JP2001077809A - Electronic certificate management device, method and recording medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a means that can simply investigate whether or not an electronic certificate is invalid. SOLUTION: A client 120 makes a request to a certificate management server 100 for an issue of an electronic certificate or invalidating the electronic certificate. The certificate management server 100 generates an electronic certificate and registers it to a repository 110 when a request from the client 120 is an issue request of the electronic certificate, and the certificate management server 100 deletes the electronic certificate from the repository 110 and informs the client 120 about it when the request from the client 120 is an invalidating request of the electronic certificate. The client 120 makes a collation request to the repository 110 to be able to investigate whether or not the electronic certificate is invalid when the client 120 acquires the electronic certificate.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an apparatus for managing an electronic certificate, and more particularly to an apparatus, a method, and a recording medium for safely and easily managing revocation of an electronic certificate.

[0002]

2. Description of the Related Art An example of a conventional electronic certificate management device is described in Japanese Patent Application Laid-Open No. Hei 10-308733. This conventional electronic certificate management device is composed of a number of clients and servers interconnected via a local network and the Internet.

A conventional electronic certificate management device having such a configuration operates as follows.

[0004] That is, an administrator who operates under the qualifications of the certification authority is given full access to the repository by issuing an "administrator distinguished name (DN)", and can add a new certificate. Also, the certificate revocation list can be modified. Others are granted less access, and unknown parties are only allowed to submit certificate requests or download public certificates (and revocation lists).

[0005]

However, this prior art has the following problems.

That is, in order to check whether an electronic certificate (hereinafter, also simply referred to as a certificate) is valid (not revoked), a certificate revocation list is acquired, and a check is made in the list. You need to make sure that the certificate you want is not included, and validity verification is complicated.
Also, the timing of updating the certificate revocation list differs depending on the certificate authority, and the revoked certificate is not always reflected in real time, and depending on the timing, the revoked certificate may not be listed in the certificate revocation list. There's a problem.

The reason is that the only means for checking whether a certificate has been revoked is to check the contents of a certificate revocation list.

An object of the present invention is to provide means for easily verifying whether a digital certificate has been revoked.

[0009]

According to a first aspect of the present invention, there is provided a digital certificate management apparatus which requests a certificate management server to issue and revoke an electronic certificate, and inquires a repository of the digital certificate. A certificate management server that performs creation or revocation processing of an electronic certificate based on a request from the client, registers or deletes the electronic certificate in a repository, and notifies the client, and registers the certificate management server. A repository for storing digital certificates that have not been revoked.

[0010] The electronic certificate management device of the second invention of the present application is:
A client for requesting issuance and revocation of an electronic certificate to a certificate management server and for inquiring of a repository for an electronic certificate; receiving a request from the client; transmitting the request to a certificate authority; and transmitting a processing result from the certificate authority. A certificate management server that receives and registers or deletes an electronic certificate in the repository and notifies the client, and creates or revokes an electronic certificate based on a request from the client transmitted from the certificate management server. A certificate authority that sends a processing result to the certificate management server; and a repository that stores an electronic certificate registered and not revoked by the certificate management server.

[0011] The electronic certificate management device of the third invention of the present application comprises:
In the second invention, the certificate management server includes an electronic certificate request message from the client, an electronic certificate revocation request message, a response message from the certificate authority, connection information with a connectable certificate authority, and a connectable certificate authority. It is characterized by storing connection information with a repository.

An electronic certificate management device according to a fourth invention of the present application is:
In the first or second invention, it is characterized in that access control is performed so that registration and deletion of an electronic certificate from / to the repository cannot be performed except by the certificate management server.

[0013] The electronic certificate management device of the fifth invention of the present application comprises:
A second invention is characterized in that there are a plurality of certificate authorities depending on the type of electronic certificate to be issued.

An electronic certificate management device according to a sixth aspect of the present invention comprises:
A second invention is characterized in that a plurality of the repositories exist according to the type of the electronic certificate to be stored.

According to a seventh aspect of the present invention, there is provided a digital certificate management method comprising:
The client makes a request for a digital certificate or a revocation request to the certificate management server, and if the request from the client is a request for a digital certificate, creates a digital certificate, registers it in the repository, and notifies the client. If the request from the client is a request for revoking a digital certificate, the client deletes the digital certificate from the repository and notifies the client, and when the client obtains the digital certificate, the client queries the repository for the digital certificate. Is performed.

