JP2007318622A - Device, system, method of authentication, program and integrated circuit - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To avoid an influence on the self-certificate authority even when the partner's certificate authority is attacked by issuing an certificate authority certificate for mutually certifying certificate authorities in the partner equipment and performing authentication by using it. <P>SOLUTION: This authentication device is constituted so that certificate authorities A, B of mutual partner equipment belong to lower rank of the self-certificate authority and issue certificates to the mutual partner certificate authorities. The authentication device has an authenticated certificate authority certificate storage part which mutually holds the certificates issued from the partner certificate authority to the self-certificate authority. In authentication, whether or not the partner certificate authority is approved by the self-certificate authority is verified by transmitting the certificate authority certificates to the partner. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a system for realizing public key cryptography.

  In recent years, opportunities to perform communication via a network between household appliances, mobile phones, and the like are increasing. For example, in an AV device, in order to protect the copyright of content, in order to prevent leakage of communication contents between devices, and in a mobile phone, after performing authentication key sharing, communication encrypted using a shared key May be performed. Here, “authentication key sharing” refers to mutual authentication between devices and the like as to whether a communication partner device is correctly created, and at the same time, the key is shared.

  In authentication key sharing, public key cryptography is used as a signature scheme and encryption scheme. Here, since anyone can create a private key / public key pair in public key cryptography, a certificate authority that is an authority that can trust the key pair must be certified to authenticate the device. Issue the public key certificate shown to the device. When sharing the authentication key, the certificate is verified to confirm that the device is authorized by the certificate authority. Non-Patent Document 1 describes an authentication key sharing method defined in a copyright protection standard called DTCP (Digital Transmission Content Protection), which is used when AV devices are connected by IEEE1394.

  When performing authentication key sharing, two devices A and B that perform authentication key sharing may have certificates issued by different certificate authorities A and B, respectively. In that case, since the mutual devices trust only their own certificate authorities, the certificates of the mutual devices cannot be verified.

  Therefore, in Patent Document 1, as shown in FIG. 14, a root certificate authority is installed above the certificate authority of each device, and a certificate authority certificate indicating that the certificate authorities are certified to certificate authorities A and B, respectively. Issue. By holding them in each device A and B and using them when sharing the authentication key, it is confirmed that each other's certificate authority is certified, and from that, indirectly from the certificate authority that you trust. Make sure the equipment is certified.

Further, in Patent Document 2, as shown in FIG. 15, in addition to the certificate authority, a reliable third-party organization that certifies the certificate authority is installed, and each certificate authority is recognized when sharing the authentication key of each device. Confirm by inquiring to a trusted third party.
JP-A-8-204699 JP 2001-298448 A DTCP Specification White Paper, [online], [April 6, 2006 search], Internet <URL: http: // www. dtcp. com / data / wp_spec. pdf> Tatsuaki Okamoto, Hiroshi Yamamoto, “Contemporary Cryptography”, Industrial Books (1997)

  However, in Patent Document 1, when the root certificate authority is attacked and the secret key is exposed, the certificates of both of the authentication systems by the two certificate authorities are forged by the attacker. Moreover, in patent document 2, there is a possibility that an incorrect certificate authority may be determined to be correct by attacking and impersonating a reliable third party.

  As described above, in both Patent Documents 1 and 2, there is a problem in that both authentication systems are collapsed by being attacked by a root certificate authority or a reliable third party.

  SUMMARY OF THE INVENTION The present invention solves the above-described problems, and an object of the present invention is to provide an authentication system that prevents both of the authentication systems from being affected even if the certificate authority is attacked.

  To achieve the above object, the invention according to claim 1 comprises a plurality of certificate authorities issuing certificates and a plurality of authentication devices holding the certificates, and authenticates each other between the plurality of authentication devices. An authentication device in an authentication system for storing a device certificate storage unit that stores a first device certificate issued from a first certificate authority that is one of the plurality of certificate authorities; and the first authentication A certificate authority certificate storage unit for storing a first certificate authority certificate issued from a second certificate authority different from the station and indicating that the first certificate authority is certified as the second certificate authority A certificate authority certificate verifying unit that verifies a second certificate authority certificate indicating that the second certificate authority is certified as the first certificate authority, and a second certificate transmitted from the authentication apparatus of the communication partner. And a device certificate verification unit for verifying the device certificate of No. 2. .

  The invention according to claim 2 is characterized in that the authentication device further includes a certificate attribute determination unit that determines a certificate authority that has issued the second device certificate, and the certified certificate verification unit includes the certificate attribute determination unit. When the second device certificate is determined to be issued from the second certificate authority, the second certificate authority certificate is verified.

  In the invention according to claim 3, the authentication apparatus further includes the authentication apparatus of the communication partner when the certificate attribute determination unit determines that the second device certificate is issued from the second certificate authority. And a certificate authority certificate transmitter for transmitting the first certificate authority certificate.

  In the invention according to claim 4, the authentication apparatus further includes the authentication apparatus of the communication partner when the certificate attribute determination unit determines that the second device certificate has been issued from the second certificate authority. A certificate authority certificate requesting unit for requesting the second certificate authority certificate.

  In the invention according to claim 5, the authentication apparatus further includes a certificate authority invalidation list storage unit that stores a certificate authority invalidation list that is invalidation information of a certificate authority issued from the first certificate authority, and the authentication A certificate authority invalidation determination unit that determines whether or not the second certificate authority is invalidated based on the certificate authority invalidation list stored in the station invalidation list storage unit. And

  The invention according to claim 6 is an authentication system comprising a plurality of certificate authorities issuing certificates and a plurality of authentication devices holding the certificates, and authenticating each other between the plurality of authentication devices, The authentication apparatus includes: a device certificate storage unit that stores a first device certificate issued from a first certificate authority that is one of the plurality of certificate authorities; and a second that is different from the first certificate authority. A certificate authority certificate storage unit that stores a first certificate authority certificate that is issued from the certificate authority and that indicates that the first certificate authority is certified as the second certificate authority; A certificate authority certificate verifying unit that verifies a second certificate authority certificate indicating that the certificate authority is certified as the first certificate authority, and a second device certificate transmitted from the authentication apparatus of the communication partner. A device certificate verification unit for verifying, wherein the first certificate authority is the first certificate authority certificate. A certificate authority certificate issuing unit for issuing the first certificate to the second certificate authority, and a device certificate issuing unit for issuing the first device certificate to the authentication device. A certificate authority certificate issuing unit that issues a second certificate authority certificate to the first certificate authority is provided.

