certificate, and transmit the encrypted certificate request information to the certificate distribution device 100.

The certification authority server 30 can issue the certificate of the object Internet device, suspend the effect, and recover and discard the certificate. For example, the certification authority server 30 issues a certificate to the object Internet device 10 from the certificate distribution apparatus 100, receives a request to stop or recover the certificate, Recovery and disposal.

The manufacturer server 50 may generate the private key and the public key pair corresponding to the object internet appliance 10 or may be generated at the object internet appliance 10. [ For example, the manufacturer server 50 can inject a private key to the object Internet device 10 or extract a public key from the object Internet device 10 when manufacturing the object Internet device 10, 100 to transmit the product information and the public key of the object Internet device 10 to request registration. In this case, the private key and the public key are distributed to the object Internet device 10 and the certificate distribution device 100 in advance, thereby preventing an attack such as hacking, etc., of the object Internet device 10.

The certificate distribution apparatus 100 receives the certificate request information including the device identification information from the object Internet apparatus 10, acquires the certificate based on the pre-registered product information and the public key corresponding to the device identification information, To the Internet device 10. The registered owner can be designated as the responsible owner by operating the certificate distribution apparatus 100 in the authorized organization and forcing the certificate distribution to be performed until the owner registers.

2 is a configuration diagram of a certificate distribution apparatus 100 according to an embodiment.

Referring to FIG. 2, the certificate distribution apparatus 100 may include a registration unit 110, a certificate acquisition unit 130, a certificate distribution unit 150, a registration information DB 170, and a certificate DB 190.

According to one embodiment, the registration unit 110 receives the product information and the public key of the object Internet device 10 from the manufacturer server 50 of the object Internet device, and registers the received product information and the public key.

For example, the registration unit 110 receives product information necessary for certificate issuance, including at least one of a device name, an ID, a serial number, a model number, and a part number of the object Internet device 10 from the manufacturer server 50 can do. However, the present invention is not limited thereto. The registration unit 110 may store the received product information and the public key of the object Internet device 10 in the registration information DB. The stored product information and the public key can then be used to obtain the certificate.

According to another embodiment, when the registering unit 110 receives a request for providing universally unique identifier (UUID) information to be injected from the manufacturer's server 50, the registering unit 110 generates UUID information, Together with the product information and the public key, to the manufacturer server 50.

Here, the UUID may be an identifier standard used in software construction. For example, a UUID is a number of 16 octets (128 bits), and in the standard format, the UUID is represented by 32 hexadecimal digits and a total of 36 characters (32 characters and 4 hyphens) 12 are separated by hyphens.

When the registration unit 110 is requested to register the public key from the manufacturer server 50, the registration unit 110 generates a UUID corresponding to the public key, and transmits the generated UUID to the manufacturer server 50 so as to inject the UUID into the object Internet apparatus 10 . After that, the object Internet device 10 may request the certificate distribution apparatus 100 for a certificate by encrypting the certificate request information with the private key and attaching the injected UUID. The certificate distribution apparatus 100 transmits the public key corresponding to the corresponding UUID To decrypt the certificate request information transmitted by the object Internet device 10. [

According to an example, the certificate obtaining unit 130 receives certificate request information including device identification information from an authentication terminal that performs authentication of the object Internet device or the object Internet device, The certificate can be obtained based on the product information and the public key.

For example, the certificate obtaining unit 130 may receive the certificate request information from the object Internet device. Objects Internet devices may have their own certificates embedded to connect to the Internet. This can be used when the device to be connected to the object Internet device can not request a certificate from the certificate distribution device. In this case, the device may be compatible with a device that authenticates the object Internet device in a pre-distribution manner of the certificate.

As another example, the certificate obtaining unit 130 may receive certificate request information from an authentication terminal that performs authentication of the object Internet appliance. For example, the authentication terminal may be a separate device that receives and processes the data of the object Internet device or another object Internet device that performs the object internet communication.

When the certificate obtaining unit 130 receives the certificate request information including the device identification information, the certificate obtaining unit 130 can verify the corresponding certificate request information. For example, when the certificate request information is encrypted with the private key of the object Internet device, the certificate obtaining unit 130 reads the public key of the object Internet device from the registration information DB 170 and decrypts the encrypted certificate request information And verification.