According to an eighth aspect of the present invention, there is provided a digital certificate management method comprising:
A client makes a request for a digital certificate or a revocation request to a certificate management server, the certificate management server sends a request from the client to a certificate authority, and the certificate authority is sent from the certificate management server. If the request from the client is a request for an electronic certificate, an electronic certificate is created and a processing result is sent to the certificate management server,
If the request from the client transmitted from the certificate management server is an electronic certificate revocation request, the certificate authority performs an electronic certificate revocation process and transmits a processing result to the certificate management server, The certificate management server receives the processing result from the certificate authority, and if the request from the client is a request for an electronic certificate, registers the electronic certificate in a repository and notifies the client of the request, and the certificate management server If a processing result is received from a certificate authority and the request from the client is a request for revocation of an electronic certificate, the electronic certificate is deleted from the repository and notified to the client,
The client may refer to the repository for the electronic certificate when the client obtains the electronic certificate.

According to a ninth aspect of the present invention, there is provided a recording medium in which a client performs a request process for requesting or revoking an electronic certificate from a certificate management server, and if the request from the client is a request for an electronic certificate. A certificate registration process of creating an electronic certificate, registering it in a repository, and notifying the client, and, if the request from the client is a request for revocation of an electronic certificate, deleting the electronic certificate from the repository and notifying the client A program for causing a computer to execute a certificate deletion process to be executed and an inquiry process for inquiring the repository for the electronic certificate when the client obtains the electronic certificate.

According to a tenth aspect of the present invention, there is provided a recording medium, wherein a client performs a request process for requesting or revoking an electronic certificate to a certificate management server, and the certificate management server transmits a request from the client to a certificate authority. And the certification authority creates an electronic certificate if the request from the client transmitted from the certificate management server is a request for an electronic certificate, and sends the processing result to the certificate management server. The digital certificate creating process to be transmitted, and the certificate authority performs the digital certificate revocation process if the request from the client transmitted from the certificate management server is a revocation request of the digital certificate, and performs the certificate management. A digital certificate revocation processing for transmitting a processing result to a server; and the certificate management server receives a processing result from the certificate authority, and a request from the client is a digital certificate. If the request is a digital certificate registration process for registering an electronic certificate in the repository and notifying the client, the certificate management server receives a processing result from the certificate authority, and the request from the client is an electronic certificate. A digital certificate deletion process for notifying the client by deleting the digital certificate from the repository if the request is a revocation request; and a query process for querying the repository for the digital certificate when the client obtains the digital certificate. And a program for causing a computer to execute the above.

[0019]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS A first embodiment of the present invention will be described with reference to the drawings.

FIG. 1 is a diagram showing the configuration of the first embodiment.

Referring to FIG. 1, an electronic certificate management device according to the present invention comprises a certificate management server 100, a repository 11
0, a client 120, and a network 130.

The certificate management server 100 includes the control device 10
1, the communication device 102, the storage device 103, and the certificate authority 1
04 and the recording medium 105.

The control device 101 includes a certificate management server 10
Program control within 0 is performed. Based on the processing result received from the certificate authority 104, the digital certificate is registered or deleted by connecting to the repository 110 through the communication device 102. In addition, create a certificate creation notification and certificate revocation notification,
The data is transmitted to the client 120 through the communication device 102.

The communication device 102 connects to the repository 110 and the client 120 via the network 130. The communication device 102 receives the certificate request message or the certificate revocation request message from the client 120 and passes it to the certificate authority 104. Also, a certificate request message, a certificate revocation request message, and the like are stored in the storage device 10.
3 is stored.

The storage device 103 stores a certificate request message, a certificate revocation request message, and the like.

Upon receiving the certificate request message from the client 120 received by the communication apparatus 102, the certificate authority 104 creates an electronic certificate, and receives the certificate revocation request message from the client 120 received by the communication apparatus 102. And a certificate revocation process, and returns a processing result to the control device 101.

The recording medium 105 stores the certificate management server 10
Record the 0 program.

The repository 110 includes a control device 111,
It includes a communication device 112 and a storage device 113.

