Patent Publication Number: US-7721102-B2

Title: System and method for detecting exposure of OCSP responder&#39;s session private key

Description:
BACKGROUND OF THE INVENTION 
   1. Field of the Invention 
   The present invention relates to an online certificate status protocol (OCSP) for verifying a certificate of a user online in a public key infrastructure (PKI), and more particularly, to a system and method for detecting exposure of an OCSP responder&#39;s session private key in a distributed OCSP based on key-insulted signature (D-OCSP-KIS) where multiple OCSP responders exist. 
   2. Description of the Related Art 
   Various cryptographic algorithms have been developed for security on the Internet. A cryptographic algorithm requires a confidentiality function for keeping information secret, a function for performing authentication to identify a person who sends information, a function for checking the integrity of information, and a non-repudiation function for preventing denial of the fact that an information provider provides information. 
   As a cryptographic algorithm having such functions, a cryptographic algorithm using a key has been widely used. The key-based cryptographic algorithm includes a symmetric encryption algorithm or a secret key algorithm which uses a single secret key, and an asymmetric encryption algorithm or a public key algorithm which uses a combination of a public key and a private key. A message digest (MD), which is not a cryptographic algorithm, is used to check integrity of received information and to perform authentication for an information sender. 
   The symmetric encryption algorithm is an algorithm in which a decryption key is derived from an encryption key and vice versa, and performs both encryption and decryption using a single secret key. A person who sends information or a message encrypts the information or message using a secret key and then sends the encrypted information, and a person who receives the encrypted information decrypts the encrypted information using the same secret key. The symmetric encryption algorithm has an advantage in that it can perform encryption and decryption rapidly, and can employ various encryption techniques and thus has many applications. On the other hand, it has a disadvantage in that it is difficult to produce and manage a secret key when there are many users and safe transmission of the secret should be guaranteed. Symmetric encryption algorithms include Data Encryption Standard (DES), International Data Encryption Algorithm (IDEA), RC2, RC5, SEED, and so on. 
   The public key encryption algorithm uses an encryption key and a decryption key which are different from each other. That is, an encryption key cannot be derived from a decryption key, and vice versa. The public key encryption algorithm uses a public key which is a combination of an encryption key and a private key. Since the public key is open to the public, a sender encrypts desired information using a receiver&#39;s public key and then sends the encrypted information, and a receiver decrypts the encrypted information using his/her private key. Ciphertext can be decrypted using a private key corresponding to a public key used for encryption, it does not require transmission of a secret key. However, the public key encryption algorithm is slow to encrypt and decrypt and thus is inconvenient when encrypting and decrypting large volumes of information. Public key infrastructure (PKI) encryption algorithms include Rivest-Shamir-Adelman (RSA), LUC, Diffie-Hellman, Elliptic Curve, and so on. 
   Meanwhile, the message digest algorithm is used to secure the integrity of information as described above. The message digest algorithm converts given information or a message into a hash value having a predetermined length using a one-way hash function. The ciphertext is transmitted together with the message digest, and a receiver decrypts it into plaintext and obtains a hash value of the plaintext, and then compares the obtained hash value to the received hash value. When the two hash values are identical, it means that there is no change in information during transmission. Message digest algorithms include Snefru, CRC-32, CRC-16, MD2, MD4, MD5, SHA, Haval, and so on. 
   The type of cryptographic algorithm most widely used in electronic commercial transactions is a hybrid type which is a mix of both asymmetric and symmetric encryption. In the hybrid type cryptographic algorithm, a message is encrypted by the secret key algorithm using a secret key, and the secret key is encrypted by the public key algorithm using a receiver&#39;s public key, and then the two ciphertexts are transmitted. The receiver decrypts the secret key using his/her private key and then decrypts the message using the decrypted secret key. For authentication, integrity and non-repudiation, something encrypted by a private key of a sender who sends the message digest (which is referred to as a “digital signature”) is generally transmitted together. The receiver decrypts the message digest using the sender&#39;s public key and then compares it with a message digest of the decrypted plaintext, thereby authenticating the sender and achieving content integrity and non-repudiation. 
   The above-described cryptographic algorithm is disclosed in Korean Publication No. 2000-72218, entitled: “METHOD FOR MANAGING AND SYNCHRONIZING SECURITY DATA IN INTERNET USING ENCRYPTION AND DIGITAL SIGNITURE” and Korean Publication No. 2004-37051, entitled: “DOCUMENT SECURITY SYSTEM AND METHOD FOR THE SAME AND RECORDING MEDIUM FOR EXECUTING THE PROGRAM CAPABLE OF READING COMPUTER”. 
   The PKI encryption algorithm described above provides extensive security such as authentication, integrity, and non-repudiation by using the public key algorithm. A main feature of the PKI encryption algorithm is the digital certificate in which identify information of an entity such as a user or an organization is linked to its public key and then digitally signed by a certificate authority (CA). When a private key of an entity or entity information is exposed, the entity requests the CA to revoke its certificate. Information indicating whether a certificate is revoked or not is referred to as certificate status information (CSI), and a certificate revocation list (CRL) is one well-known method for obtaining and managing CSI. 
