JP2003233594A - Access right management system, access right management method, access right management program and recording medium recording access right management program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To allow efficient right management of each manager. <P>SOLUTION: A manager certifying system to which an access right management system is applied comprises systems SYS mounted thereon for holding resources to be accessed by managers M via manager terminal to be operated by the managers M. In each system SYS, a certificate issuing authentication agency CA for issuing a public key certificate PKC, an attribute authentication agency AA for issuing a role allocating authentication RAAC describing information showing a manager group for a framework defining given operation of the resource to which the manager M belongs, as the attribute authenticate to be held by the manager M, and a role authentication agency RA for issuing a role defining certificate RSAC describing information showing a right permitted to the manager group, as an attribute certificate to be issued for every manager group, are installed. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

TECHNICAL FIELD The present invention relates to an access right management system, an access right management method, an access right management program and an access for managing the authority of each administrator for a predetermined resource and verifying the access of the administrator to the resource. The present invention relates to a recording medium on which a rights management program is recorded.

[0002]

2. Description of the Related Art In recent years, the number of services via the Internet has been increasing, and along with this, management of access rights has been carried out in order to eliminate unauthorized user access to hardware, software, and data. It has become very important.

In particular, high security is required, for example, a system for handling and managing a user's key used for data encryption, and a system for issuing a certificate for an individual by a certificate authority which is a trusted third party. In some systems, multiple administrators are provided, access rights are assigned to these administrators, and control is specified so that processing is permitted only when a plurality of predetermined administrators simultaneously access. There are cases and cases where one administrator prescribes operations that should not be combined.

Here, as a management method of an administrator, the concept of a group is introduced, such as management at the operating system level of UNIX (registered trademark),
There are those that give individual authority to each group and manage access. In such a management method, a user who belongs to a certain group can access the resource file managed by the group with reading and / or writing.

[0005]

By the way, in the conventional management method of the administrator, as described above, it is general that the access right is granted and the work is assigned to each group. The system side has not established a system to manage efficiently whether it belongs to a group, determine and verify whether a certain administrator belongs to that group, and manage the relationship between groups. Also, there is a problem that both the administrator side and the administrator side have a heavy burden of requiring complicated processing.

The present invention has been made in view of the above circumstances, and an access right management system, an access right management method, an access right management program, and an access right management program capable of efficiently managing the rights of a group. It is intended to provide a recording medium on which is recorded.

[0007]

An access right management system according to the present invention that achieves the above object manages the authority of each administrator for a predetermined resource and verifies the access of the administrator to the resource. A predetermined attribute for issuing a role assignment certificate, which is a management system, which is a framework for defining a predetermined operation for a resource, and which is an electronic certificate in which information indicating an administrator group as a role to which the administrator belongs is described A certification authority and a predetermined role certification authority that issues a role definition certificate that is an electronic certificate issued for each administrator group and describes the authority permitted to the administrator group. The administrator terminal that holds the role assignment certificate issued by the attribute certificate authority operates the administrator terminal and the role definition certificate issued by the role certificate authority. Then, referring to the role assignment certificate held by the administrator who accesses the held resource, the administrator group to which the administrator belongs is determined, and the role assignment certificate among the held role definition certificates is held. A system for verifying access of the administrator to a resource based on a role definition certificate associated with the certificate.

The access right management system according to the present invention is a framework for defining a predetermined operation for a resource, and is a role assignment certificate issued by an attribute certification authority with information indicating an administrator group to which an administrator belongs. In addition, describe the authority granted to the administrator group in the role definition certificate issued by the role certification authority, and refer to the role assignment certificate held by the administrator who accesses the resource by the system. The administrator group to which the administrator belongs is discriminated and the access of the administrator to the resource is verified based on the role definition certificate associated with the role assignment certificate held by the administrator.

The access right management method according to the present invention which achieves the above object is an access right management method for managing the authority of each administrator for a predetermined resource and verifying the access of the administrator to the resource. The role assignment certificate, which is a framework for defining a predetermined operation for a resource and in which information indicating an administrator group as a role to which the administrator belongs is issued by a predetermined attribute certificate authority and is held by the administrator. , A role definition certificate, which is an electronic certificate issued for each administrator group and which describes the authority permitted to the administrator group, is issued by a predetermined role certification authority and retained in the system. As the administrator accesses the resource held by the system through the administrator terminal, the role held by the administrator by the system The system determines the administrator group to which the administrator belongs by referring to the assignment certificate, and based on the role definition certificate associated with the role assignment certificate among the role definition certificates held by the system, the system It is characterized by verifying the access of the manager to the resource.

The access right management method according to the present invention is a framework for defining a predetermined operation for a resource, and a role assignment certificate issued by an attribute certification authority with information indicating an administrator group to which an administrator belongs. In addition, describe the authority granted to the administrator group in the role definition certificate issued by the role certification authority, and refer to the role assignment certificate held by the administrator who accesses the resource by the system. The administrator group to which the administrator belongs is discriminated and the access of the administrator to the resource is verified based on the role definition certificate associated with the role assignment certificate held by the administrator.

Further, the access right management program according to the present invention which achieves the above-mentioned object manages the authority of each administrator to a predetermined resource and verifies the access of the administrator to the resource by a computer-readable access right. A management program, which is a framework for defining a predetermined operation for a resource, in which a role assignment certificate in which information indicating an administrator group as a role to which the administrator belongs is described is issued by a predetermined attribute certification authority and managed. A role definition certificate, which is a digital certificate issued by each administrator group and that describes the authority permitted to the administrator group, is issued by While issued and holding the role definition certificate, the administrator can access the resources held by the system via the administrator terminal. Depending on the access, the role assignment certificate held by the administrator is referenced to determine the administrator group to which the administrator belongs and the role assignment certificate of the held role definition certificates is associated. It is characterized in that the administrator's access to the resource is verified based on the obtained role definition certificate.

The access right management program according to the present invention is a role assignment certificate issued by an attribute certificate authority, which is a framework for defining a predetermined operation on a resource and which shows information indicating an administrator group to which the administrator belongs. The role definition certificate issued by the role certificate authority describes the authority granted to the administrator group and the role assignment certificate held by the administrator who accesses the resource. To determine the administrator group to which the administrator belongs, and verify the administrator's access to the resource based on the role definition certificate associated with the role assignment certificate held by the administrator.

Furthermore, the recording medium on which the access right management program according to the present invention which achieves the above-mentioned object is recorded manages the authority of each manager for a predetermined resource and verifies the manager's access to the resource. A computer-readable recording medium storing a computer-readable access right management program, which is a framework for defining a predetermined operation for a resource, and a role assignment in which information indicating an administrator group as a role to which the administrator belongs is described. The certificate is issued by a predetermined attribute certificate authority and is held by the administrator, and the access right management program is an electronic certificate issued for each administrator group and has the authority permitted to the administrator group. A role definition certificate, which is the described digital certificate, is issued by a prescribed role certificate authority,
With the role definition certificate held, the administrator refers to the role assignment certificate held by the administrator as the administrator accesses the resource held by the system via the administrator terminal, and the relevant administrator It is characterized by determining the administrator group to which the user belongs and verifying the access of the relevant administrator to the resource based on the role definition certificate associated with the role assignment certificate among the held role definition certificates. There is.

The recording medium in which the access right management program according to the present invention is recorded is a framework for defining a predetermined operation for a resource, and the attribute certificate authority issues information indicating the administrator group to which the administrator belongs. The administrator who accesses the resource holds the authority that is described in the role assignment certificate described in the role definition certificate issued by the role certification authority, as well as described in the role assignment certificate. The system refers to the role assignment certificate to identify the administrator group to which the administrator belongs, and based on the role definition certificate associated with the role assignment certificate held by the administrator, Provide an access right management program to verify access.

[0015]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Specific embodiments to which the present invention is applied will be described in detail below with reference to the drawings.

In this embodiment, an access right management system that manages the authority of each administrator to a resource in a predetermined system and verifies the access to the resource is an administrator who performs processing including authentication of the administrator. It is applied to the authentication system. This administrator authentication system authenticates an administrator by using a mechanism of a public key infrastructure (PKI) which is a security infrastructure using a so-called public key cryptosystem, Introducing the concept of group to the management of managers, ITU-T (Internatio
nal Telecommunication Union-Telecommunication sect
or) X. PMI (Privilege
"Role" in management Infrastructure
By using the concept of "e)", group authority management can be efficiently performed.

In the following, a concept of the administrator authentication system will be described, and then an implementation example and a usage example will be described.

The administrator authentication system is conceptually shown in FIG.
As shown in, for example, operation OP₁₁, OP₁₂・ ・ ・
., OP_1nA frame that defines a predetermined operation (authority) such as
Administrator group M with the group as one role
G₁And, for example, manager M₁, M_TwoAt least
Administrators who are one or more individuals are
₁Belong to.

In the administrator authentication system, the operations defined in one administrator group need to be regarded as equivalent from the viewpoint of access right. That is, in the administrator authentication system, for example, when the operation α for reading the file A and the operation β for reading the file B are defined as the authority given to a certain administrator group, these operations are performed. It is assumed that α and β are always considered as a pair, and there is no administrator who can only perform the operation α or an administrator who can only perform the operation β. Further, in the administrator authentication system, it is possible to define an administrator group having operations that must not be combined.