The control device 111 controls the repository 110. When there is a request for registration of an electronic certificate from the certificate management server 100, the electronic certificate is registered in the storage device 113. When there is a request for deletion of the electronic certificate from the certificate management server 100, the electronic certificate is stored in the storage device 113. Remove from. When the client 120 makes an inquiry request for an electronic certificate, the storage device 113 is searched and the processing result is transmitted to the client 120 via the communication device 112.
To return. Note that access control is performed such that registration and deletion of an electronic certificate are performed only when requested by the certificate management server 100.

The communication device 112 is connected to the certificate management server 100 and the client 12 via the network 130.
Connect to 0. The communication device 112 is a client 120
Request for digital certificate from the server and certificate management server 1
A request for registration or deletion of an electronic certificate from 00 is received and passed to the control device 111.

The storage device 113 stores the certificate management server 10
0 stores the digital certificate that has been registered and not deleted. That is, only the electronic certificate that has not been revoked is stored.

The client 120 includes a control device 121
, A communication device 122, and a storage device 123.

The control device 121 controls the client 120. A certificate request message or a certificate revocation request message is transmitted to the certificate management server 100 via the communication device 122. Also, the certificate management server 100
Is received via the communication device 122 and stored in the storage device 123.

The communication device 122 is connected to the certificate management server 100 and the repository 110 via the network 130.
Connect to

The storage device 123 stores the certificate management server 10
0 stores an electronic certificate issued.

The operation of the first embodiment of the present invention will be described in detail with reference to FIGS.

FIG. 2 is a diagram showing a flow of an operation when the client makes a certificate request to the certificate management server, and FIG. 3 shows an operation when the client makes a certificate revocation request to the certificate management server. FIG. 4 is a diagram showing a flow of operation when a client inquires a repository for an electronic certificate.

First, an operation when the client 120 makes a certificate request to the certificate management server 100 will be described with reference to FIGS.

The client 120 creates a certificate request message and sends it to the communication device 102 of the certificate management server 100 via the network 130 (step A1 in FIG. 2).

The communication device 102 receives the client 1
The certificate request message from the client 20 is passed to the certificate authority 104, and the certificate authority 104 creates an electronic certificate according to the content of the certificate request message of the client 120, and passes the processing result to the control device 101 (step A2).

The control device 101 connects to the repository 110 through the communication device 102, and registers the digital certificate created in step A2 in the storage device 113 (step A).
3).

The control device 101 creates a certificate issuance notification and sends it to the client 120 through the communication device 102 (step A4).

Next, with reference to FIGS. 1 and 3, the operation when the client 120 makes a certificate revocation request to the certificate management server 100 will be described.

The client 120 executes step A4 in FIG.
Creates a revocation request message for the electronic certificate obtained in
(Step B1 in FIG. 3).

The communication device 102 receives the client 1
The certificate revocation request message from the client 20 is passed to the certificate authority 104, the certificate authority 104 analyzes the certificate revocation request message, performs revocation processing on the digital certificate of the client 120, and passes the processing result to the control device 101 (step S1). B
2).

The control device 101 connects to the repository 110 through the communication device 102 and searches for an electronic certificate corresponding to the client 120 certificate revocation request message recorded in the storage device 113 (step B3).

The control device 101 deletes the electronic certificate retrieved in step B3 through the communication device 102 (step B4).

The control device 101 creates a certificate revocation notice (step B5) and sends it to the client 120 through the communication device 102 (step B6).

Finally, the operation when the client 120 inquires the repository 110 of the digital certificate will be described with reference to FIGS.

The client 120 obtains the electronic certificate issued by the certificate management server 100 (Step C1 in FIG. 4).

The client 120 checks whether the digital certificate obtained in step C1 has already been revoked, through the communication device 122 to check whether the digital certificate has been revoked.
0 (step C2).

The client 120 is connected to the repository 110
Of the electronic certificate obtained in step C1 is stored in the storage device 113 (step C).
3).

If the digital certificate exists in the storage device 113 of the repository 110, the digital certificate has not been revoked (step C5), and if not, the digital certificate has been revoked. A judgment is made (step C6).

In FIG. 4, the connection destination repository 11
As described above, the process in which the client 120 directly connects to the repository 110 and searches for an electronic certificate has been described. When the connection destination repository 110 is unknown, the client 120 makes an inquiry to the certificate management server 100 for an electronic certificate, and the certificate management server 100 searches the repository 110 based on a request from the client 120, and A search result as to whether or not the certificate is stored can be returned to the client 120.