   The CRL is simple, but the cost of communications between a user and a CA&#39;s directory or repository is high. For this reason, several methods have been suggested to reduce the size and cost of communicating CSI, such as a delta-CRL, CRL Distributed Points (CRL DPs), Over-issued CRLs, Indirect CRLs, Dynamic CRL DPs, Freshest CRLs, Certificate Revocation Trees (CRTs), NOVOMODO, and Authenticated Directory. 
   When a client or a user wants the CSI in a timely manner, an online certificate status detecting method such as OCSP is more convenient than an offline method such as the CRL. 
   Using the OCSP, the client does not need to download the CRL from the directory of the CA, so that the communication cost is low and the client does not need a memory for storing the CRL. However, if the CSI requests are centralized to one OCSP responder, the OCSP responder may be attacked by a denial of service (DoS). To reduce the risk of a DoS attack, the OCSP responder may compute a signature value for responses in a short time. However, this may also result in replay attacks. 
   In order to reduce overload of one OCSP responder in the traditional OCSP, a distributed-OCSP (D-OCSP) in which multiple OCSP responders coexist has been introduced. If distributed OCSP responders have the same private key in the D-OCSP, an risk of exposure of the private key becomes very high. Thus, each OCSP responder has a different private key, and a client should obtain certificates of all OCSP responders to detect the CSI of the OCSP responders. However, this may also result in a high communication cost and increased memory consumption. In order to solve these problems, a single public key method in D-OCSP-KIS was proposed by Koga and Sakurai. 
   In D-OCSP-KIS, each OCSP responder has a different private key, but they all have the same certificate. Thus, the number of certificates is reduced, a communication cost is low, a computation time is short, and memory consumption is low. 
   However, the D-OCSP-KIS has several problems. If an attacker obtains a session private key of an OCSP responder within a certain time period (e.g., one day), the private key of a different OCSP responder cannot be computed without a master private key. Since a hash value is impossible to compute reversely, a hash value of a previous time period cannot be computed. However, the attacker may pretend to be an OCSP responder while the real OCSP responder does not recognize, and may send a wrong response to a client using a snatched hash value. As a result, both a user and an electronic commerce server are vulnerable to serious damage. In addition, computation, storage and distribution of a hash chain may be a load on the CA. 
   That is, the D-OCSP-KIS verifies a certificate status such that the CA issues an OCSP responder&#39;s certificate having a hash value which indicates whether the OCSP responder&#39;s certificate is valid or not each time period (e.g., one day). However, when the session private key is secretly exposed to the attacker during a certain time period, the attacker can disguise himself or herself as the OCSP responder to snatch the hash value and send a wrong response to the client using the snatched has value, thereby causing bad damage to the electronic commerce server and its users. 
   SUMMARY OF THE INVENTION 
   It is an objective of the present invention to provide a system and method for detecting exposure of an OCSP responder&#39;s session private key, whereby exposure of an OCSP responder&#39;s session private key and abuse of a snatched hash value can be detected in the D-OCSP-KIS. 
   It is another objective of the present invention to provide a system and method for detecting exposure of an OCSP responder&#39;s session private key, whereby it is possible to detect whether an attacker has secretly obtained an OCSP responder&#39;s session private key and sent a wrong response to a client using a snatched hash value. 
   It is still another objective of the present invention to provide a system and method for detecting exposure of an OCSP responder&#39;s session private key, whereby each hash value is used just once for verifying an OCSP responder&#39;s certificate and overload for production and distribution of a hash chain in a CA is decentralized to each OCSP responder. 
   One aspect of the present invention provides a system for detecting exposure of an OCSP responder&#39;s session private key in a D-OCSP-KIS to verify the status of a user&#39;s certificate online, comprising: a client for requesting certificate status information from the OCSP responder; the OCSP responder for receiving the certificate status information request from the client, sending a response, producing a hash value, and delivering the hash value to a certificate authority (CA) to get a certificate issued; and the CA for receiving the hash value from the OCSP responder and issuing the certificate to the OCSP responder in response to a certificate issue request; wherein the client verifies a digital signature using a hash value contained in the OCSP responder&#39;s certificate and the hash value contained in the response, and each client stores a counter value for a hash operation in each verification and recognizes the response as valid when a current counter value is greater than a previous counter value. 
   Another aspect of the present invention provides a method for detecting exposure of an OCSP responder&#39;s session private key in a D-OCSP-KIS to verify the status of a certificate online in a system in which a plurality of clients, a certificate authority (CA), and a plurality of OCSP responders are connected via a network, comprising the steps of: computing a hash value at each OCS responder; issuing the OCSP responder&#39;s certificate at the CA; and verifying the status of the OCSP responder&#39;s private key at the client, wherein each client verifies a digital signature using a hash value contained in the OCSP responder&#39;s certificate and a hash value contained in a response, and each client stores a counter value for a hash operation in each verification and recognizes the response as valid when a current counter value is greater than a previous counter value. 

