JP2003036231A - Electronic certificate management device and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To realize e-mail environment and/or the Internet environment in high security without imposing a workload on a user, provide an item to make the security visible and increase enjoyment. SOLUTION: This invention is an electronic certificate management device which is constituted of a certificate acquiring part to automatically acquire an electronic certificate, a certificate management information memory to store management information for the acquired certificate, a certificate memory to store the acquired certificate, an encryption processing part to an inputted message to a transmitting and receiving part after encrypting it and/or signing it, a plain message processing part to convert the encrypted message received by the transmitting and receiving part to a plain message and a character generation part to generate and transfer characters to a display part depending on the message encryption and/or the signature status. The character generation part generates certificate characters if the certificate and/or the signature is generated and generates specific characters when encrypted.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic certificate management device for managing an electronic certificate used for identifying a user in a computer network such as the Internet.

[0002]

2. Description of the Related Art With the spread of the Internet, electronic mail is widely used. Electronic mail on the Internet has the problems of eavesdropping, spoofing and tampering. "Eavesdropping" means that the content of an email can be sniffed by a third party, "spoofing" means sending an email with the name of another person, and "tampering" means a part of the content of the email or It is to change everything.

A message flowing through the Internet is delivered to the other party through a number of servers. Since the Internet is an open network and is susceptible to the interference of a third party on the way, it is difficult to avoid the problems of wiretapping, spoofing and tampering. Therefore, the user side must deal with such a problem.

Therefore, in order to deal with "eavesdropping", the confidentiality of the message is secured by encryption, authentication with a digital signature is used to deal with "spoofing", and a digital signature is used to deal with "tampering". It is desirable to achieve message integrity through encryption.

Currently, S / MIME (Secure / Multipurpose Internet Mai) is used as a specification for realizing these.
l Extensions) exists.

[0006]

[Problems to be Solved by the Invention] However, S / MIME
Is less popular than expected. The possible reasons are as follows.・ Many technical terms make it difficult for users to familiarize themselves. -User interface for certificate management is not easy to use. -Forces complicated operations and management regarding the other party's certificate acquisition method and method, key management, and certificate management including expiration date.

[0007] In short, S / MIME is too conscious of certificates and is considered unacceptable to users.

The present invention has been made to solve the above problems, and an object thereof is to provide an electronic certificate management apparatus having the following features. • Does not require or need to know specialized knowledge.・ The user interface for certificate management is easy to understand. -Hide operations or automatically manage the certificate acquisition methods and methods of other parties, key management, and certificate management including expiration date.

[0009]

A digital certificate management apparatus according to the present invention includes a certificate acquisition section for automatically acquiring an electronic certificate and a certificate management for storing management information of the acquired certificate. An information memory, a certificate memory that stores the acquired certificate, an encryption processing unit that encrypts and / or signs an input message and sends it to the transmission / reception unit, and returns the encrypted message received by the transmission / reception unit to plaintext A plain language processing unit and a character generating unit that generates a character according to the status of message encryption and / or signature and sends the character to the display unit, wherein the character generating unit is the encryption processing unit or the plain language processing unit. The information is obtained from the processing unit to determine whether the signature is generated, and when the signature is generated, the character associated with the certificate is generated, and the character is generated from the encryption processing unit or the plain culture processing unit. Message determines whether it has been encrypted to obtain a distribution, and generating a specific character when encrypted.

[0010] Preferably, the certificate acquisition unit determines whether or not a certificate has already been obtained, and when it has not obtained, applies for issuance of a certificate to a predetermined certification authority and obtains the certificate. When acquired, the character generation unit is caused to generate a character associated with the certificate.

Preferably, the certificate acquisition unit determines the necessity of certificate renewal based on the expiration date of the certificate, and applies a certificate renewal to a predetermined certificate authority when necessary, When the certificate is updated, the character generation unit is caused to generate or update the character associated with the certificate.