In such an administrator authentication system, an entity belonging to each administrator group, that is, an administrator is defined as a member. In the administrator authentication system, a plurality of members may exist in one administrator group as described above, and members can be added and / or deleted at any timing.

Further, in the administrator authentication system, it is possible to add and / or delete operations permitted as authority to each administrator group. Specifically, in the administrator authentication system, an arbitrary operation can be added when a member does not exist in the administrator group to which the arbitrary operation is added. In the administrator authentication system, when members exist in the administrator group, an arbitrary operation can be added after once deleting all the members. On the other hand, in the administrator authentication system, an arbitrary operation can be deleted when there is no member in the administrator group targeted for deleting the arbitrary operation. In the administrator authentication system, when there are members in the administrator group, it is possible to delete all members once and then delete any operation.

Further, in the administrator authentication system,
Have each administrator hold the digital certificate and hold the digital certificate.
Which administrator group a given administrator belongs to.
That is, the operations defined by an administrator group are permitted.
When the system decides whether it is allowed or not, the electronic
Certificates are used. This digital certificate has more details
As will be described later, information for identifying the administrator group, etc.
Composed as including. Smell the administrator authentication system
Is the administrator group that is digitally signed by each entity.
A digital certificate that indicates the
Administrator holds this digital certificate and the administrator group
Group that contains information indicating the permissions that are permitted for each group.
By holding the child certificate on the system side, the operation is confirmed.
A testimony is given. For example, the administrator authentication system shown in FIG.
In, the manager group MG ₁Entite belonging to
Itaru Manager M₁, M_TwoRespectively the admin group
MG₁The distributed electronic certificate indicating that the
(Integrated Circuit) Store it in a card etc.
When accessing the resource on the system side, the digital certificate
A login operation using the stored IC card or the like is performed.
On the other hand, in the administrator authentication system, the system side
Manager group MG₁Permissions granted to
Operation OP₁₁, OP₁₂・ ・ ・ ・ ・ ・ OP_1nOperate
Hold a distributed digital certificate indicating that it is possible
, The digital certificate held by the logged-in administrator and the self
The administrator operates based on the digital certificate held by
OP₁₁, OP₁₂・ ・ ・ ・ ・ ・ OP_1nCan be operated
To certify that

Now, a specific implementation example of the administrator authentication system based on such a concept will be described below.

First, before describing a specific implementation example, an electronic certificate necessary for realizing the administrator authentication system will be described here.

In the administrator authentication system, ISO (International Organization for St
andardization) / IEC (International Electrotech
nical Commission) 9594-8, or ITU-T
X. 509-based public key certificate (Public Key Certifi
cate; PKC) and Attribute Certificate
e; AC) is used.

First, the public key certificate will be described. A public key certificate is a certification authority that is an independent third party in the public key cryptosystem.
Thority; CA or Issuer Authority; IA).

Here, the public key cryptosystem will be described. In the public key cryptosystem, a sender and a receiver have different keys, one key is a public key that can be used by an unspecified user, and the other key is a secret key that is kept secret. Unlike the so-called common key cryptosystem, which uses a common key for encryption and decryption, the public key cryptosystem requires only one person to hold the secret key that needs to be kept secret. It is advantageous in key management. A typical public key cryptosystem is a so-called RSA (Ri
vest-Shamir-Adleman) There is a cipher. This RSA encryption utilizes the difficulty of the prime factorization process of the product of two very large prime numbers of about 150 digits.

The public key cryptosystem allows the public key to be used by an unspecified number of users, and a public key certificate is used to prove whether or not the public key to be distributed is legitimate. The method is widely used. For example, in the public key cryptosystem, a specific user A generates a public key and a private key that form a pair, and sends the generated public key to a certificate issuing certificate authority to obtain a public key certificate. Then, the public key certificate is made public. On the other hand, unspecified users
A public key is obtained by performing a predetermined procedure based on the public key certificate, and a plaintext document or the like is encrypted and sent to a specific user A. Then, the user A performs processing such as decrypting the encrypted document sent from an unspecified user using the private key. The public key cryptosystem is such a cryptosystem.

In the public key cryptosystem, the user A adds a signature to a plain text document or the like by using the secret key,
It becomes possible for an unspecified user to obtain a public key by performing a predetermined procedure based on the public key certificate and verify the signature. For example, in the public key cryptosystem, when the certificate issuing certificate authority determines the public key by referring to the public key certificate, it sends an arbitrary plaintext document or the like to the user A and encrypts it using the private key. And send it back again. The certificate issuing certificate authority can verify the validity of the signature by decrypting the encrypted document sent from the user A using the public key.

The public key certificate in such a public key cryptosystem is a certificate issuing certificate authority when a user who is an administrator submits information for identifying himself and a public key to the certificate issuing certificate authority. It is created by adding information for the side to identify the certificate issuing certificate authority and information such as the expiration date, and further adding a signature by the certificate issuing certificate authority.

Specifically, the public key certificate has a format as shown in FIGS. 2 and 3. It should be noted that in the figure, items for each field constituting the public key certificate, a description of each of these items, and an example of a described value are described.

The version shown in FIG. 2 is a field that describes version information of the format of the public key certificate. For example, the format is version 3
If it is, "2" indicating version 3 is described.

The serial number is a field that describes the serial number of the public key certificate set by the certificate issuing certificate authority, and describes, for example, a sequential number.

Signature algorithm identifier and signature algorithm identifier
Ithm parameters) is a field that describes information for identifying the signature algorithm of the public key certificate and its parameters. The signature algorithm includes, for example, elliptic curve cryptography or RSA cryptography. When the elliptic curve cryptography is applied as the signature algorithm, parameters and key length are described as algorithm parameters, and RSA cryptography is applied as the signature algorithm. If so, the key length is described as an algorithm parameter.

The issuer is a field described in a format (Distinguished Name) that makes it possible to identify the issuer of the public key certificate, that is, the name of the certificate issuing certificate authority.

The validity period (validity) is a field describing the start date and time (not Before) and the end date and time (not After) which are the validity periods of the public key certificate.

The subject is a field that describes the name of the person to be authenticated who is the user, and describes, for example, the identifier of the user device or the identifier of the service providing entity.

Subject public key information (subject Public
Key Info algorithm subject public key) is a field that describes a key algorithm as the user's public key information or the key information itself, and the key algorithm includes, for example, elliptic curve cryptography or RSA cryptography.

Each of these fields is a field included in the public key certificate whose format is version 1 or later, and each of the following fields is a field added to the version 3 version. .

Certificate Authority Key Identifier
er-key Identifier, authority Cert Issuer, authorit
y Cert Serial Number) is information for identifying the key for confirming the signature of the certificate issuing certificate authority, and is the key identification number in octal notation, and the name of the certificate issuing certificate authority in the General Name format. , And an authentication number field.

The subject key identifier
tifier) is a field describing an identifier for identifying each key when a plurality of keys are certified in a public key certificate.

The key usage purpose is a field for designating the purpose of use of the key. (0) Digital signature (digital signature), (1) Nonrepudiation (non Rep)
udiation), (2) for key encryption (key Enciphermen
t), (3) For message encryption (data Enciphermen
t), (4) Common key delivery (key agreement), (5) Authentication signature confirmation (key Cert Sign), (6) Revocation list signature confirmation (CRL Sign), (7) Key exchange ( key Agre
ement) Only used for data encryption (encipher Only),
And (8) Only used for decryption of data during key exchange (decipher
Only) is set for each purpose.

Private Key Usage Peri
od) is a field describing the start date and time (not Before) and the end date and time (not After), which are the expiration dates of the private key possessed by the user. By default, the expiration date of the public key certificate and the expiration date of the public key. And the expiration date of the private key are the same.

The certificate authority policy (Certificate) shown in FIG.
Policy) is a field that describes the certificate issuing policy of the certificate issuing certificate authority. For example, ISO / IEC 9
834-1 compliant policy ID (policy Identifie
r) and certification criteria (policy qualifiers) are described.

Policy mapping
s) is a field described only when authenticating a certificate issuing certificate authority, and is a field that describes the certificate issuing certificate authority's policy (issuer Domain Policy) and the subject policy (subject Domain Policy) that issue certificates. Specify the mapping.

Supported Algorithm (supported Algo
rithms) is a field that defines the attributes of the directory (X.500). The support algorithm is used to notify the attribute in advance when the communication partner uses the directory information.

Subject Alternative Name
Is a field in which a user's alias is described in a general name format.

The issuer alias (issuer Alt Name) is a field for describing the alias of the certificate issuer.

The subject directory attributes are fields that describe the user's arbitrary attributes.

The basic constraints (basic Constraints) are fields for distinguishing whether the public key to be certified is for the signature of the certificate issuing certificate authority or for the user.

Allowable Subtree Constraints (name Constraints
permitted Subtrees) is a field indicating the effective area of the public key certificate used only when the subject is the certificate issuing certificate authority.

The constraint policies (policy Constraints) are
This field describes the restrictions that require a clear authentication policy ID or prohibition policy map for the rest of the authentication path.