   
     BRIEF DESCRIPTION OF THE DRAWINGS 
     The above and other objects, features and advantages of the present invention will be more apparent from the following detailed description taken in conjunction with the accompanying drawings, in which: 
       FIG. 1  is a diagram illustrating a system configuration for computing a hash value and issuing an OCSP responder&#39;s certificate according to an exemplary embodiment of the present invention; 
       FIG. 2  is a diagram illustrating a system configuration for exchanging a response and a hash value between OCSP responders and clients  104  according to an exemplary embodiment of the present invention; 
       FIG. 3  is a flowchart illustrating a method for detecting exposure of an OCSP responder&#39;s session private key according to an exemplary embodiment of the present invention; 
       FIG. 4  is a flowchart illustrating a procedure for computing a hash value for each OCSP responder according to an exemplary embodiment of the present invention; 
       FIG. 5  is a flowchart illustrating a procedure for verifying the status of an OCSP responder&#39;s session private key at a client according to an exemplary embodiment of the present invention; and 
       FIG. 6  is a flowchart illustrating a procedure for detecting exposure of an OCSP responder&#39;s session private key at a client according to an exemplary embodiment of the present invention. 
   

   DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS 
   Hereinafter, exemplary embodiments of the present invention will be described in more detail with reference to the accompanying drawings. In the following description, a detailed description of known functions and configurations incorporated herein has been omitted for conciseness. 
   In this specification, n denotes the total number of OCSP responders, m denotes the total number of clients, and n is much less than m (n&lt;&lt;m). 
   It is assumed that an end user receives a CSI service through a client and the client registers with a CA before receiving the CSI service from an OCSP responder. 
     FIG. 1  is a diagram illustrating a system configuration for computing a hash value and issuing an OCSP responder&#39;s certificate according to an exemplary embodiment of the present invention, and  FIG. 2  is a diagram illustrating a system configuration for exchanging a response and a hash value between OCSP responders and clients according to an exemplary embodiment of the present invention. 
   As shown in  FIGS. 1 and 2 , the system of the present invention comprises a CA  105 , OCSP responders  101 , and clients  104  which are connected through a network. 
   The CA  105  receives and checks a PKI user certificate issue request and issues a certificate according to a PKI security policy. The CA  105  renews or revokes a certificate if needed and notifies clients at various locations. The CA  105  also records all certificates and transaction information in a database. 
   As an initial task, the OCSP responder  101 , in order to have its own certificate issue, computes and stores a hash value and then transmits a final value to the CA  105 . The CA  105  collects the hash value received from the OCSP responder  101  and issues a certificate  103  for the OCSP responder using its private key. The issued certificate of the OCSP responder is transmitted to the corresponding client. The hash values contained in the certificates transmitted to the clients are different from each other. 
   The user requests certificate status information (CSI) from the OCSP responder through the client  104  in order to receive a CSI service. The OCSP responder checks the CSI request received from the client  104  and returns a corresponding hash value to the client together with a response. The client  104  receives the response from the OCSP responder  101  and compares the hash value contained in the response with the hash value contained the OCSP responder&#39;s certificate  103  issued from the CA  105  to verify the status of the OCSP responder&#39;s certificate  103 . At this time, a counter value for hash operation is increased by “1”. If a current counter value is greater than a previous counter value, the client  104  recognizes that the response is valid and thus accepts the response. Otherwise, the client  104  recognizes that the session private key of the OCSP responder  101  is exposed and the hash value is abused and thus rejects the response. 
   A method for detecting exposure of the OCSP responder&#39;s session private key according to an exemplary embodiment of the present invention is explained below in detail. 
     FIG. 3  is a flowchart illustrating a method for detecting exposure of the OCSP responder&#39;s session private key according to an exemplary embodiment of the present invention. 
   As shown in  FIG. 3 , the method for detecting exposure of the OCSP responder&#39;s session private key in the D-OCSP-KIS comprises a procedure for computing a hash value for each OCSP responder  101  (ST 301 ), a procedure for issuing the OCSP responder&#39;s certificate  103  at the CA  105  (ST 302 ), and a procedure for verifying the status of the OCSP responder&#39;s session private key at the client  104  (ST 303 ). 