[0012] Preferably, the certificate acquisition unit acquires a time-limited certificate and permits a predetermined operation within a predetermined time based on the management information in the certificate management information memory.

A program according to the present invention includes a certificate acquisition unit for automatically acquiring an electronic certificate in a computer, a certificate management information memory for storing management information of the acquired certificate, and an acquired certificate. A certificate memory for storing a certificate, an encryption processing unit that encrypts and / or signs an input message and sends the message to a transmission / reception unit, a plain culture processing unit that returns an encrypted message received by the transmission / reception unit to a plain text, and a message A character generation unit that generates a character according to the status of encryption and / or signature of the character and sends the character to the display unit, wherein the character generation unit is the encryption processing unit or the plain culture processing unit. It is determined whether the signature is generated by obtaining the information from the information, and when the signature is generated, the character associated with the certificate is generated, and the encryption processing unit or the plain culture is used. Message determines whether the encrypted from management unit obtains information, and generating the specific character when encrypted.

The program according to the present invention is recorded in, for example, a recording medium. The medium includes, for example, a flexible disk, a hard disk, a magnetic tape, a magneto-optical disk, a CD (including a CD-ROM and a Video-CD),
DVD (DVD-Video, DVD-ROM, DVD
-Including RAM), ROM cartridges, RAM memory cartridges with battery backup, flash memory cartridges, non-volatile RAM cartridges, etc.

It also includes a wire communication medium such as a telephone line and a communication medium such as a wireless communication medium such as a microwave line. The Internet is also included in the communication medium here.

A medium is a medium on which information (mainly digital data, programs) is recorded by some physical means, and allows a processing device such as a computer or a dedicated processor to perform a predetermined function. It is possible.
In short, any means may be used as long as it downloads the program to the computer by some means and executes the predetermined function.

[0017]

DETAILED DESCRIPTION OF THE INVENTION An apparatus according to an embodiment of the invention is shown in FIG. In FIG. 1, reference numeral 1 denotes a certificate acquisition unit that automatically acquires an electronic certificate (based on public key cryptography),
2 is management information of the acquired certificate (for example, certificate issuer,
Certificate management information memory that stores the validity period of the certificate)
3 is a certificate memory for storing the acquired certificate, 4 is an encryption processing unit that encrypts and / or signs the message input by the input unit 7 and sends it to the transmitting / receiving unit 9, and 5 is received by the transmitting / receiving unit 9. A plain text processing unit for returning an encrypted message to plain text, 6 is a character generation unit for selecting and generating a character (for example, the one shown in FIG. 7) according to the status of message encryption and / or signature, and 8 is a message (Or its icon) is a display unit that displays the generated character. The certificate management information memory 3 also stores information about a certificate obtained from a communication partner. For example, the certificate received from the user A and the identification code of the user A (for example, mail address) are stored in association with each other. The character of the certificate described below may also be stored in association with the character.

FIG. 3A is a diagram showing the structure of the encryption processing unit 4. Reference numeral 41 is a secret key of a common encryption for encrypting the message. The private key 41 is generated and stored inside the transmission side, and is also encrypted and sent to the communication partner. The sending side encrypts the plaintext message based on the secret key 41, and the receiving side returns the encrypted message to the plaintext based on the secret key 41. Reference numeral 42 is an encoder for encrypting the message based on the secret key 41, and 43 is an encoder for encrypting the secret key 41 based on the public key 44 of the recipient's public key encryption method. The public key 44 is obtained, for example, from the certificate sent from the communication partner. Thus, FIG.
In (a), the plaintext message M is encrypted into a message M ′, and the common encryption secret key 41 is also encrypted into an encrypted secret key SK ′. These M'and S
K'is sent as an attachment to the email. Therefore,
A third party cannot steal the email. However, since there is no signature and certificate attached, it is impossible to prevent spoofing and falsification.

