JP2003152715A - Certification revocation information acquisition method and device, certification revocation information acquisition program, and storage medium for storing the certification revocation information acquisition program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a certification revocation information acquisition method by which a verifier itself can control the length of a period when the reliability of signature verification processing is deteriorated and an access frequency to an external system even when the verifier complies with the operation of not utilizing an acquired CRL (Certification Revocation List) for the purpose of confirming invalidity in excess of 'next update date' when acquiring the CRL. SOLUTION: The method of this invention includes the steps of: defining a timing when the CRL is acquired as an initial setting; monitoring the arrival of the timing to acquire the defined CRL in the case of system operation; monitoring the arrival of the next update date listed in the CRL acquired previously; acquiring the CRL from an external system including a directory at the arrival of either of the timings; and locally storing the CRL.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a revocation certificate information acquisition method and apparatus, a revocation certificate information acquisition program, and a storage medium storing the revocation certificate information acquisition program, and more particularly, to a safe and reliable computer network. To verify the validity of the public certificate, which is necessary in digital signature communication and cryptographic communication technology using public key cryptography in order to realize various EDI (electronic data crown) and EC (electronic product transaction) The present invention relates to a certificate information acquisition method and device, a revocation certificate information acquisition program, and a storage medium storing the revocation certificate information acquisition program.

[0002]

2. Description of the Related Art Conventionally, a system for verifying a user's identity, checking for falsification on a communication path, and preventing wiretapping by using digital signature technology and public communication technology using public key cryptography (hereinafter referred to as "verification"). It is necessary to confirm that the public key used at that time is indeed the public key of the communication partner, and as a method of confirming the owner of this public key, a CA (Certification Authority: The method using the public key certificate issued by the authority is used. In this method, first, the public key certificate of the communication partner is acquired, and the signature of the CA given to the acquired public key certificate and the verification of the certificate chain are performed to determine the public key certificate issuer. Check reliability. Further, by confirming that the target public key certificate has not been revoked by the CA, it is possible to judge that the obtained public key certificate is a valid and reliable certificate. Here, as one method for the verifier to confirm whether or not the public key certificate is revoked, as shown in FIG. 7, the CRL (Certifi) issued by the CA is used.
cation Revocation List: A revocation certificate list) can be obtained from a directory, etc., and it can be confirmed whether or not the public key certificate information to be verified is listed in the list.

The CRL is a list of public key certificate information that has been revoked by the CA, and when the CA revokes the public key certificate, the revocation information is reflected at a timing based on the CA policy. Issue a new (next edition) CRL.

Therefore, it can be said that it is desirable for the verifier to acquire the CRL issued as recently as possible at the time of verification, and use this to perform the invalidation confirmation.

Regarding the timing of issuing the CRL, the CA normally carries out an operation of posting the "next update date and time" in the issued CRL and issuing a new CRL by at least that date and time. And in the verifier, CA
With this operation, the acquired CRL is operated not to be used for confirmation of invalidation beyond the "next update date and time" posted on the CRL.

[0006] In such a situation where the operation related to the CRL is performed, the verifier has issued the latest C issued by the CA.
Conventionally, there are the following two timings for acquiring the RL.

(A) Acquire the CRL when the "next update date / time" is posted on the acquired CRL: (b) Acquire the CRL at any time at the timing of signature verification:

However, when the CRL is acquired at the timing shown in the above-mentioned conventional (a),
Actually, the CA issues a new CRL before the "next update date / time" posted on the CRL that the verifier has acquired, so between the issue date / time and "next update date / time",
The verifier will perform the invalidation confirmation with the latest CRL, and the reliability of the signature verification process may decrease. Therefore, when the period from the date and time when the CA actually issues a new CRL to the "next update date and time" is called the "reliability lowering period", the length of this reliability lowering period is as shown in FIG. In addition, since the CA depends on the date and time when a new CRL is issued, the verifier cannot control this by himself.

