새로운 전자금융환경에서 공인인증체계의 개선방향에 관한 연구

Abstract

Certification is an important means to identify a person in the online, non-face-to-face world. Derivative transactions may be possible when a trusted certification authority can verify a person’s identification correctly. Regarding the design of the certification authority, there are two options: whether to grant the certification body for the qualified status as the power of the government, or to leave it to the autonomy and competition in the market. In Korea, the former method has been adopted. However, the direction of the current accredited certification system becomes a problem in the trend of the regulation industry moving into the field of market competition, self-regulation and co-regulation. This issue should be carefully considered in many respects, including the credibility of the certification system, the consumer’s choice of certificate, and the scope of the financial institution’s immunity based on certificates. Accredited Certificate is basically a means of digital signatures, and authentication function is an additional effect. However, in Korea, the practice that accredited certificate module is recognized as an element of client security system has been formed in response to the security effect of the authentication function of the certificate. This is the factor that ascribe the ActiveX issue to the issue of accredited certificate. Therefore, we need to understand accredited certificate in terms of digital signature and authentication. In the past, accredited digital signature or accredited certificate has often been required even in areas where an accredited certificate is not mandatory. Since various types of certificates exist and those can be allowed, it is necessary to improve the system so that unaccredited digital signatures can be used as legally valid signatures according to the purpose of Article 3 of the Digital Electronic Signature Act. It is desirable to set up a type of advanced electronic signature between simple certificates and qualified certificate, such as the EU eIDAS regulations and the German electronic signature law because in our law, the gap between the simple digital signature and the qualified certificate is large. In the field of Electronic Financial Transactions Act, the realistic function of an accredited certificate is related to the range of liability of the financial institution and the gross negligence of the user. Only the effort of the improving the Digital Signature Act can not change the actual usage pattern of accredited certificate or the scope of the liability. If the financial institutions are responsible for the any kind of the unauthorized transfer without their fault irrespective of the use of access media similar to the legislation of the United States and the United Kingdom or the Electronic Financial Transactions Act which stipulates the scope of the user’s gross negligence is revised, the situation regarding the use and liability of the accredited certificate is greatly changed since it is unnecessary to judge the user’s gross negligence by concentrating on the access media called authentication certificate.