JP2003141085A - Access right management system, access right management method, access right management program and recording medium recording the access right management program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To easily and efficiently perform setting of an access right to operation permitted to each manager as authority. SOLUTION: In a manager authentication system to which an access right management system is applied, frame for defining a prescribed operation to resource is taken as a manager class, and a plurality of manager classes are made hierarchical and defined such as five manager classes MC1 , MC2 , MC3 , MC4 , MC5 . In a manager authentication system, the manager holds a manager class electronic certificate which is an electronic certificate carrying information showing the permitted operation, and the system side discriminates the manager class to which the manager belongs with reference to the manager class electronic certificate held by the manager accessing to the held resource to verify the manager's access to the resource.

Description

Detailed Description of the Invention

[0001]

TECHNICAL FIELD The present invention relates to an access right management system, an access right management method, an access right management program and an access for managing the authority of each administrator for a predetermined resource and verifying the access of the administrator to the resource. The present invention relates to a recording medium on which a rights management program is recorded.

[0002]

2. Description of the Related Art In recent years, the number of services via the Internet has been increasing, and along with this, management of access rights has been carried out in order to eliminate unauthorized user access to hardware, software, and data. It has become very important.

In particular, high security is required, for example, a system for handling and managing a user's key used for data encryption, and a system for issuing a certificate for an individual by a certificate authority which is a trusted third party. In some systems, multiple administrators are provided, access rights are assigned to these administrators, and control is specified so that processing is permitted only when a plurality of predetermined administrators simultaneously access. There are cases and cases where one administrator prescribes operations that should not be combined.

Here, as a management method of the administrator, the concept of a group is introduced like management at an operating system level such as UNIX (trademark), and individual authority is given to each group. There are those that manage access. In such a management method, a user who belongs to a certain group can access the resource file managed by the group with reading and / or writing.

[0005]

By the way, in the conventional management method of the administrator, the control when a certain operation, that is, the need to add and / or delete the authority to the group, or the authority different from the certain authority is required. There was not established a mechanism to efficiently control the case where the same person is not allowed to concurrently serve.

That is, in the conventional management method, although it is possible to perform these controls, it is necessary to determine the control method each time, and access control becomes complicated both on the system side and the administrator side. There was such a problem.

The present invention has been made in view of the above circumstances, and facilitates management of the authority of an administrator,
An object of the present invention is to provide an access right management system, an access right management method, an access right management program, and a recording medium on which the access right management program is recorded, which can improve the operability of an administrator.

[0008]

An access right management system according to the present invention that achieves the above object manages the authority of each administrator for a predetermined resource and verifies the access of the administrator to the resource. This is a management system that defines an administrator terminal that is operated by an administrator who holds an administrator class electronic certificate that is an electronic certificate that describes information indicating permitted operations, and a predetermined operation for a resource. The framework that defines this is the administrator class, and multiple administrator classes are hierarchically defined, and the administrator to which the administrator who accesses the held resource refers to the administrator class electronic certificate It is characterized by including a system for discriminating a person class and verifying the access of the manager to the resource.

In such an access right management system according to the present invention, a plurality of administrator classes are hierarchically defined as an administrator class, which is a framework for defining a predetermined operation for a resource, and the defined resource is retained. The administrator class electronic certificate held by the accessing administrator is referred to by the system to determine the administrator class to which the administrator belongs, and verify the administrator's access to the resource.

The access right management method according to the present invention which achieves the above object is an access right management method for managing the authority of each administrator for a predetermined resource and verifying the access of the administrator to the resource. In addition, the framework that defines the predetermined operation for the resource by the system that holds the resource is defined as the administrator class by hierarchizing multiple administrator classes, and the information indicating the permitted operation is described for the resource. When an administrator who holds an administrator class electronic certificate, which is a digital certificate, accesses it via the administrator terminal, the system refers to the administrator class electronic certificate that the administrator holds and The feature is that the administrator class to which the administrator belongs is discriminated and the access of the administrator to the resource is verified.

In such an access right management method according to the present invention, a plurality of administrator classes are hierarchically defined as an administrator class which defines a predetermined operation for a resource, and the administrator class is defined for the resource. When an administrator holding a digital certificate accesses it via the administrator terminal, the system refers to the administrator class electronic certificate held by the administrator to determine the administrator class to which the administrator belongs. And verify the administrator's access to the resource.

Further, the access right management program according to the present invention which achieves the above object manages the authority of each administrator for a predetermined resource and verifies the access of the administrator to the resource by a computer-readable access right. An electronic program in which information indicating permitted operations is described for a resource, which is a management program and defines a framework for defining a predetermined operation for a resource as an administrator class by hierarchically defining a plurality of administrator classes. When the administrator who holds the administrator class electronic certificate, which is a certificate, accesses it via the administrator terminal, the administrator belongs by referring to the administrator class electronic certificate that the administrator holds. The feature is that the administrator class is discriminated and the access of the administrator to the resource is verified.

In such an access right management program according to the present invention, a plurality of administrator classes are hierarchically defined as an administrator class for defining a predetermined operation for a resource, and the administrator class is defined for the resource. In response to the administrator holding the digital certificate accessing through the administrator terminal, the administrator class electronic certificate held by the administrator is referenced to determine the administrator class to which the administrator belongs, Verify the administrator's access to the resource.

Furthermore, the recording medium in which the access right management program according to the present invention that achieves the above-mentioned object is recorded manages the authority of each administrator for a predetermined resource and verifies the access of the administrator to the resource. A recording medium on which a computer-readable access right management program to be executed is recorded, and the access right management program defines a plurality of administrator classes in a hierarchical manner with a framework defining a predetermined operation for a resource as an administrator class. , When a manager who holds an administrator class electronic certificate, which is an electronic certificate in which information indicating permitted operations is described, accesses the resource via the administrator terminal, the management Refer to the administrator class electronic certificate held by the administrator to determine the administrator class to which the administrator belongs and It is characterized by verifying the administrator access that.

In the recording medium in which the access right management program according to the present invention is recorded, a plurality of administrator classes are hierarchically defined as an administrator class, which is a framework for defining a predetermined operation for the resource, On the other hand, when an administrator holding the administrator class electronic certificate accesses it via the administrator terminal, the administrator to which the administrator belongs belongs by referring to the administrator class electronic certificate held by the administrator. Provide an access right management program that determines the administrator class and verifies the access of the administrator to the resource.

[0016]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Specific embodiments to which the present invention is applied will be described in detail below with reference to the drawings.

In this embodiment, an access right management system that manages the authority of each administrator for a resource in a predetermined system and verifies the access to the resource is an administrator who performs processing including authentication of the administrator. It is applied to the authentication system. This administrator authentication system introduces the concept of a group into the management of the administrator, introduces the concept of hierarchizing this group, and causes the administrator to hold an electronic certificate digitally signed using a public key. Therefore, it is possible to efficiently realize the control when it is necessary to add and / or delete the authority to the group, and the control when the same person is not allowed to concurrently perform a certain authority and another authority. The operability of the person can be improved.

In the following, the concept of the administrator authentication system will be described, and then an implementation example will be described.

Conceptually, the administrator authentication system includes, for example, five administrator classes MC ₁ , MC ₂ and MC shown in FIG.
₃ , MC ₄ , MC ₅ , etc. are realized by defining a framework for defining a predetermined operation, that is, a group as an administrator class and hierarchizing a plurality of administrator classes.

In the administrator authentication system, operations defined in one administrator class need to be regarded as equivalent from the viewpoint of access right. That is, in the administrator authentication system, for example, when the operation α for reading the file A and the operation β for reading the file B are defined as the authority given to a certain administrator class, these operations are defined. α and β are always considered as a pair,
It is assumed that there is no administrator who can only perform the operation α and no administrator who can only perform the operation β. Also, in the administrator authentication system, it is possible to define an administrator class having operations that must not be combined.

Further, in the administrator authentication system,
Sub administrator class can be defined under any administrator class. In the administrator authentication system, all operations defined in the upper administrator class are inherited by the sub administrator class. That is, in the administrator authentication system, for example, when an operation α for reading the file A and an operation β for reading the file B are defined as the authority given to a certain administrator class, The operations α and β are inherited by the sub-administrator class located below the class, and the administrator belonging to this sub-administrator class can perform the operations α and β. In addition, in the administrator authentication system, a sub administrator class that inherits a plurality of administrator classes can be defined. However, in the administrator authentication system, the sub-administrator class cannot inherit the administrator class set in the administrator class that has operations that must not be performed concurrently when the hierarchy is traced to the upper level. .

Based on these rules, the administrator authentication system whose hierarchy is shown in FIG. 1 will be described. Here, for the administrator class MC ₁ , two operations OP ₁₁ and O ₁ are independently performed.
P _{1 2} is allowed as a privilege, the administrator class MC _2, alone in one operation _{OP 21} is permitted as a privilege,
It is assumed that one operation OP ₃₁ is independently permitted as the authority to the administrator class MC ₃ .

In such a manager authentication system, if manager classes MC ₂ and MC ₃ are provided as sub-manager classes below the manager class MC ₁ , managers belonging to the manager class MC ₂ Is the operation OP
₁₁ , OP ₁₂ , OP ₂₁ can be operated, and the administrator belonging to the administrator class MC ₃ operates OP ₁₁ , O 2.
The P ₁₂ and OP ₃₁ can be operated.

Further, in the administrator authentication system administrator class MC _1, it is impossible to inheritance, i.e., are defined by the administrator class MC ₄ as an administrator class with an operation that should not be concurrently Assuming that there is a manager class M ₄ , manager class M 4
Therefore, it is impossible to provide the manager class MC ₅ as a sub-manager class below C ₃ , that is, the manager class MC ₁ .

In such an administrator authentication system, the entities belonging to each administrator class, that is,
Specify the administrator as a member. In the administrator authentication system, a plurality of members may exist in one administrator class, and members can be added and / or deleted at any timing. In the administrator authentication system, an electronic certificate to be described later, which is electronically signed for each entity, is issued, and the administrator who actually performs each operation holds this electronic certificate to authenticate the operation. For example, in the administrator authentication system shown in FIG. 1, an administrator who is an entity belonging to the administrator class MC ₂ uses a distributed electronic certificate indicating that the operations OP ₁₁ , OP ₁₂ and OP ₂₁ can be operated. IC (Integrated
(Circuit) card, etc., and hold it, and when accessing the resources on the system side,
By performing a login operation using a C card or the like, the system side operates OP ₁₁ based on the electronic certificate.
Authentication is performed to the effect that OP ₁₂ and OP ₂₁ can be operated.

In addition, in the administrator authentication system, operations permitted as authority to each administrator class are added and / or
Or it can be deleted. Specifically, in the administrator authentication system, an arbitrary operation can be added when there is no member in the administrator class to which the arbitrary operation is added. In the administrator authentication system, when there are members in the administrator class, it is possible to add an arbitrary operation after deleting all members once. In the administrator authentication system, when there are members in the sub-administrator class, in order to avoid a situation in which a logical error when inheriting from a higher level to a lower level cannot be detected, Similarly, after deleting all members, any operation can be added. On the other hand, in the administrator authentication system, if there is no member in the administrator class targeted for deleting an arbitrary operation, the arbitrary operation can be deleted. In the administrator authentication system, when there are members in the administrator class, it is possible to delete all members once and then delete any operation. In addition, in the administrator authentication system, even when there are members in the sub-administrator class, any operation can be deleted after deleting all members.