Further, a more specific description will be given with reference to FIGS.

FIG. 5 is a diagram for explaining the operation of the first embodiment.

As shown in FIG. 5, for example, the client 220 acquiring the electronic certificate 221 from the certificate management server 200 sends the message 220
Electronic signature 242 using the electronic certificate 221 of
This is transmitted to the client 230 together with the electronic certificate 221. That is, the message 241 is encrypted using the secret key according to the public key method, and transmitted to the client 230 together with the electronic certificate 221. It is assumed that the attribute and the public key of the client 220 are certified in the electronic certificate 221 (step C1 in FIG. 4).

The client 230 is connected to the client 22
In order to verify whether or not the electronic document 240 received from the electronic document 240 is invalid, a connection is made to the repository 210 to verify that the electronic certificate 221 used for the electronic signature 242 is not revoked. (Step C2).

[0059] The client 230 is connected to the repository 210.
A search is made as to whether the electronic certificate 221 of the client 220 is stored in the server (step C3).

The client 220 in the repository 210
If the digital certificate 221 exists, the client 2
30 can determine that the digital certificate 221 of the client 220 has not been revoked, and if the digital signature 242 of the client 220 can be correctly verified, the contents of the message 241 can be trusted. That is, the client 230 sends the digital certificate 221
The digital signature 242 is decrypted using the above public key, and the content of the message 241 is confirmed (step C5).

If the digital certificate 221 of the client 220 does not exist in the repository 210, it is determined that the digital certificate 221 has been revoked for some reason, and the client 230 cannot trust the message 241. (Step C6).

Next, a second embodiment of the present invention will be described in detail with reference to the drawings.

FIG. 6 is a diagram showing the configuration of the second embodiment.

Referring to FIG. 6, the electronic certificate management device of the present invention comprises a certificate management server 300, a certificate authority 310
, A repository 320, a client 330, and a network 340. The second embodiment differs from the first embodiment in that the certificate management server 300 and the certificate authority 310 are connected via a network 340.

The certificate management server 300 controls the control device 30
1, a communication device 302, a storage device 303, and a recording medium 304.

The control device 301 is provided with the certificate management server 30
Program control within 0 is performed. Based on the processing result received from the certificate authority 310 via the network 340, the communication device 302 connects to the repository 320 via the network 340 to register or delete an electronic certificate. If there are a plurality of repositories, the storage device 30
The repository 320 to be connected is determined with reference to the connection information with the connectable repository stored in the storage device 3. In addition, a certificate creation notification or a certificate revocation notification is created and transmitted to the client 330 via the communication device 302 and the network 340.

The communication device 302 connects to the client 330, the certificate authority 310, and the repository 320 via the network 340. A certificate request message or a certificate revocation request message from the client 330 is received and transmitted to the certificate authority 310 via the network 340. When there are a plurality of certificate authorities, a connection destination certificate authority 310 is determined with reference to the connection information with a connectable certificate authority stored in the storage device 303. Further, a certificate request message, a certificate revocation request message, and the like are stored in the storage device 303.

The storage device 303 stores a certificate request message from the client 330, a certificate revocation request message, a response message from the certificate authority 310, connection information with a connectable certificate authority, and connection information with a connectable repository. Remember.

The recording medium 304 stores the certificate management server 30
Record the 0 program.

The certificate authority 310 creates an electronic certificate upon receiving a certificate request message from the certificate management server 300 via the network 340, and generates a certificate upon receiving a certificate revocation request message from the certificate management server 300. The revocation processing is performed, and the processing result is sent to the certificate management server 300.
Send to Note that a plurality of certificate authorities 310 can exist. In this case, the certificate management server 300 sends the certificate to the storage device 30 based on the message from the client 330.
The authentication authority 310 to communicate with is determined with reference to the connection information with the connectable authentication authority stored in the storage device 3.

The repository 320 includes a control device 321 and
It includes a communication device 322 and a storage device 323. Note that a plurality of repositories 320 can exist. In this case, the certificate management server 300 determines the repository 320 to be connected with reference to the connection information with the connectable repository stored in the storage device 303.