CRL Reference Point (Certificate Revoca
Option List Distribution Points) is a field describing the reference point of the revocation list for confirming whether the public key certificate has been revoked when the user uses the public key certificate.

The signature is issued by the public key certificate issuer, that is,
This is the signature field of the certificate issuing certificate authority. A digital signature is data generated by applying a so-called hash function to the entire public key certificate to generate a hash value and then encrypting this hash value using the private key of the certificate issuing certificate authority. is there.

The certificate issuing certificate authority issues a public key certificate in such a format, updates the expired public key certificate, and revoke a fraudulent user to reject it. Create, manage, distribute
That is, revocation is performed. The certificate issuing certificate authority also generates a public key and a private key, if necessary.

On the other hand, the user who uses this public key certificate verifies the electronic signature of the public key certificate by using the public key of the certificate issuing certificate authority that he has, and when the verification of the electronic signature is successful, Obtain the public key based on the public key certificate,
This public key can be used. Therefore, all users who use the public key certificate need to acquire whether or not they have the public key of the certificate issuing certificate authority that issued the public key certificate.

In the administrator authentication system, such public key certificate is held by each administrator and system.

Next, an attribute certificate which is another electronic certificate required in the administrator authentication system will be described. The attribute certificate is a local authority that is different from the certificate issuing certificate authority described above.
ity; AA).

The attribute certificate has a format as shown in FIGS. In addition, in the figure,
The items for each field constituting the attribute certificate and the description for each item are described.

The version shown in FIG. 4 is a field for describing the version information of the format of the attribute certificate. For example, the format is version 2
In the case of (1), "1" indicating version 2 (1) is described.

The holder is a field for specifying the owner of the public key certificate to which the attribute certificate is linked. The holder has a base certificate authority identifier (ba
As the se Certificate ID), the issuer name (issuer) of the public key certificate owned by the owner of the attribute certificate and the serial number (seria) of the public key certificate owned by the owner of the attribute certificate
l), the unique identifier (issuer UID) for identifying the issuer of the public key certificate held by the owner of the attribute certificate is described. In addition, the holder has a subject (subject) or subject alternative name (subject) in the public key certificate.
The owner name (entity name) of the attribute certificate that is the same as the Alt Name) is described. Further, in the holder, assuming that the attribute certificate is not linked to the identity information or public key certificate in the future, for example, the hash of the public key is described in the object digest information (object Digest Info). ) Is described.

The issuer is a field for designating the information of the issuer who signed the attribute certificate.

The signature is a field for describing an identifier for identifying an algorithm used for validating the signature of the attribute certificate.

The serial number is a field that describes the serial number assigned to each attribute certificate by the attribute certificate authority.

Attribute Certificate Validity (attr Cert Validity
Period) is the start date and time (n
ot Before) and end date and time (not After).

The attributes shown in FIG. 5 are fields for describing information regarding the privilege of the owner of the attribute certificate. For example, the object to which access is permitted may be described in a sentence. You may write the code that can be accessed prepared in the above, or you may write the key that encrypts a certain plaintext. For example, the attribute includes authentication information (Service Au) regarding the service used by the verifier of the attribute certificate to authenticate the owner of the attribute certificate.
thentication Information), and the access permission information (Acce
ss Identity), information for identifying the owner of the attribute certificate for billing (Charging Identity), information indicating the attribution relationship of the owner of the attribute certificate to the group (Grou
p), information indicating the role given to the owner of the attribute certificate (Role), and information regarding permission to use secret information for the owner of the attribute certificate (Clearance).

Issuer Unique ID
Is a field used when specified by the public key certificate of the issuer of the attribute certificate.

The extension information (extensions) is a field that describes not the information of the owner of the attribute certificate but the information of the attribute certificate, and the server and / or service administrator audits the owner of the attribute certificate. Information used for detecting fraudulent activity, that is, identification (Audit Identity), information indicating the server and / or service targeted by the attribute certificate (AC Targeting), the attribute certificate verifier Key information (Authority Key) of the issuer of the attribute certificate, which is auxiliary information for signature confirmation, and auxiliary information for the revocation status confirmation of the attribute certificate by the verifier of the attribute certificate.
URI (Uniform Resource Identif) of CSP Responder
iers) information (Authority Information Access),
CRL (Certificate Revocation L) which is auxiliary information for the revocation status confirmation of the attribute certificate by the verifier of the attribute certificate
ist) Information indicating the URI of the distribution point (CRL Distributio
n), information indicating that there is no revocation information corresponding to the attribute certificate (No Revocation), information used when the submitter is other than the owner, and information indicating the entity that can submit the attribute certificate ( Proxy Info) is described.

The signature (signature value) is a field that describes the signature given by the attribute certificate authority.

In the management authentication system, by holding the attribute certificate having such a format in each manager and the system, it is possible to determine which manager group the manager belongs to and what authority is granted. Can be verified.

The administrator authentication system is constructed using the above public key certificate and attribute certificate.
In the administrator authentication system, each entity has the following information when actually constructing the administrator authentication system.

That is, in the management authentication system,
For example, it is the side that handles whether or not an administrator can access a certain resource by receiving access control for a certain administrator, such as a system in a department in a company that provides a certain service. The system side has information on the defined administrator group, the digital certificate or public key issued by the above-mentioned certificate issuing certificate authority or attribute certificate authority, and the public key certificate used for mutual authentication with each administrator. Have and.

On the other hand, in the administrator authentication system, the administrator side such as a department in a company that performs management for issuing the attribute certificate to each administrator issues a certificate issuing certificate authority or an attribute certificate authority. Digital certificate or public key, a public key certificate used for mutual authentication with the system side, and an attribute certificate used for permitting access to each administrator.

In the administrator authentication system composed of the system side having such various information and the administrator side, ISO / IEC 9594-8 is used as the electronic certificate.
The attribute certificate issued by the above-mentioned attribute certificate authority defined in 1. is used. Further, in the administrator authentication system, since the public key certificate needs to be issued by the above-mentioned certificate issuing certificate authority before issuing the attribute certificate, a certificate issuing certificate authority is also introduced. further,
In the administrator authentication system, each administrator who performs an operation holds an IC card in which these electronic certificates are stored, and uses this IC card when performing an operation.

Specifically, such an administrator authentication system can be implemented as shown in FIG. That is, the administrator authentication system uses an electronic device for each system SYS that holds a resource to be accessed by the administrator M via an administrator terminal that is an information processing device such as a personal computer operated by the administrator M. Certificate issuing CA that issues a public key certificate PKC as a certificate
And an attribute certificate as an electronic certificate of each administrator M, in which information indicating an administrator group to which the administrator M belongs is described. Certificate (Role Assignment Certificat
e). ) An attribute certification authority AA that issues RAAC,
An attribute certificate as an electronic certificate issued for each administrator group, in which information indicating the authority permitted to the administrator group is described (hereinafter, a role definition certificate (Role Specification Certi
ficate). ) Role Certification Authority that issues RSAC (Ro
le Authority) RA and is installed. The role certification authority RA may be the same as the attribute certification authority AA, but here, for convenience of explanation, it is assumed that it is a logically independent organization.

In the administrator authentication system, the role definition certificate RSAC issued by the role certificate authority RA is used to define the role for each administrator group. That is, in the administrator authentication system, each operation, that is, a permitted procedure is defined for each administrator group, and this information is described in the role definition certificate RSAC issued by the role certification authority RA. It

This role definition certificate RSAC is shown in FIG.
And the role definition certificate RSAC, which is created according to the format of the attribute certificate shown in FIG.
Format version of the role definition certificate RS
Information indicating the name of the role certification authority RA, which is the issuer of the AC, information indicating the operation permitted by the code or operation name described by the system, and an administrator such as an identification name for identifying the administrator group Group information, information indicating the expiration date of the role definition certificate RSAC, verification key information of the administrator group, which is provided as necessary and requires later-described verification, signature information, and the role certification authority RA. Various information such as a signature is described.

In the administrator authentication system, the role definition certificate RSAC describing such various kinds of information is issued by the role authentication authority RA, and the system SYS holds this role definition certificate RSAC.

On the other hand, in the administrator authentication system, regarding the role assignment to each administrator group, the role assignment certificate RAA issued by the attribute certification authority AA.
C is used. That is, in the administrator authentication system, each role, that is, the administrator group to which it belongs is defined for each administrator M, and this information is described in the role assignment certificate RAAC issued by the attribute certification authority AA. It

Like the role definition certificate RSAC, this role assignment certificate RAAC is also created according to the format of the attribute certificate previously shown in FIGS. 4 and 5, and the role assignment certificate RAAC. Format version, information indicating the name of the attribute certification authority AA that is the issuer of the role assignment certificate RAAC, administrator group information such as an identification name for identifying the administrator group, and the validity of the role assignment certificate RAAC. Information indicating a time limit, information indicating a reference point to the role definition certificate RSAC for associating with the corresponding role definition certificate RSAC, signature key information of the encrypted administrator group MG described later, signature information, and Various information such as a signature by the attribute certification authority AA is described.

In the administrator authentication system, the role assignment certificate RAAC in which such various kinds of information are described is issued by the attribute certification authority AA, and the administrator M stores this role assignment certificate RAAC in an IC card or the like. Hold by.

Now, in such an administrator authentication system, each administrator signs data by using the signature key of the administrator group.