Further, in the administrator authentication system,
As described above, each administrator holds the digital certificate, and whether the administrator holding the digital certificate belongs to a certain administrator class, that is, the operation defined in the certain administrator class The electronic certificate is used when the system side determines whether or not is permitted. The details of this digital certificate will be described later, but an administrator class identifier for identifying the administrator class, expiration date information indicating the expiration date of the electronic certificate, and a signature for identifying the signer of the electronic signature. The attribute information of the person, the electronic signature, and the like are included.

As the administrator authentication system, the following three cases are defined by the signer and the signing method.

First, as a first case, a signer is set for each manager class, and each signer signs an electronic certificate of each manager class. At this time, each signer has one signature key.

In this case, in the administrator authentication system, as shown in FIG. 2, the signer itself is hierarchized according to the hierarchy of the administrator class so that the lower signer is authenticated by the upper signer. To do so. At this time,
The highest signer is self-signed.

Specifically, in the administrator authentication system, as shown in FIG. 2B, four administrator class MCs are used.
₁ , MC ₂ , MC ₃ and MC ₄ are defined, and manager classes MC ₂ and MC ₃ are provided as sub-manager classes under the manager class MC ₁ and these manager classes MC ₂ and MC are provided. Assuming that a manager class MC ₄ is provided as a sub-manager class that inherits ₃ , the security infrastructure using the so-called public key cryptosystem is also added as shown in FIG. 2 (A). Public Key Infrastructure
using the mechanism of ructure; PKI) for digital signature 4
The human signers SG ₁ , SG ₂ , SG ₃ , SG ₄ are set. In the administrator authentication system, the signer SG ₁
Have a self-signed digital certificate CER _SG1 ,
The signers SG ₂ and SG ₃ are the upper signers SG, respectively.
Electronic certificate _CER SG2 which has been signed by the _1, CER
_{S G3} and the signer SG ₄ is an upper signer S
Digital certificate CE signed by both G ₂ and SG ₃
It has R _SG4 .

On the other hand, in the administrator authentication system, as shown in FIG. 2B, the administrator class MC ₁ has the electronic certificate CER _{MC 1} signed by the signer SG ₁ and The class MC ₂ has a digital certificate CER _MC2 signed by the signer SG ₂ , and the administrator class MC ₃ has a digital certificate CER _MC3 signed by the signer SG ₃ . Administrator class M
C ₄ is a digital certificate C signed by the signer SG ₄ .
It has an ER _MC4 .

In this administrator authentication system, the system
The system side is, for example, administrator class MC_FourDetermine access rights
When you do, please use the administrator class MC_FourElectronic certificate
Book CER_MC4And verify this electronic certificate CER_MC4
Is the signer SG_FourDetermine that is signed by
It In the administrator authentication system, the signer S
G_FourDigital certificate CER_SG4Refer to
Digital certificate CER_{SG Four}Is the signer SG_Two, SG_ThreeBy
By determining that it is signed by the administrator
Class MC_FourThere are two administrator class MC_Two, MC_ThreeFrom
Recognize that it was inherited and provided. As well
In addition, in the administrator authentication system, the administrator class MC
_Two, MC_ThreeDigital certificate CER that each has
_MC2, CER _MC3And verify these digital certificates C
ER_MC2, CER_MC3Is the signer SG _Two, SG_ThreeBy
If the signer SG_Two，
SG_ThreeDigital certificate CER that each has_SG2，
CER_SG3Refer to these digital certificates CER
_SG2, CER_SG3Is the signer SG₁Signed by
By determining that the administrator class M
C_Two, MC_ThreeBoth are manager class MC₁Inherited from
Recognize that it was provided by. And manage
In the person authentication system, administrator class MC₁Has
Digital certificate CER_{MC 1}Verify this electronic proof
Book CER_MC1Is the signer SG₁Signed by
If so, the signer SG₁Electronic certificate
Book CER_SG1Refer to this digital certificate CER_SG1
Is the signer SG₁Determine that it is self-signed by
By doing, admin class MC₁Is at the top
Recognize that it is something.

As described above, in the administrator authentication system, the signer itself is hierarchized according to the hierarchy of the administrator class so that the lower signer is authenticated by the upper signer, and the self-signed electronic certificate is provided. Up to the signer who holds the document, verify the hierarchical relationship of the administrator class by referring to which signer the digital certificate that each administrator class has signed. You can

Next, in the second case, a signature key is set for each administrator class, and an electronic certificate of each administrator class is multi-signed using the signature keys of its own and upper management classes. is there.

In this case, in the administrator authentication system, there is only one signer, as shown in FIG.

Specifically, in the administrator authentication system, as shown in FIG. 3B, four administrator class MCs are used.
₁ , MC ₂ , MC ₃ and MC ₄ are defined, and manager classes MC ₂ and MC ₃ are provided as sub-manager classes under the manager class MC ₁ and these manager classes MC ₂ and MC are provided. Assuming that a manager class MC ₄ is provided as a sub-manager class that inherits ₃ from FIG.
As shown in (A), these administrator classes MC ₁ , M
One signer SG having _four signature keys KEY ₁ , KEY ₂ , KEY ₃ , KEY ₄ for each of C ₂ , MC ₃ , MC ₄ is set. In the administrator authentication system, the signer SG uses the self-signed electronic certificate CER
_{Has SG} .

On the other hand, in the administrator authentication system, as shown in FIG. 3B, the administrator class MC ₁ has an electronic certificate CER _{MC 1} signed by the signer SG using the signature key KEY _1. And admin class MC
₂ has a digital certificate CER _MC2 signed by the signer SG using the signature keys KEY ₁ and KEY ₂ , and the administrator class MC ₃ sends the signature keys KEY ₁ and KEY ₃ by the signer SG. Digital certificate CE signed using
It has R _MC3 and the administrator class MC ₄ is signed by the signer SG by the signature keys KEY ₁ , KEY ₂ , KEY ₃ and K.
It has a digital certificate CER _MC4 signed using EY ₄ .

In this administrator authentication system, the system
The system side is, for example, administrator class MC_FourDetermine access rights
When you do, please use the administrator class MC_FourElectronic certificate
Book CER_MC4And verify this electronic certificate CER_MC4
Signing key KEY by the signer SG₁, KEY_Two, KE
Y_Three, KEY_FourTo determine that it is signed
By this, administrator class MC_FourThere are three administrator classes
MC₁, MC_Two, MC _ThreeThat is located at the bottom of
Recognize and. Similarly, in the administrator authentication system
Is an administrator class MC_ThreeDigital certificate CER
_MC3And verify this electronic certificate CER_MC3Is the signer
Signature key KEY by SG₁, KEY_ThreeSigned using
Administrator class MC by determining that
_ThreeIs a manager class MC₁That is located at the bottom of
Recognize and. Similarly, the administrator authentication system
For manager class MC_TwoCE certificate held by
R_{M C2}And verify this electronic certificate CER_MC2Signed by
Person SG signing key KEY ₁, KEY_TwoSign with
Administrator class M
C_TwoIs a manager class MC₁Is located in the lower part of
Recognize that. And in the administrator authentication system
Is an administrator class MC₁Digital certificate CER
_MC1And verify this electronic certificate CER_MC1Is the signer
Signature key KEY by SG₁Must be signed using
Administrator class MC by discriminating between₁Is the highest
Recognize that it is located in. Administrator authentication system
In this way, all administrator class
Administrator class MC by referring to the electronic certificate_Four
There are two administrator class MC₁, MC_TwoInherited from
This is the one for which the manager class MC_Two, MC_ThreeGato
Moni manager class MC₁Which was inherited from
And is a manager class MC₁Is at the top
Recognize that there is.

In this way, in the administrator authentication system, the signature key set for each administrator class is used to multiple-sign the electronic certificate possessed by each administrator class and The hierarchical relationship of the administrator class can be verified by referring to which signature key is used to sign the electronic certificate.

In the administrator authentication system shown as the second case, the signer itself may be hierarchized according to the hierarchy of the administrator class as in the first case, but the hierarchy verification It is redundant from the viewpoint of, and it is sufficient to provide one signer.

Finally, in the third case, one signer and one signing key are set, and which administrator class is permitted as an authority including the inherited part in the electronic certificate of each administrator class. The operation is to set information indicating whether the operation is permitted to the user.

Specifically, in the administrator authentication system, as shown in FIG. 4 (B), four administrator class MCs are used.
₁ , MC ₂ , MC ₃ and MC ₄ are defined, and manager classes MC ₂ and MC ₃ are provided as sub-manager classes under the manager class MC ₁ and these manager classes MC ₂ and MC are provided. Assuming that a manager class MC ₄ is provided as a sub-manager class that inherits ₃ from FIG.
As shown in (A), one signer SG having one signature key KEY is set. In the administrator authentication system, the signer SG uses the self-signed electronic certificate CER
_{Has SG} .

On the other hand, in the administrator authentication system, as shown in FIG. 4 (B), the administrator class MC ₁ has an electronic certificate _{CER MC1} signed with the signature key KEY by the signer SG This electronic certificate CER
_In the predetermined field of _MC1, the administrator class MC
_The information indicating that the operation permitted as authority to ₁ is permitted to the manager class MC ₁ is described. Further, in the administrator authentication system, the administrator class MC ₂ has the electronic certificate CER _MC2 signed by the signer SG using the signature key KEY, and a predetermined field of this electronic certificate CER _MC2. the administrator class MC ₁ operation is allowed as a privilege and the administrator class MC ₂ operations are allowed as rights to the information indicating that it is permitted to the administrator class MC ₂ is described Has been done. Further, in the administrator authentication system, the administrator class MC ₃ is an electronic certificate CER signed by the signer SG using the signature key KEY.
_MC3 is provided, and in the predetermined fields of this electronic certificate CER _MC3 , the operations permitted as authority to the administrator class MC ₁ and the operations permitted as authority to the administrator class MC ₃ are The manager class MC ₃
The information that indicates permission is described in. Furthermore, in the administrator authentication system administrator class MC ₄ may signer SG has an electronic certificate _{CER MC4} signed with the signature key KEY by a predetermined of the electronic certificate _{CER MC4} In the field, an operation permitted as an authority to the administrator class MC ₁ , an operation permitted as an authority to the administrator class MC ₂ , an operation permitted to the administrator class MC ₃ as an authority, and the administrator concerned operation in class MC ₄ are allowed as authority, information indicating that it is permitted to the administrator class MC ₄ are described.

