JP2002217899A - Portable terminal, certificate verifying server, system and method for verifying effectiveness of electronic certificate - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a portable radio terminal, by which the validity of an electronic certificate can constantly be confirmed, without marked change and burden to an application on portable equipment which can be connected with the Internet. SOLUTION: In the case of identifying that communication includes the electronic certificate, a radio base station 6 makes an inquiry concerning the validity of the certificate to a certificate verifying server 8. The server 8 to which the inquiry concerning the validity of the certificate is made determines whether a held lapse certificate database 32 includes the certificate and informs the station 6 of the result. The station 6 informs a portable radio terminal 1 of the verifying result 101 of an electronic certificate, based on the validity information of the certificate received from the server 8. When the result 101 includes certificate lapse information, the terminal 1 receiving the result 101 informs the portable equipment 2 of the certificate lapse information 102.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a technology for performing secure communication on a public key infrastructure (PKI) using an electronic certificate in a portable wireless terminal connectable to the Internet. The present invention relates to a portable wireless terminal that constantly checks the validity of an electronic certificate.

[0002]

2. Description of the Related Art Conventionally, for example, in electronic commerce using the Internet, PKI cryptographic communication and electronic authentication have been generally used as secure communication means between a WWW (World Wide Web) server, a browser client, and an EMail client. . In this case, the public key used in this case includes a third-party certification body (Ce
An electronic certificate signed by rtificate Authority (CA) is attached, which is a measure against public key falsification and counterfeiting.

[0003]

An electronic certificate with such a signature may lose its validity within its expiration date for various reasons. To deal with such a situation, the CA periodically renews the certificate revocation list (Certif
icate Revocation List (CRL) has been issued,
When the certificate is received, the validity of the certificate is confirmed by comparing the received certificate with the CRL. However, since the CRL is usually enormous, the processing required for confirmation is required, and the amount of communication is also increased. Therefore, it is practically difficult for each client to perform the operation. Was.

As a solution to this problem, a server service or the like which performs CRL confirmation has recently become widespread. In order to use such a service on a client, a corresponding application (browser software, Email software, etc.) is required. It was not practical because each required special additional treatment. In particular, when the client is not a popular personal computer but a portable terminal or a device built-in type, it is difficult and impractical to implement each of various applications.

The present invention has been made in view of the above problems, and constantly checks the validity of an electronic certificate without significantly changing or burdening an application on a portable device that can be connected to the Internet. It is an object of the present invention to provide a portable wireless terminal capable of performing such operations.

[0006]

In order to solve the above problems, the invention according to claim 1 is transmitted and received between nodes on the Internet (for example, the portable device 2 and the Internet service 12 in the embodiment). Receiving a digital certificate that verifies the validity of the public key used for the encrypted data,
A portable terminal that relays data communication between nodes (for example, the portable wireless terminal 1 of the embodiment), and a communication connection unit that connects to the Internet via a wireless base station (for example, the communication connection circuit A22 of the embodiment) And communication connection circuit B2
A plurality of 3) is provided, and each communication connection means is connected to the Internet via a different path. With the above configuration, data different from service data can be transmitted and received between the user terminal and the Internet service.

According to a second aspect of the present invention, in the portable terminal according to the first aspect, at least one of the communication connection means transmits and receives communication data, and the other communication connection means checks the verification result of the electronic certificate. It is characterized by transmitting and receiving. With the above configuration, it is possible to transmit and receive certificate data relating to a public key different from service data between the user terminal and the Internet service.

According to a third aspect of the present invention, in the portable terminal according to the second aspect, whether to permit transmission / reception of communication data is determined according to whether the digital certificate included in the verification result of the digital certificate has been revoked. A relay means (for example, the relay processing unit 24 of the embodiment) for controlling the encrypted data transmitted and received between the nodes is provided. With the above configuration,
If the digital certificate has been revoked, it is notified to the user terminal, the communication data between the user terminal and the Internet service is temporarily held until the validity of the digital certificate can be verified, If the validity cannot be verified, it is possible to disconnect the communication between the user terminal and the Internet service.