  In the invention according to claim 7, the authentication apparatus further includes a certificate attribute determination unit that determines a certificate authority that has issued the second device certificate, and the certified certificate verification unit includes the certificate attribute determination unit. The second certificate authority certification certificate is verified only when it is determined that the second device certificate has been issued from the second certificate authority.

  In the invention according to claim 8, when the authentication device further determines in the certificate attribute determination unit that the second device certificate has been issued from the second certificate authority, the authentication device determines whether the second device certificate has been issued to the communication partner authentication device. A certificate authority certificate transmitter for transmitting the first certificate authority certificate is provided.

  In the invention according to claim 9, when the authentication device further determines in the certificate attribute determination unit that the second device certificate transmitted from the authentication device of the communication partner is issued from the second certificate authority. And a certificate authority certificate requesting unit for requesting the second certificate authority certificate from the authentication apparatus of the communication partner.

  The invention according to claim 10 is an authentication in an authentication device of an authentication system comprising a plurality of certificate authorities issuing certificates and a plurality of authentication devices holding the certificates, and authenticating each other between the plurality of authentication devices. A device certificate storing step of storing a first device certificate issued from a first certificate authority that is one of a plurality of certificate authorities, and a method different from the first certificate authority. A certificate authority certificate storage step for storing a first certificate authority certificate issued by the second certificate authority and indicating that the first certificate authority is certified as the second certificate authority; A certificate authority certificate verifying step for verifying a second certificate authority certificate indicating that the certificate authority is certified as the first certificate authority, and a second device certificate transmitted from the communication partner authentication device Including a device certificate verification step for verifying And butterflies.

  The invention according to claim 11 is implemented in an authentication device of an authentication system comprising a plurality of certificate authorities issuing certificates and a plurality of authentication devices holding the certificates, and authenticating each other between the plurality of authentication devices. A device certificate storing step of storing a first device certificate issued from a first certificate authority that is one of the plurality of certificate authorities, and the first certificate authority is different from the first certificate authority A certificate authority certificate storage step for storing a first certificate authority certificate issued by a second certificate authority and indicating that the first certificate authority is authorized by the second certificate authority; A certificate authority certificate verifying step for verifying a second certificate authority certificate indicating that the second certificate authority is certified as the first certificate authority; and a second device certificate transmitted from the authentication apparatus of the communication partner A device certificate verification step for verifying the certificate And wherein the door.

  The invention according to claim 12 is a medium in which the program according to claim 11 is recorded.

  The invention according to claim 13 is a collection of authentication devices in an authentication system comprising a plurality of certificate authorities issuing certificates and a plurality of authentication devices holding the certificates, and authenticating each other between the plurality of authentication devices. A device certificate storage unit that stores a first device certificate issued from a first certificate authority that is one of the plurality of certificate authorities, and is different from the first certificate authority. A certificate authority certificate storage unit that stores a first certificate authority certificate issued by the second certificate authority and indicating that the first certificate authority is certified as the second certificate authority; A certificate authority certificate verifying unit that verifies a second certificate authority certificate indicating that the certificate authority is certified as the first certificate authority, and a second device certificate transmitted from the communication partner authentication device And a device certificate verification unit for verifying the certificate.

  According to these configurations, by issuing a certificate authority certificate that mutually recognizes the certificate authority in the partner device and authenticating with it, even if the partner certificate authority is attacked, it affects the certificate authority itself. The value is great.

  Embodiments of the present invention will be described below with reference to the drawings.

(Embodiment 1)
An authentication system 1000 as one embodiment according to the present invention will be described. FIG. 1 is a diagram showing a configuration of an authentication system 1000 according to the first embodiment.

  The authentication system 1000 includes a certificate authority A1100, a certificate authority B1200, an authentication device A1300, and an authentication device B1400.

  The authentication system 1000 uses a public key cryptosystem. The public key cryptosystem is, for example, RSA cryptography or elliptic curve cryptography. The RSA encryption and the elliptic curve encryption are described on pages 110 to 113 and pages 120 to 121 of Non-Patent Document 2.

<Configuration of Certificate Authority A1100>
FIG. 2 is a diagram showing the configuration of the certificate authority A1100. The certificate authority A1100 stores a transmission / reception unit 1101 that receives and transmits data, a key generation unit 1102 that generates a key pair of the public key KPDA and the secret key KSDA of the authentication device A1300, and a secret key KSCA of the certificate authority A1100. The private key storage unit 1103, the public key storage unit 1104 that stores the public key KPCA of the certificate authority A 1100, the certificate issue unit 1105 that issues the device certificate CDA and the certificate authority certificate CCB, and the certificate authority of the certificate authority A 1100 A certificate authority certificate storage unit 1106 for storing the certificate CCA, a certificate revocation list storage unit 1107 for storing the certificate authority certificate revocation list, and a certificate revocation list for updating the certificate authority certificate revocation list And an update unit 1108.

  The transmission / reception unit 1101 transmits / receives data to / from the authentication device A1300 and the certificate authority B1200.

  The key generation unit 1102 generates the public key KPDA and the secret key KSDA of the authentication device A1300.

  The secret key storage unit 1103 stores the secret key KSCA of the certification authority A1100. It is assumed that the secret key KSCA is stored in advance.

  The public key storage unit 1104 stores the public key KPCA of the certificate authority A1100. The public key KSCA corresponds to the secret key KSCA and is stored in advance.