FIG. 3B is a view showing the structure of the flat culture processing section 5. The encrypted message M ′ and the encrypted secret key SK ′ are received from the encryption processing unit in FIG.
First, using the private key 51 of the recipient, the SK is performed by the flat culture device 52.
'To return and get the private key. Using this secret key, M'is returned by the plain culture device 53 to obtain a plaintext message.

FIG. 4 is a diagram showing the structure of the encryption processing unit 4 having a signature and certificate attachment function. Reference numeral 45 is a hash processing unit that creates a digest of the message M, and 47 is an encryptor that encrypts the digest based on the secret key 46 of the sender. The private key 46 corresponds to the public key included in the certificate obtained from the certificate authority. From 45 to 47, the electronic signature S of the sender for the plaintext message M is obtained. The signature S and the certificate C are attached together with the message M and sent by e-mail. The signature S and the certificate C can prevent spoofing and falsification. However, eavesdropping cannot be prevented because it is not encrypted.

Eavesdropping can be prevented by further encrypting the data according to the above 41 to 44. In this case, the encrypted message, the electronic signature (M + S) ', the encrypted non-secret key SK' and the certificate C are attached and sent by e-mail.

In the plaintext processing section 5 on the receiving side, a plaintext message is obtained by the procedure reverse to the above.

The operation will be described with reference to the flowchart of FIG. First, the user A requests the certificate authority to issue a certificate from his or her personal computer and receives the certificate (S1 to S4). Impersonation can be prevented by obtaining a certificate, and a pair of a public key and a private key is prepared in advance so that a signature can be signed. In addition, the message can be encrypted by sending the certificate to the other party. Therefore, in order to exchange messages securely using the Internet, it is desirable to obtain a certificate from a certificate authority.

FIG. 5 shows a procedure in which the certificate acquisition unit 1 automatically applies for and acquires a certificate. When the software is started (S20), it is determined whether the software (personal computer) has acquired the certificate (S21). If it has not been obtained, a certificate is applied to the certificate authority according to a predetermined procedure (S22). Although the certificate has been obtained, it is determined whether the certificate needs to be updated (S21).
b). For example, it is determined that the renewal is necessary when the renewal time is near, or when the latest certificate is required for the convenience of using the service. If it is determined that the update is necessary, the processing of S22 to S25 is performed. When the certificate is received (S23), it is stored in the memory 3 (S24).
Then, a character (icon) showing that the user has the certificate is generated and stored. For example, the character CH-C / S in FIG. 7 is used as this character.

In FIG. 2, S5 to S12 show a message exchange procedure between users A and B who have a certificate.

User A creates a message (S
5) Add a signature based on the public key cryptosystem to this (S)
6). These are transmitted to the user B. The data sent at this time are, for example, M, S and C in FIG. Since user A does not know user B's public key, the message remains in plain text, but if he knows the public key, it can be encrypted. At this time, a character indicating that the message is a signed message (for example, CH1 in FIG. 7 and CH-C / S indicating that the message has been signed in the vicinity thereof) is displayed on the screen of the user A. Similarly, the same character is displayed on the screen of user B. When the certificate is attached to the electronic mail received by the user B, the certificate is stored (S7b).

When user B replies to user A,
User B creates a reply message (S8), adds a signature to it (S9), and further encrypts them (S1).
0). These are transmitted to the user A. The data sent at this time are, for example, (M + S) ', SK' and C in FIG. User B uses the certificate attached to User A
You can encrypt the message because you know your public key. When the certificate is attached to the email received by the user A, the certificate is stored (S11b). Upon receiving the encrypted message, the user A performs plain culture processing (S12). At this time, a character indicating that the message is signed and encrypted is displayed on the screen of user B (for example, CH2 in FIG. 7 and CH-C / S indicating that the message has been signed in the vicinity thereof). To be done. Similarly, the same character is displayed on the screen of user A.

FIG. 2 shows a message exchange procedure between user A having a certificate and user C not having a certificate in steps S13 to S19.

