JP2002099647A - Electronic certificate managing device and storage medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To speedily take out a certificate to be attached to a message. SOLUTION: The electronic certificate managing device connected to a low level of an electronic certificate management system is provided with a certificate management table 3(11) having items wherein at least a record identifier, a verification identifier, and a certificate are recorded; and the verification identifier and record identifier are related to each other to take out certificates to be attached to messages in order.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] The present invention relates to electronic certification, authentication,
E-commerce, SET (Secure Electronic Transactio
The present invention relates to an electronic certificate management device and a storage medium for managing electronic certificates used in n) and the like.

[0002]

2. Description of the Related Art Payment may be made by credit card as part of electronic shopping and service provision on the Internet. In SET, which is a protocol for payment by credit card, an electronic certificate is used for mutual authentication. Have been.

In the digital certificate management system used in this SET, as shown in FIG. 7, a general public or a publicly recognized root certification authority (RCA) is located at the highest level. A brand certification authority (BCA) that certifies the brand of a card such as a master card, VISA, JCB, etc., is located under the root certification authority (RCA). Under the Brand Certification Authority (BCA) there are geopolitical certification authorities (GCA) that are not necessarily required, and these Brand Certification Authorities (BCA) or Geopolitical Certification Authorities (GCA)
At the lower level of the Card Member Certificate Authority (CC) that authenticates each card member from each issued credit card
A), a merchant certificate authority (MCA) that authenticates a merchant that handles a credit card and a payment gateway certificate authority (PCA) that authenticates a financial institution on a bank network that executes credit card settlement via a payment gateway It has a hierarchical structure.

By the way, CRL and BCI are used from the viewpoint of preventing unauthorized use of a certificate. CRL is a certificate revocation list for identifying revoked but not yet expired certificates, and BCI is a list that identifies all CRLs for a particular brand.

[0005] On the other hand, certificates used in SET are issued for respective purposes. For example, a signature certificate for verifying the signature of the message, an encryption certificate for encryption, a certificate verification certificate for verifying the certificate, and a CRL verification certificate for verifying CRL and BCI. There are books.

Therefore, in order to improve the reliability of a certificate or the like, a management method as shown in FIG. 8 including verification of CRL and BCI is adopted. In the figure, a mark with both wings means that a signature is attached.

[0007] The SET message in this management method is constructed by attaching necessary certificates, CRLs, and BCIs. In the SET message, a request message and a response message are paired, and the request message includes a certificate, a CRL, and a BC.
I may be included. Here, the thumbprint refers to a certificate, a CRL, and a BCI, each of which is a value generated by an operation such as a hash.

[0008] The entity receiving this request message can know the certificate, CRL, and BCI of the other party from the thumbprint. Therefore, one of the response messages contains a certificate that the other party does not have.
Attach only CRL and BCI. Therefore, when analyzing the response message, all certificates, CRLs, BCIs
Need not be confirmed, and the processing can be simplified.

Conventionally, a method of managing certificates, CRLs, and BCIs used in SET at a member store and a procedure for constructing a message will be described. The Geopolitical Certification Authority (GC
A) is optional and will not be described here.
The certificate, CRL, and BCI are each managed as one file.

Hereinafter, when transmitting a message from the member store to the payment gateway, the member store constructs the message according to the following procedure. That is, the member store attaches the member store signature certificate and the member store encryption certificate necessary for analyzing and constructing the message, as shown in FIG.
Further, an MCA certificate verification certificate for verifying the merchant signing certificate and the merchant encryption certificate.
A BCA certificate verification certificate for verifying the certificate verification certificate and an RCA certificate verification certificate for verifying the BCA certificate verification certificate are also attached. These MC
A certificate for certificate verification, BCA certificate verification certificate, R
The CA certificate verification certificate is retrieved and retrieved based on ID information relating to the signature of the certificate to be verified.

[0011] In addition, when a signature certificate and an encryption certificate of the payment gateway used at the time of message analysis are provided, a thumbprint of these certificates and a PCA certificate verification for verifying the payment gateway certificate are provided. Thumbprint of the BCA certificate verification certificate for verifying the PCA certificate verification certificate, and RCA certificate verification thumbprint of the BCA certificate verification certificate for verifying the PCA certificate verification certificate The thumbprint and the like of the certificate are also retrieved while being similarly searched.