  The certificate issuing unit 1105 receives the device certificate CDA for the public key KPDA of the authentication device A 1300, the certificate authority certificate CCB for the public key KPCB of the certificate authority B 1200, and the secret key KSCA stored in the secret key storage unit 1103. Use to generate. Here, CDA is a concatenation of public key KPDA and signature data Sig (KSCA, KPDA), and CCB is a concatenation of public key KPCB and signature data Sig (KSCA, KPCB). Here, Sig (K, D) indicates the signature data of the data D using the secret key K. The signature scheme used is an RSA signature scheme or an elliptical DSA signature scheme. The RSA signature method and the elliptical DSA signature method are described in pages 175 to 176 and 182 to 183 of Non-Patent Document 2.

  The certificate authority certificate storage unit 1106 stores the certificate authority certificate CCA of the certificate authority A1100 received from the certificate authority B1200.

  The certificate revocation list storage unit 1107 stores a certificate authority certificate revocation list CRLA including a revoked certificate authority certificate in order to invalidate the certificate authority once recognized by the certificate authority A 1100. Initially, the CA certificate revocation list CRLA is empty data.

  The certificate revocation list update unit 1108 updates the CA certificate revocation list CRLA stored in the certificate revocation list storage unit 1107. Here, the certificate authority certificate revocation list CRLA is updated to include the certificate authority certificate CCB of the certificate authority B1200. If there are certificate authorities other than the certificate authorities A 1100 and B 1200 as certificate authorities, the certificate authority certificate revocation list CRLA may be updated to include certificate authority certificates of certificate authorities other than the certificate authority B 1200. Good.

<Configuration of Certificate Authority B1200>
FIG. 3 is a diagram showing the configuration of the certificate authority B1200. The certificate authority B1200 stores a transmission / reception unit 1201 that receives and transmits data, a key generation unit 1202 that generates a key pair of the public key KPDB and the secret key KSDB of the authentication device B1400, and a secret key KSCB of the certificate authority B1200. The private key storage unit 1203, the public key storage unit 1204 that stores the public key KPCB of the certificate authority B 1200, the certificate issue unit 1205 that issues the device certificate CDB and the certificate authority certificate CCA, and the certificate authority of the certificate authority B 1200 A certificate authority certificate storage unit 1206 for storing the certificate CCB, a certificate revocation list storage unit 1207 for storing the certificate authority certificate revocation list, and a certificate revocation list for updating the certificate authority certificate revocation list And an update unit 1208.

  The transmission / reception unit 1201 transmits / receives data to / from the authentication device B 1400 and the certificate authority A 1100.

  The key generation unit 1202 generates a public key KPDB and a secret key KSDB of the authentication device B 1400.

  The secret key storage unit 1203 stores the secret key KSCB of the certificate authority B1200. The secret key KSCB is assumed to be stored in advance.

  The public key storage unit 1204 stores the public key KPCB of the certificate authority B 1200. The public key KPCB corresponds to the secret key KSCB and is stored in advance.

  The certificate issuing unit 1205 receives the device certificate CDB for the public key KPDB of the authentication device B 1400, the certificate authority certificate CCA for the public key KPCA of the certificate authority A 1100, and the secret key KSCB stored in the secret key storage unit 1203. Use to generate. Here, CDB is a concatenation of public key KPDB and signature data Sig (KSCB, KPDB), and CCA is a concatenation of public key KPCA and signature data Sig (KSCB, KPCA).

  The certificate authority certificate storage unit 1206 stores the certificate authority certificate CCB of the certificate authority B 1200 received from the certificate authority A 1100.

  The certificate revocation list storage unit 1207 stores a certificate authority certificate revocation list CRLB including a revoked certificate authority certificate in order to invalidate the certificate authority once certified by the certificate authority B 1200. Initially, the CA certificate revocation list CRLB is empty data.

  The certificate revocation list update unit 1208 updates the CA certificate revocation list CRLB stored in the certificate revocation list storage unit 1207. Here, the certificate authority certificate revocation list CRLB is updated to include the certificate authority certificate CCA of the certificate authority A1100. When there are certificate authorities other than the certificate authorities A 1100 and B 1200 as certificate authorities, the certificate authority certificate revocation list CRLB may be updated to include certificate authority certificates of certificate authorities other than the certificate authority A 1100. Good.

<Configuration of Authentication Device A1300>
FIG. 4 is a diagram illustrating a configuration of the authentication device A1300. The authentication device A 1300 includes a transmission / reception unit 1301 that receives and transmits data, a key pair request information generation unit 1302 that generates key pair request information, and a secret key storage unit 1303 that stores the secret key KSDA of the authentication device A 1300. A device certificate storage unit 1304 for storing the device certificate CDA of the authentication device A 1300, a certificate authority certificate storage unit 1305 for storing the certificate authority certificate CCA of the certificate authority A 1100, and a device certificate CDB of the authentication device B 1400. A device certificate verification unit 1306 to verify, a certificate authority certificate verification unit 1307 to verify the certificate authority certificate CCB of the certificate authority B 1200, a challenge data generation unit 1308 to generate challenge data NA, and response data to the challenge data NB Response data generation unit 1309 for generating RA, and response data RB The response data verification unit 1310 to verify, the shared key generation unit 1311 that generates the shared key AK, the shared key storage unit 1312 that stores the shared key AK, and the public key KPDB included in the device certificate CDB. A public key encryption / encryption unit 1313 that encrypts and generates an encryption key EK, a certificate revocation list storage unit 1314 that stores a certificate authority certificate revocation list, and a certificate authority certificate revocation list. The revocation checking unit 1315 for checking the revocation status of the certificate authority B 1200 is provided.

  The transmission / reception unit 1301 transmits / receives data to / from the certificate authority A 1100 and the authentication device B 1400.

  The key pair request information generation unit 1302 generates key pair request information for requesting a key pair to the certificate authority A 1100.

  The secret key storage unit 1303 stores the secret key KSDA of the authentication device A1300.

  The device certificate storage unit 1304 stores the device certificate CDA of the authentication device A1300.

  The certificate authority certificate storage unit 1305 stores the certificate authority certificate CCA of the certificate authority A1100.

  The device certificate verification unit 1306 verifies the device certificate CDB of the authentication device B 1400 using the public key KPCB included in the certificate authority certificate CCB.

  The certificate authority certificate verification unit 1307 verifies the certificate authority certificate CCB of the certificate authority B 1200 using the public key KPCA included in the certificate authority certificate CCA stored in the certificate authority certificate storage unit 1305.

