JP2005094365A - Method for managing certificate pass and information processor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To easily provide a certificate pass in an optional past time and to improve interoperability between different domains. <P>SOLUTION: A certificate pass, etc., existing in a storing means is acquired from the storing means each time a certificate pass acquisition opportunity arrives, an authentication station certificate, etc., constituting the certificate pass is stored in a storage device, a certificate pass management node is generated for each authentication station certificate, the publisher and main person, etc., of the authentication station certificate are registered in the certificate pass management node, a time series management node is generated for each certificate pass acquisition opportunity, and the address of the certificate pass management node which corresponds to each certificate path acquisition opportunity and in which the authentication station certificate forming the head of each certificate pass is registered and the address of the time series management node corresponding to the next opportunity of the certificate pass acquisition opportunity are registered in the time series management node. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a method for managing a certification path at an arbitrary time in the past in a public key infrastructure (PKI), and in particular, a certification path to a user, a related certificate revocation list, and certificate revocation information. The present invention relates to a certification path management method and a certification path management system.

  In recent years, a public key infrastructure (PKI: Public Key Infrastructure) using a public key cryptosystem has been developed, and it is becoming possible to realize services for electronic signature, authentication, anti-spoofing, and non-repudiation. In these services, a certificate issued by a third party called a certification authority is exchanged. The relying party that receives the certificate is responsible for the validity and trust of the certificate. It is necessary to confirm sex.

  There are two methods for checking the validity and reliability of a certificate: a method that the relying party performs by itself, and a method in which the relying party requests a validation authority called VA (Validation Authority) and the verification authority performs on its behalf. Exists. When checking the validity of a certificate, obtain a certificate revocation list that contains certificate revocation information from an existing storage system, and whether or not the certificate to be verified is described in the certificate revocation list. There are two types: a method for verifying the certificate and a method for checking the validity of the certificate by using a service provided by the certificate authority.

  In the certificate reliability check, a certification path construction and verification process occurs. This certification path construction is to acquire the certificate group from the trust anchor of the relying party to the received certificate from the existing storage system. The certificate authority certificate, mutual authentication certificate, link certificate, It is necessary to obtain one of the certificates to be verified. The certification path verification means an act of verifying whether the certificate constituting the certification path has been revoked and whether the certification path violates the restrictions in the certification.

As an apparatus for verifying the certification path and supporting the certificate verification, the certificate authority identifier, the certificate issued by the certificate authority, and the other certificate authority required for verifying the certificate are issued. Revocation confirmation as information designating the identifier of each certificate in the certification path representing the certificate to be certified, the presence / absence of information for confirming the revocation of each of the certificates, the method for confirming the revocation, and the contact information A certification path registration information registration unit for inputting and storing certification path registration information generated by linking a means and a certification path registration identifier representing a registration request; and the certification path registration information included in the certification path registration information The identifier of the certificate authority, the identifier of the entity, the identifier of each of the certificates in the certification path, and the revocation checking unit are linked, and an identifier indicating the linked information is added and only the linked information A certificate collection information generation apparatus including a certificate collection information generation unit that collects each of the certificates on the certificate path and generates certificate collection information for confirming revocation (see Patent Document 1) Etc. have been proposed.
JP 2000-10477 A

  By the way, the certification path construction is performed by acquiring a certificate constituting the certification path from an existing storage system. However, since the existing storage system does not hold the past certificate information, there is a problem that the certificate path cannot be easily constructed at any past time.

  In addition, in the certification path verification, the existing storage system does not maintain the past certificate revocation list, and in addition, the service provided by the certificate authority does not include the past certificate revocation information. There is also a problem that certification path verification at an arbitrary time in the past cannot be easily performed.

  Furthermore, in the above prior art, the certification path management is performed, but the certification path management in the past time is not performed in time series. Therefore, there has been a problem that it is not possible to easily provide the user with the certificate path, the related certificate revocation list, and the certificate revocation information at an arbitrary past time designated by the user.

  Also in the prior art, registration and management of a certification path is realized by a cache function. However, these certification paths can be stored only in the certification path that is valid based on the certification path verification result or the certification path that is valid in the domain when the certification validation device validates. is there.