The control device 321 controls the repository 320. When there is a request for registration of an electronic certificate from the certificate management server 300, the electronic certificate is registered in the storage device 323, and when there is a request for deletion of the electronic certificate from the certificate management server 300, the electronic certificate is stored in the storage device 323. Remove from. When the client 330 makes an inquiry request for an electronic certificate, the storage device 323 is searched and the processing result is transmitted to the client 330 via the communication device 322.
To return. Note that access control is performed such that registration and deletion of an electronic certificate are performed only when requested by the certificate management server 300.

The communication device 322 is connected to the certificate management server 300 and the client 33 via the network 340.
Connect to 0. The communication device 322 is a client 330
Request for digital certificate from the server and certificate management server 3
A request for registration or deletion of an electronic certificate from 00 is received and passed to the control device 321.

The storage device 323 stores the certificate management server 30
0 stores the digital certificate that has been registered and not deleted. That is, only the electronic certificate that has not been revoked is stored.

The client 330 is connected to the control device 331
, A communication device 332, and a storage device 333.

The control device 331 controls the client 330. A certificate request message or a certificate revocation request message is transmitted to the certificate management server 300 via the communication device 332. In addition, a certificate creation notification or a certificate revocation notification is sent from the certificate management server 300 to the communication device 33.
2 and stored in the storage device 333.

The communication device 332 is connected to the certificate management server 300 and the repository 32 via the network 340.
Connect to 0.

The storage device 333 stores an electronic certificate issued by the certificate authority 310 and the like.

The operation of the second embodiment of the present invention will be described in detail with reference to FIGS.

FIG. 7 is a diagram showing an operation flow when the client makes a certificate request to the certificate management server, and FIG. 8 is an operation when the client makes a certificate revocation request to the certificate management server. FIG.

First, the operation of the client 330 requesting a certificate from the certificate management server 300 will be described with reference to FIGS.

The client 330 creates a certificate request message and sends it to the certificate management server 300 via the network 340 (step D1 in FIG. 7).

The certificate management server 300 is the client 3
After receiving the certificate request message of the certificate authority 30, the certificate authority 310 of the connection destination is identified, a certificate request message corresponding to the protocol of each certificate authority 310 is created (step D2), and the certificate authority 310 is transmitted through the network 340.
(Step D3).

When the certificate authority 310 creates an electronic certificate corresponding to the certificate request message, the certificate authority 310
Is transmitted to the certificate management server 300 through (step D4).

The certificate management server 300 includes the communication device 30
Then, the digital certificate is connected to the repository 320 through Step 2 and the electronic certificate created in Step D4 is registered in the storage device 323 (Step D5).

The certificate management server 300 creates a certificate issuance notification and sends it to the client 330 via the network 340 (step D6).

Next, the operation of the client 330 revoking a certificate from the certificate management server 300 will be described with reference to FIGS.

The client 330 determines in step D6 of FIG.
Creates a revocation request message for the digital certificate obtained in
(Step E1 in FIG. 8).

The certificate management server 300 is the client 3
After receiving the certificate revocation request message of No. 30, the certificate authority 310 of the connection destination is identified, a certificate revocation request message corresponding to the protocol of each certificate authority 310 is created (step E2), and the certificate authority is transmitted through the network 340. The data is transmitted to 310 (step E3).

The certificate revocation processing result is received from the certificate authority 310 (step E4).

The certificate management server 300 includes the communication device 30
2 to the repository 320 and the storage device 323
Search for an electronic certificate corresponding to the certificate revocation request message of the client 330 recorded in the server (step E5).

[0092] The certificate management server 300
2 to delete the electronic certificate retrieved in step E5 (step E6).

The certificate management server 300 creates a certificate revocation notice (step E7) and sends it to the client 330 via the communication device 302 (step E8).

Finally, an operation when the client 330 inquires the repository 320 of an electronic certificate will be described with reference to FIGS.

The client 330 obtains the digital certificate issued by the certificate management server 300 (Step C1 in FIG. 4).

The client 330 checks with the repository 32 through the communication device 332 to check whether the digital certificate obtained in step C1 has already been revoked.
0 (step C2).

[0098] The client 330
Of the electronic certificate obtained in step C1 is stored in the storage device 323 (step C).
3).

If the digital certificate exists in the storage device 323 of the repository 320, the digital certificate has not been revoked (step C5). Otherwise, the digital certificate has been revoked. A judgment is made (step C6).