     FIG. 4  is a flowchart illustrating the procedure for computing the hash value for each OCSP responder according to an exemplary embodiment of the present invention. 
   K is the total number of times a signature is used by one OCSP responder  101 . For example, if each OCSP responder&#39;s certificate  103  expires after 10,000 signature operations for responses, K is 10,000. Thus, the OCSP responder&#39;s certificate  103  is revoked after 10,000 signature operations. The OCSP responder  101  can compute a hash value X K  using the following h (ST 401 ): 
   
     
       
         
           
             X 
             0 
           
           ⁢ 
           
             
               
                 h 
               
             
             
               
                 → 
               
             
           
           ⁢ 
           
             X 
             1 
           
           ⁢ 
           
             
               
                 h 
               
             
             
               
                 → 
               
             
           
           ⁢ 
           
             X 
             2 
           
           ⁢ 
           
             
               
                 h 
               
             
             
               
                 → 
               
             
           
           ⁢ 
           … 
           ⁢ 
           
               
           
           ⁢ 
           
             X 
             k 
           
           ⁢ 
           … 
           ⁢ 
           
               
           
           ⁢ 
           
             
               
                 h 
               
             
             
               
                 → 
               
             
           
           ⁢ 
           
             X 
             K 
           
         
       
     
   
   The OCSP responder  101  repetitively computes m hash chains as different input values X j,0  for m clients  104  (ST 402 ). X j,k  denotes a hash value of a time k for verification in a client j. 
   
     
       
         
           
             
               
                 
                   X 
                   
                     1 
                     , 
                     0 
                   
                 
                 ⁢ 
                 
                   
                     
                       h 
                     
                   
                   
                     
                       → 
                     
                   
                 
                 ⁢ 
                 
                   X 
                   
                     1 
                     , 
                     1 
                   
                 
                 ⁢ 
                 
                   
                     
                       h 
                     
                   
                   
                     
                       → 
                     
                   
                 
                 ⁢ 
                 
                   X 
                   
                     1 
                     , 
                     2 
                   
                 
                 ⁢ 
                 
                   
                     
                       h 
                     
                   
                   
                     
                       → 
                     
                   
                 
                 ⁢ 
                 … 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 
                   X 
                   
                     1 
                     , 
                     k 
                   
                 
                 ⁢ 
                 … 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 
                   
                     
                       h 
                     
                   
                   
                     
                       → 
                     
                   
                 
                 ⁢ 
                 
                   X 
                   
                     1 
                     , 
                     K 
                   
                 
               
             
           
           
             
               ⋮ 
             
           
           
             
               
                 
                   X 
                   
                     m 
                     , 
                     0 
                   
                 
                 ⁢ 
                 
                   
                     
                       h 
                     
                   
                   
                     
                       → 
                     
                   
                 
                 ⁢ 
                 
                   X 
                   
                     m 
                     , 
                     1 
                   
                 
                 ⁢ 
                 
                   
                     
                       h 
                     
                   
                   
                     
                       → 
                     
                   
                 