That is, in the administrator authentication system, as shown in the concept of FIG. 7, one administrator M ₁ belonging to the administrator group MG ₁ receives the role assignment certificate RAAC issued by the attribute certification authority AA. The signing key Enc that is obtained and encrypted from this role assignment certificate RAAC
The signature key K _MG1 of the administrator group MG ₁ is obtained by extracting and decrypting _k-M1 (K _MG1 ). On the other hand, in the administrator authentication system, the other administrator M ₂ belonging to the administrator group MG ₁ is the attribute certification authority A
The role assignment certificate RAAC issued by A is obtained, and the encrypted signature key Enc _k-M2 (K _MG1 ) is taken out from this role assignment certificate RAAC and decrypted to obtain the signature of the administrator group MG ₁ . Obtain the key K _MG1 . _{Incidentally, Enc k -MX} (K) shows the encryption of the signature key K based on a predetermined encryption method which depends on key k for administrators _{M X.}

As described above, in the manager authentication system, the managers M ₁ and M ₂ belonging to the manager group MG ₁ are
Respectively, the role assignment certificate RA from the attribute certification authority AA.
By acquiring the AC, the signature key K _MG1 of the administrator group MG ₁ can be obtained, and the signature key K _MG1 can be used to sign the data.

On the other hand, in the administrator authentication system, it may be necessary for an administrator belonging to a certain administrator group to verify data signed by an administrator belonging to another administrator group. In this case, in the administrator authentication system, the signature of each administrator is verified using the verification key of the administrator group that requires the above-mentioned verification.

For example, as shown in the concept of FIG.
Group MG_TwoManager M belonging to_ThreeIs an administrator group M
G₁Manager M belonging to₁, M_TwoVerify data signed by
Think about when. In this case, the administrator authentication system
Then, the manager group MG _TwoManager M belonging to_ThreeIs self
Role Certification Authority RA based on own role assignment certificate RAAC
Obtain the role definition certificate RSAC issued by
Administrator group signature key K_MG1Verification key K '_MG1To
Get it out. And the administrator authentication system
And manager M_ThreeIs the verification key K '_MG1Using administrator
Group MG₁Manager M belonging to₁, M_TwoThe signature of
To do.

As described above, in the administrator authentication system, the administrator M ₃ belonging to the administrator group MG ₂ obtains the role definition certificate RSAC from the role certification authority RA to obtain the verification key of the administrator group MG ₁ . The _K'MG1 is obtained, and the verification group _K'MG1 is used to obtain the administrator group M.
The signatures of the managers M ₁ and M ₂ belonging to G ₁ can be verified. Therefore, in the administrator authentication system,
The verification keys of the managers M ₁ and M ₂ belonging to the manager group MG ₁ and the managers M ₁ and M ₂ are the manager groups M 1.
It is not necessary to verify whether or not it belongs to G ₁ . Note that the verification key K ′ _MG1 is not necessarily stored in the role definition certificate RSAC because it is open to the public.

In such an administrator authentication system, as shown in FIG. 9, when the preparation phase P1 for constructing the administrator authentication system is performed, an administrator group is defined and each administrator group is defined. On the other hand, the registration phase P2 for registering the administrator is performed, which enables the administrator to perform an arbitrary operation using the system. In addition, in the administrator authentication system, a deletion phase P3 for deleting an administrator belonging to an arbitrary administrator group or an arbitrary administrator group as necessary.
Alternatively, the change phase P4 for changing the administrator belonging to the arbitrary administrator group or the arbitrary administrator group is performed. In the administrator authentication system, the signature phase P for the administrator to sign the data when the administrator performs any operation using the system.
5 and the verification phase P6 for the administrator to verify the signature attached to the data.

Specifically, in the administrator authentication system, as a preparation phase P1 for constructing the administrator authentication system, each attribute certificate authority AA and each role certificate authority R
In order to authenticate the IC card that A and each manager M hold, the certificate issuing certificate authority CA must be held by each attribute certification authority AA, each role certification authority RA, and each manager M. The public key certificate PKC is issued to each of the IC cards. The public key certificate PKC issued by the certificate issuing certification authority CA is held by the attribute certification authority AA and each role certification authority RA, and is stored in the IC card ICC.

Through the preparation phase P1 as described above, the administrator authentication system establishes a correspondence between the respective administrators and the attribute authentication authority AA and role authentication authority RA to be used by the system S.
It is constructed in a state managed by YS.

In addition, in the administrator authentication system constructed in this way, as the registration phase P2 for defining the administrator groups and registering the administrators in each administrator group, as shown in FIGS. The steps shown in are performed.

First, in the administrator authentication system, as shown in FIG.
The YS obtains the public key of the certificate issuing certification authority CA for verification and also obtains the public keys of the attribute certification authority AA and the role certification authority RA by downloading through the certificate issuing certification authority CA, for example.

Next, in the administrator authentication system,
In step S2, the system SYS specifies the corresponding attribute certification authority AA and role certification authority RA when registering the administrator M.

Next, in the administrator authentication system,
In step S3, the public key certificate PKC issued by the certificate issuing certification authority CA and stored in the IC card in the above-described preparation phase, and the public key obtained by the system SYS from the certificate issuing certification authority CA. Certificate PK
Mutual authentication is performed between the IC card and the system SYS using C and C. This mutual authentication is an IC held by the administrator M.
The authentication is for the card itself, and is for authenticating whether or not the IC card can be used in the system SYS.

Next, in the administrator authentication system,
The system SYS sets an administrator group and defines operations permitted to each administrator group. Actually, in the administrator authentication system, as a definition by this system SYS, about the part used in any case,
It is fixedly implemented by a predetermined program, and is extensible so that an administrator having a predetermined privilege can arbitrarily add an administrator group and operation by changing this program.

That is, in the administrator authentication system, when the IC card authentication is successful, in step S4, the system SYS issues the role definition certificate RSAC to the role authentication authority RA specified in step S2. Request.

Next, in the administrator authentication system,
In step S5, the identified role certification authority RA
The role definition certificate RSAC is created, and the created role definition certificate RSAC is passed to the system SYS. At this time, in the administrator authentication system, for example, a certain administrator group MG ₁ needs to be signed by the administrator group MG _{2 in} order to perform a certain operation, and it is necessary to verify that. As in some cases,
If there is a relationship between multiple administrator groups, that fact is also defined.

Then, in the administrator authentication system,
In step S6, the system SYS holds the role definition certificate RSAC.

Next, in the administrator authentication system,
The system SYS assigns an administrator to each defined administrator group.

That is, in the administrator authentication system, as shown in FIG. 11, in step S7, the system SYS sets the attribute authentication authority A specified in step S3.
Request A to issue the role assignment certificate RAAC.

Next, in the administrator authentication system,
In step S8, the identified attribute certification authority AA
The role assignment certificate RAAC is created, and the created role assignment certificate RAAC is passed to the system SYS. At this time, in the administrator authentication system, the attribute certification authority AA
Stores the encrypted signature key of the administrator group to which it belongs in the role assignment certificate RAAC. In the administrator authentication system, the attribute certificate authority AA encrypts the signature key using information unique to each administrator, such as the passphrase of each administrator. Specifically, the attribute certification authority AA uses the passphrase of each administrator to call the so-called RSA Sec.
PKCS (Public Key Cryptography Stan), which is a standard specification for encryption proposed by urity.
dards) # 5 may be used for encryption. Note that "# 5" in PKCS # 5 means a method of combining a passphrase, a random number, and the like to generate an encryption key and perform encryption.

Then, in the administrator authentication system,
In step S9, the system SYS stores the role assignment certificate RAAC in an IC card, distributes this IC card to each manager M, and ends the series of registration phases P2.

The administrator authentication system can define the administrator group by going through the administrator registration phase P2 consisting of such a series of steps, and register the administrator M to each administrator group. .

In the administrator authentication system in which the administrator group is thus defined and the administrator M is registered for each administrator group, the administrator M sets the system SYS.
Arbitrary operations can be performed using. In the administrator authentication system, when the administrator M uses the system SYS to perform an arbitrary operation, the steps shown in FIG. 12 are performed.

First, in the administrator authentication system, as shown in FIG.
When performing a certain operation, the registration phase P2 described above
In the administrator terminal, the IC card distributed from the system SYS is inserted into a read / write unit for reading and / or writing data with respect to the IC card provided in the administrator terminal operated by the user. Mounting.

Next, in the administrator authentication system,
In step S12, the system SYS authenticates whether the IC card can be used in the system SYS by referring to the public key certificate PKC stored in the IC card.

And in the administrator authentication system,
When the authentication of the IC card is successful, in step S13, the system SYS signs this role assignment certificate RAAC by referring to the role assignment certificate RAAC stored in the IC card using the public key KEY. The attribute certification authority AA is specified to verify that access to the corresponding administrator group is possible, it is determined whether or not the administrator M is given permission to access the operation, and a series of processing is performed. finish.

In this way, the administrator authentication system is
The system SYS can determine the permission for the operation by the administrator M, and the administrator M who is given the permission for the operation can perform the operation.