[0045] In this administrator authentication system, when the system side to determine the access rights for example, business class MC ₄ verifies the digital certificate CER _MC4 where the administrator class MC ₄ has, the electronic Certificate CER _MC4
Operations permitted to the administrator class MC ₁ , operations permitted to the administrator class MC ₂ , operations permitted to the administrator class MC ₃ , and the administrator class MC. _{By determining} that the operation that is permitted as the authority to the administrator ₄ is described in the administrator class MC ₄ , the administrator class MC ₄ has three administrator classes MC ₁ ，
Recognize that they are subordinate to MC ₂ and MC ₃ . Similarly, in the administrator authentication system, the electronic certificate CER _MC3 possessed by the administrator class MC ₃ is verified, and the electronic certificate CER _{MC 3} is added to the administrator class M 3.
Operation C ₁ is allowed as a privilege and operations that are allowed on the administrative class MC ₃ as authority determines that the information indicating that it is permitted to the administrator class MC ₃ is described By this, administrator class MC
Recognize that ₃ is subordinate to the manager class MC ₁ . Similarly, in the administrator authentication system, the electronic certificate CE possessed by the administrator class MC ₂
R _MC2 is verified, and the operation permitted to the administrator class MC ₁ by this electronic certificate CER _MC2 and the operation permitted to the administrator class MC ₂ as an authority are assigned to the administrator class MC ₂ . By discriminating that the information indicating permission is described, it is recognized that the administrator class MC ₂ is located under the administrator class MC ₁ . Then, in the administrator authentication system, the electronic certificate CER _MC1 possessed by the administrator class MC ₁ is verified, and the electronic certificate CER _MC1 is verified.
To _MC1, by determining that the operation to the administrator class MC ₁ is allowed as a privilege, information indicating that it is permitted to the administrator class MC ₁ is described, the administrator class MC ₁ Recognize that is at the top. In the administrator authentication system, the administrator class MC ₄ is provided by being inherited from the two administrator classes MC ₁ and MC ₂ by thus referring to the electronic certificates of all the administrator classes. It is recognized that the administrator classes MC ₂ and MC ₃ are both provided by being inherited from the administrator class MC ₁ and the administrator class MC ₁ is located at the highest level.

As described above, in the administrator authentication system, the operation that is permitted as an authority to which administrator class, including inheritance, is permitted by the electronic certificate of each administrator class. It is possible to verify the hierarchical relationship of the administrator class by describing the information that indicates whether or not it is registered and referring to this electronic certificate. The administrator authentication system shown as the third case is effective when the hierarchy of the administrator class is not relatively complicated.

The administrator authentication system has been conceptually described above, but a specific implementation example of the administrator authentication system will be described below.

First, before describing a specific implementation example, a data structure required will be described.

The data required to configure the administrator authentication system include the administrator class and the electronic certificate described above.

The administrator class is a sub-administrator class list that is a list of sub-administrator classes that are located below itself, a higher-level administrator class list that is a list of administrator classes that is located above itself, and has authority to itself. The operation information indicating the operations that are permitted as the above, the list of the administrator classes that do not have combined duties, which is the list of administrator classes that have operations that must not be performed concurrently, and the signature on the electronic certificate as the information for verifying the electronic certificate. It consists of personal information or signature key information. Of these various types of information, the signer information or the signature key information for the electronic certificate is changed depending on which of the above-described first case to third case is applied.

On the other hand, as the electronic certificate, ISO (Inte
rnational Organization for Standardization) / IE
C (International Electrotechnical Commission)
9594-8, or ITU-T (International Teleco
mmunication Union-Telecommunication sector) X.
509 based on the public key certificate (Public Key Cer)
tificate; PKC and Attribute Certif
icate; AC) is used.

First, the public key certificate will be described. A public key certificate is a certification authority that is an independent third party in the public key cryptosystem.
Thority; CA or Issuer Authority; IA).

Here, the public key cryptosystem will be described. In the public key cryptosystem, a sender and a receiver have different keys, one key is a public key that can be used by an unspecified user, and the other key is a secret key that is kept secret. Unlike the so-called common key cryptosystem, which uses a common key for encryption and decryption, the public key cryptosystem requires only one person to hold the secret key that needs to be kept secret. It is advantageous in key management. A typical public key cryptosystem is a so-called RSA (Ri
vest-Shamir-Adleman) There is a cipher. This RSA encryption utilizes the difficulty of the prime factorization process of the product of two very large prime numbers of about 150 digits.

The public key cryptosystem allows the public key to be used by an unspecified number of users, and a public key certificate is used to prove whether or not the public key to be distributed is legitimate. The method is widely used. For example, in the public key cryptosystem, a specific user A generates a public key and a private key that form a pair, and sends the generated public key to a certificate issuing certificate authority to obtain a public key certificate. Then, the public key certificate is made public. On the other hand, unspecified users
A public key is obtained by performing a predetermined procedure based on the public key certificate, and a plaintext document or the like is encrypted and sent to a specific user A. Then, the user A performs processing such as decrypting the encrypted document sent from an unspecified user using the private key. The public key cryptosystem is such a cryptosystem.

In the public key cryptosystem, the user A adds a signature to a plaintext document or the like by using the secret key,
It becomes possible for an unspecified user to obtain a public key by performing a predetermined procedure based on the public key certificate and verify the signature. For example, in the public key cryptosystem, when the certificate issuing certificate authority determines the public key by referring to the public key certificate, it sends an arbitrary plaintext document or the like to the user A and encrypts it using the private key. And send it back again. The certificate issuing certificate authority can verify the validity of the signature by decrypting the encrypted document sent from the user A using the public key.

The public key certificate in such a public key cryptosystem is a certificate issuing certificate authority when a user who is an administrator submits information for identifying himself and a public key to the certificate issuing certificate authority. It is created by adding information for the side to identify the certificate issuing certificate authority and information such as the expiration date, and further adding a signature by the certificate issuing certificate authority.

Specifically, the public key certificate has a format as shown in FIGS. 5 and 6. It should be noted that in the figure, items for each field constituting the public key certificate, a description of each of these items, and an example of a described value are described.

The version shown in FIG. 5 is a field that describes version information of the format of the public key certificate. For example, the format is version 3
If it is, "2" indicating version 3 is described.

The serial number is a field that describes the serial number of the public key certificate set by the certificate issuing certificate authority, and describes, for example, a sequential number.

Signature algorithm identifier and algorithm parameter (signature algorithm identifier algor)
Ithm parameters) is a field that describes information for identifying the signature algorithm of the public key certificate and its parameters. The signature algorithm includes, for example, elliptic curve cryptography or RSA cryptography. When the elliptic curve cryptography is applied as the signature algorithm, parameters and key length are described as algorithm parameters, and RSA cryptography is applied as the signature algorithm. If so, the key length is described as an algorithm parameter.

The issuer is a field described in a format (Distinguished Name) that enables identification of the issuer of the public key certificate, that is, the name of the certificate issuing certificate authority.

The validity period (validity) is a field describing the start date and time (not Before) and the end date and time (not After) which are the validity periods of the public key certificate.

The subject is a field in which the name of the authentication subject who is the user is described, and for example, the identifier of the user device, the identifier of the service providing entity, and the like are described.

Subject Public Key Information (subject Public
Key Info algorithm subject public key) is a field that describes a key algorithm as the user's public key information or the key information itself, and the key algorithm includes, for example, elliptic curve cryptography or RSA cryptography.

Each of these fields is a field included in the public key certificate whose format is version 1 or later, and each of the fields shown below is a field added to the version 3 version. .

Authority Key Identifi
er-key Identifier, authority Cert Issuer, authorit
y Cert Serial Number) is information for identifying the key for confirming the signature of the certificate issuing certificate authority, and is the key identification number in octal notation, and the name of the certificate issuing certificate authority in the General Name format. , And an authentication number field.

Subject key identifier
tifier) is a field describing an identifier for identifying each key when a plurality of keys are certified in a public key certificate.

The key usage purpose (key usage) is a field for designating the purpose of use of the key, and is (0) for digital signature (digital Signature) and (1) for non-repudiation (non Rep
udiation), (2) for key encryption (key Enciphermen
t), (3) For message encryption (data Enciphermen
t), (4) Common key delivery (key agreement), (5) Authentication signature confirmation (key Cert Sign), (6) Revocation list signature confirmation (CRL Sign), (7) Key exchange ( key Agre
ement) Only used for data encryption (encipher Only),
And (8) Only used for decryption of data during key exchange (decipher
Only) is set for each purpose.

Private Key Usage Peri
od) is a field describing the start date and time (not Before) and the end date and time (not After), which are the expiration dates of the private key possessed by the user. By default, the expiration date of the public key certificate and the expiration date of the public key. And the expiration date of the private key are the same.

The certificate authority policy (Certificate) shown in FIG.
Policy) is a field that describes the certificate issuing policy of the certificate issuing certificate authority. For example, ISO / IEC 9
834-1 compliant policy ID (policy Identifie
r) and certification criteria (policy qualifiers) are described.

Policy mapping
s) is a field described only when authenticating a certificate issuing certificate authority, and is a field that describes the certificate issuing certificate authority's policy (issuer Domain Policy) and the subject policy (subject Domain Policy) that issue certificates. Specify the mapping.

Supported Algorithm (supported Algo
rithms) is a field that defines the attributes of the directory (X.500). The support algorithm is used to notify the attribute in advance when the communication partner uses the directory information.

Subject Alt Name
Is a field in which a user's alias is described in a general name format.

The issuer alias (issuer Alt Name) is a field that describes the alias of the certificate issuer.

The subject directory attributes are fields that describe the user's arbitrary attributes.

The basic constraints (basic Constraints) are fields for distinguishing whether the public key to be certified is for the signature of the certificate issuing certificate authority or for the user.

Allowable subtree constraint names (name Constraints
permitted Subtrees) is a field indicating the effective area of the public key certificate used only when the subject is the certificate issuing certificate authority.

The constraint policy (policy Constraints) is
This field describes the restrictions that require a clear authentication policy ID or prohibition policy map for the rest of the authentication path.

CRL Reference Point (Certificate Revoca
Option List Distribution Points) is a field describing the reference point of the revocation list for confirming whether the public key certificate has been revoked when the user uses the public key certificate.

The signature is issued by the public key certificate issuer, that is,
This is the signature field of the certificate issuing certificate authority. A digital signature is data generated by applying a so-called hash function to the entire public key certificate to generate a hash value, and encrypting this hash value using the private key of the certificate issuing certificate authority. .

The certificate issuing certificate authority issues a public key certificate in such a format, updates the expired public key certificate, and invalidates the unauthorized user. Create, manage, distribute
That is, revocation is performed. The certificate issuing certificate authority also generates a public key and a private key, if necessary.

On the other hand, the user who uses this public key certificate uses his / her public key of the certificate issuing certificate authority,
When the electronic signature of the public key certificate is verified and the verification of the electronic signature is successful, the public key can be acquired based on the public key certificate and this public key can be used. Therefore,
All users who use the public key certificate must have the public key of the certificate issuing certificate authority that issued the public key certificate.

In the administrator authentication system, the signer holds such public key certificate.

Next, the attribute certificate which is one of the electronic certificates required in the administrator authentication system will be described. The attribute certificate is a local authority that is different from the above-mentioned certificate issuing certificate authority (Attribute Auth
ority; AA).

The attribute certificate has a format as shown in FIGS. 7 and 8. In addition, in the figure,
The items for each field constituting the attribute certificate and the description for each item are described.

The version shown in FIG. 7 is a field that describes version information of the format of the attribute certificate. For example, the format is version 2
In the case of (1), "1" indicating version 2 (1) is described.

The holder is a field for specifying the owner of the public key certificate to which the attribute certificate is linked. The holder has a base certificate authority identifier (ba
As the se Certificate ID), the issuer name (issuer) of the public key certificate owned by the owner of the attribute certificate and the serial number (seria) of the public key certificate owned by the owner of the attribute certificate
l), the unique identifier (issuer UID) for identifying the issuer of the public key certificate held by the owner of the attribute certificate is described. In addition, the holder has a subject (subject) or subject alternative name (subject) in the public key certificate.
The owner name (entity name) of the attribute certificate that is the same as the Alt Name) is described. Further, in the holder, assuming that the attribute certificate is not linked to the identity information or public key certificate in the future, for example, the hash of the public key is described in the object digest information (object Digest Info). ) Is described.