  The challenge data generation unit 1308 generates challenge data NA that is a random number.

  The response data generation unit 1309 generates response data RA for the challenge data NB received from the authentication device B 1400 using the secret key KSDA stored in the secret key storage unit 1303. Here, RA = Sig (KSDA, NB).

  The response data verification unit 1310 verifies the response data RB received from the authentication device B 1400 using the public key KPDA included in the device certificate CDA stored in the device certificate storage unit 1304.

  The shared key generation unit 1311 generates a shared key AK that is a random number.

  The shared key storage unit 1312 stores the shared key AK.

  The public key encryption / encryption unit 1313 encrypts the shared key AK using the public key KPDB included in the device certificate CDB, and generates an encryption key EK. Here, EK = PEnc (KPDB, AK). However, PEnc (KP, D) is encrypted data by public key encryption when the public key KP of data D is used. The public key encryption used here is, for example, RSA encryption or elliptic ElGamal encryption. The RSA cipher and the elliptic ElGamal cipher are described on pages 110 to 113 and pages 120 to 121 of Non-Patent Document 2.

  The certificate revocation list storage unit 1314 stores the certificate authority certificate revocation list CRLA received from the certificate authority A1100.

  The revocation checking unit 1315 checks whether the certificate authority certificate revocation list CRLA stored in the certificate revocation list storage unit 1314 includes the certificate authority certificate CCB of the certificate authority B 1200. When the certificate authority certificate CCB is included, it is determined that the certificate authority B1200 is invalid.

<Configuration of Authentication Device B1400>
FIG. 5 is a diagram showing the configuration of the authentication device B 1400. The authentication device B 1400 includes a transmission / reception unit 1401 that receives and transmits data, a key pair request information generation unit 1402 that generates key pair request information, and a secret key storage unit 1403 that stores the secret key KSDB of the authentication device B 1400. A device certificate storage unit 1404 for storing the device certificate CDB of the authentication device B1400, a certificate authority certificate storage unit 1405 for storing the certificate authority certificate CCB of the certificate authority B1200, and a device certificate CDA of the authentication device A1300. A device certificate verification unit 1406 to verify, a certificate authority certificate verification unit 1407 to verify the certificate authority certificate CCA of the certificate authority A 1100, a challenge data generation unit 1408 to generate challenge data NB, and response data to the challenge data NA Response data generation unit 1409 for generating RB, and response data RA Includes a response data verification unit 1410 for verifying a shared key storage unit 1411 for storing the shared key AK, encrypts the encrypted data EK, and a public key encryption unit 1412 for generating a shared key AK.

  The transmission / reception unit 1401 transmits / receives data to / from the certification authority B1200 and the authentication device A1300.

  The key pair request information generation unit 1402 generates key pair request information for requesting a key pair to the certificate authority B 1200.

  The secret key storage unit 1403 stores the secret key KSDB of the authentication device B 1400.

  The device certificate storage unit 1404 stores the device certificate CDB of the authentication device B 1400.

  The certificate authority certificate storage unit 1405 stores the certificate authority certificate CCB of the certificate authority B1200.

  The device certificate verification unit 1406 verifies the device certificate CDA of the authentication device A 1300 using the public key KPCA included in the certificate authority certificate CCA.

  The certificate authority certificate verification unit 1407 verifies the certificate authority certificate CCA of the certificate authority A 1100 using the public key KPCB included in the certificate authority certificate CCB stored in the certificate authority certificate storage unit 1405.

  The challenge data generation unit 1408 generates challenge data NB that is a random number.

  The response data generation unit 1409 generates response data RB for the challenge data NA received from the authentication device A 1300 using the secret key KSDB stored in the secret key storage unit 1403. Here, RB = Sig (KSDB, NA).

  The response data verification unit 1410 verifies the response data RA received from the authentication device A 1300 using the public key KPDB included in the device certificate CDB stored in the device certificate storage unit 1404.

  The shared key storage unit 1411 stores the shared key AK.

  The public key encryption / decryption unit 1412 encrypts the encryption key EK using the secret key KSDB stored in the secret key storage unit 1403, and generates a shared key AK.

  The certificate revocation list storage unit 1413 stores the certificate authority certificate revocation list CRLB received from the certificate authority B1200.

  The revocation checking unit 1414 checks whether the CA certificate revocation list CRLB stored in the certificate revocation list storage unit 1413 includes the CA certificate CCA of the CA A1100. When the certificate authority certificate CCA is included, it is determined that the certificate authority A1100 is invalid.

<Operation of Authentication System 1000>
The operation of the authentication system 1000 is “at the time of issuing a certificate authority certificate” for issuing a certificate authority certificate between the certificate authority A1100 and the certificate authority B1200, and issues a device certificate CDA from the certificate authority A1100 to the authentication device A1300. “At the time of issuing the device certificate CDA”, “At the time of issuing the device certificate CDB” for issuing the device certificate CDB from the certificate authority B 1200 to the authentication device B 1400, and updating the certificate authority certificate revocation list CRLA at the certificate authority A 1100 The certificate authority certificate revocation list CRLA is updated when the certificate authority certificate revocation list CRLA is updated, and the certificate authority certificate revocation list CRLB is updated at the certificate authority B 1200 and transmitted to the authentication apparatus B 1400. "When updating list CRLB" and "When sharing authentication key" between the authentication device A 1300 and the authentication device B 1400 Consisting of operations. FIG. 6 is a flowchart of “when issuing a certificate authority certificate”, FIG. 7 is a flowchart of “when issuing a device certificate CDA”, FIG. 8 is a flowchart of “when issuing a device certificate CDB”, and “CA certificate certificate revocation list” FIG. 9 is a flowchart of “when updating CRLA”, FIG. 10 is a flowchart of “when updating certificate authority certificate revocation list CRLB”, and FIGS. 11 and 12 are flowcharts of “when sharing authentication key”.

At the time of issuing the certificate authority certificate The certificate authorities A1100 and B1200 issue a certificate authority certificate that mutually recognizes the other certificate authority. The operation is shown below.