Further, the corresponding PCA, BCA, RCA
It is necessary to retrieve each CRL issued by the BCA and retrieve its thumbprint, and also retrieve the BCI issued by the BCA to retrieve the thumbprint.

[0013]

Therefore, in the management method of the SET certificate, the CRL, and the BCI handled by the member store as described above, when constructing a message, each certificate and a certificate for verifying the certificate are required. Retrieving each certificate while finding the association makes it difficult to find the association between each certificate and the certificate that verifies them,
There is a problem that it takes time to compose a message. In addition, in order to extract the thumbprint, it is necessary to search while decoding all the files, and there is a problem that the processing efficiency is very poor.

The present invention has been made in view of the above circumstances, and it is an object of the present invention to provide an electronic certificate management device for quickly extracting a certificate, its verification certificate, and a thumbprint.

Another object of the present invention is to provide a storage medium storing a certificate, a certificate for verifying the certificate, and a program for quickly extracting a thumbprint.

[0016]

(1) In order to solve the above problems, in an electronic certificate management apparatus according to the present invention connected to a lower level of an electronic certificate management system,
A certificate management table having at least a record identifier, a verification identifier, and an item for recording a certificate is provided, and a certificate attached to a message is extracted by associating the verification identifier with the record identifier.

According to the present invention, since the verification identifier and the record identifier of the certificate management table are associated with each other, for example, after extracting the self-certificate, the record of the self-certificate is obtained. When the record identifier is recorded in the item of the verification identifier corresponding to, the certificate of the record of the record identifier is taken out, and after this certificate is taken out, the certificate is traced similarly to the record identifier recorded in the verification identifier. Can be taken out, and the certificate and its verification certificate can be taken out quickly.

In the electronic certificate management device having the above-described configuration, an item for recording one or both of the CRL identifier and the BCI identifier is added to the certificate management table, and the CRL / BCI identifier and the CRL / BCI
A CRL / BCI management table for managing the CRL / BCI identifier of the certificate management table and the CRL identifier / BCI identifier of the CRL / BCI management table are issued from a higher level. Based on the CRL identifier and BCI identifier of the record of the certificate management table corresponding to the certificate,
It is also possible to quickly retrieve the CRL / BCI from the BCI management table.

Further, a certificate management table and CRL /
If a thumbprint item is added to the BCI management table, the thumbprint of the certificate, CRL, and BCI can be easily taken out.

(2) It has at least items for recording a record identifier, a verification identifier, and a certificate, has a certificate management table in which the verification identifier is associated with the record identifier, and stores a certificate retrieval program. A storage medium for extracting a self-certificate from the certificate management table, and determining whether or not a verification identifier exists in the storage medium in correspondence with the certificate extracted by the extraction function; A verification identifier presence / absence determination function, and when the determination function determines that a verification identifier is present, the verification identifier of the certificate management table is used as the record identifier based on the verification identifier, and whether the record corresponding to the record identifier is A verification identifier for retrieving a certificate; a certificate retrieval function; if the retrieved certificate has the verification identifier, the If a certificate extracting program for executing the function of repeatedly performing the verification identifier certificate extracting function is stored, the above various functions can be realized by reading the program with a computer.

[0021]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a block diagram showing one embodiment of an electronic certificate management device according to the present invention.

When this electronic certificate management device adopts the management method described above, the card member side device, the member store side device,
It corresponds to one device or all devices of the payment gateway. Hereinafter, an example in which the electronic certificate management device according to the present invention is applied to a member store side device will be described for convenience of description.

This electronic certificate management device is connected to a network 1 such as the Internet or an intranet.
A certificate management processing unit main body 2 composed of a CPU or the like serving as a member store-side apparatus main body, a table group 3 for storing certificates for managing certificates, CRLs, BCIs, etc., and required processing It comprises a storage medium 4 for storing a program, and a database 5 used for storing certificates and other necessary data included in the received message and for creating the table group 3. Although not shown, the card 1 shown in FIG. 7, various certificate authorities, a payment gateway, and the like are connected to the network 1.

The table group 3 includes a certificate management table 11 as shown in FIG. 2, a CRI management table 12 and a BCI management table 13 as shown in FIG. Note that, of the table group 3, at least the certificate management table 1 is essential, and the other tables 2 are provided as needed.