The issuer is a field for designating the name of the issuer who signed the attribute certificate.

The signature is a field for describing an identifier for identifying an algorithm used for validating the signature of the attribute certificate.

The serial number is a field that describes the serial number assigned to each attribute certificate by the attribute certificate authority.

Attribute Certificate Validity (attr Cert Validity
Period) is the start date and time (n
ot Before) and end date and time (not After).

The attributes shown in FIG. 8 are fields that describe information regarding the privilege of the owner of the attribute certificate. For example, the object to which access is permitted may be described in a sentence. You may write the code that can be accessed prepared in the above, or you may write the key that encrypts a certain plaintext. For example, the attribute includes authentication information (Service Au) regarding the service used by the verifier of the attribute certificate to authenticate the owner of the attribute certificate.
thentication Information), and the access permission information (Acce
ss Identity), information for identifying the owner of the attribute certificate for billing (Charging Identity), information indicating the attribution relationship of the owner of the attribute certificate to the group (Grou
p), information indicating the role given to the owner of the attribute certificate (Role), and information regarding permission to use secret information for the owner of the attribute certificate (Clearance).

Issuer Unique ID
Is a field used when specified by the public key certificate of the issuer of the attribute certificate.

The extension information is a field describing the attribute certificate information, not the attribute certificate owner information. The server and / or service administrator audits the attribute certificate owner. Information used for detecting fraudulent activity, that is, identification (Audit Identity), information indicating the server and / or service targeted by the attribute certificate (AC Targeting), the attribute certificate verifier Key information (Authority Key) of the issuer of the attribute certificate, which is auxiliary information for signature confirmation, and auxiliary information for the revocation status confirmation of the attribute certificate by the verifier of the attribute certificate.
URI (Uniform Resource Identif) of CSP Responder
iers) information (Authority Information Access),
CRL (Certificate Revocation L) which is auxiliary information for the revocation status confirmation of the attribute certificate by the verifier of the attribute certificate
ist) Information indicating the URI of the distribution point (CRL Distributio
n), information indicating that there is no revocation information corresponding to the attribute certificate (No Revocation), information used when the submitter is other than the owner, and information indicating the entity that can submit the attribute certificate ( Proxy Info) is described.

In the management authentication system, by holding the attribute certificate having such a format in each manager, it is possible to verify which manager class the manager belongs to.

The administrator authentication system is constructed using the administrator class, public key certificate and attribute certificate as described above. In the administrator authentication system, each entity has the following information when actually constructing the administrator authentication system.

That is, in the management authentication system,
For example, it is the side that handles whether or not an administrator can access a certain resource by receiving access control for a certain administrator, such as a system in a department in a company that provides a certain service. The system side has information on the defined administrator class, the electronic certificate or public key issued by the above-mentioned certificate issuing certificate authority or attribute certificate authority, and the public key certificate used for mutual authentication with each administrator. Have and.

On the other hand, in the administrator authentication system, the administrator side such as a department in the company that performs management for issuing the attribute certificate to each administrator is issued by the certificate issuing certificate authority or the attribute certificate authority. Digital certificate or public key, a public key certificate used for mutual authentication with the system side, and an attribute certificate used for permitting access to each administrator.

The administrator authentication system composed of the system side having such various information and the administrator side is specifically shown in FIGS. 9 and 10 in accordance with the above-mentioned first to third cases. 14 or as shown in FIG.

First, an implementation example to which the above-mentioned first case is applied will be described. In the first case, as described above, a signer having one signing key is set for each manager class, and each signer signs an electronic certificate of each manager class.

Here, in order to explain in correspondence with the administrator authentication system to which the first case whose concept is shown in FIG. 2 is applied, four administrator classes MC ₁ , M are used.
C ₂ , MC ₃ and MC ₄ are defined, and the administrator classes MC ₂ and M are subordinate to the administrator class MC ₁ as sub administrator classes.
C ₃ is provided and these administrator classes MC ₂ , MC ₃
Administrator class MC ₄ as a sub administrator class that inherits from
Is provided, and the administrator who performs the operation belongs to the administrator class MC ₄ .

In this case, in the administrator authentication system, each signer is implemented by using the above-mentioned attribute certificate authority defined by ISO / IEC 9594. In addition, in the administrator authentication system, as an electronic certificate, ISO
The attribute certificate issued by the above-mentioned attribute certificate authority defined in / IEC 9594 is used. Further, in the administrator authentication system, since the public key certificate needs to be issued by the above-mentioned certificate issuing certificate authority before issuing the attribute certificate, a certificate issuing certificate authority is also introduced. Furthermore, in the administrator authentication system, each administrator who performs an operation holds this IC card in which these electronic certificates are stored, and when performing an operation, this I
The C card shall be used.

Such an administrator authentication system is shown in FIG.
Implemented as shown. That is, the administrator authentication system
Is the four hierarchical management class MC₁, MC_Two，
MC _Three, MC_FourAccess target of administrator OP in which is defined
System that holds the resources to be used and public key certificate
Certificate issuing CA that issues the certificate and this certificate
Four public key certificates P issued by the line certificate authority CA
KC_AA1, PKC_{A A2}, PKC_AA3, PKC
_AA4Four attribute certificate authorities AA that hold each₁, A
A_Two, AA_Three, AA_FourAnd the operation performed by the administrator OP
Management that is an information processing device such as a personal computer
And a person terminal COM.

Here, the four attribute certification authorities AA₁, A
A_Two, AA_Three, AA_FourAre respectively shown in FIG. 2 above.
4 signers SG₁, SG_Two, SG_Three, SG_FourEquivalent to
And these attribute certification authorities AA₁, AA_Two, A
A_Three, AA_Four4 public key certificates P each holds
KC_AA1, PKC_AA2, PKC_AA3, PKC
_AA4Are the digital certificates CER_SG1, CER
_SG2, CER_SG3, CER _SG4Corresponding to
is there.

In the administrator authentication system, there are four
Sex Certification Authority AA₁, AA_Two, AA_Three, AA_FourThat
4 manager class MC₁, MC_Two, MC_Three, MC
_FourAttribute certification authority AA₁about,
Self-signed public key certificate PKC_AA1Have and attributes
Certificate Authority AA_Two, AA_ThreeFor, respectively, the top genus
Sex Certification Authority AA₁Public key certificate PKC signed by
_AA2, PKC_AA3With attribute certification authority AA_FourAbout
Is a higher-level attribute certificate authority AA_Two, AA_ThreeBy both
Signed public key certificate PKC_AA4Shall have
4 attribute certification authorities AA₁, A
A_Two, AA_Three, AA_FourEach attribute certification authority A without layering
A₁, AA_Two, AA_Three, AA_FourHeld by each
Key certificate PKC _AA1, PKC_AA2, PKC_AA3，
PKC_AA4Describes the information that indicates the higher-level attribute certification authority.
By doing so, it is configured as if it were logically layered.
You may.

As a preparation phase for constructing such an administrator authentication system, the process shown in FIG. 10 is performed.

First, in the administrator authentication system, as shown in the figure, in step S1, the attribute authentication stations AA ₁ , AA ₂ , AA ₃ , AA _4, and the IC card to be held by the administrator OP. In order to certify the ICC, the certificate issuing certificate authority CA uses the attribute certificate authorities AA ₁ , AA.
_The public key certificate P for each of ₂ , ₂ , AA ₃ , and AA _4.
KC _AA1 , PKC _AA2 , PKC _AA3 , PKC
While issuing _AA4 , the public key certificate PKC is issued to the IC card ICC that the administrator OP holds. Public key certificates PKC _{A A1} , PKC _AA2 , PK issued by the certificate issuing CA
C _AA3 and PKC _AA4 are respectively attribute certification authorities AA
_The public key certificate PKC is stored in the IC card ICC while being held by ₁ , AA ₂ , AA ₃ , and AA ₄ .

Next, in the administrator authentication system,
In step S2, the system SYS defines the administrator classes MC ₁ , MC ₂ , MC ₃ , MC ₄ and the operations belonging to these administrator classes MC ₁ , MC ₂ , MC ₃ , MC ₄ . Actually, in the administrator authentication system, as a rule by this system SYS, the part used in any case is fixedly implemented by a predetermined program, and an administrator having a predetermined privilege changes this program. It is implemented so that an administrator class and operation can be added arbitrarily.

And in the administrator authentication system,
In step S3, the system SYS verifies for verification.
Acquire the public key of the certificate issuing authority CA and, for example,
For example, download via the Certificate Issuing Certification Authority CA
By Attribute Certification Authority AA₁, AA_Two, AA_Three, AA_Fourof
Signature key, that is, public key KEY₁, KEY_Two, KEY
_Three, KEY_FourTo get. Note that these public keys KEY
₁, KEY_Two, KEY _Three, KEY_FourRespectively, first
Digital certificate CER shown in FIG._MC1, CER _MC2，
CER_MC3, CER_MC4It corresponds to. This
As a result, in the administrator authentication system, the system S
Administrator class MC by YS₁, MC _Two, MC_Three, M
C_FourAnd attribute certificate authority AA₁, AA_Two, AA_Three, AA_FourWith
Manage the response and end the series of preparation phases.

The administrator authentication system goes through the preparation phase consisting of such a series of steps, whereby the administrator classes MC ₁ , MC ₂ , MC ₃ , MC ₄ and the attribute certificate authority A
System SY corresponds to A ₁ , AA ₂ , AA ₃ , and AA _4.
It is constructed in a state managed by S.

In the administrator authentication system constructed as described above, the steps shown in FIG. 11 are performed as the administrator registration phase for registering the administrator OP.

First, in the administrator authentication system, as shown in FIG.
The YS specifies the corresponding attribute certification authority when registering the administrator OP. That is, in the administrator authentication system, as described above, the administrator OP is the administrator class MC ₄
System SY since it belongs to
Attribute certificate authority A corresponding to administrator class MC ₄ by S
Identify A ₄ .

Next, in the administrator authentication system,
In step S12, the IC card IC issued by the certificate issuing certification authority CA in the above-mentioned preparation phase
The public key certificate PKC stored in C and the system S
The public key KEY that YS has obtained from the attribute certification authority AA _4
4 is used to perform mutual authentication between the IC card ICC and the system SYS. This mutual authentication is authentication for the IC card ICC itself held by the administrator OP, and is for authenticating whether or not the IC card ICC can be used in the system SYS.

Next, in the administrator authentication system,
If the authentication of the IC card ICC is successful, step S13
In the system SYS is, attribute authority identified in step S11, i.e., with respect to attribute authority AA _4, and requests the issuance of an attribute certificate AC.

Next, in the administrator authentication system,
In step S14, the identified attribute certification authority, that is, the attribute certification authority AA ₄ creates the attribute certificate AC,
The created attribute certificate AC is passed to the system SYS.

Then, in the administrator authentication system,
In step S15, the system SYS stores the attribute certificate AC in the IC card ICC, and the IC card IC
The CC is distributed to the administrator OP, and the series of administrator registration phases is completed.

The administrator authentication system can register the administrator OP by going through the administrator registration phase consisting of such a series of steps.