                 ⁢ 
                 
                   X 
                   
                     m 
                     , 
                     2 
                   
                 
                 ⁢ 
                 
                   
                     
                       h 
                     
                   
                   
                     
                       → 
                     
                   
                 
                 ⁢ 
                 … 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 
                   X 
                   
                     m 
                     , 
                     k 
                   
                 
                 ⁢ 
                 … 
                 ⁢ 
                 
                     
                 
                 ⁢ 
                 
                   
                     
                       h 
                     
                   
                   
                     
                       → 
                     
                   
                 
                 ⁢ 
                 
                   X 
                   
                     m 
                     , 
                     K 
                   
                 
               
             
           
         
       
     
   
   Each OCSP responder  101  repetitively computes n×m hash chains as different input values X i,j,0  (ST 403 ). X i,j,k  denotes a hash value of a time k computed in an OSCP responder i for distribution to the client j. 
   
     
       
         
           
               
           
           ⁢ 
           
             
               
                 
                     
                 
               
               
                 
                   
                     
                       X 
                       
                         1 
                         , 
                         1 
                         , 
                         0 
                       
                     
                     ⁢ 
                     
                       
                         
                           h 
                         
                       
                       
                         
                           → 
                         
                       
                     
                     ⁢ 
                     
                       X 
                       
                         1 
                         , 
                         1 
                         , 
                         1 
                       
                     
                     ⁢ 
                     
                       
                         
                           h 
                         
                       
                       
                         
                           → 
                         
                       
                     
                     ⁢ 
                     
                       X 
                       
                         1 
                         , 
                         1 
                         , 
                         2 
                       
                     
                     ⁢ 
                     
                       
                         
                           h 
                         
                       
                       
                         
                           → 
                         
                       
                     
                     ⁢ 
                     … 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       X 
                       
                         1 
                         , 
                         1 
                         , 
                         k 
                       
                     
                     ⁢ 
                     … 
                     ⁢ 
                     
                         
                     
                     ⁢ 
                     
                       
                         
                           h 
                         
                       
                       
                         
                           → 
                         
                       
                     
                     ⁢ 
                     
                       X 
                       
                         1 
                         , 
                         1 
                         , 
                         K 
                       
                     
                   
                   ⁢ 
                   
                       
                   
                 
               
               
                 
                   In 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   OCSP 
                 
               
             
             
               
                 
                   responder 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   1 
                 
               
               
                 
                     
                 
               
               
                 
                     
                 
               
             
             
               
                 
                     
                 
               
               
                 ⋮ 
               
               
                 
                     
                 
               
             
             
               
                 
                     
                 
               
               
                 
                   
                     X 
                     
                       1 
                       , 
                       m 
                       , 
                       0 
                     
                   
                   ⁢ 
                   
                     
                       
                         h 
                       
                     
                     
                       
                         → 
                       
                     
                   
                   ⁢ 
                   
                     X 
                     
                       1 
                       , 
                       m 
                       , 
                       1 
                     
                   
                   ⁢ 
                   
                     
                       
                         h 
                       
                     
                     
                       
                         → 
                       
                     
                   
                   ⁢ 
                   
                     X 
                     
                       1 
                       , 
                       m 
                       , 
                       2 
                     
                   
                   ⁢ 
                   
                     
                       
                         h 
                       
                     
                     
                       
                         → 
                       
                     
                   
                   ⁢ 
                   … 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     X 
                     
                       1 
                       , 
                       m 
                       , 
                       k 
                     
                   
                   ⁢ 
                   … 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         h 
                       
                     
                     
                       
                         → 
                       
                     
                   
                   ⁢ 
                   
                     X 
                     
                       1 
                       , 
                       m 
                       , 
                       K 
                     
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                     
                 
               
               
                 ⋮ 
               
               
                 
                     
                 
               
             
             
               
                 
                     
                 
               
               
                 
                   X 
                   
                     i 
                     , 
                     j 
                     , 
                     k 
                   
                 
               
               
                 
                   In 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   OCSP 
                 
               
             
             
               
                 
                   responder 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   j 
                 
               
               
                 
                     
                 
               
               
                 
                     
                 
               
             
             
               
                 
                     
                 
               
               
                 ⋮ 
               
               
                 
                     
                 
               
             
             
               
                 
                     
                 
               
               
                 
                   
                     X 
                     
                       n 
                       , 
                       1 
                       , 
                       0 
                     