The certificate management table 11 includes an ID which is an identifier for identifying each record, a type indicating which entity is the certificate, a signature, an encryption, a certificate verification, a CRL verification, etc. The purpose of use indicating which type of use is to be provided, the SubjectDN indicating the institution holding the certificate, the IssuerDN indicating the issuing institution, and the BCI-I indicating the issued BCI
D, a CRL-ID indicating the issued CRL, a verification ID indicating a record of the certificate that can verify the certificate, and a thumbprint item represented by the certificate body and a hash value are provided. Matters are recorded.

Next, in the CRI management table 12, a CRL-ID which is an identifier for identifying each record, a CRL body, a thumbprint represented by a hash value, and the like are recorded. The BCI management table 13 records a BCI-ID, which is an identifier for identifying each record, a BCI body, and a thumbprint represented by a hash value or the like.

Incidentally, in the case of a member store certificate, the identifier ID
1 manages a signature purpose and ID2 manages an encryption purpose. It is the MCA that issued the merchant certificate, and the merchant certificate can be verified using the certificate for the MCA certificate verification. Therefore, an ID managed by the MCA certificate verification certificate is used as the verification ID. Is recorded.

Next, in the PGWY certificate, signature for ID3 and encryption for ID4 are managed. It is the PCA that issued the PGWY certificate, and the PGWY certificate can be verified using the certificate for certificate verification of the PCA.
“8”, which is an ID managed by the PCA certificate verification certificate, is recorded as the verification ID.

Also, the MCA certificate is used for signing ID5,
ID6 manages encryption and ID7 manages certificate verification. The BCA issued this MCA certificate.
Since the MCA certificate can be verified by the CA certificate verification certificate, “10” is recorded as the verification ID.

In the PCA certificate, ID8 for certificate verification and ID9 for CRL verification are managed. The CRL issued by this PCA is the CRL in the CRL management table 12.
Since it is managed by RL-ID1, the CRL-ID of the PCA certificate verification certificate record in the certificate management table 11 is stored.
“1” is recorded in the ID. It is the BCA that issued the PCA certificate, and since the PCA certificate can be verified using the certificate for verifying the BCA, “10” is recorded as the verification ID.

In the BCA certificate, ID10 for certificate verification and ID11 for CRL verification are managed.
The CRL issued by this BCA is the CRL management table 12
Of the BCA certificate verification certificate record in the certificate management table 11
“2” is recorded in the RL-ID. In addition, BCA
Issued by the BCI in the BCI management table 13
-Certificate management table 1 because it is managed by ID1
BCI-I of the record of the BCA certificate verification certificate 1
“1” is recorded in D. It is the RCA that issued the BCA certificate, and since the BCA certificate can be verified by the RCA certificate verification certificate, “12” is recorded as the verification ID.

Further, the RCA certificate is managed in the ID 12 for certificate verification. This RCA certificate is RC
A is issued by itself, so the verification ID is NULL
It is.

Next, various operation examples when the above-described table group 3 is used will be described.

(1) A procedure for constructing a message to be transmitted to the payment gateway by the certificate management device, for example, a member store device using the above tables 11 to 13 will be described.

The member store apparatus takes out all the certificates attached to the message. Since the attached certificate is its own certificate, the certificate for signing the affiliated store and the certificate for encrypting the affiliated store are extracted from the certificate management table 11, which are the certificates of the records indicated by ID1 and ID2. Remove from the main unit. At this time, the verification ID is also taken out. This verification ID
Is “7”, the certificate management table 1
The certificate body of the record indicated by ID7 of No. 1 is taken out, and the verification ID is taken out similarly. This verification ID is "1
0 ”, the ID of the certificate management table 11
Take out the certificate body indicated by 10, and similarly check the verification ID
Also take out. Since the verification ID is “12”, the certificate body indicated by ID 12 in the certificate management table 11 is similarly extracted. Since the verification ID of the record of the certificate indicated by the ID 12 is NULL,
The search ends. All the certificates retrieved as described above are attached to the message and transmitted to the payment gateway.

Therefore, according to the above-described embodiment, for example, the member store side device sequentially retrieves various certificates while sequentially tracing the record IDs recorded in the verification IDs of the certificate management table 11 and the like. Since a required certificate can be taken out, a message to be transmitted can be created quickly.

(2) An example will be described in which the member store-side device generates a thumbprint for a certificate sent from the payment gateway that is the partner after transmitting the message.