Further, in the administrator authentication system in which the administrator OP is registered in this way, when the administrator OP uses the system SYS to perform an arbitrary operation, a usage phase is shown in FIG. The steps shown are performed.

First, in the administrator authentication system, as shown in FIG.
When performing a certain operation, the IC card ICC distributed from the system SYS in the administrator registration phase described above.
Is inserted into the read / write unit R / W that reads and / or writes data to and from the IC card ICC provided in the administrator terminal COM that the user operates, and is attached to the administrator terminal COM.

Next, in the administrator authentication system,
In step S22, the system SYS refers to the public key certificate PKC stored in the IC card ICC, so that the IC card ICC sets the system SYS to the relevant system SYS.
Authenticate whether it can be used in.

Then, in the administrator authentication system,
If the authentication of the IC card ICC is successful, step S23
In the system SYS, by referring to the attribute certificate AC stored in the IC card ICC by using the public key KEY ₄ , the attribute certificate authority that has signed this attribute certificate AC, that is, the attribute certificate authority AA. ₄ to verify that the corresponding administrator class MC ₄ can be accessed, determine whether or not to grant the administrator OP access permission for the operation, and execute a series of usage phases. finish.

The administrator authentication system can determine the permission for the operation by the administrator OP by the system SYS by going through the use phase consisting of such a series of steps, and the administrator who is given the operation permission can be determined. The OP can perform the operation.

Furthermore, in the administrator authentication system, when it is desired to delete a member belonging to the administrator class,
As described above, when deleting a member belonging to the administrator class, such as a case of temporarily deleting a member in order to add and / or delete an operation for the administrator class, as shown in FIG. The steps shown are performed. Members belonging to a certain administrator class have different public key certificates PKC, but the attribute certificate AC has different data as it has different issuance dates, expiration dates, etc. Have a relationship to hold the same thing.

First, in the administrator authentication system, as shown in FIG.
YS operates the administrator terminal CO under the operation of the administrator OP.
A member deletion request given by M is accepted.

Next, in the administrator authentication system,
In step S32, the public key certificate PKC stored in the IC card ICC and the public key KEY ₄ obtained from the attribute certification authority AA ₄ by the system SYS are used to communicate between the IC card ICC and the system SYS. Mutually authenticate with.

Next, in the administrator authentication system,
In step S33, the system SYS requests the attribute certification authority that has issued the attribute certificate AC stored in the IC card ICC, that is, the attribute certification authority AA ₄ to request revocation of the attribute certificate AC.

Next, in the administrator authentication system,
In step S34, the attribute certification authority AA ₄ creates a revocation list as necessary. It should be noted that this revocation list indicates that the attribute certificate AC is invalid when there is an administrator who is using the attribute certificate AC, so it is not necessary to issue it. is there.

Then, in the administrator authentication system,
In step S35, the system SYS deletes the attribute certificate AC stored in the IC card ICC and ends the series of deletion phases.

The administrator authentication system can delete the members belonging to the administrator class by going through the deletion phase consisting of such a series of steps.

In the administrator authentication system, when updating the members belonging to the administrator class, the deletion phase shown in FIG. 13 is performed as the update phase.
Furthermore, the members belonging to the administrator class can be updated by performing the administrator registration phase shown in FIG.

As described above, in the administrator authentication system, a signer having one signing key is set for each administrator class, and each signer signs the electronic certificate of each administrator class. It can be implemented by applying a case.

Next, an implementation example to which the above-mentioned second case is applied will be described. In the second case, as described above, the signature key is set for each administrator class, and the electronic certificate of each administrator class is multi-signed by using the signature keys of its own and upper management classes. .

Here, also in order to explain in correspondence with the administrator authentication system to which the second case whose concept is shown in FIG. 3 is applied, the four administrator classes MC ₁ and M are used.
C ₂ , MC ₃ and MC ₄ are defined, and the administrator classes MC ₂ and M are subordinate to the administrator class MC ₁ as sub administrator classes.
C ₃ is provided and these administrator classes MC ₂ , MC ₃
Administrator class MC ₄ as a sub administrator class that inherits from
Is provided, and the administrator who performs the operation belongs to the administrator class MC ₄ .

In this case, in the administrator authentication system, each signer is set to ISO in the same manner as in the first case described above.
It is implemented using the attribute certification authority defined in / IEC 9594. Further, in the administrator authentication system, an attribute certificate issued by an attribute certificate authority defined in ISO / IEC 9594 is used as the electronic certificate. Further, in the administrator authentication system, the public key certificate needs to be issued by the certificate issuing certificate authority before issuing the attribute certificate, so a certificate issuing certificate authority is also introduced. Furthermore, in the administrator authentication system, each administrator who performs an operation holds an IC card in which these electronic certificates are stored, and when performing an operation,
This IC card shall be used.

Such an administrator authentication system is shown in FIG.
It is implemented as shown in. That is, the administrator authentication system has four hierarchical administrator classes MC ₁ and M.
A system SYS that holds resources to be accessed by an administrator OP in which C ₂ , MC ₃ , and MC ₄ are defined, a certificate issuing certificate authority CA that issues a public key certificate, and this certificate issuing certificate authority CA Public key certificate P issued by
One attribute authority AA holding KC _AA and administrator O
An administrator terminal COM, which is an information processing device such as a personal computer that P operates, is provided.

Here, one attribute certificate authority AA corresponds to the one signer SG shown in FIG. 3, and the public key certificate PKC held by this attribute certificate authority AA.
_AA corresponds to the electronic certificate CER _SG .

In the administrator authentication system, the administrator O
The attribute certificate AC stored in the IC card ICC that P holds will be stored in the administrator classes MC ₁ , MC ₂ , MC.
₃ and MC ₄ , the signature keys of the attribute certificate authority AA, that is, the public keys KEY ₁ , KEY ₂ , KEY ₃ ,
By signing with the KEY ₄ , it is possible to grasp the hierarchical relationship of the administrator class to which the administrator OP belongs, that is, the administrator class MC ₄ .

As a preparation phase for constructing such an administrator authentication system, the first phase shown in FIG.
In this case, the same process as the preparation phase is performed. That is, in the administrator authentication system, the process shown in FIG. 15 is performed as the preparation phase.

First, in the administrator authentication system, as shown in the figure, in step S41, the IC card I to be held by the attribute authentication authority AA and the administrator OP.
In order to be able to certify the CC, the certificate issuing certificate authority CA
Issues the public key certificate PKC _AA to the attribute certificate authority AA and issues the public key certificate PKC to the IC card ICC to be held by the administrator OP, as in step S1 described above. To do. Certificate issuing certificate authority C
The public key certificate PKC _AA issued by A is held by the attribute certification authority AA, and the public key certificate PKC is stored in the IC card ICC.

Then, in the administrator authentication system,
In step S42, the system SYS, similarly to step S2 described above, manages the manager classes MC ₁ and M.
C ₂ , MC ₃ , MC ₄ and their manager class M
The operations belonging to C ₁ , MC ₂ , MC ₃ , and MC ₄ are specified.

Then, in the administrator authentication system,
In step S43, the system SYS is, as in step S3 described above, the certificate issuing certificate authority CA for verification.
Of the attribute certification authority AA to be used for each of the administrator classes MC ₁ , MC ₂ , MC ₃ and MC ₄ by obtaining the public key of Public key KEY ₁ ,
Obtain KEY ₂ , KEY ₃ , and KEY ₄ . Note that these public keys KEY ₁ , KEY ₂ , KEY ₃ , and KEY
₄ are the signature keys KEY ₁ and K shown in FIG. 3, respectively.
It corresponds to EY ₂ , KEY ₃ , and KEY ₄ . As a result, in the administrator authentication system, the system S
Administrator class MC ₁ , MC ₂ , MC ₃ , M by YS
Public key _KEY 1 of the C ₄ and attribute authority AA, _KEY 2, K
The correspondence with EY ₃ and KEY ₄ is managed, and a series of preparation phases are ended.

The administrator authentication system goes through the preparation phase consisting of such a series of steps to obtain the administrator classes MC ₁ , MC ₂ , MC ₃ , MC ₄ and the attribute certification authority A.
Correspondence with the public keys KEY ₁ , KEY ₂ , KEY ₃ , and KEY ₄ of A is constructed in a state managed by the system SYS.

In the administrator authentication system thus constructed, the steps shown in FIG. 16 are performed as the administrator registration phase for registering the administrator OP.

First, in the administrator authentication system, as shown in FIG.
YS is the administrator OP, as in step S11 described above.
Specify the corresponding attribute certificate authority when registering. Here, since only one attribute certification authority AA exists as the attribute certification authority, the attribute certification authority AA is specified by the system SYS in the administrator certification system.

Then, in the administrator authentication system,
In step S52, the IC card IC issued by the certificate issuing certificate authority CA in the above-described preparation phase
The public key certificate PKC stored in C and the system S
Public key KE that YS has obtained from the attribute certification authority AA
Using Y ₁ , KEY ₂ , KEY ₃ , and KEY ₄ , IC
Mutual authentication is performed between the card ICC and the system SYS.

Then, in the administrator authentication system,
If the authentication of the IC card ICC is successful, step S53
In the system SYS, in step S13 described above,
Similarly, the attribute certification authority AA specified in step S51
Is requested to issue the attribute certificate AC.

Next, in the administrator authentication system,
In step S54, the attribute certification authority AA creates the attribute certificate AC, and uses the created attribute certificate AC in the system S.
Hand over to YS. At this time, unlike the first case, the attribute certificate authority AA, when giving a signature to the attribute certificate AC, gives a signature according to the hierarchy of the administrator class to which the administrator OP belongs. That is, since the administrator OP belongs to the administrator class MC ₄ in the attribute certification authority AA, the public keys KEY ₁ and KE are assigned to the attribute certificate AC.
A signature is attached using Y ₂ , KEY ₃ , and KEY ₄ .

Then, in the administrator authentication system,
In step S55, the system SYS stores the attribute certificate AC in the IC card ICC, distributes the IC card ICC to the manager OP, and ends the series of manager registration phases, as in step S15 described above.

The administrator authentication system can register the administrator OP by going through the administrator registration phase consisting of such a series of steps.

Further, in the administrator authentication system in which the administrator OP is registered in this way, when the administrator OP uses the system SYS to perform an arbitrary operation, a usage phase is shown in FIG. The steps shown are performed.

First, in the administrator authentication system, as shown in FIG.
Similar to step S21 described above, when performing a certain operation, the system SY is executed in the administrator registration phase described above.
Management by inserting the IC card ICC distributed from S into the read / write unit R / W that is provided in the administrator terminal COM that is operated by itself and that reads and / or writes data to the IC card ICC Attach to the person terminal COM.

Next, in the administrator authentication system,
In step S62, the system SYS refers to the public key certificate PKC stored in the IC card ICC in the same manner as in step S22 described above.
It authenticates whether the card ICC can be used in the system SYS.

Then, in the administrator authentication system,
If the authentication of the IC card ICC is successful, step S63
In the system SYS, the public key KEY ₁ , KEY ₂ , KEY ₃ , and KEY _{4 of the} attribute certificate AC stored in the IC card ICC are matched with the hierarchy of the administrator class.
By referring to the attribute certificate AC, the attribute certificate authority AA that has signed the attribute certificate AC is specified, and it is verified that the corresponding administrator class MC ₄ can be accessed. It is determined whether or not the access right is granted to the operation, and the series of use phases is ended.

