JP2003298580A - Expired public key certificate list generating apparatus, expired public key certificate list generating method, computer program, and recording medium for recording the computer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an expired public key certificate list generating apparatus capable of quickly creating an expired public key certificate list so as to thereby prevent degraded performance of other services in an authentication station. <P>SOLUTION: The authentication station (CA) 1 is provided with: an expired certificate information database 12 for storing expired certificate information including a serial number and an expired date of a public key certificate; an expired certificate information acquisition section 16 for acquiring the stored expired certificate information; and an expired public key certificate list generating section 17 for generating the expired public key certificate list including the acquired expired certificate information. In the case of creating the expired public key certificate list, it is not required to acquire the serial number and the expired data sequentially from the public key certificate database 11 to create the expired certificate information, resulting that the expired public key certificate list can quickly be created thereby preventing the degraded performance of other services in the authentication station. <P>COPYRIGHT: (C)2004,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a revocation public key certificate list generation device capable of rapidly generating a revocation public key certificate list and thereby preventing performance degradation of other services.
The present invention relates to a revocation public key certificate list generation method, a computer program for executing the method, and a recording medium recording the computer program.

[0002]

2. Description of the Related Art PKI (Public Key Infrastructure)
In the case of "ructure", a user who registers a public key with a certificate authority (CA) has a public key certificate issued at the time of issuance with the intention of using the public key certificate until the expiration date.
However, the public key certificate may become invalid before the expiration date due to various conditions such as the following.

(1) Change of user's own name (2) Change of relationship between certified person and CA (for example, retirement,
(3) Compromise of private key corresponding to public key certificate In such a case, CA invalidates the public key certificate of the user and discloses it to other users in some way. Notify that the key certificate has been revoked.

A revoked public key certificate list (RL) is used to notify the revoked public key certificate. CA
Regularly lists revoked public key certificates that list all public key certificates that have become invalid during the validity period ("example" twice / day, etc. (this pace is optional by CA)) And deliver it to the user. Alternatively, the user can access the CA to obtain the revoked public key certificate list. This allows the user to know the revoked public key certificate.

FIG. 4 is a diagram showing the structure of a revocation public key certificate list.

In the revocation public key certificate list (RL), R
The L version, the RL issuer, the current RL issue date, the next RL issue date, the revocation certificate information group, and the like are described. In each revocation certificate information of the revocation certificate information group, the serial number and revocation date of the revoked public key certificate are described as required items, and it seems that the public key has been compromised as an extension element (Option). Date (invalidityDate) etc. are described. The revocation public key certificate list (RL) also describes an extension element (Option) as the main RL. Then, the revoked public key certificate list (RL) is attached with a CA signature (Signature) for the described information.

FIG. 5 is a flowchart showing a conventional revoked public key certificate list generation process. When the RL is generated, the CA acquires information about serial numbers, revocation dates, and extension elements (Option) of all revoked public key certificates from the public key certificate database (step S101), and these public keys are acquired. Revocation certificate information including information for each certificate is generated (step S10).
3), a revocation public key certificate list including each revocation certificate information is generated (step S105).

[0008]

However, there are problems in the above-described conventional revoked public key certificate list generation processing.

When generating the revoked public key certificate list,
Since it is necessary to generate a revocation public key certificate list that includes revocation certificate information for all public key certificates that are revoked at that time, as shown in FIG. 6, revocation public keys issued in the past. The revocation certificate information included in the certificate list also needs to be generated again after retrieving the information from the public key certificate database, which takes a long time to generate the revocation public key certificate list (RL). It is a factor.

Further, as described above, the revocation public key certificate list cannot be quickly generated in the conventional case.
As shown in, if a large number of public key certificates are invalid and the time interval for issuing the revocation public key certificate list is short, the CA must always generate the revocation public key certificate list. I have to. Therefore, the performance of other services such as issuance and reference of public key certificates performed by the same certificate authority will be degraded.

Therefore, the present invention has been made in view of the above conventional problems, and an object of the present invention is to quickly generate a revocation public key certificate list, thereby preventing performance degradation of other services. An object is to provide a revocation public key certificate list generation device, a revocation public key certificate list generation method, a computer program for executing the method, and a recording medium recording the computer program.

[0012]

In order to solve the above-mentioned conventional problems, the present invention of claim 1 is a revocation public key certificate list generating apparatus for generating a revocation public key certificate list, wherein a public key certificate is used. Revocation certificate information storing means for storing revocation certificate information including the identification information of the public key certificate and the revocation date of the public key certificate, and a revocation certificate for acquiring the revocation certificate information stored in the revocation certificate information storing means. Revocation public key certificate list including certificate information acquisition means and revocation public key certificate list generation means for generating a revocation public key certificate list including revocation certificate information acquired by the revocation certificate information acquisition means The generator is the solution.