In the process of generating the thumbprint, since the certificate to be sent from the other party is attached to the certificate already possessed, the certificate for the PGWY signature, the certificate for the PGWY encryption, and these certificates are used. And a thumbprint for the CRL and BCI issued from an entity located at a higher level in the certificate management form.

First, the PGWY PGWY signature certificate indicated by ID3 and ID4 in the certificate management table 11,
The generated thumbprints are extracted from the GWY encryption certificate. At this time, the verification ID is also taken out. Since the verification ID is “8”, the thumbprint generated from the certificate of the record indicated by ID8 in the certificate management table 11 is extracted.

By the way, CRL-I of the record of ID8
Since “1” is recorded in D, the CRL thumbprint of CRL-ID1 in the CRL management table 12 is also extracted. Further, since the verification ID of the record of ID 8 in the table 11 is “10”, the thumbprint generated from the certificate of the record indicated by ID 10 in the certificate management table 11 is extracted. BCI-I of the record
Since “1” is recorded in D, the BCI thumbprint of the BCI-ID is extracted from the BCI management table 13, and the CRL-ID of the corresponding record in the table 11 is further extracted.
Is recorded in the CRL management table 1
2 to extract the CRL-ID2 CRL thumbprint. The verification ID of the record in the table 11 is “1”.
2 ”, the thumbprint generated from the certificate of the record indicated by ID 12 in the certificate management table 11 is extracted.

Then, by attaching all the thumbprints of the certificate, CRL, and BCI extracted as described above to the request message, the payment gateway has the corresponding certificate, CRL, and BCI. Do not attach to the response message.

Therefore, according to the above-described embodiment, when the thumbprints of all the certificates are taken out, they are recorded in the items of the verification ID, BCI-ID and CRL-ID in the certificate management table 11 and the like. Since the thumbprint generated from each certificate is taken out while tracing the record ID and the record ID of the tables 12 and 13, the thumbprint can be taken out quickly, and the processing efficiency can be greatly improved.

(3) Creation of various tables 11 to 13 in the member store side device.

A. 9 is an example of creating a certificate management table 11.

First, when the certificate management table 11 is created, a table corresponding to the certificate management table having each item of the certificate management table 11 is created in the database 5.
It is assumed that necessary items are recorded in items that can be known in advance in the table.

In this state, the member store apparatus receives a message including various certificates. The information of the certificate for verifying the certificate includes the certificate management table 11 and the like. The information of various certificates is included.

Therefore, the member store side apparatus searches the record of the verification certificate from the table corresponding to the certificate management table of the database 5 based on the information of the verification certificate for verifying the received certificate. The ID of the record is taken out. Thereafter, when the received certificate is recorded in the table corresponding to the certificate management table of the database 5, the ID retrieved by the search is recorded in the verification ID corresponding to the received certificate.

Hereinafter, for each certificate, a table corresponding to a certificate management table is created by associating a verification ID with a record ID based on information of a verification certificate for verifying these certificates.

The table equivalent to the certificate management table created as described above can be used as the formal certificate management table 11. b. 6 is an example of creating a CRL management table 12.

A CRL management table equivalent table corresponding to the CRL management table 12 is created on the database 5 in the same manner as in (3) a, and necessary items that can be known in advance are described. In this state, the received message
When the RL is included, the information of the verification certificate for verifying the CRL includes information for creating the CRL management table 12. Thus, based on the information of the CRL verification certificate for verifying the CRL, a table corresponding to the certificate management table of the database 5 can be searched, and the ID 9 can be searched.

By the way, in the table equivalent to the certificate management table, the same SuR as the ID of the record of the CRL verification certificate is stored.
ID as the record of the certificate for certificate verification which is bject
Search for 8. CRL of the record indicated by this ID8
CRL-ID1, which is stored in the table corresponding to the CRL management table, that is, "1" is recorded in -ID1.

When a table corresponding to the CRL management table is created in this way, this is used as the formal CRL management table 12.

Therefore, by creating as described above, the thumbprint can be taken out from the table corresponding to the CRL management table by the link using the certificate for certificate verification, and the issued CRL can be taken out at the same time.

C. 6 is an example of creating a BCI management table 13.

A BCI management table equivalent table corresponding to the BCI management table 13 is created on the database 5 in the same manner as in (3) a, and necessary items that can be known in advance are described. In this state, the received message
When the CI is included, the information on the verification certificate for verifying the BCI includes information for creating the BCI management table 13. Therefore, based on the information of the BCI verification certificate for verifying the BCI, a table corresponding to the certificate management table of the database 5 can be searched, and the ID 11 can be searched.