The administrator authentication system can determine the permission for the operation by the administrator OP by the system SYS by going through the use phase consisting of such a series of steps, and the administrator who is given the permission for the operation can The OP can perform the operation.

Furthermore, in the administrator authentication system, when a member belonging to the administrator class is deleted, the process shown in FIG. 18 is performed as a deletion phase.

First, in the administrator authentication system, as shown in FIG.
YS is the administrator OP, as in step S31 described above.
A member deletion request given from the administrator terminal COM is received under the operation of.

Subsequently, in the administrator authentication system,
In step S72, the public key certificate PKC stored in the IC card ICC and the public keys KEY ₁ , KEY ₂ , obtained by the system SYS from the attribute certification authority AA.
Mutual authentication is performed between the IC card ICC and the system SYS by using KEY ₃ and KEY ₄ .

Then, in the administrator authentication system,
In step S73, the system SYS requests the attribute certificate authority AA, which issues the attribute certificate AC stored in the IC card ICC, to revoke the attribute certificate AC, as in step S33 described above. .

Then, in the administrator authentication system,
In step S74, the attribute certificate authority AA creates a revocation list as needed, as in step S34 described above.

Then, in the administrator authentication system,
In step S75, the system SYS deletes the attribute certificate AC stored in the IC card ICC, as in step S35 described above, and ends the series of deletion phases.

The administrator authentication system can remove the members belonging to the administrator class by going through the deletion phase consisting of such a series of steps.

In the administrator authentication system, when updating the members belonging to the administrator class, the deletion phase shown in FIG. 18 is executed as the update phase.
Furthermore, the members belonging to the administrator class can be updated by performing the administrator registration phase shown in FIG.

As described above, in the administrator authentication system, the signature key is set for each administrator class, and the electronic certificate of each administrator class is multi-signed by using the signature keys of the self and upper management classes. Two cases can be applied and implemented.

Next, an implementation example to which the above-mentioned third case is applied will be described. In the third case, as described above, one signer and one signing key are set, and which administrator class is authorized as an authority including the inherited part in the electronic certificate of each administrator class. The information indicating whether or not the operation being performed is permitted by the user.

Here, also in order to explain in correspondence with the administrator authentication system to which the third case whose concept is previously shown in FIG. 4 is applied, the four administrator classes MC ₁ , M
C ₂ , MC ₃ and MC ₄ are defined, and the administrator classes MC ₂ and M are subordinate to the administrator class MC ₁ as sub administrator classes.
C ₃ is provided and these administrator classes MC ₂ , MC ₃
Administrator class MC ₄ as a sub administrator class that inherits from
Is provided, and the administrator who performs the operation belongs to the administrator class MC ₄ .

In this case, in the administrator authentication system, each signer is set to ISO in the same manner as in the first case described above.
It is implemented using the attribute certification authority defined in / IEC 9594. Further, in the administrator authentication system, an attribute certificate issued by an attribute certificate authority defined in ISO / IEC 9594 is used as the electronic certificate. Further, in the administrator authentication system, the public key certificate needs to be issued by the certificate issuing certificate authority before issuing the attribute certificate, so a certificate issuing certificate authority is also introduced. Furthermore, in the administrator authentication system, each administrator who performs an operation holds an IC card in which these electronic certificates are stored, and when performing an operation,
This IC card shall be used.

Such an administrator authentication system is shown in FIG.
It is implemented as shown in. That is, the administrator authentication system has four hierarchical administrator classes MC ₁ and M.
A system SYS that holds resources to be accessed by an administrator OP in which C ₂ , MC ₃ , and MC ₄ are defined, a certificate issuing certificate authority CA that issues a public key certificate, and this certificate issuing certificate authority CA Public key certificate P issued by
One attribute authority AA holding KC _AA and administrator O
An administrator terminal COM, which is an information processing device such as a personal computer that P operates, is provided.

Here, one attribute certificate authority AA corresponds to the one signer SG shown in FIG. 4, and the public key certificate PKC held by this attribute certificate authority AA.
_AA corresponds to the electronic certificate CER _SG .

In the administrator authentication system, the administrator O
In the field describing the above-mentioned attributes in the attribute certificate AC stored in the IC card ICC to be held by P, the operation permitted to any administrator class including the inheritance, By describing the information indicating whether the user is allowed to
Administrator class to which P belongs, that is, administrator class MC
It is possible to grasp the hierarchical relationship of ₄ .

The preparation phase for constructing such an administrator authentication system is the second phase shown in FIG.
In this case, the same process as the preparation phase is performed.

That is, in the administrator authentication system, in order to authenticate the IC card ICC held by the attribute authentication station AA and the administrator OP, the certificate issuing certificate authority CA performs the above-mentioned step S41. Similarly, the public key certificate PKC _AA is issued to the attribute certification authority AA, and the public key certificate PKC is issued to the IC card ICC to be held by the manager OP. Public key certificate PK issued by the certificate issuing CA
The _CAA is held by the attribute certification authority AA, and the public key certificate PKC is stored in the IC card ICC.

Next, in the administrator authentication system,
The system SYS is similar to step S42 described above,
It defines each administrator class MC ₁ , MC ₂ , MC ₃ , MC ₄ and the operations belonging to these administrator classes MC ₁ , MC ₂ , MC ₃ , MC ₄ .

And in the administrator authentication system,
The system SYS obtains the public key of the certificate issuing certificate authority CA for verification and, for example, the certificate issuing certificate authority CA
Attribute Certification Authority AA by downloading via
, And the public key KEY is obtained, and a series of preparation phases are completed. The public key KEY corresponds to the signature key KEY shown in FIG.

The administrator authentication system goes through the preparation phase consisting of such a series of steps to obtain the administrator classes MC ₁ , MC ₂ , MC ₃ , MC ₄ and these administrator classes MC ₁ , MC ₂ , MC ₃ , MC ₄ are associated with the attributes and are managed by the system SYS.

In the administrator authentication system thus constructed, the administrator registration phase for registering the administrator OP is the administrator registration phase in the second case shown in FIG. Similar steps are performed. That is, in the administrator authentication system, the process shown in FIG. 20 is performed as the administrator registration phase.

First, in the administrator authentication system, as shown in FIG.
YS is the administrator OP, as in step S51 described above.
Specify the corresponding attribute certificate authority when registering. Here, since only one attribute certification authority AA exists as the attribute certification authority, the attribute certification authority AA is specified by the system SYS in the administrator certification system.

Then, in the administrator authentication system,
In step S82, the IC card IC issued by the certificate issuing certificate authority CA in the above-described preparation phase
The public key certificate PKC stored in C and the system S
Mutual authentication is performed between the IC card ICC and the system SYS by using the public key KEY that YS has obtained from the attribute certification authority AA.

Then, in the administrator authentication system,
If the authentication of the IC card ICC is successful, step S83
In the system SYS, in step S53 described above.
Similarly to, the attribute certification authority AA specified in step S81
Is requested to issue the attribute certificate AC.

Subsequently, in the administrator authentication system,
In step S84, the attribute certificate authority AA creates the attribute certificate AC, and uses the created attribute certificate AC in the system S.
Hand over to YS. At this time, the attribute certificate authority AA, when giving a signature to the attribute certificate AC, differs from the second case in that which administrator class, including inheritance, is included in the field describing the attribute in the attribute certificate AC. As information indicating whether or not the operation permitted as a right is permitted to the self, information indicating the corresponding administrator class is described according to the hierarchy of the administrator class to which the administrator OP belongs. That is, since the administrator OP belongs to the administrator class MC ₄ in the attribute certification authority AA, the attribute class in the attribute certificate AC describes the inherited administrator class and the administrator class to which it belongs. That is, the information indicating the administrator classes MC ₁ , MC ₂ , MC ₃ , MC ₄ is described, and the signature is attached using the public key KEY.

In the administrator authentication system,
In step S85, the system SYS stores the attribute certificate AC in the IC card ICC, distributes the IC card ICC to the manager OP, and ends the series of manager registration phases, as in step S55 described above.

The administrator authentication system can register the administrator OP by going through the administrator registration phase consisting of such a series of steps.

Further, in the administrator authentication system in which the administrator OP is registered in this way, when the administrator OP uses the system SYS to perform an arbitrary operation, the operation phase is first set as shown in FIG. The same process as the utilization phase in the second case shown in 17 is performed.

That is, in the administrator authenticating system, the administrator OP performs the same operation as in step S61 described above.
When performing a certain operation, the IC card ICC distributed from the system SYS in the administrator registration phase described above,
The IC provided in the administrator terminal COM operated by itself
The card is attached to the administrator terminal COM by inserting it into the read / write unit R / W that reads and / or writes data to / from the card ICC.

Then, in the administrator authentication system,
The system SYS is similar to step S62 described above,
Public key certificate PKC stored in IC card ICC
By referring to, it is authenticated whether the IC card ICC can be used in the system SYS.

And in the administrator authentication system,
If the IC card ICC authentication is successful, the system SYS
Is the attribute certificate AC stored in the IC card ICC
When using the public key KEY to refer to the attribute certificate AC
By referring to the information indicating the administrator class described in the field describing the attribute in, the access to the corresponding administrator class MC ₄ by specifying the attribute certificate authority AA that has signed this attribute certificate AC can be performed. It is verified that it is possible, it is determined whether or not the administrator OP is given permission to access the operation, and the series of use phases is ended.

The administrator authentication system can determine the permission of the operation by the administrator OP by the system SYS by going through the use phase consisting of such a series of steps, and the administrator who is given the operation permission can be determined. The OP can perform the operation.

Furthermore, in the administrator authentication system, when a member belonging to the administrator class is deleted, the same process as the delete phase in the first case shown in FIG. 13 is performed as the delete phase. Be seen. That is, in the administrator authentication system, the process shown in FIG. 21 is performed as the deletion phase.

First, in the administrator authentication system, as shown in FIG.
YS is the administrator OP, as in step S31 described above.
A member deletion request given from the administrator terminal COM is received under the operation of.

Then, in the administrator authentication system,
In step S92, the public key certificate PKC stored in the IC card ICC and the public key KEY obtained by the system SYS from the attribute certification authority AA are used to obtain the I
Mutual authentication is performed between the C card ICC and the system SYS.

Next, in the administrator authentication system,
In step S93, the system SYS requests the attribute certificate authority AA, which issues the attribute certificate AC stored in the IC card ICC, to revoke the attribute certificate AC, as in step S33 described above. .

Then, in the administrator authentication system,
In step S94, the attribute certification authority AA creates a revocation list as necessary, as in step S34 described above.

And in the administrator authentication system,
In step S95, the system SYS deletes the attribute certificate AC stored in the IC card ICC, as in step S35 described above, and ends the series of deletion phases.

The administrator authentication system can delete the members belonging to the administrator class by going through the deletion phase consisting of such a series of steps.

In the administrator authentication system, when updating the members belonging to the administrator class, the deletion phase shown in FIG. 21 is executed as the update phase.
Furthermore, the members belonging to the administrator class can be updated by performing the administrator registration phase shown in FIG.

As described above, in the administrator authentication system, one signer and one signing key are set, and the administrator certificate including the inheritance is assigned to which administrator class as an authority in each administrator class electronic certificate. It can be implemented by applying the third case of setting information indicating whether the permitted operation is permitted to the self.