According to a fourth aspect of the present invention, there is provided a certificate verification server for verifying the validity of a public key used for encrypted data transmitted and received between nodes on the Internet (for example, a certificate verification server according to the embodiment). 8) wherein a revocation certificate database (for example, the revocation certificate database 32 of the embodiment) that records whether or not an electronic certificate that certifies the validity of a public key has been revoked, and a mobile phone that relays communication between nodes. Certificate verification result responding means for verifying the recorded contents of the revocation certificate database and responding to the certificate verification result in response to an inquiry about the validity of the public key from the wireless base station connected to the portable terminal (for example, Certificate verification result answer processing unit 33)
Are provided. With the configuration described above, it is possible to provide information on an electronic certificate in response to an inquiry about the validity of an electronic certificate from a user terminal.

According to a fifth aspect of the present invention, in the certificate verification server according to the fourth aspect, a certificate obtained by acquiring a certificate revocation list issued by a third-party certification authority and recording the certificate revocation list in a revocation certificate database. A revocation list acquisition unit (for example, the certificate revocation list acquisition processing unit 31 of the embodiment) is provided. With the above configuration, it is possible to obtain new electronic certificate information as needed and provide the latest information to the user terminal or the Internet service.

According to a sixth aspect of the present invention, there is provided an electronic certificate validity verification system for verifying the validity of a public key used for encrypted data transmitted and received between nodes on the Internet. To a device including the portable terminal according to any one of claims 3 to 5 and the certificate verification server according to claim 4 or claim 5.
By obtaining the certificate verification result output from the certificate verification server via a wireless base station connected to a portable terminal that relays communication between nodes, control of encrypted data transmitted and received between nodes can be achieved. It is characterized by performing. With the above configuration, it is possible to provide information on the validity of the electronic certificate to all user terminals or Internet services regardless of the type of user terminal or Internet service.

[0012] The invention according to claim 7 is a digital certificate validity verification method for verifying the validity of a public key used for encrypted data transmitted and received between nodes on the Internet. Transmitting and receiving communication data using at least one of two or more communication connection means for connecting to the Internet via the Internet, and obtaining a certificate revocation list issued by a third party certificate authority to certify the revocation. In the process of recording in the certificate database and verifying the validity of the public key from the wireless base station connected to the portable terminal relaying communication between nodes, the contents of the revocation certificate database are verified and certified. Replying the document verification result using the rest of the communication connection means.

According to an eighth aspect of the present invention, there is provided a computer readable program storing a control program of a certificate verification server for verifying the validity of a public key used for encrypted data transmitted and received between nodes on the Internet. A recording medium, wherein the program acquires a certificate revocation list issued by a third-party certification authority, records the revocation list in a revocation certificate database, and is connected to a portable terminal that relays communication between nodes. In response to an inquiry about the validity of the public key from the wireless base station, the computer verifies the recorded contents of the revocation certificate database and returns the certificate verification result using the rest of the communication connection means. It is characterized by.

[0014]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing a device configuration of the embodiment. In this figure, reference numeral 1 denotes a portable terminal of the present embodiment that can be connected to the Internet. The portable device 2 is a general portable device connected to the portable wireless terminal 1 by the communication unit 3 and communicating with the Internet. The communication means 3 is a wired or wireless LAN including the portable wireless terminal 1 and the portable device 2.
(Local Area Network), whereby any number of portable devices 2 may be connected to the portable wireless terminal 1. Also, as an example of the portable device 2, a PDA
(Personal Digital Assistants) and wearable computers. The wireless base station 4 is a base station that controls a wireless communication line to which the portable wireless terminal 1 is connected via a communication unit 5 that performs normal data transmission and reception. It is a base station that controls a wireless communication line to which the portable wireless terminal 1 is connected via the communication unit 7 that performs validity confirmation.

On the other hand, the certificate verification server 8
Is a server that manages a revocation certificate that records the revocation status of a public key used to protect communication when using information on the Internet. The communication unit 9 communicates with the wireless base station 4 and the wireless base station 6. Connected. Further, the communication means 9
Is connected to the Internet 11 via the router 10,
A general Internet service 12 for transmitting an electronic certificate is connected to the Internet 11. The Internet service 12 is, for example, a WWW service, E
A mail service is conceivable. The Internet 11 is also connected to a certification authority 13 which is a third party certification authority that has signed the electronic certificate of the Internet service 12.