The certificate management table-equivalent table has the same Su as the record ID of the BCI verification certificate.
I as the record of the certificate for certificate verification
Search for D10. In BCI-ID1 of the record indicated by ID10, BCI-ID1 stored in the above-described table corresponding to the BCI management table is recorded.

After the table corresponding to the BCI management table is created in this way, this table is used as the formal BCI management table 13.

Therefore, by making the above, the thumbprint can be taken out from the table corresponding to the BCI management table by the link using the certificate for certificate verification, and the BCI issued at this time can be taken out at the same time. Become.

(4) Next, the storage medium 4 according to the present invention
A series of processes of the program stored in the program will be described.

A. About certificate removal processing.

After reading the program stored in the storage medium 4 and transferring it to an appropriate buffer (not shown), the management processing unit main body 2 executes the processing shown in FIG. 4, ie, the message corresponding to the above (1). Executes the process of extracting the certificate for construction.

The management processing unit body 2 first extracts a certificate (own certificate) for certifying the entity itself from the certificate management table 11 (S1: own certificate extracting function). Thereafter, it is determined whether or not the extracted certificate has a verification ID (S2: verification ID presence / absence determination function).
When it is determined that there is D, a certificate is extracted from the record having the verification ID as an ID in the certificate management table 11 based on the verification ID (S3: verification ID certificate extraction function).

Further, it is determined whether or not the certificate extracted in step S3 has a verification ID (S2), and if so, the verification ID is set as an ID again, and the certificate is extracted from the certificate management table 11. . Thereafter, as long as the verification ID exists, the verification ID is set to the ID from the certificate management table 11.
Is repeated.

If there is no verification ID in step S2, the search / retrieval processing of the certificate is terminated.

B. Thumbprint removal process.

The management processing unit main body 2 reads out the program stored in the storage medium 4 and transfers it to an appropriate buffer (not shown), and then executes the processing shown in FIG. 5, that is, the sum corresponding to the above (2). Execute the print removal process.

First, the management processing unit main body 2 takes out the thumbprint of the other party certificate from the certificate management table 11 (S11: function of taking out the other party certificate thumbprint). Thereafter, it is determined whether or not the extracted certificate has a verification ID (S12: Verification ID presence / absence determination function).
Take out the thumbprint of the certificate whose ID is D (S1
3: Verification ID-compatible certificate thumbprint extraction function).

Further, after taking out the thumbprint of the certificate, it is determined whether or not the certificate has a CRL-ID (S14: CRL-ID presence / absence determination function). The CRL thumbprint is extracted (S15: CRL thumbprint extraction function).

If there is no CRL-ID in step S14 or after taking out the CRL thumbprint in step S14, the process proceeds to step S16, where it is determined whether or not the certificate has a BCI-ID (S16: B
CI-ID presence / absence determination function, B when determined to be present
The BCI thumbprint is extracted from the CI management table 13 (S17: BCI thumbprint extraction function).

Further, after taking out the thumbprint in step S17, it is determined whether or not the certificate in the certificate management table 11 has a verification ID (S12). When it is determined that the certificate is present, the verification ID is set to the ID again. The thumbprint of the certificate to be printed is taken out, and if there is no verification ID, the search / taking process of the thumbprint is ended.

C. About table creation processing.

After reading the program stored in the storage medium 4 and transferring it to an appropriate buffer (not shown), the management processing unit main body 2 executes the processing shown in FIG. 6, ie, the table corresponding to the above (3). Execute the creation process.

Upon receiving the message (S21), the management processing unit main body 2 determines whether the message includes a certificate, CRL, and BCI (S22 to S22).
S24: Information presence / absence determination function in message).

If the message includes a certificate based on the determination result in step S22, the ID of the record of the verification certificate is extracted from the information of the verification certificate for verifying the certificate (S25: Certificate ID extraction function), verification ID corresponding to the certificate in table 11
The extracted ID is recorded (S2).
6: ID recording function).

In step S23, it is verified whether or not the CRL is included in the message. If the message is included, the certificate for CR and CRL verification is stored in the database 5 or other memory (S27). : CRL storage function), database equivalent table search, ID from CRL verification certificate record, CRL-ID
It is stored as 1 (S28: CRL verification certificate ID extraction function).