Furthermore, in the administrator authentication system,
If you want to delete the administrator who belongs to the administrator group, or if you want to delete the administrator once in order to add and / or delete the operation for any administrator group as described above, When deleting an administrator who belongs to a group, or when deleting an arbitrary administrator group itself, a deletion phase P3 shown in FIG.
The process shown in 4 is performed. Each administrator belonging to a certain administrator group holds different public key certificates PKC, but the role assignment certificate RA.
Regarding the AC, the data is different because the issue date and the expiration date are different, but the same attribute is held.

First, the deletion of the administrator will be described. In the administrator authentication system, when deleting an arbitrary administrator, the role assignment certificate RAAC held by the administrator is deleted.
Revocation processing of.

That is, in the administrator authentication system, as shown in FIG. 13, in step S21, the system SYS accepts the administrator deletion request given from the administrator terminal under the operation of the administrator M. .

Next, in the administrator authentication system,
In step S22, the public key certificate PKC stored in the IC card and the public key certificate PKC that the system SYS has obtained from the certificate issuing certificate authority CA are used to exchange between the IC card and the system SYS. Perform mutual authentication.

Next, in the administrator authentication system,
In step S23, the system SYS sends the role assignment certificate RAA to the attribute certification authority AA that issues the role assignment certificate RAAC stored in the IC card.
Request C to be revoked.

Next, in the administrator authentication system,
In step S24, the attribute certification authority AA creates a revocation list as needed. It should be noted that this revocation list indicates that the role assignment certificate RAAC is invalid when there is an administrator M who is using the role assignment certificate RAAC, so it is not always necessary to issue it. There is no such thing.

Then, in the administrator authentication system,
In step S25, the system SYS deletes the role assignment certificate RAAC stored in the IC card,
The series of administrator deletion phases P3 is completed.

The administrator authentication system can delete the administrator M belonging to an arbitrary administrator group by going through the deletion phase P3 consisting of such a series of steps.

Next, the deletion of the administrator group will be described. In the administrator authentication system, when deleting an arbitrary administrator group, after performing the revocation processing of the role assignment certificate RAAC held by the administrator belonging to the administrator group, the administrator has a plurality of administrators. If you belong to a group, the role assignment certificate RAAC held by the administrator
Is performed, and the role definition certificate RSAC of the administrator group is revoked.

That is, in the administrator authentication system, as shown in FIG. 14, in step S31, the system SYS requests the deletion of the administrator group given from the administrator terminal under the operation of the administrator M. Accept.

Next, in the administrator authentication system,
In step S32, the public key certificate PKC stored in the IC card and the public key certificate PKC obtained from the certificate issuing certificate authority CA by the system SYS are used to exchange between the IC card and the system SYS. Perform mutual authentication.

Next, in the administrator authentication system,
In step S33, the processing similar to that in steps S23 to S25 shown in FIG. 13 is performed, thereby performing the revocation processing of the role assignment certificate RAAC held by the administrator M belonging to the administrator group to be deleted.

Then, in the administrator authentication system,
If the administrator belongs to multiple administrator groups,
In step S34, the process similar to the process shown in FIG. 11 is performed to reissue the role assignment certificate RAAC held by the administrator M.

Next, in the administrator authentication system,
The role definition certificate RSAC of the administrator group to be deleted is revoked.

That is, in the administrator authentication system, in step S35, the system SYS makes the IC
The role definition certificate R stored in the card is issued to the role certification authority RA that has issued the role definition certificate RDAC.
Request SAC revocation.

Next, in the administrator authentication system,
In step S36, the role certification authority RA creates a revocation list as necessary. Since this revocation list indicates that the role definition certificate RSAC is invalid when there is an administrator M who belongs to the administrator group defined by the role definition certificate RSAC, it is not always necessary. It does not need to be issued.

Then, in the administrator authentication system,
In step S37, the system SYS deletes the retained role definition certificate RSAC and ends the series of administrator group deletion phases P3.

The administrator authentication system can delete an arbitrary administrator group by going through the deletion phase P3 consisting of such a series of steps.

Furthermore, in the administrator authentication system, when changing an administrator belonging to an arbitrary administrator group or an arbitrary administrator group, a change phase P4 is shown in FIG. 15, FIG. 16 or FIG. Processing is performed.

First, the change of administrator will be described. In the administrator authentication system, when changing an administrator belonging to an arbitrary administrator group, as shown in FIG.
In step S41, the administrator deletion phase P3 previously shown in FIG. 13 is performed, and further, in step S42, the registration phase P2 previously shown in FIG. 10 and FIG.
Then, a series of manager change phases P4 is completed.

The administrator authentication system can change the administrator belonging to an arbitrary administrator group by going through the change phase P4 consisting of such a series of steps.

Next, changing the manager group will be described. In the administrator authentication system, arbitrary administrator group changes include changing or deleting information of the administrator group and changing operations of the administrator group.

In the administrator authentication system, when changing or deleting the information of the administrator group, as shown in FIG. 16, in step S51, the same as in steps S35 to S37 shown in FIG. The role definition certificate RSAC of the administrator group to be changed is revoked by performing the above process.

Then, in the administrator authentication system,
In step S52, by performing the same processing as steps S4 to S6 shown in FIG.
Reissue processing is performed with the corrected contents of the role definition certificate RSAC of the administrator group to be changed, and the change phase P4 regarding a series of change or deletion of information of the administrator group is ended.

On the other hand, in the administrator authentication system, when changing the operation of the administrator group, the operation belonging to the administrator group to be changed is deleted in step S61 as shown in FIG.

Then, in the administrator authentication system,
In step S62, the operation belonging to the administrator group to be changed is registered, and the change phase P4 for changing the operation of the administrator group is ended.

The administrator authentication system can change any administrator group by going through the change phase P4 consisting of such a series of steps.

In the administrator authentication system, when the administrator uses the system to perform an arbitrary operation, the administrator signs the data when the administrator signs the data. In some cases, the system may sign the signature.

In the administrator authentication system, when a signature is given on the administrator side, the signature phase P5 shown in FIG.
The process shown in 8 is performed.

That is, in the administrator authentication system, as shown in the figure, in step S71, the administrator M mounts the role allocation certificate RAAC by mounting the IC card on the administrator terminal operated by himself. S
Present to YS.

Then, in the administrator authentication system,
In step S72, the system SYS, after authenticating the IC card, verifies the role assignment certificate RAAC by referring to the signature and the content of the role assignment certificate RAAC of the administrator M, and sets the role assignment certificate RAAC. Fetch the associated role definition certificate RSAC.

Then, in the administrator authentication system,
In step S73, the system SYS verifies the role definition certificate RSAC by referring to the signature and content of the extracted role definition certificate RSAC.

Next, in the administrator authentication system,
In step S74, when the system SYS determines that the role definition certificate RSAC is correct, it issues a command to the manager M to sign.

Then, in the administrator authentication system,
In step S75, the administrator M sets the system SYS.
In response to a command from the role assignment certificate RAAC, the signature key of the administrator group is decrypted and taken out, and the signature key is used to sign the data.
Finish 5

The administrator authentication system can perform the signature on the side of the administrator M by going through the signature phase P5 including such a series of steps.

On the other hand, in the administrator authentication system, when a signature is made on the system side, the processing shown in FIG. 19 is performed as the signature phase P5.

That is, in the administrator authentication system, as shown in the figure, in step S81, the administrator M mounts the role allocation certificate RAAC by mounting the IC card on the administrator terminal operated by himself. S
Present to YS.

Then, in the administrator authentication system,
In step S82, the system SYS, after authenticating the IC card, verifies the role assignment certificate RAAC by referring to the signature and the content of the role assignment certificate RAAC of the administrator M, and sets the role assignment certificate RAAC. Fetch the associated role definition certificate RSAC.

Next, in the administrator authentication system,
In step S83, the system SYS verifies the role definition certificate RSAC by referring to the signature and content of the extracted role definition certificate RSAC.

Then, in the administrator authentication system,
In step S84, when the system SYS determines that the role definition certificate RSAC is correct, the system SYS signs the data by using the signature key of the administrator group to which the administrator M belongs, and a series of signatures. The phase P5 ends.

The administrator authentication system can make a signature on the system SYS side through the signature phase P5 consisting of such a series of steps.

Furthermore, in the administrator authentication system,
When the administrator uses the system to perform any operation, the administrator can verify the signature attached to the data by either the administrator side or the system side. There is.

In the administrator authentication system, when the administrator performs the verification, the verification phase P6 shown in FIG.
The processing indicated by 0 is performed.

That is, in the administrator authentication system, as shown in the figure, in step S91, the administrator M attaches the IC card to the administrator terminal operated by him / herself, thereby issuing the role assignment certificate RAAC to the system. S
Present to YS.

Next, in the administrator authentication system,
In step S92, the system SYS, after authenticating the IC card, verifies the role assignment certificate RAAC by referring to the signature and the content of the role assignment certificate RAAC of the administrator M, and makes the role assignment certificate RAAC. Fetch the associated role definition certificate RSAC.

Then, in the administrator authentication system,
In step S93, the system SYS verifies the role definition certificate RSAC by referring to the signature and content of the extracted role definition certificate RSAC.

Subsequently, in the administrator authentication system,
In step S94, when the system SYS determines that the role definition certificate RSAC is correct, it gives the administrator M a verification key for the administrator group and issues an instruction to perform the verification. .