  Step S101: The transmission / reception unit 1101 of the certification authority A1100 transmits the public key KPCA stored in the public key storage unit 1104 to the certification authority B1200.

  Step S102: The transmission / reception unit 1201 of the certification authority B1200 receives the public key KPCA from the certification authority A1100.

  Step S103: The certificate issuing unit 1105 of the certificate authority B 1200 generates a certificate authority certificate CCA from the public key KPCA.

  Step S104: The transmission / reception unit 1201 of the certification authority B1200 transmits the certification authority certificate CCA and the public key KPCB stored in the public key storage unit 1204 to the certification authority A1100.

  Step S105: The transmission / reception unit 1101 of the certificate authority A1100 receives the certificate authority certificate CCA and the public key KPCB from the certificate authority B1200.

  Step S106: The certificate authority certificate storage unit 1106 of the certificate authority A1100 stores the certificate authority certificate CCA.

  Step S107: The certificate issuing unit 1205 of the certificate authority A 1100 generates a certificate authority certificate CCB from the public key KPCB.

  Step S108: The transmission / reception unit 1101 of the certificate authority A1100 transmits the certificate authority certificate CCB to the certificate authority B1200.

  Step S109: The transmission / reception unit 1201 of the certification authority B1200 receives the certification authority certificate CCB from the certification authority A1100.

  Step 110: The certificate authority certificate storage unit 1206 of the certificate authority B 1200 stores the certificate authority certificate CCB. End.

When issuing a device certificate CDA The certificate authority A 1100 issues a secret key and a certificate to the authentication device A 1300. The operation is shown below.

  Step S151: The key pair request information generating unit 1302 of the authentication device A 1300 generates key pair request information.

  Step S152: The transmission / reception unit 1301 of the authentication device A1300 transmits the key pair request information to the certificate authority A1100.

  Step S153: The transmission / reception unit 1101 of the certificate authority A1100 receives the key pair request information from the authentication device A1300.

  Step S154: The key generation unit 1102 of the certificate authority A 1100 generates a public key KPDA and a secret key KSDA.

  Step S155: The certificate issuing unit 1105 of the certificate authority A 1100 generates a device certificate CDA for the public key KPDA.

  Step S156: The transmitting / receiving unit 1101 of the certificate authority A 1100, the secret key KSDA, the device certificate CDA, the certificate authority certificate CCA stored in the certificate authority certificate storage unit 1106, and the certificate revocation list storage unit 1107 The certificate authority certificate revocation list CRLA stored in the authentication device A1300 is transmitted to the authentication device A1300.

  Step S157: The transmission / reception unit 1301 of the authentication apparatus A1300 receives the secret key KSDA, the device certificate CDA, the certificate authority certificate CCA, and the certificate authority certificate revocation list CRLA from the certificate authority A1100.

  Step S158: The secret key storage unit 1303 of the authentication device A 1300 stores the secret key KSDA.

  Step S159: The device certificate storage unit 1304 of the authentication device A 1300 stores the device certificate CDA.

  Step S160: The certificate authority certificate storage unit 1305 of the authentication apparatus A 1300 stores the certificate authority certificate CCA.

  Step S161: The certificate revocation list storage unit 1314 of the authentication device A 1300 stores the certificate authority certificate revocation list CRLA. End.

When issuing a device certificate CDB The certification authority B1200 issues a secret key and a certificate to the authentication device B1400. The operation is shown below.

  Step S201: The key pair request information generating unit 1402 of the authentication device B 1400 generates key pair request information.

  Step S202: The transmission / reception unit 1401 of the authentication device B1400 transmits key pair request information to the certificate authority B1200.

  Step S203: The transmission / reception unit 1201 of the certificate authority B1200 receives the key pair request information from the authentication device B1400.

  Step S204: The key generation unit 1202 of the certificate authority B 1200 generates a public key KPDB and a secret key KSDB.

  Step S205: The certificate issuing unit 1205 of the certificate authority B 1200 generates a device certificate CDB for the public key KPDB.

  Step S206: The transmission / reception unit 1201 of the certificate authority B 1200 includes the secret key KSDB, the device certificate CDB, the certificate authority certificate CCB stored in the certificate authority certificate storage unit 1206, and the certificate revocation list storage unit 1207. The certificate authority certificate revocation list CRLB stored in the authentication device B1400 is transmitted to the authentication device B1400.

  Step S207: The transmission / reception unit 1401 of the authentication apparatus B 1400 receives the secret key KSDB, the device certificate CDB, the certificate authority certificate CCB, and the certificate authority certificate revocation list CRLB from the certificate authority B1200.

  Step S208: The secret key storage unit 1403 of the authentication device B 1400 stores the secret key KSDB.

  Step S209: The device certificate storage unit 1404 of the authentication device B 1400 stores the device certificate CDB.

  Step S210: The certificate authority certificate storage unit 1405 of the authentication apparatus B 1400 stores the certificate authority certificate CCB.

  Step S211: The certificate revocation list storage unit 1413 of the authentication device B 1400 stores the certificate authority certificate revocation list CRLB. End.

When the CA certificate revocation list CRLA is updated When the certificate authority B1200 is attacked and it is found that the security has been lowered, the certificate authority certificate of the certificate authority B1200 certified by the certificate authority A1100 is invalidated. There is a case. The operation in that case is shown below.

  Step S251: The certificate revocation list update unit 1108 of the certificate authority A 1100 updates the certificate authority certificate revocation list CRLA stored in the certificate revocation list storage unit 1107.

  Step S252: The transmission / reception unit 1101 of the certificate authority A1100 transmits the updated certificate authority certificate revocation list CRLA to the authentication apparatus A1300.

  Step S253: The transmission / reception unit 1301 of the authentication device A1300 receives the certificate authority certificate revocation list CRLA from the certificate authority A1100.

  Step S254: The certificate revocation list storage unit 1314 of the authentication device A 1300 stores the certificate authority certificate revocation list CRLA. End.

● When the CA certificate revocation list CRLB is updated When it is determined that the CA has been attacked and the security has been lowered, the CA certificate of the CA A1100 certified by the CA B1200 is invalidated. There is a case. The operation in that case is shown below.