Then, after extracting the SubjectDN from the certificate for CRL verification from the table corresponding to the certificate management table (S29: certificate holding organization specifying function), the certificate having the same SubjectDN as the SubjectDN of the certificate for CRL verification is obtained. The ID is searched and retrieved as a record of the verification certificate (S3
0: Certificate verification certificate ID extraction function). In the CRL-ID1 of the record indicated by this ID, the CRL-ID1 when the table corresponding to the CRL management table is stored is recorded (S31: CRLID recording function).

Further, in step S24, when the message includes the BCI, the same processing as in the case where the CRL is included is performed (S27 to S3).
1).

After the series of processes described above, it is determined whether the process is completed. If not, the process proceeds to step S22.
And the same processing is repeatedly executed.

Therefore, according to the above-described embodiment, the verification identifier and the record identifier of the certificate management table 11 are associated with each other. Since the record identifier is recorded in the item of the verification identifier corresponding to the record, the certificate can be taken out from the record of the record identifier, and the certificate can be taken out by tracing the record identifier similarly recorded in the verification identifier. Certificate and its verification certificate can be taken out quickly.

An item for recording one or both of the CRL identifier and the BCI identifier is added to the certificate management table 11, and the CRL / BCI identifier and the CRL are further added.
CRL / BCI management table 12, which manages / BCI,
13, the CRL identifier of the certificate management table 11,
BCI identifier and CR of the CRL / BCI management table
If the configuration is such that the L identifier and the BCI identifier are related,
The CRL / BCI can be quickly extracted from the CRL / BCI management tables 12 and 13 based on the CRL identifier and the BCI identifier of the record of the certificate management table 11 corresponding to the certificate issued from the upper level.

Further, the certificate management table 11 and the CR
By adding the item of the thumbprint to the L / BCI management tables 12 and 13, the thumbprint of the certificate, CRL, and BCI can be easily taken out.

The present invention is not limited to the above embodiment, but can be implemented in various modifications without departing from the spirit of the invention. Further, the embodiments can be implemented in combination as much as possible, and in that case, the effect of the combination can be obtained. Furthermore, the above embodiments include various upper and lower stage inventions.
Various inventions can be extracted by appropriately combining a plurality of disclosed components. For example, if an invention is extracted because some constituent elements can be omitted from all the constituent elements described in Means for Solving the Problems, the omitted part may be omitted when implementing the extracted invention. Is appropriately supplemented by well-known conventional techniques.

[0084]

As described above, according to the present invention, it is possible to provide an electronic certificate management device capable of quickly extracting a certificate, a certificate for verification thereof, and a thumbprint.

Further, the present invention can provide a storage medium storing a certificate and a program for quickly extracting a certificate for verification and a thumbprint.

[Brief description of the drawings]

FIG. 1 is a configuration diagram showing an embodiment of an electronic certificate management device according to the present invention.

FIG. 2 is a diagram showing an example of an array of each item data of a certificate management table.

FIG. 3 is a diagram showing a CRL / BCI management table.

FIG. 4 is a flowchart for explaining an operation of taking out a certificate.

FIG. 5 is a flowchart illustrating an operation of taking out a thumbprint.

FIG. 6 is a flowchart illustrating processing for creating the tables shown in FIGS. 2 and 3;

FIG. 7 is a diagram showing a management form of a general electronic certificate management system.

FIG. 8 is a diagram illustrating a method for managing an electronic certificate.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 ... Network 2 ... Certificate management processing part main body 3 ... Table group 4 ... Storage medium 5 ... Database 11 ... Certificate management table 12 ... CRL management table 13 ... BCI management table

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat ゛ (Reference) G06F 17/60 512 G06F 17/60 512 G07D 9/00 461 G07D 9/00 461A G07F 19/00 476F Term (Reference) 3E040 AA03 BA18 DA02 5B049 AA05 BB11 BB46 CC05 CC08 CC39 DD01 DD04 EE01 EE23 EE24 FF03 FF04 GG04 GG07 GG10 5B055 CC11 EE02 EE03 EE17 EE21 EE27 HA02 HA12 HB01 KK34 PA19 PA02

Claims (6)