And in the administrator authentication system,
In step S95, the administrator M sets the system SYS.
In response to the command from the system SYS, the verification of the data signature is performed using the verification key given from the system SYS, and the series of verification phase 6 is ended.

The manager authentication system can verify the signature on the manager M side by going through the verification phase P6 consisting of such a series of steps.

In the administrator authentication system, any person may verify the signature. Therefore, if the administrator M can obtain the verification key of the administrator group, the system SYS is permitted. The verification may be performed without obtaining the information.

On the other hand, in the administrator authentication system, when verification is performed on the system side, the processing shown in FIG. 21 is executed as the verification phase P6.

That is, in the administrator authentication system, as shown in the figure, the administrator M mounts the role assignment certificate RAAC by mounting the IC card on the administrator terminal operated by himself / herself in step S101. Present to SYS.

Next, in the administrator authentication system,
In step S102, the system SYS authenticates the IC card and then, the role assignment certificate RAAC of the administrator M.
The role assignment certificate RAAC is verified by referring to the signature and content of the role assignment certificate RAAC, and the role definition certificate RSAC associated with the role assignment certificate RAAC is retrieved.

Next, in the administrator authentication system,
In step S103, the system SYS verifies the role definition certificate RSAC by referring to the signature and content of the extracted role definition certificate RSAC.

Then, in the administrator authentication system,
In step S104, when the system SYS determines that the role definition certificate RSAC is correct, the system SYS verifies the data signature using the verification key of the administrator group to which the administrator M belongs, and a series of Verification phase 6
To finish.

The administrator authentication system can verify the signature on the system SYS side by going through the verification phase P6 consisting of such a series of steps.

In the administrator authentication system, it goes without saying that if the verification key belongs to another manager group, the system SYS extracts the verification key from the corresponding role definition certificate RSAC. .

As described above, the administrator authentication system is
A role assignment certificate RAAC issued by an attribute authority AA defined in SO / IEC 9594-8,
Role definition certificate RS issued by the role certification authority RA
It can be implemented using AC and.

Now, description will be made below regarding a usage example to which the administrator authentication system thus implemented can be applied.

First, as an example of using the administrator authentication system, there is an in-house approval system for arbitrary data such as approval. Here, it is assumed that the manager is set as the manager group MG ₁ and the department manager is set as the manager group MG ₂ .

In such an in-house approval system,
Prescribed role Certification Authority RA admin group MG₁，
MG_TwoRole definition certificate RSA for each of the
C₁, RSAC_TwoIs issued and these role definition certificates R
SAC₁, RSAC_TwoConfigure the in-house system SYS
It is held by a predetermined server. At this time, the administrator group M
G _TwoRole definition certificate RSAC_TwoIn the admin group
MG₁The verification key of is stored.

[0170] In the internal authorization system assigns each manager administrator group MG _1, assign each director to the Administrators group MG _2, the administrator group _MG 1, MG ₂ by predetermined attribute authority AA Issue role assignment certificates RAAC ₁ and RAAC ₂ for each. At this time, the role assignment certificates RAAC ₁ , RAA
The signature keys of the administrator groups MG ₁ and MG ₂ are encrypted and stored in C ₂ , respectively. In the in-house approval system, role assignment certificate R for each section manager
While storing AAC ₁ in an IC card etc. and distributing it,
The role assignment certificate RAAC ₂ is stored in an IC card or the like and distributed to each manager.

In the in-house approval system, when a section manager approves the data of a section manager, the section manager has his own role assignment certificate RAAC ₁ and the role definition certificate RSAC ₁ held by the system SYS. Use and to sign the data. On the other hand, in the in-house approval system, the department manager verifies the signature attached to the data by using the role assignment certificate RAAC ₁ and the role definition certificate RSAC _{1 of the} section manager, and the data is correct. If it is determined that the signature is signed, the data is signed using the signature key extracted from the role assignment certificate RAAC ₂ of the administrator group MG ₂ .

In the in-house approval system, if an arbitrary person can obtain the verification key of each of the manager groups MG ₁ and MG ₂ , the signature of the section manager and department manager attached to the data Can be verified.

As described above, the administrator authentication system can be applied to the in-house approval system for arbitrary data.

Another example of the use of the administrator authentication system is a mailing list system for transmitting / receiving encrypted mail or signed mail within a predetermined group. Here, it is assumed that a certain mailing list is set as the administrator group MG ₁ .

In such a mailing list system, a predetermined role certification authority RA issues a role definition certificate RSAC for the administrator group MG _{1 and} the role definition certificate RSAC is used to form a system SYS in the company. Held by the mail server.

Further, in the mailing list system, members are set in the mailing list and a predetermined attribute certificate authority AA issues a role assignment certificate RAAC for the administrator group MG ₁ . At this time, in the role assignment certificate RAAC, the mailing list, that is, the decryption key or the signature key of the administrator group MG ₁ is encrypted and stored. In the mailing list system, the role assignment certificate RAAC is stored in an IC card or the like and distributed to each member.

In the mailing list system, when a member sends an encrypted mail,
The member is responsible for his / her role assignment certificate RAAC and the system SYS associated with this role assignment certificate RAAC.
Obtains the verification key of the mailing list by using the role definition certificate RSAC held by and encrypts the mail using this verification key and sends it. On the other hand, in the mailing list system, the member who receives the sent mail uses the role assignment certificate RAAC of the sending member and the role definition certificate RSAC associated with this role assignment certificate RAAC to send the mailing list. The decryption key is extracted, and the received encrypted mail is decrypted using this decryption key.

On the other hand, in the mailing list system, when a member sends a signed mail,
The member is responsible for his / her role assignment certificate RAAC and the system SYS associated with this role assignment certificate RAAC.
Obtains the signing key of the mailing list using the role definition certificate RSAC held by, and uses this signing key to sign mail data and send it. On the other hand, in the mailing list system, the member who receives the sent mail uses the role assignment certificate RAAC of the sending member and the role definition certificate RSAC associated with this role assignment certificate RAAC to send the mailing list. The verification key is extracted, and the signature attached to the received signature mail is verified using this verification key.

As described above, the administrator authentication system can also be applied to a mailing list system for transmitting / receiving encrypted mail or signed mail within a predetermined group.

As described above, the administrator authentication system is the ITU-T X. By using the concept of "role" in PMI defined in P.509 and introducing the role assignment certificate and the role definition certificate to manage the authority of the administrator group, the authority is granted for each administrator group. It becomes possible to think of the definition of the operation, let the operation be performed without being aware of the members belonging to the administrator group,
It also becomes possible to perform verification. That is, the administrator authentication system does not need to manage the information and key information of the members belonging to each administrator group, and can efficiently manage the authority of the administrator group.

Further, the administrator authentication system introduces the role assignment certificate and the role definition certificate, so that even if a member belonging to an arbitrary administrator group is changed, the administrator group will be added to the administrator group. It is not necessary to change the system that performs the operation or the system that verifies the operation performed by the administrator group.

Further, the administrator authentication system introduces a role definition certificate so that a plurality of administrator groups need to be signed in order to make a certain signature. If there is a relationship between the administrator groups, the fact can be defined, and the relationship between the administrator groups can be easily defined.

Furthermore, in the administrator authentication system, access management is performed by using the public key certificate and the attribute certificate, so that the administrator can be authenticated and the access right is granted. It becomes possible for the system side to accurately judge whether or not the state is present.

In the administrator authentication system, the public key certificate and the attribute certificate are stored in a removable medium such as an IC card which can be attached to and detached from the administrator terminal operated by the administrator, and the removable medium is stored in the removable medium. By having the administrator hold the information, the administrator does not need to be aware of any complicated mechanism regarding authentication and access right management. Therefore, the administrator authentication system can also improve the operability of the administrator.

The present invention is not limited to the above embodiment. For example, in the above-described embodiments, the explanation has been made assuming that the administrator is authenticated by using the mechanism of the public key infrastructure using the public key cryptosystem, but the present invention applies the common key cryptosystem. May be. However, in this case, since it is necessary for more than one person to hold the private key, it is not preferable in terms of security as compared to the case where the public key cryptosystem is used, and the problem of lacking the role of proof even in the case of signature There is.

Further, according to the present invention, not only the implementation of the administrator group and other definitions can be realized by hardware but also software. When the present invention is implemented by software, for example, a CPU (Central Proc.
Each function can be realized by executing the access right management program for managing the access right of the administrator by the essing unit). This access right management program can be provided by a predetermined recording medium such as a so-called compact disc or a transmission medium such as the Internet.

As described above, it goes without saying that the present invention can be appropriately modified without departing from the spirit thereof.

[0188]

As described in detail above, the access right management system according to the present invention manages the authority of each administrator for a predetermined resource and verifies the access of the administrator to the resource. And a predetermined attribute certificate authority that issues a role assignment certificate that is a framework that defines a predetermined operation for a resource and that is an electronic certificate that describes information indicating an administrator group as a role to which the administrator belongs And a predetermined role certification authority that issues a role definition certificate, which is an electronic certificate issued for each administrator group and describes the authority permitted to the administrator group, and attribute authentication The administrator terminal that holds the role assignment certificate issued by the authority, and the role definition certificate issued by the role certification authority Refer to the role assignment certificate held by the administrator who accesses the specified resource, determine the administrator group to which the administrator belongs, and associate it with the role assignment certificate among the held role definition certificates. And a system that verifies the access of the administrator to the resource based on the obtained role definition certificate.