For example, the certificate obtaining unit 130 may request the certification authority server 30 to issue a certificate based on the obtained product information and the public key, and may receive the certificate issued from the certification authority server 30. The received certificate may be provided to the object Internet device and may be stored in the certificate DB 190 of the certificate distribution apparatus 100.

As another example, the certificate obtaining unit 130 may obtain a certificate from the certificate DB 190 based on the device identification information. For example, if the certificate for the object Internet device is already received from the certification authority server 30 and stored in the certificate DB 190 for management, the certificate acquisition unit 130 sends a separate certificate request It is possible to acquire the certificate stored in the certificate DB 190 and transmit it to the object Internet device 10. [ However, if the certificate does not exist in the certificate DB, it can request a certificate from the certificate authority server.

As another example, the certificate obtaining unit 130 may request the certification authority server 30 to issue a new certificate when the certificate exists in the certificate DB 190 but the obtained certificate is not valid. For example, when the validity period of the certificate has elapsed, the certificate obtaining unit 130 may discard the certificate or request the certification authority server to update the existing certificate. Alternatively, if the certificate is not valid, the certificate obtaining unit 130 may discard the existing certificate, and then request a new certificate.

The certificate thus obtained may be transmitted to the object Internet device or the authentication terminal that has transmitted the certificate request information through the certificate distribution unit 150. [

The certificate request information may further include at least one of time information, a PIN, and a Time-based One Time Password (T-OTP). In this case, the certificate obtaining unit 130 can verify the validity of the certificate request based on at least one of the time information, the PIN, and the T-OTP, and obtain the certificate based on the verification result.

As an example, the certificate request information may include time information. For example, the time information may be a timestamp. The certificate obtaining unit 130 may extract time information from the certificate request information and compare the extracted time information with the current time of the certificate distribution apparatus 100 to verify the validity of the certificate request. For example, if the tolerance is assumed to be within one second, if the difference between the time information and the current time is less than one second, the certificate obtaining unit 130 may determine that the certificate request is valid, It can be judged to be invalid.

In another example, the certificate request information may include a Personal Identification Number (PIN). The certificate obtaining unit 130 may extract the PIN from the certificate request information. Also, the certificate obtaining unit 130 can inquire the PIN according to the user, and can verify the validity of the certificate request by comparing the extracted PIN with the PIN inquired by the certificate distribution apparatus 100. [

As another example, the certificate request information may include a T-OTP. T-OTP is a method of using time as an input value used to generate a one-time password. The object Internet device generates a one-time password using the current time as an input value and transmits the generated one-time password to the certificate distribution apparatus 100. The certificate acquisition unit 130 also generates a one-time password in the same manner to check the validity of the value transmitted by the client can do. Accordingly, when the certificate request is delayed for a predetermined time or longer, the one-time passwords may be different from each other, and the certificate obtaining unit 130 may determine that the certificate request is invalid.

Authentication of the object Internet device performed by the authentication terminal may include at least one of authentication of the object Internet device itself and authentication of the digital signature data by the object Internet device.

For example, if the authentication terminal is a separate processing device that receives and processes the data of the object Internet device, the authentication terminal needs to determine whether the received data is falsified or altered. To this end, the object Internet device may transmit its certificate request information and digitally signed data to the authentication terminal. Accordingly, the authentication terminal can transmit the certificate request information of the relevant object Internet device to the certificate distribution apparatus 100, receive the certificate, verify the validity of the digital signature based on the received certificate, .

In another example, the authentication terminal may be another object Internet device that performs object-to-object Internet communication. For example, when the first-object Internet appliance and the second-object internet appliance are connected to each other, the certificate obtaining part 130 obtains the certificate request information for the mutual connection from the first-object Internet appliance and the second- A first certificate of the first thing Internet device and a second certificate of the second matter internet device, and acquires the first certificate and the second certificate of the second matter internet device, 2 certificate to the second-party Internet device and the first-party Internet device, respectively.

FIG. 3 is a flowchart illustrating a method of registering a public key according to an embodiment.