[Claims] 1. An electronic certificate management device connected to a lower level of an electronic certificate management system, comprising: a certificate management table having at least a record identifier, a verification identifier, and an item for recording a certificate; An electronic certificate management device for extracting a certificate attached to a message by associating the certificate with the record identifier. 2. The electronic certificate management device according to claim 1, wherein an item for recording one or both of a CRL identifier and a BCI identifier is added to the certificate management table, and the CRL / BCI identifier and the CRL / A CRL / BCI management table for managing BCI is provided, and a CRL identifier and a BCI identifier of the certificate management table and a CRL identifier and B of the CRL / BCI management table are provided.
By associating with the CI identifier, the CRL identifier and the BCI identifier of the record of the certificate management table corresponding to the certificate issued from the upper level,
An electronic certificate management device, which extracts a CRL / BCI from an L / BCI management table. 3. The electronic certificate management apparatus according to claim 1, wherein a thumbprint item is added to the certificate management table and the CRL / BCI management table, and the certificate, the CRL, and the BRL are added.
An electronic certificate management device wherein a thumbprint of a CI can be taken out. 4. A storage having at least items for recording a record identifier, a verification identifier, and a certificate, having a certificate management table in which the verification identifier is associated with the record identifier, and storing a certificate extracting program. Medium, wherein the certificate extracting program has a self-certificate extracting function for extracting a self-certificate from the certificate management table, and whether or not there is a verification identifier corresponding to the certificate extracted by the extracting function. Verification identifier presence / absence judgment function for judging, and when it is judged that there is a verification identifier by this judgment function, the verification identifier of the certificate management table is used as the record identifier based on the verification identifier,
A verification identifier certificate extraction function for extracting the record corresponding to the record identifier or the certificate, and a function for repeating the verification identifier certificate extraction function if the extracted certificate has the verification identifier. A computer-readable storage medium characterized by the above-mentioned. 5. A certificate management table having at least items for recording a record identifier, a verification identifier, a CRL identifier, a BCI identifier, a certificate and a thumbprint, and a CRL associated with the CRL identifier and the BCI identifier.
A storage medium having a CRL / BCI management table for managing a BCI and a thumbprint, and storing a certificate thumbprint extraction program, wherein the certificate thumbprint extraction program stores another program from the certificate management table. A function for extracting a thumbprint of a certificate related to the lower-level device, and a function for extracting a thumbprint of the certificate, and when a record corresponding to the extracted certificate has the verification identifier, the verification identifier is stored in the record from the certificate management table. A function for taking out a verification identifier-compatible certificate thumbprint for taking out a thumbprint of a certificate as an identifier, a CRL identifier presence / absence determining function for determining whether or not the certificate has a CRL identifier; Fetching a CRL thumbprint from the CRL management table Arm and a printed take-out function, without the CRL identifier or the CRL
A BCI identifier presence / absence determination function for determining whether or not the certificate has a BCI identifier after the thumbprint is retrieved, and a BCI thumbprint retrieval for extracting the BCI thumbprint from the BCI management table when the BCI identifier is present by this function. A computer-readable storage medium for implementing functions. 6. A certificate management table equivalent table having at least a record identifier, a certificate holder, a verification identifier, a CRL identifier, a BCI identifier, and a certificate, and a CR associated with the CRL identifier and the BCI identifier.
A storage medium having a table corresponding to a CRL / BCI management table having items of L and BCI and storing a table creation processing program for creating the table from information included in the message, wherein a certificate, A function for determining whether or not information is included in the message, which determines whether or not the CRL and the BCI are included;
A record identifier extracting function for extracting a record identifier of the verification certificate from the certificate management table equivalent table based on information of the certificate for verifying the certificate, and a verification identifier corresponding to the received certificate record An identifier recording function for recording the retrieved record identifier, a storage function for storing a CRL / BCI and a CRL / BCI verification certificate when the determination function includes a CRL / BCI, CRL / BC which searches a table equivalent table, extracts a record identifier from the record of the CRL / BCI verification certificate, and stores it.
I. A function for extracting a certificate identifier for verification and a certificate for extracting a record identifier of a certificate for certificate verification at the same certificate holder based on the certificate holder for the CRL verification certificate from a table corresponding to the certificate management table. A computer function for extracting a certificate identifier for certificate verification and a recording function for recording a record identifier stored in the function for extracting a certificate identifier for CRL / BCI verification in correspondence with the retrieved record identifier. A readable storage medium.