According to the present invention of claim 1, revocation certificate information storage means for storing revocation certificate information including identification information of a public key certificate and a revocation date of the public key certificate, and the revocation certificate. Revocation certificate information acquisition means for acquiring revocation certificate information stored in the certificate information storage means, and a revocation public key certificate list including revocation certificate information acquired by the revocation certificate information acquisition means Since a means for generating a revocation public key certificate list is provided, when generating the revocation public key certificate list, the identification information and revocation date of the public key certificate are acquired from the public key certificate database etc. one by one, and the revocation certificate is obtained. It is not necessary to generate the certificate information, and as a result, the revoked public key certificate list can be generated quickly, thereby preventing performance degradation of other services provided by the certificate authority.

According to a second aspect of the present invention, the revocation certificate information storage means has revocation certificate information storage means for storing revocation certificate information, and the revocation public key certificate list generation apparatus according to claim 1 has a solving means. And

According to the second aspect of the present invention, since the revocation certificate information storage means is provided with the revocation certificate information storage means for storing the revocation certificate information, the revocation certificate is valid until the generation of the revocation public key certificate list. You can store calligraphy information,
This allows the revocation public key certificate list to be generated quickly.

According to the third aspect of the present invention, the identification information of the public key certificate, the expiration date of the public key certificate, and the information about the extension element are stored in the storage unit storing the public key certificate. The revocation public key certificate list generation device according to claim 1 or 2, further comprising revocation certificate information generation means which is acquired upon revocation and generates revocation certificate information including the identification information, the revocation date, and the extension element. Will be the solution.

According to the present invention of claim 3, from the storage means storing the public key certificate, the identification information of the public key certificate, the expiration date of the public key certificate, and the information on the extension element are provided to the public key certificate. When revocation public key certificate list is generated, it has revocation certificate information generation means for acquiring revocation certificate information including the identification information, revocation date and extension element when revocation certificate is invalidated. There is no need to generate revocation certificate information, which allows the revocation public key certificate list to be generated quickly.

According to the present invention of claim 4, in a revocation public key certificate list generation method for generating a revocation public key certificate list, identification information of the public key certificate and a revocation date of the public key certificate are provided. Revocation certificate information acquisition step of acquiring the revocation certificate information from the revocation certificate information storage means in which the revocation certificate information including the revocation certificate information is generated, and a revocation public key certificate list including the acquired revocation certificate information is generated. A revocation public key certificate list generation method including a revocation public key certificate list generation step.

According to the present invention of claim 4, the revocation certificate is stored in the revocation certificate information storage means in which the revocation certificate information including the identification information of the public key certificate and the revocation date of the public key certificate is stored. Revocation certificate information acquisition stage of acquiring certificate information,
Since a revocation public key certificate list generation step of generating a revocation public key certificate list including the acquired revocation certificate information is provided, the public key certificate identification information and the revocation date from the public key certificate database etc. It is not necessary to obtain each revocation certificate to generate revocation certificate information one by one, and as a result, a revocation public key certificate list can be generated quickly, thereby preventing performance degradation of other services provided by the certificate authority.

The present invention according to claim 5 comprises a revocation public key certificate list generation method according to claim 4, further comprising a revocation certificate information storage step of storing revocation certificate information in the revocation certificate information storage means. And

According to the present invention of claim 5, a revocation certificate information storing step for storing revocation certificate information in the revocation certificate information storage means is provided, so that the revocation certificate is revoked until the generation of the revocation public key certificate list. Certificate information can be stored, which allows quick generation of revoked public key certificate lists.

According to a sixth aspect of the present invention, the identification information of the public key certificate, the expiration date of the public key certificate, and the information about the extension element are stored in the storage unit in which the public key certificate is stored. 6. The revocation public key certificate list generation method according to claim 4 or 5, further comprising a revocation certificate information generation step of generating revocation certificate information including the identification information, the revocation date, and the extension element upon revocation. Will be the solution.

According to the present invention of claim 6, from the storage means storing the public key certificate, the identification information of the public key certificate, the expiration date of the public key certificate, and the information about the extension element are provided to the public key certificate. When a certificate revocation list is created, it has a revocation certificate information generation step that generates revocation certificate information that includes the identification information, revocation date, and extension element when the certificate is revoked. There is no need to generate revocation certificate information, which allows the revocation public key certificate list to be generated quickly.

