JP2003273855A - Digital authentication management method, digital authentication issue server, digital authentication transmission client, and digital authentication management program and recording medium therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a digital authentication management method, a digital authentication issue server, a digital authentication transmission client, a digital authentication management program and a recording medium therefor, and a digital authentication transmission program in which security of the digital authentication is managed and expiration of the digital authentication is obviated. <P>SOLUTION: The digital authentication management method for managing the digital authentication in the digital authentication issue server (10) which issues the digital authentication to a client through a network comprises an issue step for issuing the digital authentication to the client, and a transfer step for transferring the issued authentication to a computer (20), to which access from the network side is restricted. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a digital certificate used for authentication, and more particularly to a digital certificate management method for managing a digital certificate, a digital certificate distribution server, a digital certificate sending client, and a digital certificate management. Program and recording medium

[0002]

2. Description of the Related Art User authentication is performed when a client logs in to a server. There are several types of user authentication, such as basic authentication and digital certificate authentication. With digital certificate authentication, the client holds a digital certificate in advance and sends it to the server when logging in. In this way, the server authenticates the client.

This digital certificate certifies that the communication partner on the network is genuine, and the serial number, the name of the certificate authority (CA) that issued the certificate, the expiration date, the owner name, and the owner's name. Information such as public key is included.
Generally, the basic format is ITU-T (Internation
al Telecommunication Union, Telecommunication stan
Dardization sector) X.509 compliant.

The digital certificate can be obtained by the client when the client requests the server to distribute the digital certificate. The digital certificate is renewed at regular intervals for the purpose of ensuring security. Therefore, the client must perform the renewal work within the deadline so that the digital certificate does not expire.

[0005]

As described above, the digital certificate has an expiration date and cannot be used after the expiration date. In addition, it is managed so as to be provided in a server accessed by an unspecified number of clients in order to distribute a digital certificate to the clients.

Thus, it is a security problem that important data such as a digital certificate is provided in a server accessed by an unspecified number of clients. In addition, the client may forget to update the digital certificate and it may expire, which is not convenient.

In view of the above problems, the present invention manages a digital certificate safely and prevents a digital certificate from expiring before it can be used, a digital certificate distribution server, and a digital certificate transmission. It is an object to provide a client, a digital certificate management program and a recording medium.

[0008]

According to a first aspect of the present invention, there is provided a digital certificate distribution server for distributing a digital certificate to a client via a network, the digital certificate managing method managing the digital certificate. The distribution step of distributing the digital certificate to the client, and the distribution of the digital certificate to the computer to which access from the network side is restricted after the digital certificate is normally distributed to the client. And a transfer stage for transferring a book.

According to the first aspect of the present invention, the digital certificate is transferred to a computer to which access by an unspecified number of clients connected to the network is restricted, whereby the digital certificate, which is important data, is leaked or falsified. Security can be increased. The access restriction in this case includes not allowing access at all.

The invention according to claim 2 is characterized in that, in the distributing step, information on the client to which the digital certificate is distributed is recorded.

According to the second aspect, by holding the information of the client who has distributed the digital certificate,
This makes it easy to prevent duplicate distribution of digital certificates and check whether they have been illegally distributed.

According to a third aspect of the present invention, the fact that the digital certificate has been transferred is recorded in the transferring step.

According to the third aspect, it is possible to confirm by recording whether the digital certificate has been transferred.

According to a fourth aspect of the present invention, there is provided a digital certificate distribution server for distributing a digital certificate to a client via a network, the distribution means distributing the digital certificate to the client, and the network. And a transfer means for transferring the distributed digital certificate to a computer whose access from the side is restricted.

According to the fourth aspect, the digital certificate is transferred to a computer to which access by an unspecified number of clients connected to the network is restricted, so that the digital certificate, which is important data, is leaked or falsified. Security can be increased. The access restriction in this case includes not allowing access at all.

According to a fifth aspect of the present invention, there is provided a digital certificate management method for managing an expiration date of the digital certificate in an access right issuing server which gives an access right to a client having a digital certificate,
When the client makes an access, a warning notification judging step for judging whether to notify the expiration warning of the digital certificate, and a warning notification for notifying the expiration warning based on the judgment result in the warning notification judging step And stages.

According to the fifth aspect, the expiration date can be prevented in advance by notifying that the expiration date will expire after a predetermined period.

According to a sixth aspect of the present invention, in the warning notification determination step, the warning notification determination is performed based on an interval at which the client accesses the access authority issuing server and an expiration date of the digital certificate. It is characterized.