  Step S301: The certificate revocation list update unit 1208 of the certificate authority B 1200 updates the certificate authority certificate revocation list CRLB stored in the certificate revocation list storage unit 1207.

  Step S302: The transmission / reception unit 1201 of the certificate authority B 1200 transmits the updated certificate authority certificate revocation list CRLB to the authentication apparatus B 1400.

  Step S303: The transmission / reception unit 1401 of the authentication device B 1400 receives the certificate authority certificate revocation list CRLB from the certificate authority B 1200.

  Step S304: The certificate revocation list storage unit 1413 of the authentication device B 1400 stores the certificate authority certificate revocation list CRLB. End.

Authentication Key Sharing Authentication devices A 1300 and B 1400 perform mutual authentication and key sharing (shared key delivery). The operation is shown below.

  Step S351: The transmission / reception unit 1301 of the authentication device A 1300 transmits the device certificate CDA and the certificate authority certificate CCA to the authentication device B 1400.

  Step S352: The transmission / reception unit 1402 of the authentication device B 1400 receives the device certificate CDA and the certificate authority certificate CCA from the authentication device A 1300.

  Step S353: The invalidation confirmation unit 1414 of the authentication device B 1400 determines whether or not the certification authority A 1100 is invalid. If not invalid, go to the next step. If invalid, the process is terminated.

  Step S354: The certificate authority certificate verifying unit 1407 of the authentication apparatus B 1400 verifies the certificate authority certificate CCA. If the certificate authority certificate CCA is correct, go to the next step. If it is not correct, the process is terminated.

  Step S355: The device certificate verification unit 1406 of the authentication device B 1400 verifies the device certificate CDA. If the device certificate CDA is correct, go to the next step. If it is not correct, the process is terminated.

  Step S356: The challenge data generation unit 1408 of the authentication device B 1400 generates challenge data NB.

  Step S357: The transmission / reception unit 1401 of the authentication device B 1400 transmits the device certificate CDB, the certificate authority certificate CCB, and the challenge data NB to the authentication device A 1300.

  Step S358: The transmission / reception unit 1301 of the authentication device A 1300 receives the device certificate CDB, the certificate authority certificate CCB, and the challenge data NB from the authentication device B 1400.

  Step S359: The invalidation confirmation unit 1315 of the authentication device A1300 determines whether or not the certification authority B1200 is invalid. If not invalid, go to the next step. If invalid, the process is terminated.

  Step S360: The certificate authority certificate verifying unit 1307 of the authentication apparatus A 1300 verifies the certificate authority certificate CCB. If the certificate authority certificate CCB is correct, go to the next step. If it is not correct, the process is terminated.

  Step S361: The device certificate verification unit 1306 of the authentication device A 1300 verifies the device certificate CDB. If the device certificate CDB is correct, go to the next step. If it is not correct, the process is terminated.

  Step S362: The response data generation unit 1309 of the authentication device A 1300 generates response data RA.

  Step S363: The challenge data generation unit 1308 of the authentication device A 1300 generates challenge data NA.

  Step S364: The transmission / reception unit 1301 of the authentication device A 1300 transmits the response data RA and the challenge data NA to the authentication device B 1400.

  Step S365: The transmission / reception unit 1401 of the authentication device B 1400 receives the response data RA and the challenge data NA from the authentication device A 1300.

  Step S366: The response data verification unit 1410 of the authentication device B 1400 verifies the response data RA. If the response data RA is correct, go to the next step. If it is not correct, the process is terminated.

  Step S367: The response data generation unit 1409 of the authentication device B 1400 generates response data RB.

  Step S368: The transmission / reception unit 1401 of the authentication device B 1400 transmits the response data RB to the authentication device A 1300.

  Step S369: The transmission / reception unit 1301 of the authentication device A 1300 receives the response data RB.

  Step S370: The response data verification unit 1310 of the authentication device A 1300 verifies the response data RB. If the response data RB is correct, go to the next step. If it is not correct, the process is terminated.

  Step S371: The shared key generation unit 1311 of the authentication device A1300 generates a shared key AK and stores it in the shared key storage unit 1312.

  Step S372: The public key encryption / encryption unit 1313 of the authentication device A1300 generates an encryption key EK from the shared key AK.

  Step S373: The transmission / reception unit 1301 of the authentication device A1300 transmits the encryption key EK to the authentication device B1400.

  Step S374: The transmission / reception unit 1401 of the authentication device B 1400 receives the encryption key EK from the authentication device A 1300.

  Step S375: The public key encryption / decryption unit 1412 of the authentication apparatus B 1400 generates a shared key AK from the encryption key EK and stores it in the shared key storage unit 1411. End.

<Effect of Embodiment 1>
In the first embodiment, as shown in FIG. 12, each of the certificate authorities A and B regards the other certificate authority as a lower level and issues a certificate to certify the certificate authority. Here, if the safety of the certificate authority B is lowered, the certificate authority certificate CCB is included in the certificate revocation list held by the authentication apparatus A, so that the certificate authority B has a device certificate issued. It is possible to eliminate the authentication device. Further, when the safety of the certification authority A is lowered, the certification apparatus having a device certificate issued by the certification authority A is included by including the certification authority certificate CCA in the certificate revocation list held by the certification apparatus B. Can be eliminated. As described above, even if any certificate authority is attacked and the security is lowered, it is possible to prevent the other certificate authorities from being affected by the invalidation.

(Modification)
The embodiment described above is an example of the implementation of the present invention, and the present invention is not limited to this embodiment, and can be implemented in various modes without departing from the scope of the present invention. is there. For example, the present invention includes the following cases.

  (1) In the certificate authorities A1100 and B1200, the certificate authority's own private key and public key pair are given in advance. However, the certificate authority itself may generate this key pair.

  (2) Although the signature data of the public key is used as the certificate, the target data of the signature data may include not only the public key but also the owner information of the public key such as the ID of the public key. In this case, the owner information of the public key is included in the certificate.