Further, when the CRL is acquired at the timing shown in the above-mentioned conventional (b), when the CA has a new CRL.
Even if you have issued a
Since L is acquired and the invalidation confirmation can be performed using the L, the reliability of the signature verification process is not deteriorated as in the case of acquiring at the timing of (a) above, but the CRL is not used. There is a problem in that the frequency of access to an external system such as a CA or a directory for obtaining the information is large and the processing load is heavy.

Therefore, in the above conventional method, the verifier is
In order to obtain the CRL, it is necessary to select whether to allow the reliability of the signature verification process to be reduced for a period length that cannot be controlled by the verifier itself or to allow frequent access to an external system. There is a problem of disappearing.

The present invention has been made in view of the above points, and in the acquisition of the CRL, the signature verification process is performed while following the operation that the acquired CRL is not used for confirmation of invalidation beyond the "next update date and time". Revocation certificate information acquisition method and device, and revocation certificate information acquisition program, and memory storing revocation certificate information acquisition program for allowing verifier to control the length of reliability deterioration period and access frequency to external system The purpose is to provide a medium.

[0011]

FIG. 1 is a diagram for explaining the principle of the present invention.

According to the present invention (Claim 1), a revocation certificate information acquisition method for performing revocation confirmation processing of a public certificate, which is necessary when performing digital signature communication or encrypted communication using public key cryptography, As an initial setting, the timing to acquire the CRL is defined (step 1), the arrival of the defined timing to acquire the defined CRL is monitored during the system operation (step 2), and the CRL that was previously acquired is posted. The arrival of the next update date and time is monitored (step 3), and when any arrival is detected (step 4, Yes), the CRL is acquired from the external system including the directory (step 5) and stored locally. (Step 6).

FIG. 2 is a block diagram showing the principle of the present invention.

The present invention (Claim 2) is a revocation certificate information acquisition apparatus for performing a revocation confirmation process of a public certificate, which is necessary when performing electronic signature communication or encrypted communication using public key cryptography. CRL acquisition timing defining means 11 for defining the timing for acquiring the CRL, and CRL
CRL acquisition timing monitoring means 12 for monitoring the timing of CRL acquisition defined by the acquisition timing definition means 11, and next update date and time monitoring means 13 for monitoring the arrival of the next update date and time posted in the CRL acquired last time. , C
When the RL acquisition timing monitoring means 12 has reached the acquisition timing or the next update date / time monitoring means 13 has detected that the next update date / time has arrived,
Get the CRL from the external system, including the directory,
And CRL acquisition means 14 for locally storing.

The present invention (Claim 3) is a revocation certificate information acquisition program for performing invalidation confirmation processing of a public certificate, which is necessary when performing electronic signature communication or encrypted communication using public key cryptography. There is a CRL acquisition timing definition process for defining the timing to acquire the CRL,
CRL defined in the CRL acquisition timing definition process
The acquisition timing has arrived in the CRL acquisition timing monitoring process that monitors the acquisition timing, the next update date monitoring process that monitors the arrival of the next update date and time posted in the previously acquired CRL, and the CRL acquisition timing monitoring process. Alternatively, when the next update date and time monitoring process detects that the next update date and time has arrived, the CRL acquisition process for acquiring the CRL from the external system including the directory and locally storing the CRL.

The present invention (claim 4) provides a revocation certificate information acquisition program for performing revocation confirmation processing of a public certificate, which is necessary when performing electronic signature communication or encrypted communication using public key cryptography. A stored storage medium, a CRL acquisition timing definition process for defining the timing to acquire the CRL, and a CR that monitors the acquisition timing of the CRL defined in the CRL acquisition timing definition process.
L acquisition timing monitoring process and previously acquired CR
Whether the acquisition timing has arrived in the next update date monitoring process that monitors the arrival of the next update date and time posted in L and the CRL acquisition timing monitoring process, or the next update date has arrived in the next update date monitoring process. CRL acquisition process for acquiring the CRL from the external system including the directory and storing it locally when detected.