The present invention according to claim 7 provides a solving means with a computer program for executing the method according to any one of claims 4 to 6.

According to the present invention of claim 7, a public key certificate revocation list generation method for executing the public key certificate revocation list generation method capable of rapidly generating the revocation public key certificate list and thereby preventing performance degradation of other services in the certificate authority is executed. A computer program can be distributed.

The present invention according to claim 8 provides a solution by using a recording medium recording a computer program for executing the method according to any one of claims 4 to 6.

According to the present invention of claim 8, a public key certificate revocation list generation method for executing the public key certificate revocation list generation method capable of rapidly generating the revocation public key certificate list and thereby preventing performance degradation of other services in the certificate authority is executed. A recording medium having the computer program recorded therein can be distributed.

[0028]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a diagram showing a main configuration of a certificate authority (hereinafter referred to as CA) 1 which is a computer system embodying a revocation public key certificate list generation device of the present invention.

The CA 1 is a public key certificate database 11 in which public key certificates are stored and stored, a revocation certificate information database 12 in which revocation certificate information is stored and stored, and a revocation target in the public key certificate database 11. Public key certificate state management unit 13 that changes the state of the public key certificate of the public key certificate to the invalid state, and a revocation certificate that generates revocation certificate information of the public key certificate invalidated by the public key certificate state management unit 13 A certificate information generation unit 14, a revocation certificate information storage unit 15 that stores the revocation certificate information generated by the revocation certificate information generation unit 14 in the revocation certificate information database 12, and a revocation public key certificate list generation unit. At this time, the revocation certificate information acquisition unit 16 that acquires all revocation certificate information in the revocation certificate information database 12, and the revocation certificate information acquisition unit 16 To generate a revocation public key certificate list that contains the certificate revocation information of Te and a revoked public key certificate list generating section 17.

Each processing unit of CA1 is realized by reading a computer program from the storage medium storing the program into CA1 and executing the program by the arithmetic processing unit of CA.

The serial number is CertificateSer
It is written as ialNumber and the revocation date is written as Revocation Date. The list of revoked public key certificates is Revocation Lis
It is written as t and abbreviated as RL.

Next, the operation of this embodiment will be described. First, a process of generating and storing revocation certificate information will be described.
FIG. 2 is a flowchart showing generation and storage processing of a revocation public key certificate list, and a diagram showing transitions of states of the public key certificate database 11 and revocation certificate information database 12 in the generation process.

Here, as an example, in the public key certificate database 11, serial numbers “00359” and “0” are stored.
It is assumed that the public key certificates of “1123” and “01156” are stored. In the public key certificate database 11, the serial number “0035
The public key certificate of “9” is valid, the public key certificates of serial numbers “01123” and “01156” are invalid, and the expiration date of each public key certificate is “200”.
2/1/25 ”is recorded.

In the revocation certificate information database 12, the revocation certificate information 121 about the public key certificate of the serial number "01123" is associated with the serial number "01156" and the revocation certificate information 121 is associated with the serial number "01156". It is assumed that the revocation certificate information 122 regarding the public key certificate of the serial number is stored. These are generated and stored by the generation and storage processing of revocation certificate information described below.

Now, for example, on January 30, 2002, there is an invalidation application (step S1) accompanied by designation of a public key certificate (for example, a public key certificate of serial number "00359") to be invalidated. Then, the public key certificate status management unit 13 invalidates the status of the designated public key certificate (public key certificate of serial number “00359” in this example) to be revoked in the public key certificate database 11. The state is changed (step S3). The public key certificate status management unit 13 uses the public key certificate database 1
The date of the current day (in this example, the date “2002/1/30”) is recorded in 1 as the expiration date of the public key certificate.

Next, the revoked certificate information generation unit 14 causes the public key certificate invalidated by the public key certificate state management unit 13 in step S3 (in this example, the serial number "003").
Revocation certificate information of "59" public key certificate) is generated (step S5). Specifically, the serial number (“0035 in this example” as the identification information of the public key certificate is used.
9 ”) and the revocation date (“ 2002/1/30 ”in this example) and, if necessary, the information related to the extension element of each revocation certificate information from the public key certificate database 11,
Revocation certificate information (at least revocation certificate information 12 in this example) including at least this serial number and revocation date, and further including an extension element (crlEntryExtentions) if necessary.
3) is generated. Next, the revocation certificate information storage unit 15
Revocation certificate information generated by the revocation certificate information generation unit 14 in step S5 (revocation certificate information 123 in this example)
Is stored in the revocation certificate information database 12 in association with the serial number of the revoked public key certificate (public key certificate with serial number “00359” in this example) (step S7), and the process is executed. Finish.