FIG. 2 is a block diagram showing a configuration of the portable wireless terminal 1 of the embodiment. In FIG.
The portable wireless terminal 1 includes a mobile device connection circuit 21, a communication connection circuit A22, a communication connection circuit B23, and a relay processing unit 2.
And 4. The portable device connection circuit 21 is an interface circuit for connecting the portable device 2 to the portable wireless terminal 1 by the communication unit 3. Communication connection circuit A22
Is an interface circuit for connecting the portable wireless terminal 1 to the wireless base station 4 by the communication means 5. The communication connection circuit B23 is connected to the portable wireless terminal 1 by the communication means 7.
Is an interface circuit for connecting to the wireless base station 6.

The relay processing unit 24 includes the portable device connection circuit 21
Device 2 connected via a communication connection circuit A22
Base station 4 connected via a communication connection circuit B
A processing unit that relays communication with the wireless base station 6 connected via the communication terminal 22. In addition, the relay processing unit 24 includes the portable device 2
Based on the notification from the wireless base station 6 regarding the validity of the public key used to protect communication when using information on the Internet, based on the notification from the wireless base station 6 (1) The public key from the wireless base station 6 is in an invalid state When notified, the portable device 2 is notified. (2) Suppress data transmission from the portable device 2 to the Internet service 12 until it can be confirmed that the public key is valid. (3) The communication path from the portable device 2 to the Internet service 12 is blocked. Perform one of the operations.

The relay processing unit 24 may be realized by dedicated hardware, and is constituted by a memory and a CPU (Central Processing Unit), and stores a program for realizing the above functions. The function may be realized by loading it into a memory and executing it.

FIG. 3 is a block diagram showing a configuration of the certificate verification server 8 according to the embodiment. In FIG. 3, the certificate verification server 8 includes a certificate revocation list acquisition processing unit 31, a revocation certificate database 32, and a certificate verification result response processing unit 33. The certificate revocation list acquisition processing unit 31 acquires a certificate revocation list issued by a third-party certification authority. Revocation certificate database 3
Reference numeral 2 denotes a database in which the certificate revocation list acquisition processing unit 31 records a certificate revocation list acquired from a third-party certification organization. The certificate verification result response processing unit 33 searches the certificate revocation list recorded in the revocation certificate database 32 for the validity of the electronic certificate inquired from the wireless base station 6, and determines whether or not the corresponding data exists. A reply is sent to the wireless base station 6 as a certificate verification result.

The revocation certificate database 32 may be composed of a non-volatile memory such as a hard disk device, a magneto-optical disk device, or a flash memory, or a computer-readable and writable recording medium using a combination thereof. Further, the certificate revocation list acquisition processing unit 31 and the certificate verification result response processing unit 33 may be each realized by dedicated hardware, and may be realized by a memory and a CPU (central processing unit). It may be configured so as to realize the functions by loading a program for realizing the functions of the above-described units into a memory and executing the programs.

It is assumed that an input device, a display device, and the like (neither is shown) are connected to the certificate revocation server 8 as peripheral devices. Here, the input device refers to an input device such as a keyboard and a mouse. The display device refers to a CRT (Cathode Ray Tube) display device, a liquid crystal display device, or the like.

Next, referring to FIG. 4, while the portable device 2 is connected to the portable wireless terminal 1 by the communication means 3, the Internet service 1 on the Internet 11
2 will be described. First, the mobile device 2
Makes a connection request to the Internet service 12,
The Internet service 12 has a certification authority 1 in advance.
The electronic certificate 100 signed by the third party is sent (step S1). Here, as such a communication form,
At present, SSL (Secure Sockets Layer), which is generally used for realizing a service that places importance on confidentiality and reliability of information such as electronic commerce, can be considered.
The electronic certificate 100 is sent to the wireless base station 4 and the wireless base station 6 via the communication means 9 at the same time.

Next, upon identifying that the communication includes an electronic certificate, the wireless base station 6 inquires of the certificate verification server 8 about the validity of the certificate (step S2).
The certificate verification server 8 inquired about the validity of the certificate determines whether or not the certificate is included in the held revocation certificate database 32 and notifies the wireless base station 6 of the result. (Step S3). In this case, the wireless base station 4 transmits the data received from the Internet service 12 to the portable wireless terminal 1 as it is (step S4).