  However, in the case of interoperability between different PKI domains, there are cases where the determination of whether the certification path is valid depends on the verification policy of the user. Therefore, it is necessary to register and manage not only a valid certification path but also an invalid certification path. Therefore, considering the interoperability between different PKI domains, there has been a problem that it is necessary to share certification path information across domain boundaries.

  Therefore, the present invention has been made in view of the above problems, and can easily provide a certification path at an arbitrary past time, and can improve interoperability between different domains. The main purpose is to provide a path management method and a certification path management system.

  A certification path management method of the present invention that solves the above-mentioned problem is a method of managing a certification path in a public key infrastructure by an information processing apparatus, and a predetermined path every time a certification path acquisition timing arrives. A certificate path, a certificate revocation list and certificate revocation information related to the certificate path, which exist in the storage means belonging to the certification path acquisition range, are acquired from the storage means, and the acquired certificate path And the certificate revocation list and certificate revocation information related to the certificate authority certificate are stored in a storage device, and a certificate path management node is provided for each of the acquired certificate authority certificates. Generated and stored in the generated certification path management node is a certificate authority certificate issuer and subject, a certificate authority certificate, a certificate revocation list, and a certificate revocation information storage destination address. Certificate The address of the other certification path management node where the subsequent certificate with the subject of the certificate authority certificate at the head of the certificate as the issuer is registered is registered, and each time the certification path is obtained, the time series A management node is generated, and in the generated time-series management node, an address of a certification path management node corresponding to each certification path acquisition timing, in which a certification authority certificate forming the head of each certification path is registered, and The address of the time-series management node corresponding to the next time of the certification path acquisition time is registered (first invention).

  According to a second aspect of the present invention, in the certification path management method according to the first aspect of the invention, a designated time, issuer information of a trust anchor, and issuer information of a verification target certificate are received from a user terminal, Based on the received designated time, the time series management node corresponding to the designated time designated is identified, and the trust anchor issuer information is obtained based on the information of the certification path management node registered in the identified time series management node. The certification path management node including the certification path management node including the issuer of the verification target certificate as the subject is identified, and the corresponding storage path address on the storage device indicated by each identified certification path management node The certificate authority certificate to be issued, the certificate revocation list issued by the issuer of the certificate authority certificate, or the certificate revocation information provided by the certificate authority, and the acquired certificate authority certificate Certificate and the certificate revocation list issued by the issuer of the certificate authority certificate or the certificate revocation information provided by the certificate authority, with the certificate to be verified added and transmitted to the user terminal To do.

  Furthermore, a third invention is the certification path management method according to the first or second invention, wherein the certification path received from a user terminal, a certificate revocation list and a certificate related to the certification path, are provided. When the time-series management node and the certification path management node including the revocation information do not exist in the search range of the information processing apparatus, the information processing apparatus is connected to the network through the certificate, and the certificate is the same as the information processing apparatus. To another information processing apparatus that executes the path management method, a request for obtaining a certification path and a certificate revocation list and certificate revocation information related to the certification path is transmitted, from the other information processing apparatus, In response to the acquisition request, the certificate path, the certificate revocation list and certificate revocation information related to the certificate path are received, and the received certificate path and the certificate related to the certificate path are received. A write revocation list and certificate revocation information, and transmits to the user terminal.

  According to a fourth aspect of the present invention, there is provided an information processing apparatus for managing a certification path in a public key infrastructure, and storing means belonging to a predetermined certification path acquisition range every time a predetermined certification path acquisition timing arrives A certificate path, a certificate revocation list and certificate revocation information related to the certificate path, and a certificate authority certificate constituting the acquired certificate path. Means for storing a certificate revocation list and certificate revocation information related to the certificate authority certificate in a storage device; means for generating a certification path management node for each acquired certificate authority certificate; In the generated certification path management node, the issuer and subject of the certification authority certificate, the storage address where the certification authority certificate, the certificate revocation list, and the certificate revocation information are stored, and the certification path Ahead A means for registering an address of another certification path management node in which a subsequent certificate with the subject of the certification authority certificate as an issuer is registered, and time series management for each certification path acquisition timing A means for generating a node, and an address of a certification path management node in which the certificate authority certificate that forms the head of each certification path corresponding to each certification path acquisition timing is registered in the generated time-series management node And a means for registering the address of the time-series management node corresponding to the next time of the certification path acquisition time.