Therefore, the revocation certificate information database 12 has revocation certificate information 121 and revocation certificate information 122.
In addition, the revocation certificate information 123 is stored. Since the revocation certificate information is stored in the revocation certificate information database 12 in association with the serial number of the public key certificate, when the public key certificate is deleted from the public key certificate database 11, the revocation certificate information is revoked from the serial number. You can search and delete the certificate information.

Next, the process of generating the revoked public key certificate list will be described. FIG. 3 is a flowchart showing a process of generating a revocation public key certificate list. Here, too, a description will be given with reference to the above example.

Now, the revocation certificate information acquisition unit 16 has an opportunity to generate a revocation public key certificate list (RL) (step S1).
1), the revocation certificate information in the revocation certificate information database 12 (in this example, the revocation certificate information 121, 12
2 and 123) are all acquired (step S1)
3).

Next, the revocation public key certificate list generation unit 17
Generates a revocation public key certificate list including all revocation certificate information acquired by the revocation certificate information acquisition unit 16 in step S13 (step S15), and ends the process.

The revocation certificate information stored in the revocation certificate information database 12 is not erased even after the revocation public key certificate list is generated, and the database 12 is not erased.
Since the revocation certificate information issued in the past is retained, it is not necessary to obtain and generate the serial number and the revocation date information from the public key certificate database 11 again.

As described above, the certificate authority 1 of the present embodiment embodies the revocation public key certificate list generation device and executes the revocation public key certificate list generation method.

That is, the revocation public key certificate list generation device (1) stores revocation certificate information including a serial number as identification information of the public key certificate and the revocation date of the public key certificate. Revocation certificate information database 12 which is certificate information storage means, and revocation certificate information acquisition unit which is revocation certificate information acquisition means for acquiring revocation certificate information stored in the revocation certificate information storage means (12). 16
And a revocation public key certificate list generation unit 17 which is revocation public key certificate list generation means for generating a revocation public key certificate list including the revocation certificate information acquired by the revocation certificate information acquisition means (16). Therefore, when the revocation public key certificate list is generated, it is necessary to acquire the identification information of the public key certificate and the revocation date from the public key certificate database 11 etc. one by one to generate the revocation certificate information. As a result, the revoked public key certificate list can be quickly generated, thereby preventing performance degradation of other services in the certificate authority.

That is, the revocation public key certificate list generation device (1) stores revocation certificate information storing revocation certificate information including the identification information of the public key certificate and the revocation date of the public key certificate. Step S13, which is a revocation certificate information acquisition step of acquiring the revocation certificate information from the means (12).
And the public key certificate revocation list generation method including step S15 which is a revocation public key certificate list generation step of generating a revocation public key certificate list including the obtained revocation certificate information. It is not necessary to generate revocation certificate information when generating the public key certificate list, and as a result, the revocation public key certificate list can be generated quickly, thereby preventing performance degradation of other services.

Further, the revocation public key certificate list generation device (1) is a revocation certificate information storage section 15 which is revocation certificate information storage means for storing revocation certificate information in the revocation certificate information storage means (12). Since it is provided, the revocation certificate information can be stored until the time of generating the revocation public key certificate list, and thereby the revocation public key certificate list can be generated quickly.

Further, the revocation public key certificate list generation device (1) is provided with a public key certificate which is a revocation certificate information storing step for storing revocation certificate information in the revocation certificate information storage means (12). Since the revocation list generation method is executed, the revocation certificate information can be stored until the time of generating the revocation public key certificate list, which allows the revocation public key certificate list to be generated quickly. .

Further, the revocation public key certificate list generation device (1) uses the serial number as the identification information of the public key certificate from the public key certificate database 11 which is a storage means storing the public key certificate and the relevant serial number. Revocation certificate information generation that acquires revocation date and extension element information of public key certificate when revoking public key certificate and generates revocation certificate information including the identification information and revocation date extension element Since the revocation certificate information generation unit 14 as a means is provided, it is not necessary to generate the revocation certificate information when generating the revocation public key certificate list, and thus the revocation public key certificate list can be generated quickly. become.

That is, the revoked public key certificate list generation device (1) uses the storage means (1) in which the public key certificate is stored.
A revocation certificate that obtains the identification information of the public key certificate, the revocation date and the extension element information of the public key certificate from 1), and generates revocation certificate information including the identification information, the revocation date, and the extension element. Since the step S5 which is the step of generating the certificate information is provided, it is not necessary to generate the revocation certificate information when generating the revocation public key certificate list, whereby the revocation public key certificate list can be generated quickly. .