Referring to FIG. 3, the manufacturer server 50 may generate a private key and a public key pair corresponding to the object Internet appliance while manufacturing the object Internet appliance (310). The generated private key can be injected into the object Internet device 10 at the manufacturing stage 320. The object Internet device 10 stores the private key 330 and the private key injection is completed to the manufacturer server 50 (340). In addition, the manufacturer server 50 requests the certificate distribution apparatus 100 to register the product information and the public key of the object Internet device 10 corresponding to the object Internet device 10 (350). Thereafter, the certificate distribution apparatus 100 registers the received product information and the public key, stores the product information and the public key of the relevant object Internet device (360), and notifies the manufacturer server 50 that the registration is completed (370). At this time, the registration of the received product information and the public key may be performed by the registration unit 110 of FIG. 2, and the registration may be performed by the registration information DB 170 of FIG.

4 is a flowchart illustrating a method of registering a public key according to another embodiment.

Referring to FIG. 4, the certificate distribution apparatus 100 may generate a UUID corresponding to the public key and provide the UUID to the object Internet apparatus. To this end, the manufacturer server 50 generates a key pair of the object Internet device 410, registers the generated public key, and identifies the object Internet device corresponding to the public key by the certificate distribution device 100 (420). ≪ / RTI > In this case, the certificate distribution apparatus 100 generates a UUID for identifying the object Internet device (430), and registers the generated UUID and the public key (440).

The generated UUID information is provided to the manufacturer server (450), and the manufacturer server transmits it together with the private key of the object internet device (10) so that the object internet device (10) stores it (460). Thereafter, the object Internet device 10 stores the private key (470), and notifies the manufacturer server that the injection is completed (480).

When the object Internet device 10 generates certificate request information for authentication, the registered UUID is transmitted to the certificate distribution apparatus 100 together with the certificate request information encrypted using the injected private key, 100 can extract the corresponding UUID and use it to decrypt the certificate request information encrypted with the corresponding public key.

FIG. 5 is a flowchart illustrating a method of registering a public key according to another embodiment.

Referring to FIG. 5, a key pair corresponding to the object Internet device 10 may be generated in the object Internet device 10 and provided to the certificate distribution device 100, instead of the manufacturer terminal. To this end, the manufacturer server 50 requests the object Internet device 10 to generate a key pair 510, the object internet device 10 receives the request to generate a private key and a public key 520, The key is stored 530 in the Internet appliance 10, and the generated public key is transmitted 540 to the manufacturer server 50. Then, the manufacturer server 50 requests registration of the public key together with the product information of the Internet device of the certificate distribution apparatus 100 (550), the certificate distribution apparatus 100 registers the public key (560) The server 50 is notified of completion of registration (570).

FIG. 6 is an exemplary diagram illustrating a method of distributing a certificate to an authentication terminal 70 according to an embodiment.

Referring to FIG. 6, the authentication terminal 70 is connected to the object Internet device 10 and can receive data from the object internet device 10. The authentication terminal 70 may receive the certificate request information from the object Internet device 10 and request the certificate distribution device 100 for the certificate of the object Internet device 10. [

The object Internet device 10 may be a vehicle black box 10 and the authentication terminal 70 may be a smartphone 70 and the vehicle black box 10 may be a smart phone 70 It is possible to provide a recorded image. At this time, the smartphone 70 needs to check whether or not the data received from the vehicle black box is falsified or altered. In this case, the vehicle black box 10 can electronically sign an image of the vehicle using the private key built in the vehicle, and can transmit the information including the certificate request information to the smartphone 70. The smartphone 70 may transmit the certificate request information including the device identification information of the vehicle black box 10 to the certificate distribution apparatus 100 to request the certificate.

For another example, it is necessary for the authentication terminal 70 to check whether or not the image provided in the vehicle black box 10 in which the Internet is not supported is falsified or altered. In this case, the vehicle black box 10 can electronically sign its own image using the private key built in itself, and the device identification information and authentication of the vehicle black box 10 are transmitted from the smartphone 70 The PIN may be manually input and transmitted to the certificate distribution apparatus 100 to request a certificate.