In FIG. 4, the connection destination repository 32
As described above, the process in which the client 330 directly connects to the repository 320 and searches for an electronic certificate has been described. When the connection destination repository 320 is unknown, the client 330 queries the certificate management server 300 for an electronic certificate, and the certificate management server 300 searches the repository 320 based on the request from the client 330, and A search result as to whether the certificate is stored may be returned to the client 330. In this case, if there are a plurality of repositories, the certificate management server 300 sequentially searches for connectable repositories with reference to the connectable repository information stored in the storage device 303.

Further, a specific description will be given with reference to FIGS. 7 and 9.

FIG. 9 is a diagram for explaining the operation of the second embodiment.

As shown in FIG. 9, for example, the certificate management server 400 issues a certificate authority 410 that issues a different digital certificate.
And certificate authorities 420 and 430, as well as repositories 440 with different types (issuers, applications, etc.) of stored digital certificates
And the repository 450 and the repository 460 are connected by a network.

When the client 470 attempts to obtain an electronic certificate issued by the certificate authority 410, the client 470 sends a certificate request message of a content requesting the electronic certificate of the certificate authority 410 to the certificate management server 400. Create and transmit (Step D1 in FIG. 7).

The certificate management server 400 analyzes the certificate request message from the client 470, and
A certificate request message in a format requested by the server 10 is created (step D2) and transmitted to the certificate authority 410 (step D3).

The certificate authority 410 creates an electronic certificate of the client 470 in response to the certificate request message received in step D3, and sends it to the certificate management server 400 (step D4).

The certificate management server 400 defines in advance a repository to be stored according to the type of electronic certificate, and selects a repository to store the certificate of the client 470 received from the certificate authority 410 according to the type. And
Register (step D5).

The certificate management server 400 creates a certificate creation notification and sends it to the client 470 (step D6).

As described above, regarding the digital certificate issued by the certificate management server, in order to check whether the digital certificate has been revoked, it is necessary to check whether the digital certificate is stored in the repository. You just have to check. That is, if the electronic certificate is stored, it can be determined that the electronic certificate has not been revoked, and if the electronic certificate has not been stored, it can be determined that the electronic certificate has already been revoked. In this way, it is possible to securely and easily verify whether the electronic certificate has been revoked.

In the above-described embodiment of the present invention, a program for executing the processing operation of the electronic certificate management device is recorded as data on a recording medium such as a magnetic disk or an optical disk. Is used to operate the electronic certificate management device. As described above, the data for operating the electronic certificate management apparatus according to the present invention is recorded on the recording medium, and the function of the electronic certificate management apparatus can be realized by installing the recording medium.

[0110]

An advantage of the present invention is that it can be easily verified whether or not a digital certificate has been revoked.

The reason is that the certificate management server registers the digital certificate in the repository when creating the digital certificate and deletes the certificate in the repository when the digital certificate is revoked. This is because only the certificate exists in the repository.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of a first embodiment.

FIG. 2 is a diagram showing an operation flow when a client makes a certificate request to a certificate management server.

FIG. 3 is a diagram showing an operation flow when a client makes a certificate revocation request to a certificate management server.

FIG. 4 is a diagram showing an operation flow when a client inquires a repository for a certificate;

FIG. 5 is a view for explaining the operation of the first embodiment;

FIG. 6 is a diagram illustrating a configuration according to a second embodiment;

FIG. 7 is a diagram showing an operation flow when a client makes a certificate request to a certificate management server.

FIG. 8 is a diagram showing an operation flow when a client makes a certificate revocation request to a certificate management server.

FIG. 9 is a view for explaining the operation of the second embodiment;

[Explanation of symbols]

 REFERENCE SIGNS LIST 100 certificate management server 101 control device 102 communication device 103 storage device 104 certificate authority 105 recording medium 110 repository 111 control device 112 communication device 113 storage device 120 client 121 control device 122 communication device 123 storage device 130 network 200 certificate management server 210 Repository 220 client 221 electronic certificate 230 client 240 electronic document 241 message 242 electronic signature 300 certificate management server 301 control device 302 communication device 303 storage device 304 recording medium 310 certificate authority 320 repository 321 control device 322 communication device 323 storage device 330 client 331 Control device 332 Communication device 333 Storage device 340 Network 400 Certificate management server 410 Certificate Authority 420 Certificate Authority 430 Certificate Authority 440 Repository 450 Repository 460 Repository 470 Client

Claims (10)