The computer program for causing the revocation public key certificate list generation device (1) to execute the public key certificate revocation list generation method described above is a semiconductor memory,
It can be widely distributed by being recorded on a computer-readable recording medium such as a magnetic disk, an optical disk, a magneto-optical disk, a magnetic tape, or transmitted via a communication network such as the Internet.

[0050]

As described above, according to the present invention,
The revocation certificate information is acquired from revocation certificate information storage means that stores revocation certificate information including identification information of the public key certificate and revocation date of the public key certificate, and the acquired revocation certificate information. Since the revocation public key certificate list including the is generated, when generating the revocation public key certificate list, the identification information and the revocation date are acquired from the public key certificate database etc. one by one, and the revocation certificate information is acquired. As a result, the revoked public key certificate list can be quickly generated, which can prevent performance degradation of other services in the certificate authority.

[Brief description of drawings]

FIG. 1 is a diagram showing a main configuration of a certificate authority 1 embodying a revocation public key certificate list generation device of the present invention.

FIG. 2 is a flowchart showing generation and storage processing of a revocation public key certificate list, and diagrams showing transitions of states of a public key certificate database 11 and a revocation certificate information database 12 in the generation process.

FIG. 3 is a flowchart showing a process of generating a revocation public key certificate list.

FIG. 4 is a diagram showing the structure of a revocation public key certificate list.

FIG. 5 is a flowchart showing conventional revoked public key certificate list generation processing.

FIG. 6 is a diagram showing a problem of conventional generation processing of a revocation public key certificate list.

FIG. 7 is a diagram showing a problem of conventional revoked public key certificate list generation processing.

[Explanation of symbols]

1 Certificate Authority (CA) 11 Public Key Certificate Database 12 Revocation certificate information database 13 Public key certificate status management unit 14 Revocation certificate information generator 15 Revocation certificate information storage 16 Revocation certificate information acquisition section 17 Revocation public key certificate list generation unit 121,122,123 Revocation certificate information

   ─────────────────────────────────────────────────── ─── Continued front page    (72) Inventor Takeshi Nagayoshi             2-3-1, Otemachi, Chiyoda-ku, Tokyo             Inside Telegraph and Telephone Corporation (72) Inventor Hiroshi Masamoto             2-3-1, Otemachi, Chiyoda-ku, Tokyo             Inside Telegraph and Telephone Corporation F term (reference) 5B085 AC05 AE00 BA06 BG02                 5J104 AA16 EA01 EA09 EA11 EA19                       MA01 MA05 NA02 PA07

Claims (8)

[Claims] 1. A revocation public key certificate list generation device for generating a revocation public key certificate list stores revocation certificate information including identification information of the public key certificate and revocation date of the public key certificate. Revocation certificate information storage means, revocation certificate information acquisition means for acquiring revocation certificate information stored in the revocation certificate information storage means, and revocation certificate information acquired by the revocation certificate information acquisition means And a revocation public key certificate list generation means for generating a revocation public key certificate list containing the revocation public key certificate list. 2. The revocation public key certificate list generation device according to claim 1, further comprising revocation certificate information storage means for storing revocation certificate information in the revocation certificate information storage means. 3. Obtaining the identification information of the public key certificate, the expiration date of the public key certificate, and the information about the extension element from the storage unit storing the public key certificate when the public key certificate is invalidated. 3. The revocation public key certificate list generation device according to claim 1, further comprising revocation certificate information generation means for generating revocation certificate information including the identification information, the revocation date, and the extension element. 4. A revocation public key certificate list generation method for generating a revocation public key certificate list, wherein revocation certificate information including identification information of the public key certificate and a revocation date of the public key certificate is Revocation certificate information acquisition step of acquiring the revocation certificate information from the stored revocation certificate information storage means, and a revocation public key certificate generating a revocation public key certificate list including the acquired revocation certificate information. A revocation public key certificate list generation method comprising: a list generation step. 5. The revocation public key certificate list generation method according to claim 4, further comprising a revocation certificate information storage step of storing revocation certificate information in said revocation certificate information storage means. 6. Obtaining the identification information of the public key certificate, the expiration date of the public key certificate, and the information about the extension element from the storage unit storing the public key certificate when the public key certificate is invalidated. 6. The revocation public key certificate list generation method according to claim 4, further comprising a revocation certificate information generation step of generating revocation certificate information including the identification information, the revocation date, and the extension element. 7. A computer program for executing the method according to claim 4. 8. A recording medium on which a computer program for executing the method according to claim 4 is recorded.