Upon receiving the certificate request information including the device identification information of the black box 10 from the smartphone 70, the certificate distribution apparatus 100 transmits the certificate request information based on the pre-registered product information and the public key corresponding to the device identification information Obtain the certificate, and transmit the obtained certificate to the smartphone 70 that has transmitted the certificate request information.

The smartphone 70 can authenticate the validity of the digital signature using the certificate received from the certificate distribution apparatus 100, thereby confirming whether the data is falsified or tampered.

7 is an exemplary view for explaining a certificate distribution method for an interconnection according to an embodiment.

Referring to FIG. 7, the two Internet devices 10 and 15 may require mutual authentication to operate in connection with each other. In this case, the authentication terminal may be a matter-of-interest Internet device that requests a certificate of the object Internet device to determine whether to connect or not.

For example, the two object Internet devices may be the vehicle black box 10 and the monitor 15, respectively. At this time, the vehicle black box 10 is connected to the monitor 15 and can transmit the image stored in the smartphone 15. Further, the vehicle black box 10 needs to transmit an image only to the monitor 15 registered to itself. Similarly, the monitor 15 needs to receive the image only from the authenticated vehicle black box 10, and it is necessary to check whether the image received from the vehicle black box 10 has been falsified or altered. In such a case, mutual authentication may be required between each of the vehicle black box 10 and the monitor 15.

At this time, the vehicle black box 10 can receive the certificate request information of the monitor 15 from the monitor 15, request the certificate distribution apparatus 100 for the certificate of the monitor 15, The monitor 15 can be authenticated by receiving a certificate corresponding to the monitor 15. The monitor 15 can also receive the certificate request information of the vehicle black box 10 from the vehicle black box 10 and request the certificate distribution apparatus 100 for the certificate, And can authenticate the black box 10 for a vehicle.

8 is an exemplary diagram illustrating a certificate distribution method for authenticating a user authentication token 10 according to an embodiment.

Referring to FIG. 8, the user terminal 80 can exchange data with the server 85 performing a specific function. In this case, the user terminal 80 needs to generate authentication information or securely sign it to secure the data transmitted by the user terminal 80, and can use the user authentication token 10 for this purpose. Also, the server 85 needs to check whether the received data has been falsified or altered, and for this, the user terminal needs to authenticate the user authentication token 10 used for authentication.

At this time, the server 85 can receive the certificate request information of the user authentication token 10 through the user terminal 80, and can request a certificate to the certificate distribution apparatus 100 using the certificate request information. In this case, the certificate distribution apparatus 100 receives the certificate request information of the user authentication token 10 and acquires the certificate based on the previously registered product information and the public key corresponding to the device identification information of the user authentication token 10 And transmit the obtained certificate to the server 85 with the certificate request information.

The server 85 can authenticate the user authentication token 10 by using the certificate received from the certificate distribution apparatus 100 and thereby check whether the data received from the user terminal 80 is falsified or tampered with have.

9 is a flowchart illustrating a certificate distribution method according to an embodiment.

Referring to FIG. 9, the certificate distribution apparatus receives the product information and the public key of the object Internet apparatus from the manufacturer server of the object Internet apparatus, and registers the received product information and the public key (910). At this time, the object Internet device can store the product information and the public key of the received object Internet device in the registration information DB.

Thereafter, the certificate distribution apparatus can receive certificate request information of the object Internet apparatus from the registered object internet apparatus. In this case, the Internet distribution apparatus can extract the public key corresponding to the object Internet apparatus and decrypt the certificate request information received from the object Internet apparatus. Thereafter, the certificate distribution apparatus extracts product information of the object Internet appliance and acquires the certificate based on the extracted product information (930). At this time, in order to acquire the certificate, the certificate distribution apparatus can search whether the corresponding certificate is stored in the certificate distribution apparatus. If the certificate exists in the certificate distribution device as a result of the search, the certificate distribution device can read the certificate and provide it to the Internet device. On the other hand, if the certificate does not exist in the search result certificate distribution device, the certificate distribution device can request the certificate of the object Internet device to be issued to the certification authority server. Alternatively, when the certificate exists in the search result certificate distribution device but the validity period of the certificate has expired, the certificate distribution device may renew the old certificate or request a new certificate. The certificate thus obtained is transmitted to the object Internet device or the authentication terminal that transmitted the certificate request information (950).