  Furthermore, a fifth invention is the information processing apparatus according to the fourth invention, wherein, from the user terminal, means for receiving the designated time, the issuer information of the trust anchor, and the issuer information of the verification target certificate; Based on the received designated timing, a means for identifying a time series management node corresponding to the designated designated timing, and a trust anchor issuer based on the information of the certification path management node registered in the identified time series management node A certification path management node including information, means for identifying a certification path management node whose subject is the issuer of the certificate to be verified, and a storage location on the storage device indicated by each of the identified certification path management nodes From the address, obtain the appropriate certificate authority certificate and the certificate revocation list issued by the certificate authority certificate issuer or the certificate revocation information provided by the certificate authority. And adding the certificate to be verified to the obtained certificate authority certificate and the certificate revocation list issued by the issuer of the certificate authority certificate or the certificate revocation information provided by the certificate authority. Means for transmitting to a user terminal.

  According to a sixth invention, in the information processing apparatus according to the fourth or fifth invention, the certificate path received from a user terminal, a certificate revocation list and certificate revocation information related to the certificate path. If the time series management node and the certification path management node including the information processing device are not within the search range of the information processing device, they are connected to the information processing device via a network, Means for transmitting an acquisition request for a certificate path and a certificate revocation list and certificate revocation information related to the certification path to another information processing apparatus executing the method, from the other information processing apparatus, Means for receiving a certification path, a certificate revocation list and certification revocation information related to the certification path, and the received certification path and the certification path in response to the acquisition request; A certificate revocation list and certificate revocation information communicated, characterized in that it comprises, means for transmitting to the user terminal.

  In addition, the problems disclosed by the present application and the solutions thereof will be clarified by the embodiments of the present invention and the drawings.

  According to the present invention, a certification path at an arbitrary past time can be easily provided, and interoperability between different domains can be improved.

  Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a configuration diagram of a certification path management system (information processing apparatus) according to an embodiment of the present invention. A certification path management system 10 as an information processing apparatus according to the present invention includes an existing storage system 110 in which a CA certificate and a related certificate revocation list that constitute a certification path are stored and stored via a network 100. The system 115, the CA service device 120 that is an inquiry destination when acquiring certificate revocation information, the user terminal 140 that makes a certificate path acquisition request, and the certificate path when acquiring certificate path information of another domain The management system 10 is connected to other certification path management systems 150 and 160 for which an inquiry is made, and enables mutual transmission of data. The network 100 includes not only the Internet but also other network communications and communication circuits. For example, various networks such as a LAN, a dedicated line, a WAN (Wide Area Network), a power line network, a wireless network, a public line network, and a mobile phone network can be adopted. Further, if a virtual private network technology such as VPN is used, communication with improved security is established when the Internet is adopted.

  The certification path management system 10 also includes a setting control apparatus 20 that processes information on a certification path acquisition time interval (acquisition timing) and a certification path acquisition range (eg, domain) set by an administrator or the like.

  Further, based on the information transmitted by the setting control apparatus 20, the (all) CA certificates and related certificate revocation lists constituting the certification path are acquired from the existing storage system 110 or the storage system 115, and A certificate path acquisition unit 41 is provided for making an inquiry to the certificate authority service device 120 provided by the certificate authority and acquiring certificate revocation information.

  Further, node management means 42 is provided. This means 42 functions to generate a certification path management node and store the certificate authority certificate, the associated certificate revocation list, and certificate revocation information in the storage device 30. Further, information on elements constituting the certification path is registered in the certification path management node. Further, information for performing time series management of the certification path management node including the certification path acquisition time is registered in the time series management node.

  In addition, another certificate path management system access unit 43 that instructs the communication control device 50 to access the other certificate path management systems 150 and 160 is provided.

  Further, a certification path management module 40 comprising the certification path acquisition means 41, node management means 42, and other certification path management system access means 43, the existing storage systems 110 and 115, and the certificate authority service device 120 The communication control apparatus 50 provided with the communication control means for performing data communication between is provided.

  The storage device 30 also stores a certificate authority certificate, a certificate revocation list, and certificate revocation information.