As described above, in the present invention, in addition to the acquisition timing at the time when the next update date / time has passed, the CRL acquisition process is performed at the timing defined by the verifier himself even before the next update date / time. It is possible to control the maximum length of the reliability reduction period of the signature verification process and the access frequency to the external system by the defined time interval of the acquisition timing. Therefore, the verifier can control the reliability degradation period of the signature verification process and the access frequency to the external system while following the operation that the acquired CRL is not used for confirmation of invalidation beyond the "next update date and time". The acquisition process can be realized.

[0018]

BEST MODE FOR CARRYING OUT THE INVENTION According to the present invention, even when the CRL is acquired, the acquired CRL is not used for the invalidation confirmation beyond the “next update date / time”, but the reliability of the signature verification process is reduced. We propose a method that verifier can control the length and access frequency to external system.

FIG. 3 shows the configuration of a revocation certificate acquisition apparatus according to an embodiment of the present invention.

The apparatus shown in the figure comprises a CRL acquisition timing definition unit 11, a CRL acquisition timing monitoring unit 12, a next update date management unit 13 and a CRL acquisition unit 14.

The CRL acquisition timing definition unit 11 uses the CR
The verifier defines the timing of acquiring L. When there are a plurality of CAs, they may be defined for each CA or may be defined uniformly. The location to be defined may be a file or a memory. In addition, as a method of defining the timing, the time may be designated, or the time of the acquisition interval may be designated.

The CRL acquisition timing monitoring unit 12 uses the CR
Whether or not the CRL acquisition timing defined by the L acquisition timing definition unit 11 has arrived is monitored.

The next update date / time management unit 13 monitors whether the next update date / time posted in the CRL acquired last time has arrived.

When the CRL acquisition timing monitoring unit 12 detects that the acquisition timing has arrived or the next update date / time management unit 13 has detected that the time update date / time has arrived, the CRL acquisition unit 14 stores the CRL in an external system such as a directory. Get from and save locally.

Next, the CRL acquisition process with the above configuration will be described.

FIG. 4 is a diagram for explaining the operation in one embodiment of the present invention.

It is assumed that the numbers in circles in the same figure and the numbers described below match.

At the time of initial setting, the CRL acquisition timing definition unit 11 is used to define the timing for acquiring the CRL in a file or the like.

During operation of the verifier system, C
The RL acquisition timing is monitored. At the same time, the next update date / time management unit 13 is used to monitor whether or not the next update date / time posted in the previously acquired CRL has arrived.

When the CRL acquisition timing monitoring unit 12 detects that the acquisition timing has arrived or the next update date and time management unit 13 has detected that the next update date and time has arrived, the CRL acquisition unit 14 is used to store the CRL in an external directory or the like. Get it from the system and save it locally.

Returning to, waits for the acquisition timing of the next CRL.

[0032]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 5 shows the configuration of a revocation certificate information acquisition apparatus according to an embodiment of the present invention.

The revocation certificate information acquisition apparatus shown in FIG.
RL acquisition timing definition unit 11, CRL acquisition timing monitoring unit 12, next update date management unit 13, CRL acquisition unit 1
4, CRL acquisition timing definition file 15 and CRL file 16. The CRL acquisition timing definition unit 11 has a file writing function 111 that stores the input CRL acquisition timing in the CRL acquisition timing definition file 15.

The CRL acquisition timing monitoring unit 12 uses the CR
It has a file reading function 121 for reading the CRL acquisition timing from the L acquisition timing definition file 15 and a time monitoring function 122 for monitoring the arrival of time.

The next update date / time management unit 13 has a file reading function 131 for reading the next update date / time information from the CRL file and a time monitoring function 132 for monitoring the arrival of the read next update date / time.

The CRL acquisition unit 14 is the external system 100.
It has a CRL acquisition function 141 for acquiring the CRL from and a file writing function 142 for writing the acquired CRL in the CRL file 16.

Next, the operation of the above configuration will be described.

FIG. 6 is a diagram for explaining the operation of one embodiment of the present invention.

In the following description, the operation will be described separately for system initialization and system operation.

First, the processing at the time of system initialization will be described.

The file writing function 111 of the CRL acquisition timing definition unit 11 is used to create the CRL acquisition timing definition file 15 that defines the CRL acquisition tones. In the present embodiment, the following description will be given assuming that it is defined as "00 minute every hour" (= "maximum length of reliability lowering period" = 1 hour).