Next, the radio base station 6 notifies the portable radio terminal 1 of the digital certificate verification result 101 based on the validity information of the certificate received from the certificate verification server 8 (step S5). The portable wireless terminal 1 that has received the certificate verification result 101 notifies the portable device 2 of the certificate revocation information 102 when the certificate revocation information 101 includes the certificate revocation information (step S6). Note that, as a more secure embodiment, the portable wireless terminal 1 operates until the certificate validity information is confirmed by the digital certificate verification result 101.
Data transmission from the mobile device 2 to the Internet service 12 may be suppressed. As a more secure embodiment, the portable wireless terminal 1 may block a communication path from the portable device 2 to the Internet service 12.

The certificate verification server 8 periodically acquires the certificate revocation list 103 issued by the external certification authority 13 and holds a list of revoked certificates (revocation certificate database 32). (Step S
7). Note that the certificate verification server 8 uses the certificate revocation list 103 received from the certificate authority 13 as needed to verify the validity of the certificate.
4 to obtain the certificate revocation information 104 (step S8).

Here, in the case where the validity check of the digital certificate is executed not on the portable device 2 but on an external device,
FIG. 5 shows an advantage in the case of having two or more communication means.
This will be described with reference to FIG. Portable wireless terminal 51 and wireless base station 5
In a situation in which communication is performed using only one communication means, the wireless base station 53 needs to hold communication data from the Internet service 12 until the validity check of the electronic certificate 100 is completed. There is. Generally, since the wireless base station 53 needs to process a large amount of communication data,
Even if the time required to verify the digital certificate is very short, the amount of packets that the wireless base station 53 must hold increases, and the cost burden for processing and holding the packets increases. I do. According to the present invention, regardless of whether the certificate is valid or not, data received from the Internet service 12 can be communicated on the communication path side using the communication means 5, the radio base station 4, and the communication means 9. Therefore, such a burden does not occur.

Next, the advantage for the portable device 2 will be described. In the present invention, only the notification of the certificate revocation information 102 from the portable wireless terminal 1 is received.
There is no need to incorporate a complicated certificate verification processing function on a mobile device with limited resources.

In the above-described embodiment, a case has been described in which one wireless base station 6 is provided. However, any number of wireless base stations 6 may be provided. In this case, a plurality of connection circuits B23 included in the portable wireless terminal 1 and a plurality of certificate verification result response processing sections 33 included in the certificate verification server 8 are provided in accordance with the number of the wireless base stations 6. I do. This can further reduce the time spent for validating the electronic certificate.

Also, in the above-described embodiment, the case has been described where the Internet service 12 issues a public key and the portable device 2 uses it. Conversely, the portable device 2 issues a public key, A communication partner on the Internet may use it. In this case, in FIG. 4 and FIG. 5, the positions of the Internet service 12 and the portable device 2 may be switched. This makes it possible to exchange encrypted information between portable devices via the Internet.

The portable wireless terminal 1 and the certificate verification server 8 record a program for realizing the functions on a computer-readable recording medium.
The functions of the above-described devices may be realized by causing a computer system to read and execute the program recorded on the recording medium.

Here, the “computer system” includes an OS and hardware such as peripheral devices.
If a WW (World Wide Web) system is used, a homepage providing environment (or display environment) is also included. The "computer-readable recording medium" is a floppy (registered trademark) disk, a magneto-optical disk, a ROM, a CD-ROM.
And a storage device such as a hard disk built in a computer system. Further, a “computer-readable recording medium” refers to a medium that dynamically stores a program for a short time, such as transmitting a program via a computer network such as the Internet or a communication line such as a telephone line. (Transmission medium or transmission wave), in which case a program holding a program for a certain period of time, such as a volatile memory in a computer system serving as a server or a client, is also included.

Further, the above-mentioned program may be for realizing a part of the above-mentioned functions, and may be for realizing the above-mentioned functions in combination with a program already stored in a computer system, so-called, It may be a difference file (difference program).