User A creates a message (S1
3) Add a signature based on the public key cryptosystem to this (S)
14). These are transmitted to the user B (S15). The data sent at this time are, for example, M, S and C in FIG. Since user C does not have a certificate, the message from user A to user C is always in plain text.
When the certificate is attached to the email received by the user C, the certificate is saved (S15b). At this time, a character indicating that the message is a signed message (for example, CH1 in FIG. 7 and CH-C / S indicating that the message has been signed in the vicinity thereof) is displayed on the screen of the user A. Similarly, the same character is displayed on the screen of the user C.

When user C replies to user A,
User C creates a reply message (S16) and further encrypts it (S17). This is transmitted to the user A. The data transmitted at this time is, for example, M ′ and SK ′ in FIG. Since the user C knows the public key of the user A by the attached certificate, the message can be encrypted. Upon receiving the encrypted message, the user A performs a plain culture process (S19). At this time, a character (for example, CH3 in FIG. 7) indicating that the message is not signed is displayed on the screen of the user C. Similarly, the same character is displayed on the screen of user A.

Next, the procedure for generating a character will be described with reference to FIG. Character generation unit 6 in FIG.
Determines whether the message sent based on the information from the cryptographic processing unit 4 has a signature / certificate attached (S3
0), it is determined whether the message is encrypted (S32), and whether the message received based on the information from the flat culture processing unit 5 has a signature / certificate attached (S30), the message is encrypted. It is determined whether or not it has been removed (S32). When the signature (and / or the certificate) is attached, the certificate character is generated and displayed (S31). When encrypted, an encrypted character is generated and displayed (S33). If none of the above applies, a normal character is generated and displayed (S34).

FIG. 7 shows an example of a character. CH1 indicates, for example, a plaintext message, CH2 indicates an encrypted message, and CH3 indicates an encrypted message without a signature / certificate. CH-C / S indicates that the message has a signature and / or a certificate attached. It is preferable that the character be familiar to the user.

In the above description, the embodiment of the present invention has been described by taking the case of exchanging messages by e-mail as an example, but the present invention is not limited to this. The present invention can be applied to, for example, a browser for using a WWW server, or a so-called net game. For example, it can be applied to access control in browsers and games, SSL client authentication, and electronic signature. For example, it is possible to oblige the user to obtain a certificate when using an online game so that the game can be enjoyed only within the time (for example, one hour) indicated by the certificate.

According to the embodiment of the present invention, the following is possible. -Link the character data and the certificate. -The presence of characters allows key management and certificate management to be implemented without the user's awareness.・ Visual safety can be used to show safety. -Collaboration with the certificate management function of other software (browser, etc.)-Certificate management platform in desktop environment

That is, according to the embodiment of the present invention,
A character-based Internet client application (character mailer, etc.) becomes a desktop security management application at the same time as its original function. Therefore, the certificate application, acquisition, and renewal are automatically performed without the user's awareness. Certificate management for other applications (browser, etc.) can be performed on behalf of the system, and certificates and private keys for other applications can be automatically installed. This allows, for example, client authentication in electronic commerce (EC),
A digital signature can be realized. The device according to the embodiment of the present invention is an Internet security platform.

The present invention is not limited to the above embodiments, and various modifications can be made within the scope of the invention described in the claims, and these are also included in the scope of the present invention. It goes without saying that this is what is done.

For example, it can be applied to any application under the desktop environment of a personal computer. The electronic certificate management apparatus according to the embodiment of the present invention centrally manages certificates for personal computers, and enables the use of electronic certificates in arbitrary applications.

Further, in the present specification, the means does not necessarily mean a physical means, but also includes the case where the function of each means is realized by software.
Further, the function of one means may be realized by two or more physical means, or the functions of two or more means may be realized by one physical means.

[0039]

According to the present invention, it is possible to realize a highly secure mail environment and / or Internet environment without automating complicated certificate management and burdening the user, and to show safety. Offer items and increase your enjoyment.