  Next, from the determination of the acquisition start of the certification path, the certification revocation list, and the certification revocation information by the certification path management module 40 in the certification path management system 10 (hereinafter, system 10), the certification path management node The flow of processing until the information for managing the time series in the time series management node is described. FIG. 2 is a flowchart showing a processing procedure example 1 by the certification path management module according to the embodiment of the present invention. Note that “CT” in FIG. 2 indicates the current time (data acquisition time), and “ST” indicates that the certification path management module 40 first acquires the certificate authority certificate, certificate revocation list, and certificate revocation information. “A” indicates a variable value 0, and “TI” indicates a certification path acquisition time interval set by the administrator and transmitted by the setting control device 20.

  The certification path management module 40 determines the processing start timing based on the certification path acquisition time interval set by the administrator and transmitted from the setting control apparatus 20 (s200). If the determination result indicates that processing is started (s200: YES), an existing certification path is configured from the existing storage system 110 or storage system 115 via the network 100 via the communication control device 50. Acquisition of all certificate authority certificates is started (s205). The certification path acquisition range indicates a domain range from which certification paths and certificate revocation lists are acquired, and is represented by a Distinguished Name entry.

  Next, when a certificate revocation list acquisition destination is included in the acquired CA certificate, a certificate revocation list is acquired from the certificate revocation list acquisition destination indicated by a predetermined area of the CA certificate. If the certificate authority certificate includes an area indicating the certificate revocation information acquisition destination, the certificate revocation information acquisition destination indicated by the area is inquired to obtain certificate revocation information (s210). On the other hand, when the area indicating the certificate revocation information acquisition destination is not included in the certificate authority certificate, the certificate revocation information is not acquired. When the area indicating the certificate revocation list acquisition destination is not included in the certificate authority certificate, the certificate revocation list is acquired using the issuer information of the certificate authority certificate.

  Subsequently, a certification path management node for managing the acquired certification authority certificate in the form of a certification path is generated for the number of the acquired certification authority certificates (s215). In this process, if a certification path that overlaps a part of another certification path exists at the same time, the certification path management node for the certification path with a short certification path length is the same certification path management node. Is not generated within the scope of the time series management node for managing time series.

  Next, it is confirmed that the acquired CA certificate, certificate revocation list, and certificate revocation information do not exist in the storage device 30 (s220). When the acquired CA certificate, certificate revocation list, and certificate revocation information do not exist in the storage device 30 (s220: NO), the CA certificate, certificate revocation list, and certificate revocation information are stored in the storage device 30. 30 (s230). Also, information including the storage destination address in the storage device 30 is registered in the area of the certification path management node (s235).

  On the other hand, if the obtained CA certificate, certificate revocation list, or certificate revocation information exists in the storage device 30 (s220: YES), an existing CA certificate is created in the area of the generated certification path management node. Information including the storage address of the certificate, certificate revocation list and certificate revocation information is registered (s225).

  Next, it is determined that the area indicating the time (CT) when the certificate authority certificate, certificate revocation list, and certificate revocation information are acquired is not included in all the time-series management nodes (s240). If the determination result indicates that the acquisition time (CT) is not included in all time-series management nodes (s240: NO), a new time-series management node is generated (s250). Then, the address information (including) of the certification path management node including the CA certificate at the head of the certification path is registered in each predetermined area of the time series management node (s255).

  On the other hand, if there is a time-series management node including an area indicating the time (CT) when the certificate authority certificate, certificate revocation list, and certificate revocation information is acquired (s240: YES), it corresponds to the head of the certification path. The address (including) information of the certification path management node including the certificate authority certificate is registered in each predetermined area of the previous time-series management node (s245).

  After the registration process to the time series management node as described above, the CA certificate and related certificates that make up the certification path at the time (CT) when the CA certificate, certificate revocation list, and certificate revocation information were acquired Confirm that registration of the revocation list and certificate revocation information to the certification path management node and the time series management node is completed (s260). If registration is completed (s260: YES), wait until the next certification path acquisition time. .

  FIG. 3 is an explanatory diagram showing an example of information registered in the certification path management node and the connection of certification path management nodes according to the embodiment of the present invention. Hereinafter, detailed information registered in the certification path management node will be described. The certification path management node 300 generated as described above can be composed of, for example, six areas 302, 304, 306, 308, 310, and 312.