  (3) The certificate authority certificate revocation list may be signed by the certificate authority that issues it. In that case, the signature of the CA certificate revocation list may be verified when the CA certificate revocation list is issued or when the authentication key is shared.

  (4) The certificate authority certificate revocation list may include not the certificate authority certificate to be invalidated but the ID and public key of the certificate authority to be invalidated.

  (5) In the initial stage of the certificate authority certificate revocation list, empty data is used. However, this may be information indicating empty data. Further, it includes information indicating the number of certificate authorities to be invalidated, and this may be 0 at the initial stage.

  (6) The device certificate may include information on the certificate authority that issued it. At this time, the signature target data of the signature data which is the device certificate includes not only the public key of the authentication apparatus but also the information of the certificate authority. Further, the data to be signed may include not only the public key and certificate authority information but also the information of the authentication device that is the owner of the public key.

  (7) When the data to be signed in the device certificate includes information on the certificate authority, the certificate authority that issued the device certificate of the other authentication device is determined by checking the device certificate when sharing the authentication key. The authentication apparatus may include a certificate attribute determination unit. Therefore, the certificate authority certificate may be verified only when the issued certificate authority is different from the certificate authority that issued the device certificate of its own authentication device.

  (8) At the time of authentication key sharing, a shared key is generated by generating a shared key from the authentication device A 1300 to the authentication device B 1400, and transmitting the encrypted key, and this is performed by the authentication device B 1400. A shared key may be generated. Further, instead of distributing the shared key, the authentication devices A 1300 and B 1400 may each generate data, such as DH key sharing or elliptical DH key sharing, and both may generate a shared key. DH key sharing and elliptical DH key sharing are described on pages 200 to 202 of Non-Patent Document 2.

  (9) There may be three or more certificate authorities and authentication devices, such as three, not two each. In that case, there may be more than one certificate authority certificate issued by the certificate authority and held by the authentication device.

  (10) Each of the above devices is specifically a computer system including a microprocessor, ROM, RAM, a hard disk unit, a display unit, a keyboard, a mouse, and the like. A computer program is stored in the RAM or hard disk unit. Each device achieves its functions by the microprocessor operating according to the computer program. Here, the computer program is configured by combining a plurality of instruction codes indicating instructions for the computer in order to achieve a predetermined function.

  (11) A part or all of the components constituting each of the above devices may be configured by one system LSI (Large Scale Integration). The system LSI is a super multifunctional LSI manufactured by integrating a plurality of components on one chip, and specifically, a computer system including a microprocessor, a ROM, a RAM, and the like. . A computer program is stored in the RAM. The system LSI achieves its functions by the microprocessor operating according to the computer program.

  (12) A part or all of the components constituting each of the above devices may be configured as an IC card that can be attached to and detached from each device or a single module. The IC card or the module is a computer system including a microprocessor, a ROM, a RAM, and the like. The IC card or the module may include the super multifunctional LSI described above. The IC card or the module achieves its function by the microprocessor operating according to the computer program. This IC card or this module may have tamper resistance.

  (13) The present invention may be the method described above. Further, the present invention may be a computer program that realizes these methods by a computer, or may be a digital signal composed of the computer program.

  (14) Further, the present invention provides a recording medium capable of reading the computer program or the digital signal, such as a flexible disk, a hard disk, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a BD (Blu). -Ray Disc), or recorded in a semiconductor memory or the like. Further, the digital signal may be recorded on these recording media.

  (15) In the present invention, the computer program or the digital signal may be transmitted via an electric communication line, a wireless or wired communication line, a network represented by the Internet, a data broadcast, or the like.

  (16) The present invention may be a computer system including a microprocessor and a memory, wherein the memory stores the computer program, and the microprocessor operates according to the computer program. .

  (17) Another computer system that is independent by recording and transferring the program or the digital signal on the recording medium or by transferring the program or the digital signal via the network or the like. May be implemented.

  (18) The above embodiment and the above modifications may be combined.

  According to these configurations, by issuing a certificate authority certificate that mutually recognizes the certificate authority in the partner device and authenticating using it, even if the partner certificate authority is attacked, it affects the certificate authority itself. Can not be.

The block diagram which shows the structure of the authentication system 1000 as one embodiment which concerns on this invention The figure which shows the structure of certification authority A1100 The figure which shows the structure of certificate authority B1200 The figure which shows the structure of authentication apparatus A1300. The figure which shows the structure of authentication apparatus B1400 Flowchart showing operation of “certificate authority certificate issuance” of authentication system 1000 Flowchart showing operation of “system certificate CDA issuance” of authentication system 1000 Flowchart showing operation of “system certificate CDB issuance” of authentication system 1000 Flowchart showing the operation of the “certification authority certificate revocation list CRLA update” of the authentication system 1000 The flowchart showing the operation of the “certification authority certificate revocation list CRLB update” of the authentication system 1000 Flowchart showing the first half of the operation of “authentication key sharing” of authentication system 1000 A flowchart showing the latter half of the operation of “authentication key sharing” of authentication system 1000 The figure which shows the outline | summary of the certificate issuance of the authentication system 1000 The figure which shows the outline | summary of the certificate issuance of patent document 1 The figure which shows the outline | summary of the certificate issue of patent document 2

Explanation of symbols

1000 Authentication System 1100 Certificate Authority A
1101, 1201, 1301, 1401 Transmission / reception unit 1102, 1202 Key generation unit 1103, 1203, 1303, 1403 Private key storage unit 1104, 1204 Public key storage unit 1105, 1205 Certificate issue unit 1106, 1206, 1305, 1405 Certificate authority certificate Certificate storage unit 1107, 1207, 1314, 1413 Certificate revocation list storage unit 1108, 1208 Certificate revocation list update unit 1200 Certificate authority B
1300 Authentication device A
1302, 1402 Key pair request information generation unit 1304, 1404 Device certificate storage unit 1306 Device certificate verification unit 1307, 1407 Certification authority certificate verification unit 1308, 1408 Challenge data generation unit 1309, 1409 Response data generation unit 1310, 1410 Response Data verification unit 1311 Shared key generation unit 1312, 1411 Shared key storage unit 1313, 1412 Public key encryption / encryption unit 1315, 1414 Invalidation confirmation unit 1400 Authentication device B
1406 Device certificate verification unit