As described above, the administrator authentication system groups each framework defining a predetermined operation as an administrator class, and introduces the concept of hierarchizing a plurality of administrator classes, thereby providing each administrator with a hierarchy. It is possible to easily and efficiently set the access right to the operation permitted as the authority, and to easily add and / or delete a new operation. In addition, the administrator authentication system defines a hierarchical administrator class so that when a new operation is added, the sub administrator class can be used.
It can be easily performed without affecting the configuration of the existing system. Further, the administrator authentication system sets, as an attribute of the administrator class, the fact that the administrator class has an operation that must not be performed if one administrator does not want to concurrently perform a plurality of operations. Only this is enough and control can be performed easily.

In addition, in the administrator authentication system, by performing access management using the public key certificate and the attribute certificate, it becomes possible to authenticate the administrator and to have access right. It becomes possible for the system side to accurately judge whether or not there is any.

Furthermore, in the administrator authentication system,
The public key certificate and the attribute certificate are stored in a removable medium such as an IC card that can be attached to and detached from an administrator terminal operated by the administrator, and the administrator holds the removable medium. , You don't need to be aware of complicated mechanism about authentication and access right management. Therefore, the administrator authentication system can also improve the operability of the administrator.

The present invention is not limited to the above embodiment. For example, in the above-described embodiments, the explanation has been made assuming that the administrator is authenticated by using the mechanism of the public key infrastructure using the public key cryptosystem, but the present invention applies the common key cryptosystem. May be. However, in this case, since it is necessary for more than one person to hold the private key, it is not preferable in terms of security as compared to the case where the public key cryptosystem is used, and the problem of lacking the role of proof even in the case of signature There is.

In the above embodiment, four administrator classes MC ₁ , MC ₂ , MC ₃ and MC ₄ are defined,
The administrator classes MC ₂ and MC ₃ are provided below the administrator class MC ₁ as sub administrator classes, and the administrator class MC ₄ is provided as a sub administrator class that inherits these administrator classes MC ₂ and MC ₃ . Although the system has been mainly described, it goes without saying that the present invention can be applied to a system having a hierarchical structure other than this.

Further, according to the present invention, the implementation of the administrator class and other definitions can be realized not only by hardware but also by software. When the present invention is implemented by software, for example, a CPU (Central Proc.
Each function can be realized by executing the access right management program for managing the access right of the administrator by the essing unit). This access right management program can be provided by a predetermined recording medium such as a so-called compact disc or a transmission medium such as the Internet.

As described above, it goes without saying that the present invention can be appropriately modified without departing from the spirit thereof.

[0203]

As described in detail above, the access right management system according to the present invention manages the authority of each administrator for a predetermined resource and verifies the access of the administrator to the resource. And a framework for defining a predetermined operation for a resource and an administrator terminal operated by an administrator who holds an administrator class electronic certificate that is an electronic certificate in which information indicating permitted operations is described. Is defined as an administrator class, and multiple administrator classes are hierarchically defined, and the administrator class to which the administrator who accesses the held resource refers to the administrator class electronic certificate And a system for verifying the access of the manager to the resource.

Therefore, the access right management system according to the present invention defines a framework for defining a predetermined operation for a resource as an administrator class, and defines a plurality of administrator classes in a hierarchical manner to access the held resource. The administrator class is referred to by the system to determine the administrator class to which the administrator belongs, and the administrator's access to resources is verified. It is possible to easily and efficiently set the access right to the performed operation.

In addition, the access right management method according to the present invention manages the authority of each administrator for a predetermined resource,
An access right management method for verifying the access of an administrator to a resource, wherein a framework for defining a predetermined operation on the resource by a system holding the resource is defined as an administrator class by hierarchically defining a plurality of administrator classes, Depending on the administrator who holds the administrator class electronic certificate, which is the electronic certificate in which the information indicating the permitted operations is described, accessing the resource via the administrator terminal, the system The administrator class electronic certificate held by the administrator is referenced to determine the administrator class to which the administrator belongs, and the access of the administrator to the resource is verified.

Therefore, in the access right management method according to the present invention, a plurality of administrator classes are hierarchically defined as an administrator class for defining a predetermined operation for a resource, and the administrator class electronic resource is defined for the resource. When the administrator holding the certificate accesses it via the administrator terminal, the system refers to the administrator class electronic certificate held by the administrator to determine the administrator class to which the administrator belongs. By verifying the access of the administrator to the resource, it becomes possible to easily and efficiently set the access right to the operation permitted as the authority to each administrator.

Further, the access right management program according to the present invention is a computer-readable access right management program for managing the authority of each administrator for a predetermined resource and verifying the access of the administrator to the resource. An administrator, which is a digital certificate that describes information indicating permitted operations for a resource, by defining a framework that defines a predetermined operation for a resource as an administrator class by hierarchically defining multiple administrator classes. When an administrator who holds a class electronic certificate accesses it via an administrator terminal, the administrator class electronic certificate that the administrator holds is referenced to determine the administrator class to which the administrator belongs. , Verify the administrator's access to the resource.

Therefore, the access right management program according to the present invention hierarchically defines a plurality of administrator classes as an administrator class, which is a framework for defining a predetermined operation for a resource. When the administrator holding the certificate accesses it via the administrator terminal, the administrator class electronic certificate held by the administrator is referenced to determine the administrator class to which the administrator belongs, and the resource By verifying the administrator's access to the, the system in which this access right management program is installed can easily and efficiently set the access right to the operation permitted as the authority to each administrator. And

[0209] Furthermore, the recording medium on which the access right management program according to the present invention is recorded manages the authority of each administrator for a predetermined resource and verifies the administrator's access to the resource. A recording medium in which a right management program is recorded, wherein the access right management program defines a framework for defining a predetermined operation for a resource as a manager class by hierarchically defining a plurality of manager classes, and for the resource, An administrator who holds an administrator class electronic certificate, which is an electronic certificate that describes information indicating permitted operations, is accessed by the administrator in response to access via the administrator terminal. Refer to the class digital certificate to determine the administrator class to which the administrator belongs, and access the resource to the administrator. To verify.

Therefore, in the recording medium in which the access right management program according to the present invention is recorded, a plurality of administrator classes are hierarchically defined as the administrator class, which is a framework for defining a predetermined operation for the resource, and The administrator who holds the administrator class electronic certificate refers to the administrator class electronic certificate held by the administrator in response to the access via the administrator terminal, and the administrator to which the administrator belongs It is possible to provide an access right management program that determines the class and verifies the access of the administrator to the resource. Therefore, the system in which the access right management program is installed can easily and efficiently set the access right to the operation permitted as an authority to each administrator.

[Brief description of drawings]

FIG. 1 is a conceptual diagram of an administrator authentication system shown as an embodiment of the present invention.

FIG. 2 is a conceptual diagram of a first case of the administrator authentication system, where (A) shows a concept of a signer and (B) shows
It is a figure which shows the concept of an administrator class.

FIG. 3 is a conceptual diagram of a second case of the administrator authentication system, where (A) shows the concept of a signer and (B) shows
It is a figure which shows the concept of an administrator class.

FIG. 4 is a conceptual diagram of a third case of the same administrator authentication system, where (A) shows the concept of a signer and (B) shows
It is a figure which shows the concept of an administrator class.

FIG. 5 is a diagram illustrating a format of a public key certificate.

FIG. 6 is a diagram for explaining the format of a public key certificate and is a diagram for explaining the remaining items following the items shown in FIG.

FIG. 7 is a diagram illustrating a format of an attribute certificate.

8 is a diagram illustrating a format of an attribute certificate and a diagram illustrating remaining items following the items illustrated in FIG. 7. FIG.

FIG. 9 is a diagram illustrating a configuration of the same administrator authentication system as an implementation example of the first case.

FIG. 10 is a flowchart for explaining a series of steps as a preparation phase in the same administrator authentication system as an implementation example of the first case.

FIG. 11 is a flowchart for explaining a series of steps as an administrator registration phase in the same administrator authentication system as an implementation example of the first case.

FIG. 12 is a flowchart for explaining a series of steps as a utilization phase in the same administrator authentication system as an implementation example of the first case.

FIG. 13 is a flowchart for explaining a series of steps as a deletion phase in the same administrator authentication system as an implementation example of the first case.

FIG. 14 is a diagram illustrating a configuration of the same administrator authentication system as an implementation example of the second case.

FIG. 15 is a flowchart for explaining a series of steps as a preparation phase in the same administrator authentication system as an implementation example of the second case.

FIG. 16 is a flowchart for explaining a series of steps as an administrator registration phase in the same administrator authentication system as an implementation example of the second case.

FIG. 17 is a flowchart for explaining a series of steps as a utilization phase in the same administrator authentication system as an implementation example of the second case.

FIG. 18 is a flowchart for explaining a series of steps as a deletion phase in the same administrator authentication system as an implementation example of the second case.

FIG. 19 is a diagram illustrating a configuration of the same administrator authentication system as an implementation example of a third case.

FIG. 20 is a flowchart for explaining a series of steps as an administrator registration phase in the same administrator authentication system as an implementation example of the third case.

FIG. 21 is a flowchart for explaining a series of steps as a deletion phase in the same administrator authentication system as an implementation example of the third case.

[Explanation of symbols]

AA, AA₁, AA_Two, AA_Three, AA_Four  Attribute Certificate Authority,
  AC attribute certificate, CA certificate issuing certificate authority, CE
R_MC1, CER_MC2, CER_MC3, CE
R_MC4, CER_SG, CER_SG1, CER_SG2，
CER_SG3, CER _SG4  Electronic certificate, COM
Administrator terminal, ICC IC card, KEY, KEY
₁, KEY_Two, KEY_Three, KEY_Four  Signing key, public key,
  MC₁, MC _Two, MC_Three, MC_Four, MC₅  Admin
Russ, OP Manager, OP₁₁, OP₁₂, OP
₂₁, OP₃₁  Operation, PKC, PKC_AA, PKC
_AA1, PKC_AA2, PKC_AA3, PKC_AA4  
Public key certificate, R / W read / write unit, S
G, SG₁, SG_Two, SG_Three, SG_Four  Signer, SY
S system

Claims (66)