                   
                   ⁢ 
                   
                     
                       
                         h 
                       
                     
                     
                       
                         → 
                       
                     
                   
                   ⁢ 
                   
                     X 
                     
                       n 
                       , 
                       1 
                       , 
                       1 
                     
                   
                   ⁢ 
                   
                     
                       
                         h 
                       
                     
                     
                       
                         → 
                       
                     
                   
                   ⁢ 
                   
                     X 
                     
                       n 
                       , 
                       1 
                       , 
                       2 
                     
                   
                   ⁢ 
                   
                     
                       
                         h 
                       
                     
                     
                       
                         → 
                       
                     
                   
                   ⁢ 
                   … 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     X 
                     
                       n 
                       , 
                       1 
                       , 
                       k 
                     
                   
                   ⁢ 
                   … 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     
                       
                         h 
                       
                     
                     
                       
                         → 
                       
                     
                   
                   ⁢ 
                   
                     X 
                     
                       n 
                       , 
                       1 
                       , 
                       K 
                     
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                     
                 
               
               
                 ⋮ 
               
               
                 
                     
                 
               
             
             
               
                 
                     
                 
               
               
                 
                   
                     X 
                     
                       n 
                       , 
                       m 
                       , 
                       0 
                     
                   
                   ⁢ 
                   
                     
                       
                         h 
                       
                     
                     
                       
                         → 
                       
                     
                   
                   ⁢ 
                   
                     X 
                     
                       n 
                       , 
                       m 
                       , 
                       1 
                     
                   
                   ⁢ 
                   
                     
                       
                         h 
                       
                     
                     
                       
                         → 
                       
                     
                   
                   ⁢ 
                   
                     X 
                     
                       n 
                       , 
                       m 
                       , 
                       2 
                     
                   
                   ⁢ 
                   
                     
                       
                         h 
                       
                     
                     
                       
                         → 
                       
                     
                   
                   ⁢ 
                   … 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   
                     X 
                     
                       n 
                       , 
                       m 
                       , 
                       k 
                     
                   
                   ⁢ 
                   … 
                   ⁢ 
                   
                     
                       
                         h 
                       
                     
                     
                       
                         → 
                       
                     
                   
                   ⁢ 
                   
                     X 
                     
                       n 
                       , 
                       m 
                       , 
                       K 
                     
                   
                 
               
               
                 
                   In 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   OCSP 
                 
               
             
             
               
                 
                   responder 
                   ⁢ 
                   
                       
                   
                   ⁢ 
                   n 
                 
               
               
                 
                     
                 
               
               
                 
                     
                 
               
             
           
         
       
     
   
   Next, each OCSP responder  101  stores the input values X i,1,0 , . . . , X i,m,0  and all intermediate hash values and securely delivers the final values X i,1,K , . . . , X i,m,K  to the CA  105  (ST 404 ). 
   The procedure for issuing the OCSP responder&#39;s certificate  103  at the CA  105  is explained below. 
   First, the CA  105  gathers the final values X i,1,K , . . . , X i,m,K  from each OCSP responder  101  and issues m OCSP responder&#39;s certificates C client     —     j  for distribution to the clients  104  using its own private key. SN denotes a serial number of the certificate, V denotes a validity period, and I and S respectively denote an issuer and an owner of the certificate. Here, the hash value contained each certificate  103  is unique. The certificates to be distributed to the m clients  104  are as follows:
 
 C   client     1     =Sig   K     CA   ( PK   res   , SN, I, S, V, X   1,1,K   , . . . , X   n,1,K ) Certificate for client 1
 
 C   client     m     =Sig   K     CA   ( PK   res   , SN, I, S, V, X   1,m,K   , . . . , X   n,m,K ) Certificate for client m
 
   Next, the procedure for verifying the status of the private key at the client will be described with reference to  FIG. 5 . 
     FIG. 5  is a flowchart illustrating the procedure for verifying the status of the OCSP responder&#39;s session private key at the client according to an exemplary embodiment of the present invention. 
   When the OCSP responder i delivers a response to the client j, a hash value X i,j,k  is transmitted together (ST 501 ). The OCSP responder  101  delivers a hash value X i,j,k−1  to the client with a first response and a hash value X i,j,k−2  with a second response. In this way, a hash value X i,j,0  is delivered with the last response.
 