Next, the processing during operation of the verifier system will be described.

First, the CRL acquisition timing monitoring unit 1
By using the file reading function 121 of No. 2, the information of "00 minute every hour" is read from the CRL acquisition timing definition file 15 which defines the acquisition timing of the CRL created in (2). Subsequently, the time monitoring function 122 is used to monitor the arrival of "00 minute every hour". At the same time as these processes, the CRL file 16 acquired last time is read by using the file reading function 131 of the next update date management unit 13.
Then, the next update date and time information is read, and then the time monitoring function 132 is used to monitor the arrival of the read next update date and time. In the present embodiment, the next update date / time information posted in the CRL file 16 acquired last time is “2001.
The following description will be given on the assumption that the time is "August 1, 0:10:00" and the current time is "July 31, 2001 23: 50: 0".

As time passes, the current time is “2001
The time monitoring function 122 of the CRL acquisition timing monitoring unit 12 determines that “0 hour, 0 hour, 0 second on August 1,”
C of the CRL acquisition unit 14 is detected when "0 minutes" has arrived.
Call the RL acquisition function 141. CRL acquisition function 141
According to the call, for example, the external system 10
LDAP (Light-weight Director
The CRL is acquired according to the y Access Protocol) protocol and stored locally in the CRL file 16 using the file writing function 142.

With respect to the CRL acquired and stored in
The file read function 13
1 is used to read the next update date / time information from the CRL file 16, and then the time monitoring function 132 is used to monitor the arrival of the read next update date / time. In this embodiment, the next update date / time information read here is "200".
The following explanation will be continued on the assumption that it was 0: 40: 0 on August 1, 1st.

As time passes, the current time is “2001
If the signature verification process occurs in the verifier system at 0:30:00 on August 1, 2014, it is possible to confirm whether the public key certificate used for signature verification has been revoked. Using the CRL acquired in and.

Further, when time passes and the current time becomes “0: 40: 0 seconds on August 1, 2001”,
The time monitoring function 132 detects that the next update date and time "01:40:00 on August 1, 2001" has arrived, and the CRL is detected.
The acquisition function 141 is called. The CRL acquisition function 141
Following the call, the CRL is obtained from the directory of the external system 100 and stored locally in the CRL file 16 using the file write function 142.

With respect to the CRL acquired and stored in
The file read function 13
The arrival of the next update date and time read using 1 is monitored.

Thereafter, when "00 hour every hour" arrives, the processing of "1" is performed, when the next update date and time arrives, the processing of "1" is performed, and when the signature verification processing occurs,
The most recent CRL acquired at that time, as in
Is used to perform the invalidation confirmation processing.

As described above, in the verifier system, in addition to the timing at which the next update date and time indicated in the CRL acquired immediately before is passed, the CRL of the CRL is set at the timing defined by the verifier even before the next update date. By performing the acquisition, the acquired CRL is not used for confirmation of invalidation beyond the "next update date and time", but the reliability deterioration period of the signature verification process is within the acquisition timing time interval defined by the verifier. (In this example, within 1 hour),
In addition, it is possible to control access to the external system 100 only as many times as necessary.

Further, the operation shown in FIGS. 4 and 6 is constructed as a program and installed in a computer used as a revocation certificate information acquisition device, or
It can also be distributed via a network.

Further, the constructed program is stored in a hard disk device connected to a computer used as a revocation certificate information acquisition device, a portable storage medium such as a floppy (registered trademark) disk or a CD-ROM. The present invention can be easily realized by installing it when carrying out the present invention.

The present invention is not limited to the above embodiment, but various modifications and applications are possible within the scope of the claims.

[0055]

As described above, according to the present invention, the verifier acquires the reliability of the signature verification process and the CRL from the external system in the signature verification process according to the importance of the data to be verified. It is possible to adjust the magnitude of the access processing load.

Further, since the CRL acquisition processing can be performed without interlocking with the signature verification processing, the time required for the CRL acquisition processing does not affect the processing time for signature verification.