  Information included in each area includes an issuer (area 302) of a certificate authority certificate constituting a certification path, a subject (area 304) of the certificate authority certificate, and the certificate authority. The storage location address (region 306) in the certificate storage device 30, the storage location address (region 308) in the storage device 30 of the certificate revocation list issued by the certificate authority certificate issuer, and the authentication The storage location address (area 310) in the storage device 30 of the certificate revocation information obtained from the service provided by the authority certificate issuer and the information of the subsequent CA certificate constituting the certification path This is the address (area 312) of the certification path management node to be included.

  For example, when there are five certificate authority certificates constituting one certificate path, five certificate path management nodes (certificate path management nodes 300, 320, 340, 360, 380) are generated. The connection of each certification path management node is indicated by the address of the subsequent certification path management node. Further, for example, when there are three certification authority certificates constituting another certification path and the certification path constituted by the certification authority certificate is a part of another certification path, A certification path management node is not generated when a certification path is acquired at the same time for a certification path constituted by a certification authority certification path.

  FIG. 4 is an explanatory diagram showing registration information in the time-series management node according to an embodiment of the present invention. Next, detailed information registered in the time-series management node will be described. Note that “CT” in FIG. 4 indicates the current time (data acquisition time), and “ST” indicates that the certification path management module 40 first acquires the certificate authority certificate, certificate revocation list, and certificate revocation information. “TI” indicates a certification path acquisition time interval set by the administrator and transmitted by the setting control device 20.

  The above-described time-series management node 400 includes an area (area 405) indicating the time when acquisition processing of all existing certificate paths, related certificate revocation lists, and certificate revocation information is performed, and the next time-series node. An area (address area 410) indicating an address, and all certification paths, associated certification revocation lists, and certification path information existing when the certification revocation information is obtained. It consists of areas (areas 415, 420, and 425) for registering the start address. In addition, the area for registering the start address of each certification path management node is the number of certification paths that exist at the time of certification path acquisition, or when the obtained certification path overlaps with an existing certification path. Since there are no certification path management nodes for certification paths having a short path length that overlap, there are a number of certification paths that are obtained by subtracting the number of certification paths having a short path length from the number of certification paths that exist.

  For example, when “CT = ST + 0 * TI” (area 405) at the time of certification path acquisition, if there are three certification path management node groups for each certification path acquired, each certification path management node In order to indicate the address of the certification path management node serving as the head of the group (the CA certificate corresponding to the head of the certification path), the time series management node 400 is provided with three areas (areas 415, 420, and 425). Register the address of the first certification path management node of the certification path management node group.

  Also, an area (area 410) for indicating the address of the time-series management node 450, which is the information registration destination of the certification path management node in the next certification path acquisition “CT = ST + 1 * TI”, is provided. The address of the time series management node 450 is registered. By the registration, all existing certificate paths, related certificate revocation lists, and certificate revocation information can be managed in time series.

  If there is no certificate authority certificate that makes up the certificate path due to compromise of the certificate authority key, etc., and the certificate path cannot be constructed, as shown in the figure, the time series In the management node 450, the area indicating the head address of the certification path management node group is smaller than that in the time-series management node 400. Further, in the area 465 and the area 470 of the time series management node 450, the area 415 and the area 420 of the time series node 400 are shown as a result of the certification path construction at the certification path acquisition time “CT = ST + 1 * TI”. Since only acquisition of a certification path similar to the certification path is required and no new certification path needs to be stored in the storage device 30, the same address as the start address of the certification path node indicated by the area 415 and the area 420 is stored in the area. 465 and region 470 are also shown.

  Hereinafter, referring to FIG. 5 (and FIG. 3 described above), the certification path management module 40 receives a certification path acquisition request from the user terminal 140, and requests the certification path, the associated certificate revocation list, and the certification. A flow of processing until the revocation information is returned to the user terminal 140 will be described. FIG. 5 is a flowchart showing a processing procedure example 2 by the certification path management module according to the embodiment of the present invention.

  It is assumed that the certification path management module 40 in the system 10 receives a certification path acquisition request from the user terminal 140 (s500: YES). In this case, it is verified that the domain to which the trust anchor and the verification target certificate provided by the user terminal 140 belong is included in the certification path acquisition range set by the administrator or the like and transmitted by the setting control device 20 ( s505).

  As a result of the verification, if the trust anchor and the domain of the certificate to be verified are included in the certification path acquisition range (s510: YES), the certificate path management including the issuer information of the trust anchor in the area 302 A node (see FIG. 3) and a certification path management node (see FIG. 3) including the issuer information of the verification target certificate in the area 304 are specified (s515).