[0033]

As described above, according to the present invention, a certificate verifying function is performed by a server at a radio base station side, so that a digital certificate can be obtained without incorporating a complicated certificate verifying function on a portable device. The effect that the validity can be always confirmed can be obtained. Also, by providing the portable wireless terminal with two or more communication means, communication data from the Internet service is held until the validity check of the electronic certificate is completed between the portable wireless terminal and the wireless base station. This eliminates the need to keep the communication data and reduces the cost burden on the wireless base station for processing and holding the communication data. In addition, since the validity of the electronic certificate is verified by providing a plurality of wireless base stations, the effect of minimizing the time spent for validating the validity of the electronic certificate can be obtained.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of an embodiment of the present invention.

FIG. 2 is a block diagram showing a configuration of the portable wireless terminal 1 of FIG.

FIG. 3 is a block diagram showing a configuration of a certificate verification server 8 of FIG.

FIG. 4 is a diagram showing a digital certificate verification operation of the embodiment.

FIG. 5 is a diagram showing an electronic certificate verification operation when only one communication path is used.

[Explanation of symbols]

 REFERENCE SIGNS LIST 1 portable wireless terminal 2 portable device 3 communication means 4 wireless base station 5 communication means 6 wireless base station 7 communication means 8 certificate verification server 9 communication means 10 router 11 Internet 12 Internet service 13 certification authority 14 certificate verification authority 21 mobile Device connection circuit 22 Communication connection circuit A 23 Communication connection circuit B 24 Relay processing unit 31 Certificate revocation list acquisition processing unit 32 Revocation certificate database 33 Certificate verification result response processing unit

Claims (8)

[Claims] 1. A portable terminal that receives an electronic certificate for verifying the validity of a public key used for encrypted data transmitted and received between nodes on the Internet and relays data communication between the nodes. A portable terminal comprising a plurality of communication connection means for connecting to the Internet via a wireless base station, wherein each communication connection means is connected to the Internet via a different path. 2. The portable terminal according to claim 1, wherein at least one of the communication connection means transmits and receives communication data, and the other communication connection means transmits and receives a verification result of the electronic certificate. 3. A relay for determining whether to permit transmission / reception of the communication data according to whether or not the digital certificate included in the verification result of the digital certificate has been revoked, and controlling encrypted data transmitted / received between the nodes. 3. The portable terminal according to claim 2, further comprising means. 4. A certificate verification server for verifying the validity of a public key used for encrypted data transmitted and received between nodes on the Internet, comprising: a digital certificate for certifying the validity of the public key; A revocation certificate database that records the presence or absence of revocation; and a record of the revocation certificate database in response to an inquiry about the validity of the public key from a wireless base station connected to a portable terminal that relays communication between the nodes. A certificate verification server, comprising: a certificate verification result reply unit that verifies the contents and returns a certificate verification result. 5. A certificate revocation list acquiring means for acquiring a certificate revocation list issued by a third-party certification authority and recording the certificate revocation list in the revocation certificate database. Certificate validation server. 6. An electronic certificate validity verification system for verifying the validity of a public key used for encrypted data transmitted and received between nodes on the Internet, wherein the electronic certificate validity verification system comprises: And a certificate verification server according to claim 4 or claim 5, wherein the portable terminal outputs a certificate verification result output by the certificate verification server. By controlling the encrypted data transmitted and received between the nodes by acquiring the data via a wireless base station connected to the portable terminal that relays the communication between the nodes. Document validity verification system. 7. An electronic certificate validity verification method for verifying the validity of a public key used for encrypted data transmitted and received between nodes on the Internet, wherein the method is for connecting to the Internet via a wireless base station. Transmitting and receiving communication data using at least one of the two or more communication connection means; obtaining a certificate revocation list issued by a third party certification authority and recording the certificate revocation list in a revocation certificate database; In response to an inquiry about the validity of the public key from a wireless base station connected to a portable terminal that relays communication between the nodes, the content of the revocation certificate database is verified, and a certificate verification result is obtained. Answering using the rest of the communication connection means. 8. A computer-readable recording medium recording a control program of a certificate verification server for verifying the validity of a public key used for encrypted data transmitted and received between nodes on the Internet, The program includes a process of acquiring a certificate revocation list issued by a third-party certification authority and recording the certificate revocation list in a revocation certificate database, and a process of receiving a certificate revocation list from a wireless base station connected to a portable terminal that relays communication between the nodes. A process of verifying the recorded content of the revocation certificate database with respect to the inquiry of the validity of the public key, and returning a certificate verification result using the rest of the communication connection unit. Characteristic computer readable recording medium.