Therefore, the access right management system according to the present invention is a framework for defining a predetermined operation for a resource, and the role assignment certificate issued by the attribute certificate authority is the information indicating the administrator group to which the administrator belongs. In addition to describing, describe the authority granted to the administrator group in the role definition certificate issued by the role certificate authority, and refer to the system the role assignment certificate held by the administrator who accesses the resource. By determining the administrator group to which the administrator belongs, and verifying the administrator's access to the resource based on the role definition certificate associated with the role assignment certificate held by the administrator, Authority management can be performed efficiently.

The access right management method according to the present invention manages the authority of each administrator for a predetermined resource,
A role assignment certifying method for verifying the access of an administrator to a resource, which is a framework for defining a predetermined operation for a resource and in which information indicating an administrator group as a role to which the administrator belongs is described. Issued by a prescribed attribute certificate authority and have the administrator hold it,
A role definition certificate, which is an electronic certificate issued for each administrator group and that describes the authority permitted to the administrator group, is issued by a prescribed role certification authority and held by the system. , As the administrator accesses the resource held by the system through the administrator terminal, the system refers to the role assignment certificate held by the administrator to determine the administrator group to which the administrator belongs Then, the system verifies the access of the administrator to the resource based on the role definition certificate associated with the role assignment certificate among the role definition certificates held by the system.

Therefore, the access right management method according to the present invention is a framework for defining a predetermined operation for a resource, and the role assignment certificate issued by the attribute certificate authority is the information indicating the administrator group to which the administrator belongs. In addition to describing, describe the authority granted to the administrator group in the role definition certificate issued by the role certification authority,
The system refers to the role assignment certificate held by the administrator who accesses the resource to determine the administrator group to which the administrator belongs, and the role definition certificate associated with the role assignment certificate held by the administrator Based on the above, by verifying the access of the manager to the resource, it becomes possible to efficiently manage the authority of the manager group.

Further, the access right management program according to the present invention is a computer-readable access right management program for managing the authority of each administrator for a predetermined resource and verifying the administrator's access to the resource, A role assignment certificate, which is a framework for defining a predetermined operation for a resource and in which information indicating an administrator group as a role to which the administrator belongs is issued by a predetermined attribute certificate authority and is held by the administrator. , A role definition certificate, which is an electronic certificate issued for each administrator group and that describes the authority permitted to the administrator group, is issued by a predetermined role certification authority, and the role definition certificate is issued. The administrator can access the resources held by the system through the administrator terminal while holding the document. Then, the role assignment certificate held by the administrator is referenced to determine the administrator group to which the administrator belongs, and the role definition certificate associated with the role assignment certificate among the held role definition certificates Based on the above, the administrator's access to the resource is verified.

Therefore, the access right management program according to the present invention is a framework for defining a predetermined operation for a resource, and the role assignment certificate issued by the attribute certificate authority is the information indicating the administrator group to which the administrator belongs. The role definition certificate issued by the role certificate authority describes the authority granted to the administrator group, and the system assigns the role assignment certificate held by the administrator who accesses the resource. By referring to determine the administrator group to which the administrator belongs, and verify the administrator's access to the resource based on the role definition certificate associated with the role assignment certificate held by the administrator, The system in which the access right management program is implemented efficiently manages the authority of the administrator group. Possible to be.

Furthermore, the recording medium on which the access right management program according to the present invention is recorded manages the authority of each administrator for a predetermined resource and verifies the administrator's access to the resource. A recording medium in which a rights management program is recorded, which is a framework for defining a predetermined operation for a resource, and a role assignment certificate in which information indicating an administrator group as a role to which the administrator belongs is described as a predetermined attribute. The access right management program is a digital certificate issued by the certificate authority and held by the administrator. The access right management program is an electronic certificate issued for each administrator group and describes the authority granted to the administrator group. The role definition certificate is issued by a specified role certificate authority, and the administrator holds the role definition certificate. In response to accessing the resource held by the system via the administrator terminal, the role assignment certificate held by the administrator is referred to determine the administrator group to which the administrator belongs and holds it. The access of the administrator to the resource is verified based on the role definition certificate associated with the role assignment certificate among the role definition certificates.

Therefore, the recording medium in which the access right management program according to the present invention is recorded is a framework for defining a predetermined operation for a resource, and the attribute certificate authority issues information indicating the administrator group to which the administrator belongs. The role that is described in the role assignment certificate and the authority that is granted to the administrator group is described in the role definition certificate issued by the role certificate authority, and is retained by the administrator who accesses the resource. The system refers to the role assignment certificate to determine the administrator group to which the administrator belongs, and based on the role definition certificate associated with the role assignment certificate held by the administrator, the administrator's access to the resource It is possible to provide an access right management program for verifying. Therefore, the system in which the access right management program is installed can efficiently manage the authority of the administrator group.

[Brief description of drawings]

FIG. 1 is a conceptual diagram of an administrator authentication system shown as an embodiment of the present invention.

FIG. 2 is a diagram illustrating a format of a public key certificate.

FIG. 3 is a diagram for explaining the format of a public key certificate, and is a diagram for explaining the remaining items following the items shown in FIG.

FIG. 4 is a diagram illustrating a format of an attribute certificate.

FIG. 5 is a diagram for explaining the format of an attribute certificate, and is a diagram for explaining the remaining items following the items shown in FIG.

FIG. 6 is a diagram illustrating a configuration of the same administrator authentication system as an implementation example.

FIG. 7 is a conceptual diagram of the same administrator authentication system, and is a diagram for explaining how each administrator signs data using the signature key of the administrator group.

FIG. 8 is a conceptual diagram of the same administrator authentication system, and is a diagram for explaining how the signature of each administrator is verified using the verification key of the administrator group that requires verification.

FIG. 9 is a flowchart for explaining each phase performed in the administrator authentication system.

FIG. 10 is a flowchart for explaining a series of steps as a registration phase in the administrator authentication system.

11 is a flowchart for explaining a series of steps as a registration phase in the same administrator authentication system, and is a flowchart for explaining the remaining steps following the step shown in FIG.

FIG. 12 is a flow chart for explaining a series of steps when an administrator performs an arbitrary operation using the system in the administrator authentication system.

FIG. 13 is a flowchart for explaining a series of steps as a deletion phase for deleting an administrator who belongs to an arbitrary administrator group in the administrator authentication system.

FIG. 14 is a flow chart for explaining a series of steps as a deletion phase for deleting an arbitrary administrator group in the administrator authentication system.

FIG. 15 is a flowchart for explaining a series of steps as a change phase for changing an administrator who belongs to an arbitrary administrator group in the administrator authentication system.

FIG. 16 is a flowchart for explaining a series of steps as a change phase for changing or deleting information of an administrator group in the administrator authentication system.

FIG. 17 is a flowchart for explaining a series of steps as a change phase for changing the operation of the administrator group in the administrator authentication system.

FIG. 18 is a flowchart for explaining a series of steps as a signature phase in which the administrator signs in the administrator authentication system.

FIG. 19 is a flowchart for explaining a series of steps as a signature phase in which a signature is made on the system side in the administrator authentication system.

FIG. 20 is a flowchart for explaining a series of steps as a verification phase in which the administrator verifies the signature in the administrator authentication system.

FIG. 21 is a flowchart for explaining a series of steps as a verification phase in which the system side verifies the signature in the administrator authentication system.

[Explanation of symbols]

AA Attribute Certification Authority, CA Certificate Issuing Certification Authority, OP
₁₁ , OP ₁₂ , ..., OP _1n operation, M,
M ₁ , M ₂ , M ₃ administrator, MG ₁ , MG ₂ administrator group, PKC public key certificate, RA role certificate authority, RAAC, RAAC ₁ , RAAC ₂ role assignment certificate, RSAC, RSAC ₁ , RSAC ₂ Role definition certificate, SYS system

Claims (46)