  Then, it is determined whether the specified certification path management node exists on the same certification path (s520). If they exist on the same certification path (s520: YES), the certification path management nodes constituting the one kind of certification path are specified with the two certification path management nodes at the beginning and end, and each The certificate authority certificate, certificate revocation list, and certificate revocation information are obtained from the storage destination address in the storage device 30 indicated by the certification path management node (s525).

  Next, the verification target certificate provided from the user terminal 140 is added to the acquired CA certificate (s530), and the certificate is returned to the user terminal 140 together with the related certificate revocation list and certificate revocation information. (s535).

  On the other hand, the certification path management node including the trust anchor issuer (issuer) and the certification path management node having the subject certificate issuer (issuer) in the subject information are the same certificate. If it does not exist on the path (s520: NO), the certification path management module 40 returns a message indicating that the requested certification path does not exist to the user terminal 140 (s540), and the process ends.

  On the other hand, when the trust anchor and the domain of the verification target certificate are not included in the certification path acquisition range in the step s510 (s510: NO), the certification path management module 40 uses the other certification path management system. A certification path acquisition request is sent to 150 or 160 (s545). Acquire the certification path including the verification target certificate, the related certificate revocation list and the certificate revocation information returned from the other certification path management system 150 or 160 in response to this request (s550), and obtain the relevant The returned information is returned to the user terminal 140 (s535), and the process ends.

  According to the present invention, a certificate path, a related certificate revocation list, and a certificate revocation based on a certification path acquisition time (time interval) and a certification path acquisition range (for example, domain) set by an administrator. Certificates at any time in the past in the Public Key Infrastructure (PKI) by acquiring information and simplifying the management of time-series certificate paths, certificate revocation lists, and certificate revocation information A pass can be easily provided.

  Further, by using services of other certification path management systems, a wide range of certification paths, certificate revocation lists, and certificate revocation information can be provided to users. Further, interoperability can be improved by entrusting the determination of the validity of the certification path to the user validation policy without performing certification path validation in the certification path management system.

  That is, it is possible to easily provide a certification path at an arbitrary time in the past, and to improve interoperability between different domains.

  As mentioned above, although embodiment of this invention was described concretely based on the embodiment, it is not limited to this and can be variously changed in the range which does not deviate from the summary.

1 is a configuration diagram of a certification path management system (information processing apparatus) according to an embodiment of the present invention. FIG. It is a flowchart which shows the process procedure example 1 by the certification | authentication path management module based on one embodiment of this invention. It is explanatory drawing which shows the example of the information registered into the connection of a certification path management node and the certification path management node based on one embodiment of this invention. It is explanatory drawing which shows the registration information to the time series management node based on one embodiment of this invention. It is a flowchart which shows the process procedure example 2 by the certification | authentication path management module based on one embodiment of this invention.

Explanation of symbols

10 Certification path management system (information processing equipment)
DESCRIPTION OF SYMBOLS 20 Setting control apparatus 30 Storage apparatus 40 Certificate path management module 41 Certificate path acquisition means 42 Node management means 43 Other certification path management system access instruction means 50 Communication control apparatus 100 Network 110 Storage system A
115 Storage system B
120 Certification Authority Service 150 Other Certification Path Management System 160 Other Certification Path Management System

Claims (6)