[Brief description of drawings]

FIG. 1 is a block diagram of an apparatus according to an embodiment of the present invention.

FIG. 2 is a flowchart of overall processing according to the embodiment of the present invention.

FIG. 3 is an explanatory diagram of encryption processing and plain culture processing.

FIG. 4 is an explanatory diagram of encryption processing.

FIG. 5 is a flowchart of a certificate acquisition unit of the device according to the embodiment of the present invention.

FIG. 6 is a flowchart of a character generation unit of the device according to the embodiment of the present invention.

FIG. 7 is an example of a character generated by the device according to the embodiment of the present invention.

[Explanation of symbols] 1 Certificate acquisition department 2 Certificate management information memory 3 Certificate memory 4 Encryption processing unit 5 Flat culture processing department 6 Character generator 7 Input section 8 Display 9 Transmitter / receiver

─────────────────────────────────────────────────── ─── Continuation of front page (51) Int.Cl. ⁷ Identification code FI Theme Court (reference) H04L 9/00 601E (72) Inventor Tadao Shibasaki 4-1, Kioicho, Chiyoda-ku, Tokyo New Otani Garden Court 8th floor Japan Baltimore Technologies Co., Ltd. (72) Inventor, Shoichi Takahashi 4th Kioicho, Chiyoda-ku, Tokyo New Otani Garden Court, 8th Floor, Japan Baltimore Technologies Co., Ltd. F-term (reference) 5J104 AA04 AA09 AA16 EA05 EA06 EA19 LA06 PA08

Claims (5)

[Claims] 1. A certificate acquisition unit for automatically acquiring an electronic certificate, a certificate management information memory for storing management information of the acquired certificate, and a certificate memory for storing the acquired certificate. , An encryption processing unit that encrypts and / or signs an input message and sends it to the transmission / reception unit, a plaintext processing unit that returns an encrypted message received by the transmission / reception unit to a plaintext, and an encryption and / or signature of the message. A character generation unit that generates a character according to the situation and sends it to the display unit, the character generation unit obtains information from the encryption processing unit or the plain culture processing unit and determines whether a signature has been generated. Generating a character associated with the certificate when the signature is generated, and obtaining information from the encryption processing unit or the plain language processing unit to determine whether the message has been encrypted, Electronic certificate management apparatus characterized by generating a particular character when Goka. 2. The certificate acquisition unit determines whether or not a certificate has already been acquired, and if not, applies to a predetermined certificate authority to issue a certificate and acquires the certificate. The electronic certificate management apparatus according to claim 1, wherein the character generation unit causes the character generation unit to generate a character associated with the certificate. 3. The certificate acquisition unit determines the necessity of certificate renewal based on the expiration date of the certificate, and when necessary, applies for renewal of the certificate to a predetermined certification authority and certifies the certificate. The electronic certificate management apparatus according to claim 1, wherein when the certificate is updated, the character generation unit is caused to generate or update the character associated with the certificate. 4. The certificate acquisition unit acquires a time-limited certificate and permits a predetermined operation within a predetermined time based on the management information in the certificate management information memory. The electronic certificate management device according to item 1. 5. A certificate acquisition unit for automatically acquiring an electronic certificate, a certificate management information memory for storing management information of the acquired certificate, and a certificate for storing the acquired certificate in a computer. A write memory, an encryption processing unit that encrypts and / or signs an input message and sends it to the transmission / reception unit, a plain culture processing unit that returns an encrypted message received by the transmission / reception unit to plaintext, and an encryption and / or message Or a program for configuring a character generation unit that generates a character according to the status of the signature and sends the character to the display unit, wherein the character generation unit receives information from the encryption processing unit or the plain culture processing unit. Then, it is determined whether or not a signature is generated, and when the signature is generated, a character associated with the certificate is generated, and information is obtained from the encryption processing unit or the plain culture processing unit. The resulting message is determined whether or not encrypted, the program and generating the specific character when encrypted.