[Claims] 1. An access right management system that manages the authority of each administrator for a predetermined resource and verifies the access of the administrator to the resource, in which information indicating permitted operations is described. Administrator class that is a digital certificate A plurality of the above administrator classes are hierarchized with the administrator terminal that holds the electronic certificate operated by the above administrator and the framework that defines a predetermined operation for the above resource as the administrator class. The administrator class that the administrator belongs to by referring to the administrator class electronic certificate held by the administrator who accesses the resource that is defined and held by the administrator And a system for verifying the access of the access right management system. 2. The access right management system according to claim 1, wherein the system defines an operation defined in one administrator class as being equivalent from the viewpoint of access right. 3. The access right management system according to claim 1, wherein the system defines an administrator class having operations that must not be combined. 4. The access right management system according to claim 1, wherein the system is defined by making a plurality of administrators belong to one administrator class. 5. The access right management system according to claim 1, wherein the system is capable of adding and / or deleting an administrator belonging to an arbitrary administrator class. 6. The access right management system according to claim 1, wherein the system can add and / or delete an operation permitted as an authority to an arbitrary administrator class. 7. The access right management system according to claim 1, wherein the system defines a sub administrator class under an arbitrary administrator class. 8. The access right management system according to claim 7, wherein the sub-administrator class inherits all operations defined in a higher-level administrator class. 9. The access right management system according to claim 7, wherein the system defines a sub administrator class that inherits a plurality of administrator classes. 10. The system sets a signer having one signature key for each administrator class, and causes each signer to sign an administrator class electronic certificate which is an electronic certificate of each administrator class. The access right management system according to claim 1, wherein: 11. The access right management system according to claim 10, wherein the signer is hierarchized according to the hierarchy of the administrator class, and the lower signer is authenticated by the upper signer. . 12. The top signer has a signer digital certificate which is a self-signed digital certificate, and the subordinate signer holds a signer digital certificate signed by a higher signer. The access right management system according to claim 11, characterized by comprising. 13. The signer is an attribute certificate authority that is a predetermined independent third party in the public key cryptosystem and is a local authority different from the certificate issuing certificate authority that issues the public key certificate. 13. The access right management system according to claim 12, wherein: 14. The access right management system according to claim 13, wherein the signer electronic certificate is a public key certificate issued by the certificate issuing certificate authority. 15. The access right management system according to claim 12, wherein any administrator class has the administrator class electronic certificate signed by a hierarchically corresponding signer. 16. The administrator class electronic certificate is an attribute issued by an attribute certificate authority which is a local authority different from a certificate issuing certificate authority which is a predetermined independent third party in the public key cryptosystem. The access right management system according to claim 15, wherein the access right management system is a certificate. 17. The system according to claim 1, wherein the administrator class electronic certificate held by an arbitrary administrator class is verified, and the signature is given to the administrator class electronic certificate. The access right management system according to claim 15, wherein the access right of an arbitrary administrator class is determined based on the signer electronic certificate. 18. The above system sets a signature key for each administrator class and causes one signer to hold the signature key, and the administrator class electronic certificate, which is an electronic certificate of each administrator class, manages its own and higher ranks. The access right management system according to claim 1, wherein the signature key of a class is used for multiple signatures. 19. The access right management system according to claim 18, wherein the signer has a signer electronic certificate which is a self-signed electronic certificate. 20. The signer is an attribute certificate authority which is a predetermined independent third party in the public key cryptosystem and is a local authority different from the certificate issuing certificate authority which issues the public key certificate. 20. The access right management system according to claim 19, wherein: 21. The access right management system according to claim 20, wherein the signer electronic certificate is a public key certificate issued by the certificate issuing certificate authority. 22. The access right according to claim 19, wherein an arbitrary administrator class has the administrator class electronic certificate which is multi-signed by using the signature keys of self and a higher administrator class. Management system. 23. The administrator class electronic certificate is an attribute issued by an attribute certification authority which is a local authority different from a certificate issuing certification authority which is a predetermined independent third party in the public key cryptosystem. 23. The access right management system according to claim 22, wherein the access right management system is a certificate. 24. The system is based on a signature key used when verifying an administrator class electronic certificate possessed by an arbitrary administrator class and giving a signature to the administrator class electronic certificate. 23. The access right management system according to claim 22, wherein the access right of an arbitrary administrator class is judged. 25. The above system sets one signer and one signing key, and which administrator class including inheritance is included in which administrator class is the electronic certificate of each administrator class? The access right management system according to claim 1, wherein information indicating whether or not an operation permitted as a right is permitted is described. 26. The access right management system according to claim 25, wherein the signer has a signer electronic certificate which is a self-signed electronic certificate. 27. The signer is an attribute certificate authority which is a predetermined independent third party in the public key cryptosystem and is a local authority different from the certificate issuing certificate authority which issues the public key certificate. 27. The access right management system according to claim 26, wherein: 28. The access right management system according to claim 27, wherein the signer electronic certificate is a public key certificate issued by the certificate issuing certificate authority. 29. The access right management system according to claim 26, wherein any administrator class has the administrator class electronic certificate signed by the signer. 30. The administrator class electronic certificate is an attribute issued by an attribute certification authority which is a local authority different from a certificate issuing certification authority which is a predetermined independent third party in the public key cryptosystem. 30. The access right management system according to claim 29, which is a certificate. 31. The system verifies an administrator class electronic certificate possessed by an arbitrary administrator class, and based on the information described in the administrator class electronic certificate, an arbitrary administrator 30. The access right management system according to claim 29, wherein the access right of the class is determined. 32. The administrator class electronic certificate is stored in a recording medium that is removable from the administrator terminal and is readable and / or writable by the administrator terminal, and is stored in the recording medium from the system to the administrator. The access right management system according to claim 1, wherein the access right management system is distributed to the. 33. An access right management method for managing the authority of each administrator for a predetermined resource, and verifying the access of the administrator to the resource, wherein the system for holding the resource provides a predetermined access to the resource. An administrator class, which is a digital certificate that describes information indicating the permitted operations for the above resources, is defined by hierarchically defining a plurality of the above administrator classes as a framework for defining operations. In response to the administrator holding the certificate accessing through the administrator terminal, the administrator class referring to the administrator class electronic certificate held by the administrator by the system, the administrator class to which the administrator belongs And an access right management method for verifying the access of the administrator to the resource. 34. The operation defined in one administrator class is defined by the system as being equivalent from the viewpoint of access right.
The access right management method described in 3. 35. The access right management method according to claim 33, wherein an administrator class having operations that must not be combined is defined by the system. 36. The access right management method according to claim 33, wherein one administrator class is defined by the system to which a plurality of administrators belong. 37. The access right management method according to claim 33, wherein an administrator belonging to an arbitrary administrator class can be added and / or deleted by the system. 38. The access right management method according to claim 33, wherein an operation permitted as an authority to an arbitrary administrator class can be added and / or deleted by the system. 39. The access right management method according to claim 33, wherein a sub-administrator class is defined under the arbitrary administrator class by the system. 40. The access right management method according to claim 39, wherein the sub-administrator class inherits all operations defined in a higher-level administrator class. 41. The access right management method according to claim 39, wherein the system defines a sub-manager class that inherits a plurality of manager classes. 42. A signer having one signature key is set for each administrator class by the system, and each signer signs an administrator class electronic certificate which is an electronic certificate of each administrator class. 34. The method according to claim 33,
Access right management method described. 43. The access right management method according to claim 42, wherein the signer is hierarchized according to the hierarchy of the administrator class, and the lower signer is authenticated by the upper signer. . 44. The uppermost signer has a signer electronic certificate which is a self-signed electronic certificate, and the lower signer has a signer electronic certificate signed by an upper signer. 44. The access right management method according to claim 43, further comprising: 45. The signer is an attribute certificate authority which is a predetermined independent third party in the public key cryptosystem and is a local authority different from the certificate issuing certificate authority which issues the public key certificate. The access right management method according to claim 44, wherein: 46. The access right management method according to claim 45, wherein the signer electronic certificate is a public key certificate issued by the certificate issuing certificate authority. 47. The access right management method according to claim 44, wherein any administrator class has the administrator class electronic certificate signed by a hierarchically corresponding signer. 48. The administrator class electronic certificate is an attribute issued by an attribute certificate authority which is a local authority different from a certificate issuing certificate authority which is a predetermined independent third party in the public key cryptosystem. 48. The access right management method according to claim 47, which is a certificate. 49. The system verifies the administrator class electronic certificate possessed by an arbitrary administrator class, and the signature possessed by a signer who has signed the administrator class electronic certificate. 48. The access right management method according to claim 47, wherein access of an arbitrary administrator class is determined based on the user electronic certificate. 50. A signature key is set for each administrator class by the system and is held by a single signer, and the administrator class electronic certificate, which is an electronic certificate of each administrator class, has its own and superior management classes. 34. The access right management method according to claim 33, wherein the signature key is used for multiple signatures. 51. The access right management method according to claim 50, wherein the signer has a signer electronic certificate which is a self-signed electronic certificate. 52. The signer is an attribute certificate authority which is a predetermined independent third party in the public key cryptosystem and is a local authority different from the certificate issuing certificate authority which issues the public key certificate. 52. The access right management method according to claim 51, wherein: 53. The access right management method according to claim 52, wherein the signer electronic certificate is a public key certificate issued by the public key issuing certificate authority. 54. The access right according to claim 51, wherein an arbitrary administrator class has the administrator class electronic certificate multi-signed by using the signature keys of the self administrator and a higher administrator class. Management method. 55. The administrator class electronic certificate is an attribute issued by an attribute certificate authority which is a local authority different from a certificate issuing certificate authority which is a predetermined independent third party in the public key cryptosystem. 55. The access right management method according to claim 54, which is a certificate. 56. The system verifies an administrator class electronic certificate possessed by an arbitrary administrator class,
55. The access right management method according to claim 54, wherein an access right of an arbitrary administrator class is determined based on a signature key used when a signature is given to the administrator class electronic certificate. 57. One signer and one signing key are set by the system, and the administrator class electronic certificate, which is the electronic certificate of each administrator class, has authority over which administrator class including inheritance. 34. The access right management method according to claim 33, wherein information indicating whether or not the operation permitted as is permitted is described. 58. The access right management method according to claim 57, wherein the signer has a signer electronic certificate which is a self-signed electronic certificate. 59. The signer is an attribute certificate authority which is a predetermined independent third party in the public key cryptosystem and is a local authority different from the certificate issuing authority which issues the public key certificate. 59. The access right management method according to claim 58, wherein: 60. The access right management method according to claim 59, wherein the signer electronic certificate is a public key certificate issued by the certificate issuing certificate authority. 61. The access right management method according to claim 58, wherein any administrator class has the administrator class electronic certificate signed by the signer. 62. The administrator class electronic certificate is an attribute issued by an attribute certification authority which is a local authority different from a certificate issuing certification authority which is a predetermined independent third party in the public key cryptosystem. The access right management method according to claim 61, wherein the access right management method is a certificate. 63. The system verifies the administrator class electronic certificate possessed by any administrator class,
The access right management method according to claim 61, wherein an access right of an arbitrary administrator class is determined based on the information described in the administrator class electronic certificate. 64. The administrator class electronic certificate is stored in a recording medium which is removable from the administrator terminal and is readable and / or writable by the administrator terminal, and is stored in a recording medium from the system to the administrator. 34. The access right management method according to claim 33, wherein the access right management method is distributed to the. 65. A computer-readable access right management program that manages the authority of each administrator for a predetermined resource and verifies the access of the administrator to the resource, and defines a predetermined operation for the resource. The above-mentioned framework is defined as an administrator class by hierarchically defining a plurality of the above administrator classes, and an administrator class electronic certificate, which is an electronic certificate in which information indicating the permitted operations is described for the above resources, In response to the administrator holding the access via the administrator terminal, the administrator class to which the administrator belongs is determined by referring to the administrator class electronic certificate held by the administrator, and the resource An access right management program characterized by verifying the access of the administrator to the. 66. A recording medium in which a computer-readable access right management program for managing the authority of each administrator for a predetermined resource and for verifying the access of the administrator to the resource is recorded. The right management program defines a framework for defining a predetermined operation for the resource as an administrator class by hierarchically defining a plurality of the above administrator classes, and describes information indicating the permitted operation for the resource. In response to the administrator holding the administrator class electronic certificate, which is a digital certificate, accessed through the administrator terminal, refer to the administrator class electronic certificate held by the administrator and An access characterized by determining the administrator class to which the administrator belongs and verifying the access of the administrator to the above resources. A recording medium on which a rights management program is recorded.