A method of managing a certification path in a public key infrastructure by an information processing device,
A certificate path, a certificate revocation list and certificate revocation information related to the certification path, which are present in the storage means belonging to the predetermined certification path acquisition range each time a predetermined certification path acquisition timing arrives Is obtained from the storage means,
Storing the certificate authority certificate constituting the acquired certificate path, the certificate revocation list and the certificate revocation information related to the certificate authority certificate in a storage device;
Generate a certification path management node for each obtained CA certificate,
In the generated certification path management node, the issuer and subject of the certification authority certificate, the storage address where the certification authority certificate, the certificate revocation list, and the certificate revocation information are stored, and the certification path Register the address of the other certification path management node in which the subsequent certificate with the subject of the certificate authority certificate at the head as the issuer is registered,
For each certification path acquisition time, generate a time series management node,
In the generated time-series management node, the address of the certification path management node corresponding to each certification path acquisition timing, in which the certification authority certificate at the head of each certification path is registered, and the certification path acquisition A certification path management method characterized by registering an address of a time-series management node corresponding to a next time of a time. The certification path management method according to claim 1,
From the user terminal, receive the designated time, the issuer information of the trust anchor, and the issuer information of the verification target certificate,
Based on the received designated time, identify a time series management node corresponding to the designated time,
Based on the information of the certification path management node registered in the specified time-series management node, the certificate having the certification path management node including the trust anchor issuer information and the issuer of the verification target certificate as the subject Identify the path management node,
Provided by the certification authority certificate and the certificate revocation list issued by the issuer of the certification authority certificate or the certification authority from the storage destination address on the storage device indicated by each of the identified certification path management nodes Obtained certificate revocation information,
A user terminal in which a certificate to be verified is added to the acquired certificate authority certificate and the certificate revocation list issued by the certificate authority certificate issuer or the certificate revocation information provided by the certificate authority. A certification path management method characterized by: The certification path management method according to claim 1 or 2,
The time-series management node and the certification path management node including the certification path received from the user terminal, the certificate revocation list and certification revocation information related to the certification path, search for the information processing apparatus. If not in range,
A certificate path, a certificate revocation list and a certificate associated with the certification path, are connected to the information processing apparatus via a network and execute the certification path management method in the same manner as the information processing apparatus. Send an acquisition request with certificate revocation information,
From the other information processing apparatus, in response to the acquisition request, a certificate path, a certificate revocation list and certificate revocation information related to the certification path are received,
A certificate path management method, comprising: transmitting the received certificate path, a certificate revocation list and certificate revocation information related to the certificate path to a user terminal. An information processing apparatus for managing a certification path in a public key infrastructure,
A certificate path, a certificate revocation list and certificate revocation information related to the certification path, which are present in the storage means belonging to the predetermined certification path acquisition range each time a predetermined certification path acquisition timing arrives Means for obtaining from the storage means;
Means for storing, in a storage device, a certificate authority certificate constituting the acquired certificate path, a certificate revocation list and certificate revocation information related to the certificate authority certificate;
Means for generating a certification path management node for each obtained CA certificate;
In the generated certification path management node, the issuer and subject of the certification authority certificate, the storage address where the certification authority certificate, the certificate revocation list, and the certificate revocation information are stored, and the certification path Means for registering an address of another certification path management node in which a subsequent certificate with the subject of the certificate authority certificate at the head as an issuer is registered;
Means for generating a time-series management node for each certification path acquisition timing;
In the generated time-series management node, the address of the certification path management node corresponding to each certification path acquisition timing, in which the certification authority certificate at the head of each certification path is registered, and the certification path acquisition Means for registering the address of the time series management node corresponding to the next time of the time;
An information processing apparatus comprising: In the certification path management system according to claim 4,
Means for receiving a designated time, issuer information of a trust anchor, and issuer information of a verification target certificate from a user terminal;
Based on the received designated time, means for identifying a time series management node corresponding to the designated time,
Based on the information of the certification path management node registered in the specified time-series management node, the certificate having the certification path management node including the trust anchor issuer information and the issuer of the verification target certificate as the subject Means for identifying a path management node;
Provided by the certification authority certificate and the certificate revocation list issued by the issuer of the certification authority certificate or the certification authority from the storage destination address on the storage device indicated by each of the identified certification path management nodes Means for obtaining the certificate revocation information,
A user terminal in which a certificate to be verified is added to the acquired certificate authority certificate and the certificate revocation list issued by the certificate authority certificate issuer or the certificate revocation information provided by the certificate authority. Means for transmitting to,
An information processing apparatus comprising: The certification path management system according to claim 4 or 5,
The time-series management node and the certification path management node including the certification path received from the user terminal, the certificate revocation list and certification revocation information related to the certification path, search for the information processing apparatus. If not in range,
A certificate path, a certificate revocation list and a certificate associated with the certification path, are connected to the information processing apparatus via a network and execute the certification path management method in the same manner as the information processing apparatus. Means for sending an acquisition request with revocation information;
Means for receiving, from the other information processing apparatus, a certificate path, a certificate revocation list and certificate revocation information related to the certification path, in response to the acquisition request;
Means for transmitting the received certificate path, a certificate revocation list and certificate revocation information related to the certificate path, to a user terminal;
An information processing apparatus comprising:

Images