[Brief description of drawings]

FIG. 1 is a diagram for explaining the principle of the present invention.

FIG. 2 is a principle configuration diagram of the present invention.

FIG. 3 is a configuration diagram of a revocation signature certificate information acquisition device according to an embodiment of the present invention.

FIG. 4 is a diagram for explaining an operation in the embodiment of the present invention.

FIG. 5 is a configuration diagram of a revocation certificate information acquisition device according to an embodiment of the present invention.

FIG. 6 is a diagram for explaining the operation of the embodiment of the present invention.

FIG. 7 is a flow of a method for checking whether or not a public key certificate is invalidated by CRL in the related art.

FIG. 8 is a diagram illustrating a period during which there is a possibility that the reliability of the signature verification process may decrease in the revocation confirmation using the CRL.

[Explanation of symbols]

11 CRL acquisition timing definition means, CRL acquisition timing definition section 12 CRL acquisition timing monitoring section, CRL acquisition timing monitoring section 13 Next update timing monitoring section, next update timing monitoring section 14 CRL acquisition section, CRL acquisition section 15 CRL acquisition timing definition file 16 CRL file 100 External system 111 File writing function 121 File reading function 122 Time monitoring function 131 File reading function 132 Time monitoring function 141 CRL acquisition function 142 File writing function

Claims (4)

[Claims] 1. A revocation certificate information acquisition method for performing revocation confirmation processing of a public certificate, which is necessary when performing digital signature communication or encrypted communication using public key cryptography, wherein the revocation certificate is initially set. The timing to acquire the certification list (hereinafter referred to as CRL) is defined, and when the system is operating, the arrival of the defined timing to acquire the defined CRL is monitored, and the next update date and time posted in the previously acquired CRL. A method of acquiring revocation certificate information, characterized by monitoring the arrival of the CRL and acquiring the CRL from an external system including a directory when any of the arrival is detected and storing the CRL locally. 2. A revocation certificate information acquisition device for performing revocation confirmation processing of a public certificate, which is necessary when performing electronic signature communication or encrypted communication using public key cryptography, and acquires a CRL. CRL acquisition timing defining means for defining timing, and CRL defined by the CRL acquisition timing defining means
CRL acquisition timing monitoring means for monitoring the timing of acquisition, next update date and time monitoring means for monitoring the arrival of the next update date and time posted in the previously acquired CRL, and acquisition timing for the CRL acquisition timing monitoring means. Or when the next update date / time monitoring means detects that the next update date / time has arrived, the CRL acquisition means stores the CRL from an external system including a directory and stores it locally. Revocation certificate information acquisition device. 3. A revocation certificate information acquisition program for performing revocation confirmation processing of a public certificate, which is necessary when performing electronic signature communication or encrypted communication using public key cryptography, and acquires a CRL. CRL acquisition timing definition process for defining timing, and C defined in the CRL acquisition timing definition process
A CRL acquisition timing monitoring process that monitors the timing of RL acquisition, a next update date and time monitoring process that monitors the arrival of the next update date and time posted in the previously acquired CRL, and an acquisition timing in the CRL acquisition timing monitoring process. A CRL acquisition process for acquiring a CRL from an external system including a directory and locally storing the CRL when the next update date / time is detected in the next update date / time monitoring process. Revocation certificate information acquisition program. 4. A storage medium in which a revocation certificate information acquisition program for performing revocation confirmation processing of a public certificate, which is necessary when performing electronic signature communication or encrypted communication using public key cryptography, is stored. , A CRL acquisition timing definition process for defining the timing to acquire the CRL, and a C defined in the CRL acquisition timing definition process.
A CRL acquisition timing monitoring process that monitors the timing of RL acquisition, a next update date and time monitoring process that monitors the arrival of the next update date and time posted in the previously acquired CRL, and an acquisition timing in the CRL acquisition timing monitoring process. A CRL acquisition process for acquiring a CRL from an external system including a directory and locally storing the CRL when the next update date / time is detected in the next update date / time monitoring process. A storage medium that stores a revocation certificate information acquisition program.