According to the sixth aspect of the present invention, the warning is notified according to the access interval which greatly differs depending on the client. Therefore, it is possible to prevent the expiration date of the digital certificate before issuing the warning before the fixed number of days. it can.

The invention according to claim 7 is characterized in that in the warning notifying step, the expiration warning is notified and the digital certificate is updated.

According to the seventh aspect, not only the expiration warning is issued, but also the update processing can be performed upon receipt of the warning notification. Therefore, the update processing can be easily performed.

According to an eighth aspect of the present invention, there is provided a digital certificate transmitting client for accessing a server using a digital certificate, the digital certificate transmitting means transmitting a digital certificate to the server, and the server. When the expiration date of the transmitted digital certificate expires after a predetermined period, the expiration date warning receiving step of receiving an expiration date warning indicating that the expiration date of the digital certificate expires after a predetermined period, It is characterized by having.

According to the eighth aspect, since the expiration warning can be received from the server, the expiration date of the digital certificate can be prevented.

The recording medium for recording the digital certificate management program is a recording medium for recording information optically, electrically or magnetically, such as a CD-ROM, a flexible disk, a magneto-optical disk (MO). Various types of recording media such as a medium or a semiconductor memory such as a ROM or a flash memory that electrically records information can be used.

[0025]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 shows an example of the overall configuration of the digital certificate distribution system according to the embodiment of the present invention. Figure 1
Includes a client 12, a firewall 18,
Digital certificate distribution server 10 and WWW server 14
And a digital certificate management server 20 and an administrator client 22, and the client 12 and the firewall 18 are connected via the Internet 16. Further, the firewall 18 is a NIC (Ne
It has three twork Interface Cards. Of these, the first is used to connect to the Internet 16. Two
The third is used to connect the digital certificate distribution server 10 and the WWW server 14. The third is used to connect the digital certificate management server 20 and the administrator client 22. In the case of this configuration, the digital certificate management server 20 and the administrator client 22 are not allowed to access from the Internet 16 at all. Therefore, the digital certificate management server 20
Therefore, it can be said that the administrator client 22 is safe against attacks from the Internet 16. The administrator client 22 is the digital certificate distribution server 10
And a client for managing the WWW server 14 and the like.

The digital certificate distribution server 10, W
The WW server 14, digital certificate management server 20, and administrator client 22 are computer systems such as personal computers and workstations, and an example of the hardware configuration thereof is shown in FIG.

The computer system of FIG. 2 has an input device 28, a display device 30, a drive device 32, a recording medium 34, an auxiliary storage device 36, and a memory device 38, which are connected to each other by a bus B. , Arithmetic processing unit 24
And an interface device 26.

The input device 28 is composed of a keyboard and a mouse operated by a user of the computer system, and is used for inputting various operation signals to the computer system. The display device 30 displays various windows and data necessary for operating the computer system. The interface device 26 is an interface for connecting a computer system to a network, and is composed of, for example, a NIC (Network Interface Card) or a modem.

The program for operating the server is provided by the recording medium 34 such as a CD-ROM or downloaded through the Internet 16. The recording medium 34 is set in the drive device 32, and data and programs are installed in the auxiliary storage device 36 from the recording medium 34 via the drive device 32.

The auxiliary storage device 36 stores data and programs, and also stores necessary files and the like. The memory device 38 reads the program from the auxiliary storage device 36 and stores the program when the computer system is activated. The arithmetic processing unit 24 executes processing according to the program read and stored in the memory device 38.

Next, the distribution of the digital certificate will be described with reference to the drawings. FIG. 3 is a flowchart showing a process in which the digital certificate distribution server 10 distributes a digital certificate. This flowchart will be described with reference to FIG. 4, in which the client 12, the digital certificate distribution server 10 and the digital certificate management server 20 are shown. The process of the flowchart of FIG. 3 shows the process of the digital certificate distribution server 10 between the client 12 and the digital certificate distribution server 10 shown in FIG.

First, in step S101, the digital certificate distribution server 10 determines the password sent by the client 12. Here, assuming that the password can be determined, the process proceeds to step S102, and the digital certificate distribution server 10 determines whether the client 12 has not yet downloaded the digital certificate. This determination is made by the digital certificate management server 20.
It can be determined by inquiring. if,
If the client 12 has already downloaded the digital certificate, the digital certificate distribution server 10
In step S105, the fact that the download has been completed is displayed, and the contact information when re-download is necessary is specified.
Be prepared for loss of certificates.