One aspect of the present invention may be embodied as computer readable code on a computer readable recording medium. The code and code segments implementing the above program can be easily deduced by a computer programmer in the field. A computer-readable recording medium may include any type of recording device that stores data that can be read by a computer system. Examples of the computer-readable recording medium include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical disk, and the like. In addition, the computer-readable recording medium may be distributed to networked computer systems and written and executed in computer readable code in a distributed manner.

The present invention has been described with reference to the preferred embodiments. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Therefore, the scope of the present invention should not be limited to the above-described embodiments, but should be construed to include various embodiments within the scope of the claims.

10: Object Internet device 30: Certificate authority server
50: manufacturer server 100: certificate distribution device
110: registering unit 130: certificate obtaining unit
150: certificate distribution unit 170: registration information DB
190: Certificate DB

Claims (10)

1. A certificate distribution device for an object Internet device,
A registration unit for receiving the product information and the public key of the object Internet appliance from the manufacturer server of the object internet appliance, and registering the received product information and the public key;
Receiving certificate request information including device identification information from an authentication terminal that performs authentication of the object Internet device or the object Internet device and acquiring a certificate based on the previously registered product information and the public key corresponding to the device identification information A certificate obtaining unit; And
A certificate distributing unit for transmitting the obtained certificate to a destination Internet device or an authentication terminal that has transmitted the certificate request information; The certificate issuing device. The method according to claim 1,
The certificate obtaining unit
Requesting the certificate authority server to issue a certificate based on the registered product information and the public key, and receiving the certificate issued from the certificate authority server. 3. The method of claim 2,
A registration information DB for storing product information and a public key of the object Internet device; And
And a certificate DB for storing a certificate of the object Internet appliance issued from the certification authority server,
The certificate obtaining unit
Acquires a certificate from the certificate DB based on the device identification information, and requests the certificate authority server to issue a new certificate if the certificate does not exist in the certificate DB or if the obtained certificate is invalid. The method according to claim 1,
The register
(UUID) information, and registers the UUID information together with the product information and the public key when receiving a request for providing universal unique identifier (UUID) information to be transmitted from the manufacturer server to the object Internet device, The certificate distribution device that sends the certificate to. The method according to claim 1,
Wherein the certificate request information further includes at least one of time information, a PIN, and a time-based one time password (T-OTP)
The certificate obtaining unit
Verifying the validity of the certificate request based on at least one of the time information, the PIN, and the T-OTP, and obtaining the certificate based on the verification result. The method according to claim 1,
Wherein the authentication of the object Internet device performed by the authentication terminal includes at least one of authentication of the object Internet device itself and authentication of the digitally signed data by the object Internet device. The method according to claim 1,
The certificate obtaining unit
Wherein the second certificate obtaining unit obtains the first certificate of the first object Internet appliance and the second certificate of the second object internet appliance upon receiving certificate request information for interconnection from the first object internet appliance and the second object internet appliance, To the second Internet appliance and the first Internet appliance, the first Internet certificate and the second certificate, respectively, so that the Internet and the second Internet are mutually authenticated. In a certificate distribution method of a certificate distribution apparatus,
Receiving product information and a public key of the object Internet appliance from a manufacturer server of the object internet appliance, and registering the received product information and a public key;
Receiving certificate request information including device identification information from an authentication terminal that performs authentication of the object Internet device or the object Internet device and acquiring a certificate based on the previously registered product information and the public key corresponding to the device identification information ; And
Transmitting the obtained certificate to a destination Internet device or an authentication terminal that has transmitted the certificate request information; ≪ / RTI > 9. The method of claim 8,
The step of obtaining the certificate
Requesting the certificate authority server to issue a certificate based on the registered product information and the public key, and receiving the certificate issued from the certificate authority server. 9. The method of claim 8,
Wherein the certificate request information further includes at least one of time information, a PIN, and a time-based one time password (T-OTP)
The step of obtaining the certificate
Validating the validity of the certificate request based on at least one of the time information, the PIN, and the T-OTP, and obtaining the certificate based on the verification result.

Images