[Claims] 1. An access right management system for managing the authority of each administrator for a predetermined resource and verifying the access of the administrator to the resource, which is a framework for defining a predetermined operation for the resource. And a predetermined attribute certification authority that issues a role assignment certificate that is an electronic certificate that describes information indicating an administrator group as a role to which the administrator belongs, and an electronic certificate issued for each administrator group Holds a predetermined role certification authority that issues a role definition certificate, which is an electronic certificate that describes the authority that is permitted to the administrator group, and the role assignment certificate issued by the above attribute certification authority. The administrator terminal that is operated by the administrator and the role definition certificate issued by the role certificate authority are held and Refer to the role assignment certificate held by the administrator who accesses the above to determine the administrator group to which the administrator belongs, and associate the role assignment certificate with the role assignment certificate of the held role definition certificates. And a system for verifying access of the administrator to the resource based on the role definition certificate. 2. The access according to claim 1, wherein the system verifies the role assignment certificate held by the administrator and retrieves a role definition certificate associated with the role assignment certificate. Rights management system. 3. The system verifies the retrieved role definition certificate and, if it is determined that the role definition certificate is correct, an instruction to sign the administrator. The access right management system according to claim 2, wherein 4. The access according to claim 3, wherein the administrator terminal signs data by using a signature key of an administrator group to which the administrator belongs in response to a command from the system. Rights management system. 5. The access right management system according to claim 4, wherein the administrator terminal extracts the signature key from the role assignment certificate. 6. The signature key is encrypted based on a predetermined encryption method, and the administrator terminal decrypts and extracts the encrypted signature key from the role assignment certificate. The access right management system according to claim 5, wherein 7. The access right management system according to claim 6, wherein the attribute certification authority stores the encrypted signature key in the role assignment certificate and issues it. 8. The access right management system according to claim 7, wherein the attribute certificate authority encrypts the signature key based on a predetermined encryption method depending on the administrator key. . 9. The system verifies the retrieved role definition certificate, and if the system determines that the role definition certificate is correct, it uses the signature key of the administrator group to which the administrator belongs. The access right management system according to claim 2, wherein the data is signed. 10. The system verifies the retrieved role definition certificate and, if it is determined that the role definition certificate is correct, an administrator to which the administrator belongs 3. The access right management system according to claim 2, wherein the verification key of the group is given and a command for verification is issued. 11. The access right management system according to claim 10, wherein the administrator terminal verifies the signature of the data using the verification key in response to a command from the system. 12. The system verifies the retrieved role definition certificate, and if it is determined that the role definition certificate is correct, the system uses the verification key of the administrator group to which the administrator belongs. The access right management system according to claim 2, wherein the signature of the data is verified. 13. The administrator terminal to which predetermined data is transmitted belongs to the administrator terminal by using the role assignment certificate of the administrator and the role definition certificate associated with the role assignment certificate. Get the verification key of the administrator group,
The access right management system according to claim 1, wherein data is encrypted using the verification key. 14. The administrator terminal receiving predetermined data uses the role assignment certificate of the administrator who sent the data and the role definition certificate associated with the role assignment certificate. The access right management system according to claim 1, wherein a decryption key of an administrator group to which the administrator belongs is taken out, and the received data is decrypted using the decryption key. 15. The access right management system according to claim 1, wherein the system defines operations defined in one administrator group as equivalent operations from the viewpoint of access rights. 16. The access right management system according to claim 1, wherein the system defines an administrator group having operations that should not be concurrently performed. 17. The access right management system according to claim 1, wherein the system is defined by making a plurality of administrators belong to one administrator group. 18. The access right management system according to claim 1, wherein the system is capable of adding and / or deleting an administrator belonging to an arbitrary administrator group. 19. The access right management system according to claim 1, wherein the system is capable of adding and / or deleting an operation permitted as an authority to an arbitrary administrator group. 20. A certificate issuing certificate authority that issues a public key certificate as an electronic certificate that is an independent predetermined third party in the public key cryptosystem, and the attribute certificate authority and the role certificate authority are The access right management system according to claim 1, wherein the access right management system is a local institution different from the certificate issuing certificate authority. 21. The access right management system according to claim 1, wherein the role certification authority is the same as the attribute certification authority. 22. The role assignment certificate is stored in a recording medium which is removable from the administrator terminal and is readable and / or writable by the administrator terminal, and is stored in a recording medium from the system to the administrator. The access right management system according to claim 1, wherein the access right management system is distributed. 23. An access right management method for managing the authority of each administrator for a predetermined resource and verifying the access of the administrator to the resource, which is a framework for defining a predetermined operation for the resource. A role assignment certificate in which information indicating an administrator group as a role to which the administrator belongs is issued by a predetermined attribute certification authority and is held by the administrator. A role definition certificate, which is a certificate and an electronic certificate in which the authority permitted to the administrator group is described, is issued by a predetermined role certification authority and held by the system. The role assignment certificate held by the administrator by the system upon accessing the resource held by the system via The administrator group to which the administrator belongs, and based on the role definition certificate associated with the role assignment certificate among the role definition certificates held by the system, the system An access right management method characterized by verifying the access of the administrator to the resource according to. 24. The access according to claim 23, wherein the system verifies the role assignment certificate held by the administrator, and retrieves a role definition certificate associated with the role assignment certificate. Rights management method. 25. The role definition certificate retrieved by the system is verified, and if it is determined that the role definition certificate is correct, a signature is given to the administrator. The access right management method according to claim 24, wherein an instruction is issued. 26. The access according to claim 25, wherein in response to a command from the system, the administrator terminal signs data by using a signature key of an administrator group to which the administrator belongs. Rights management method. 27. The access right management method according to claim 26, wherein the signature key is extracted from the role assignment certificate by the administrator terminal. 28. The signature key is encrypted based on a predetermined encryption method, and the encrypted signature key is decrypted and taken out from the role assignment certificate by the administrator terminal. 28. The access right management method according to claim 27, wherein: 29. The access right management method according to claim 28, wherein the signature key encrypted by the attribute certificate authority is stored and issued in the role assignment certificate. 30. The access right management method according to claim 29, wherein the attribute certificate authority encrypts the signature key based on a predetermined encryption method depending on the administrator key. . 31. When the role definition certificate retrieved by the system is verified and it is determined that the role definition certificate is correct, a signature key of an administrator group to which the administrator belongs is set. 25. The access right management method according to claim 24, wherein the data is signed by using the data. 32. When the role definition certificate retrieved by the system is verified and it is determined that the role definition certificate is correct, the management to which the manager belongs to the manager. 25. The access right management method according to claim 24, wherein a verification key of a person group is given and a command for performing verification is issued. 33. The access right management method according to claim 32, wherein the administrator terminal verifies the signature of the data using the verification key in response to a command from the system. 34. When the role definition certificate retrieved by the system is verified and it is determined that the role definition certificate is correct, a verification key of an administrator group to which the administrator belongs is provided. 25. The access right management method according to claim 24, wherein the verification of the data signature is performed using the data signature. 35. Management to which the administrator belongs by using the role assignment certificate of the administrator and the role definition certificate associated with the role assignment certificate by the administrator terminal transmitting predetermined data. 24. The access right management method according to claim 23, wherein a verification key of the person group is acquired, and the data is encrypted using the verification key. 36. The management using the role assignment certificate of the administrator who has sent the data by the administrator terminal receiving the predetermined data and the role definition certificate associated with the role assignment certificate. 24. The access right management method according to claim 23, wherein a decryption key of an administrator group to which the person belongs is taken out, and the received data is decrypted using the decryption key. 37. The operation defined in one administrator class is defined as being equivalent from the viewpoint of access right by the system.
The access right management method described in 3. 38. The access right management method according to claim 23, wherein an administrator class having operations that must not be combined is defined by the system. 39. The access right management method according to claim 23, wherein one administrator group is defined by the system to which a plurality of administrators belong. 40. The access right management method according to claim 23, wherein an administrator belonging to an arbitrary administrator class can be added and / or deleted by the system. 41. The access right management method according to claim 23, wherein an operation permitted as an authority to an arbitrary administrator class can be added and / or deleted by the system. 42. The attribute certification authority and the role certification authority are independent predetermined third parties in the public key cryptosystem and are certificate issuing certification authorities that issue public key certificates as electronic certificates. 24. The access right management method according to claim 23, wherein the access rights are managed by different local institutions. 43. The access right management method according to claim 23, wherein the role certification authority is the same as the attribute certification authority. 44. The role assignment certificate is stored in a recording medium which is removable from the administrator terminal and is readable and / or writable by the administrator terminal, and the role assignment certificate is sent from the system to the administrator. 24. The access right management method according to claim 23, wherein the access right management method is distributed as follows. 45. A computer-readable access right management program that manages the authority of each administrator for a predetermined resource and verifies the access of the administrator to the resource, and defines a predetermined operation for the resource. A role assignment certificate in which information indicating the administrator group as a role to which the above-mentioned administrator belongs is issued by a predetermined attribute certification authority and is held by the above-mentioned administrator. A role definition certificate, which is an electronic certificate issued each time and in which the authority permitted to the administrator group is described, is issued by a predetermined role certification authority and holds the above role definition certificate Then, in response to the administrator accessing the resource held by the system through the administrator terminal, By referring to the role assignment certificate held by the administrator, the administrator group to which the administrator belongs is determined, and the role definition associated with the role assignment certificate among the held role definition certificates An access right management program characterized by verifying the access of the administrator to the resource based on a certificate. 46. A recording medium on which a computer-readable access right management program for managing the authority of each administrator for a predetermined resource and verifying the access of the administrator to the resource is recorded. A role assignment certificate, which is a framework for defining a predetermined operation for, and in which information indicating an administrator group as a role to which the administrator belongs is issued by a predetermined attribute certification authority and is held by the administrator. In the access right management program, the role definition certificate, which is an electronic certificate issued for each administrator group and in which the authority permitted to the administrator group is described, has a predetermined role. Issued by a certificate authority and holding the above role definition certificate, the above administrator can access the above system via the administrator terminal. Depending on the access to the resource held, the role assignment certificate held by the administrator is referenced to determine the administrator group to which the administrator belongs, and the role definition certificate held A recording medium having an access right management program recorded therein, which verifies the access of the administrator to the resource based on a role definition certificate associated with the role assignment certificate.