If it has not been downloaded yet, in step S103 the digital certificate distribution server 10
The downloaded client information is notified to the digital certificate management server 20, and the digital certificate management server 20 records it in a download processing user information database (hereinafter referred to as DL user DB) which will be described later. The digital certificate distribution server 10 then proceeds to step S
The client 12 receives the digital certificate data at 104.
And the process ends.

Next, the DL user DB will be described with reference to FIG. As shown in FIG. 5, the DL user DB is composed of “items” and “formats” corresponding thereto. The items are "authentication ID", "password", and "connection source I".
P address ”,“ browser name ”,“ client OS ”
It consists of "name" and "download date and time". Of these, the authentication ID and the password are items input by the client 12 in order to obtain the digital certificate from the digital certificate distribution server 10, and both are 8-digit alphanumeric characters. The connection source IP address is the IP address of the client when the client 12 acquires the digital certificate.
The browser name is the name of the internet browsing software. The client OS name is the name of the operating system of the client 12. The download date and time is the date and time when the client 12 downloaded the digital certificate.

Next, the process of transferring the downloaded digital certificate to the digital certificate management server 20 will be described with reference to the flowchart of FIG. In addition,
The process of the flowchart of FIG. 6 shows the process between the digital certificate management server 20 and the digital certificate distribution server 10 shown in FIG.

In step S201, the digital certificate management server 20 refers to the DL user DB and extracts the user information which is the information of the downloaded client. If the digital certificate has not been downloaded, in step S202. The process ends. If it has been downloaded, the digital certificate is transferred to the digital certificate management server 20 in step S203. Then, the download management database (hereinafter, referred to as DL management DB) described below is updated.

FIG. 7 is a diagram showing the DL management DB. This DL management DB is a database in which a serial number is added as an item to the DL user DB, and the serial number is
It is managed by 12 alphanumeric characters. The transferred and isolated digital certificate is managed by this DL management DB.
It should be noted that the moving date and time of the digital certificate may be further added to the DL management DB.

As described above, when the digital certificate is downloaded, it is important data by isolating the digital certificate in the digital certificate management server 20 which is safe against attacks from the Internet 16. The security of the digital certificate is ensured.

Next, the process of issuing a digital certificate expiration warning will be described. This expiration warning means that the client who has the digital certificate is the WWW server 14
If the digital certificate is about to expire when you access the, you will be warned that the client is about to expire.

This processing is shown in the flowchart of FIG. 8 and FIG.
It will be explained using and. FIG. 9 is a diagram showing how the WWW server 14 gives a warning to the client 12.

In step S301, the WWW server 14
Decrypts an encrypted digital certificate. Then, in step S302, the WWW server 14 acquires the expiration date from the decrypted digital certificate and holds the expiration date in the environment variable. In the next step S303, it is determined whether the expiration date is near. In the process of determining whether or not the time is near, for example, a period is set in advance such as one month, and the expiration date of the received digital certificate is, for example, 1
If it is February 31, it is a process of determining that the expiration date is near when it is accessed after November 30, which is one month before.

If the result of the determination in step S303 for making such a determination is that the expiration date is not near, the protected content that cannot be viewed without a digital certificate, which is a normal process, is displayed, and the process related to the expiration warning ends. To do.

If the result of determination in step S303 is that the expiration date is near, the process proceeds to step S304, and the average of the use intervals of the client is calculated from the access log recorded each time the client accesses. This usage interval is, for example, an interval from the date of access to the date of next access, the date of access is, for example, November 3, and the date of next access is 1
If it is January 5, the interval will be two days.

The average of such utilization intervals is calculated in step S3.
In step S305, it is determined whether the client may access again before the expiration of the digital certificate. This means, for example, if the average usage interval is 3 days, the deadline is December 31, and the date of access today is December 20, if you access again by the expired December 31st. Forecasting, the warning of expiration is not issued and the process proceeds to step S307. If today's date of access is December 30, it is predicted that the access will not be completed before the expiration, and an expiration warning is displayed in step S306.

In the process of step S305, in addition to the above process, for example, "always display a warning if 14 days before" is determined, and if access is made within 14 days before expiration, the average use interval is set. Regardless, the warning may be displayed without fail, or the warning may be given in a stronger tone as the deadline approaches.

Further, in addition to displaying the warning in step S306, the process of updating the digital certificate may be made selectable, and the client 12 may perform the process of updating the digital certificate.