Claims (13)

An authentication device in an authentication system that includes a plurality of certificate authorities that issue certificates and a plurality of authentication devices that hold the certificates, and that authenticates each other between the plurality of authentication devices,
A device certificate storage unit that stores a first device certificate issued from a first certificate authority that is one of the plurality of certificate authorities;
An authentication storing a first certificate authority certificate issued from a second certificate authority different from the first certificate authority and indicating that the first certificate authority is certified as the second certificate authority Authority certificate storage,
A certificate authority certificate verifying unit that verifies a second certificate authority certificate indicating that the second certificate authority is certified as the first certificate authority;
An authentication device comprising: a device certificate verification unit that verifies a second device certificate transmitted from an authentication device of a communication partner. The authentication apparatus further includes a certificate attribute determination unit that determines a certificate authority that has issued the second device certificate.
The certification certificate verification unit verifies the second certification authority certification certificate when the certificate attribute judgment unit determines that the second device certificate has been issued by the second certification authority. The authentication device according to claim 1, wherein: When the certificate attribute determination unit determines that the second device certificate has been issued from the second certificate authority, the authentication apparatus further transmits the first certificate authority to the communication partner authentication apparatus. The authentication apparatus according to claim 1, further comprising: a certificate authority certificate transmission unit that transmits a certificate. When the certificate attribute determination unit determines that the second device certificate has been issued from the second certificate authority, the authentication apparatus further sends the second certificate authority to the communication partner authentication apparatus. The authentication apparatus according to any one of claims 1 to 3, further comprising a certificate authority certificate request unit that requests a certificate. The authentication apparatus further includes a certificate authority invalidation list storage unit that stores a certificate authority invalidation list that is certificate authority invalidation information issued by the first certificate authority,
A certification authority invalidation determination unit that determines whether or not the second certification authority is invalidated based on the certification authority invalidation list stored in the certification authority invalidation list storage unit. The authentication device according to any one of claims 1 to 4, wherein An authentication system that includes a plurality of certificate authorities that issue certificates and a plurality of authentication devices that hold the certificates, and that authenticates each other between the plurality of authentication devices,
The authentication device
A device certificate storage unit that stores a first device certificate issued from a first certificate authority that is one of the plurality of certificate authorities;
An authentication storing a first certificate authority certificate issued from a second certificate authority different from the first certificate authority and indicating that the first certificate authority is certified as the second certificate authority Authority certificate storage,
A certificate authority certificate verifying unit that verifies a second certificate authority certificate indicating that the second certificate authority is certified as the first certificate authority;
A device certificate verification unit that verifies the second device certificate transmitted from the authentication device of the communication partner,
The first certificate authority is:
A certificate authority certificate issuing unit that issues the first certificate authority certificate to the second certificate authority;
A device certificate issuing unit that issues the first device certificate to the authentication device;
The second certificate authority is:
An authentication system comprising: a certificate authority certificate issuing unit that issues the second certificate authority certificate to the first certificate authority. The authentication apparatus further includes a certificate attribute determination unit that determines a certificate authority that has issued the second device certificate.
The certification certificate verification unit obtains the second certification authority certification certificate only when the certificate attribute judgment unit determines that the second device certificate is issued from the second certification authority. It verifies. The authentication system of Claim 6 characterized by the above-mentioned. When the certificate attribute determination unit determines that the second device certificate has been issued from the second certificate authority, the authentication apparatus further transmits the first certificate authority certificate to the communication partner authentication apparatus. The authentication system according to claim 6 or 7, further comprising a certificate authority certificate transmitter that transmits a certificate. The authentication apparatus further determines, when the certificate attribute determination unit determines that the second device certificate transmitted from the communication partner authentication apparatus is issued from the second certificate authority, the communication partner authentication apparatus. The authentication system according to claim 6, further comprising: a certificate authority certificate requesting unit that requests the second certificate authority certificate. An authentication method in an authentication apparatus of an authentication system comprising a plurality of certificate authorities issuing certificates and a plurality of authentication apparatuses holding the certificates, and authenticating each other between the plurality of authentication apparatuses,
A device certificate storage step of storing a first device certificate issued from a first certificate authority that is one of the plurality of certificate authorities;
An authentication storing a first certificate authority certificate issued from a second certificate authority different from the first certificate authority and indicating that the first certificate authority is certified as the second certificate authority A station certificate storage step;
A certificate authority certificate verification step of verifying a second certificate authority certificate indicating that the second certificate authority is authorized by the first certificate authority;
And a device certificate verification step for verifying the second device certificate transmitted from the authentication device of the communication partner. A program that includes a plurality of certificate authorities that issue certificates and a plurality of authentication devices that hold the certificates, and that is executed by an authentication device of an authentication system that authenticates each other between the plurality of authentication devices,
A device certificate storage step of storing a first device certificate issued from a first certificate authority that is one of the plurality of certificate authorities;
An authentication storing a first certificate authority certificate issued from a second certificate authority different from the first certificate authority and indicating that the first certificate authority is certified as the second certificate authority A station certificate storage step;
A certificate authority certificate verification step of verifying a second certificate authority certificate indicating that the second certificate authority is authorized by the first certificate authority;
And a device certificate verification step for verifying the second device certificate transmitted from the authentication device of the communication partner. A medium on which the program according to claim 11 is recorded. An authentication device integrated circuit in an authentication system comprising a plurality of certificate authorities issuing certificates and a plurality of authentication devices holding the certificates, and authenticating each other between the plurality of authentication devices,
A device certificate storage unit that stores a first device certificate issued from a first certificate authority that is one of the plurality of certificate authorities;
An authentication storing a first certificate authority certificate issued from a second certificate authority different from the first certificate authority and indicating that the first certificate authority is certified as the second certificate authority Authority certificate storage,
A certificate authority certificate verifying unit that verifies a second certificate authority certificate indicating that the second certificate authority is certified as the first certificate authority;
An integrated circuit comprising: a device certificate verification unit that verifies a second device certificate transmitted from an authentication apparatus of a communication partner.

Images