&lt;X i,j,k , R, Sig SK     i   (R)&gt;At the first response to client j
 
&lt;X i,j,K−1 , R, Sig SK     i   (R)&gt;At the k-th response to client j
 
&lt;X i,j,0 , R, Sig SK     i   (R)&gt;At the last response to client j
 
   When the client j receives the response from the OCSP responder i (ST 502 ), the client  104  verifies a digital signature using the OCSP responder&#39;s public key PK res  (ST 503 ). At this time, the client  104  verifies the status of the OCSP responder&#39;s certificate  103  using the hash value X i,j,k  received together with the response and the hash value X i,j,k  contained in the OCSP responder&#39;s certificate  103  (ST 504 ). In more detail, the client  104  can check the validity of a private key SK i  by performing a hash function once at the first response, and by performing a hash function twice at the second response. The client performs the hash function k times to check the status validation of the OCSP responder&#39;s private key at the last response. Thus, the client  104  performs the hash function an average of K/2 times (here, 5,000 times) to check the validity status of the OCSP responder  101 &#39;s private key.
 
 X   i,j,K   =h ( X   i,j,K−1 ) At the first response
 
 X   i,j,K   =h   k ( X   i,j,K−k ) At the  K -th response
 
 X   i,j,K   =h   K ( X   i,j,0 ) At the last response
 
   The client stores a counter value k at each response and compares it with a previous counter value at a previous response. If a current counter value is greater than a previous counter value (C now ==C before +1), the client  104  recognizes it as meaning that the response is valid. Otherwise, the client  104  recognizes it as indicating exposure of the session private key and abuse of the hash value. 
   Next, the procedure for detecting exposure of the session key at the client will be described with reference to  FIG. 6 . 
     FIG. 6  is a flowchart illustrating the procedure for detecting exposure of the OCSP responder&#39;s session private key at the client according to an exemplary embodiment of the present invention. 
   The client  104  performs a hash function once using the hash value X i,j,k  included in the response to obtain a hash value (ST 601 ), sets X temp  as the obtained hash value (ST 602 ), and increases the counter C now  by 1 (ST 603 ).
 
 X   temp   ←h ( X   i,j,k )
 
 C   now   ←C   now +1
 
   The client then compares X temp  with X i,j,k  contained in the OCSP Responder i&#39;s certificate (ST 604 ). If X temp  is identical to X i,j,k , it goes to ST 606 . Otherwise, the client sets X i,j,k  to X temp  and it goes back to ST 601  (ST 605 ).
 
X i,j,k ←X temp  
 
   The client  104  checks if C now ==C before +1 is satisfied or not (ST 606 ). If C now ==C before +1 is satisfied, then the client accepts the response (ST 607 ). Otherwise, the client rejects the response (ST 608 ).
 
 C   now   ==C   before +1
 
   Finally, the client  104  sets C now  as C before  (ST 609 ) and “0” as C now  (ST 610 ), and then the client goes back to S 601  to process the next response.
 
C before ←C now  
 
C now ←0
 
   According to the above exemplary embodiment of the present invention, by using a 20-byte hash value and hash operation (which is 10,000 times faster than a digital signature algorithm), efficient and secure PKI environments can be constructed by additionally using a hash value without additional PKI elements or change in the PKI structure. Thus, when the present invention is commercialized, it can be applied to any wireless or wired environment using the OCSP-PKI. 
   As described above, according to the system and method for detecting exposure of an OCSP responder&#39;s session private key, in a PKI environment using D-OCSP, a reliable response can be provided to the client. 
   That is, since it is possible to detect an attacker sending a wrong response to a client using a snatched hash value when an OCSP responder&#39;s session private key is exposed to the attacker, exposure of the OCSP responder&#39;s session private key and abuse of the hash value can be fundamentally prevented, thereby providing a reliable OCSP response. 
   In addition, since security technology employing the present invention is safer and more efficient than the existing OCSP service in the PKI, use of the PKI can be expanded and reliable OCSP response service can be provided to users. 
   Exemplary embodiments of the present invention have been disclosed herein and, although specific terms are employed, they are used and are to be interpreted in a generic and descriptive sense only and not for purpose of limitation. Accordingly, it will be understood by those of ordinary skill in the art that various changes in form and details may be made without departing from the spirit and scope of the present invention as set forth in the following claims.