If the client 12 chooses to perform the update processing, the WWW server 14 changes the connection destination of the client 12 to the digital certificate distribution server 10 in order to perform the digital certificate update processing. As a result, the update process can be performed. Alternatively, when the WWW server 14 also has the function of the digital certificate distribution server 10, the digital certificate update processing is performed by the WWW server 14.

Further, the WWW server 14 notifies the digital certificate management server 20 of the usage interval information of each client, and the digital certificate management server 20 uses this information to set the date and time when the digital certificate is distributed to each client. It may be set.

Further, the digital certificate management server 20
When the certificate is transferred from the server to the network-accessible digital certificate distribution server 10, the client may be notified that the certificate can be acquired.

[0051]

As described above, a digital certificate management method, a digital certificate distribution server, and a digital certificate transmission client are provided which securely manage digital certificates and prevent expiration of the digital certificates. .

[Brief description of drawings]

FIG. 1 is an overall configuration diagram of a digital certificate distribution system according to an embodiment of the present invention.

FIG. 2 is a hardware block diagram of a computer system.

FIG. 3 is a flowchart showing a process of distributing a digital certificate.

FIG. 4 is a diagram showing how a digital certificate is transferred.

FIG. 5 is a diagram showing a download processing user information database.

FIG. 6 is a flowchart showing a process of transferring to a digital certificate management server.

FIG. 7 is a diagram showing a download management database.

FIG. 8 is a flowchart showing a process of warning a client.

FIG. 9 is a diagram showing how a WWW server gives a warning to a client.

[Explanation of symbols]

10 ... Digital certificate distribution server 12 ... Client 14 ... WWW server 16 ... Internet 18 ... Firewall 20 ... Digital certificate management server 22 ... Administrator client 24 ... Arithmetic processing device 26 ... Interface device 28 ... Input device 30 ... Display device 32 ... Drive device 34 ... Recording medium 36 ... Auxiliary storage device 38 ... Memory device

Claims (12)

[Claims] 1. A digital certificate distribution server for distributing a digital certificate to a client via a network, which is a digital certificate management method for managing the digital certificate, wherein the digital certificate is distributed to the client. And a transfer step of transferring the distributed digital certificate to a computer whose access from the network side is restricted. 2. The digital certificate management method according to claim 1, wherein in the distributing step, information about the client who has distributed the digital certificate is recorded. 3. The digital certificate management method according to claim 1, wherein the transfer of the digital certificate is recorded in the transferring step. 4. A digital certificate distribution server that distributes a digital certificate to a client via a network, and a distribution unit that distributes the digital certificate to the client, and access from the network side is restricted. And a transfer means for transferring the distributed digital certificate to a computer. 5. A digital certificate management method for managing an expiration date of the digital certificate in an access right issuing server which gives an access right to a client having a digital certificate. A warning notification determining step of determining whether or not to notify the expiration warning of the digital certificate, and a warning notification step of notifying the expiration warning based on the determination result of the warning notification determining step. Digital certificate management method. 6. The warning notification determination step performs the warning notification determination based on an interval at which the client accesses the access authority issuing server and an expiration date of the digital certificate. Digital certificate management method described in. 7. The digital certificate management method according to claim 5, wherein in the warning notification step, the expiration warning is notified and the digital certificate is updated. 8. A digital certificate sending client for accessing a server using a digital certificate, the digital certificate sending means sending a digital certificate to the server, and the digital certificate sent from the server. When the expiration date of the certificate expires after a predetermined period of time, the expiration date warning receiving step of receiving an expiration date warning indicating that the expiration date of the digital certificate expires after the predetermined period of time is provided. Digital certificate sending client. 9. A method for causing a computer to execute a distribution procedure for distributing a digital certificate to a client and a transfer procedure for transferring the distributed digital certificate to a computer to which access from the network side is restricted. Digital certificate management program. 10. A determination procedure for determining the validity period of the digital certificate based on the validity period of the digital certificate when the client accesses the computer, and an expiration warning is notified according to the validity period. A digital certificate management program for executing the warning notification procedure. 11. A digital certificate for causing a computer to execute a distribution procedure for distributing a digital certificate to a client and a transfer procedure for transferring the distributed digital certificate to a computer whose access from a network is restricted. A computer-readable recording medium recording a book management program. 12. A determination procedure for determining a validity period of the digital certificate based on a validity period of the digital certificate when the client accesses the computer, and an expiration warning is notified according to the validity period. And a computer-readable recording medium recording a digital certificate management program for executing the warning notification procedure.