[Claims] 1. A client for requesting issuance and revocation of a digital certificate from a certificate management server and inquiring a repository for a digital certificate, and processing for creating or revoking a digital certificate based on a request from the client. A certificate management server that registers or deletes a digital certificate in the repository and notifies the client of the digital certificate, and a repository that stores the digital certificate registered by the certificate management server and not revoked. Book management device. 2. A client for requesting issuance and revocation of an electronic certificate from a certificate management server and inquiring an electronic certificate against a repository, and receiving a request from the client and transmitting the request to a certificate authority to perform the authentication. A certificate management server that receives a processing result from a bureau, registers or deletes an electronic certificate in a repository, and notifies the client of the result;
A certificate authority for creating or revoking an electronic certificate based on a request from the client transmitted from the certificate management server and transmitting a processing result to the certificate management server; A digital certificate management device, comprising: 3. The certificate management server includes: an electronic certificate request message from the client; an electronic certificate revocation request message; a response message from the certificate authority; connection information with a connectable certificate authority; 3. The electronic certificate management device according to claim 2, wherein connection information with a repository is stored. 4. The electronic certificate management apparatus according to claim 1, wherein registration and deletion of the electronic certificate in the repository are controlled so that the registration and deletion cannot be performed by a server other than the certificate management server. . 5. The electronic certificate management device according to claim 2, wherein a plurality of certificate authorities exist according to the type of the digital certificate to be issued. 6. The electronic certificate management device according to claim 2, wherein a plurality of repositories exist according to types of electronic certificates to be stored. 7. A client makes a request for an electronic certificate or a revocation request to a certificate management server. If the request from the client is a request for an electronic certificate, an electronic certificate is created and registered in a repository. Notify the client, if the request from the client is a request for revocation of a digital certificate, delete the digital certificate from the repository and notify the client, the client will be sent to the repository when obtaining the digital certificate An electronic certificate management method characterized by performing an inquiry of an electronic certificate. 8. A client makes a request for an electronic certificate or a revocation request to a certificate management server, the certificate management server sends a request from the client to a certificate authority, and the certificate authority sends the certificate to the certificate management server. If the request from the client transmitted from the management server is a request for an electronic certificate, an electronic certificate is created and a processing result is transmitted to the certificate management server, and the certificate authority transmits the processing result from the certificate management server. If the request from the client is a request for revoking an electronic certificate, the client performs revocation processing of the electronic certificate and sends a processing result to the certificate management server, and the certificate management server sends the processing result from the certificate authority. If the request from the client is a request for an electronic certificate, register the electronic certificate in the repository and notify the client, the certificate management server If the processing result is received from the certificate authority and the request from the client is a request for revocation of the digital certificate, the digital certificate is deleted from the repository and notified to the client, and when the client obtains the digital certificate, An electronic certificate management method, wherein the repository is queried for an electronic certificate. 9. A request process in which a client makes a request for a digital certificate or a revocation request to a certificate management server;
If the request from the client is a request for a digital certificate, a certificate registration process for creating a digital certificate, registering it in a repository, and notifying the client, and a request from the client for a revocation request for a digital certificate. For example, a computer executes a certificate deletion process of deleting an electronic certificate from a repository and notifying the client, and an inquiry process of inquiring the repository of the electronic certificate when the client obtains the electronic certificate. A recording medium characterized by recording a program for causing the recording medium to be executed. 10. A request processing in which a client makes a request for an electronic certificate or a revocation request to a certificate management server, the certificate management server transmits a request from the client to a certificate authority, The certificate authority creates an electronic certificate if the request from the client sent from the certificate management server is a request for an electronic certificate, and sends a processing result to the certificate management server. If the request from the client transmitted from the certificate management server is an electronic certificate revocation request, the certificate authority performs an electronic certificate revocation process and transmits a processing result to the certificate management server. Certificate revocation processing, the certificate management server receives the processing result from the certificate authority, and if the request from the client is a request for an electronic certificate, An electronic certificate registration process for registering an electronic certificate and notifying the client, and the certificate management server receives a processing result from the certificate authority and, if the request from the client is an electronic certificate revocation request, a repository. And causing the computer to execute an electronic certificate deletion process of deleting the electronic certificate from the client and notifying the client of the electronic certificate, and an inquiry process of querying the repository for the electronic certificate when the client obtains the electronic certificate. Recording medium for recording a program for recording.