JP2008278086A - Data processing system and method for generating electronic certificate - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a data processing system for setting an electronic certificate in a reader/writer. <P>SOLUTION: This data processing system 1 is provided with a reader/writer 20; a data processor 10; and an IC card 30 for electronic certificate generation for generating electronic certificates 28a to 28c. This reader/writer 20 generates a pair of public key and a secret key, and transmits the public key to the IC card 30. The IC card 30 encrypts the public key received from the reader/writer 20 by a secret key owned by the IC card 30, and generates electronic certificates 28a to 28c including the encrypted information of the public key, and transmits the electronic certificates 28a to 28c to the reader/writer 20. The reader/writer 20 receives the electronic certificate 28 to be transmitted form the IC card 30, and stores the received electronic certificates 28a to 28c. The reader/writer 20 transmits the electronic certificates 28a to 28c to the data processor 10 for authentication in the case of communicating with the data processor 10. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a data processing system including a reader / writer, and more particularly to a reader / writer authentication technique.

  2. Description of the Related Art Conventionally, data processing systems such as an electronic money system that read information on a user's card by a reader / writer and send the read information to a higher-level data processing apparatus are known. In such a data processing system, it is desirable to perform authentication between the reader / writer and the data processing apparatus. In particular, when applied to a payment system such as an electronic money system, it is necessary to strengthen security by performing authentication between the reader / writer and the data processing device.

Currently, a digital certificate using a public key is known as a technique for performing mutual authentication and identity verification between terminals. For example, in the communication system described in Patent Document 1, the print server has an electronic certificate. When the client PC requests printing from the print server, the client PC receives an electronic certificate from the print server and performs processing for confirming the identity of the print server.
JP 2007-13597 A

  In Patent Document 1 described above, the print server is connected to the LAN, and the electronic certificate in the print server is managed by a management PC on the LAN. As a result, the management PC can store the electronic certificate in the print server or update the electronic certificate before the expiration date of the electronic certificate expires.

  However, in a data processing system in which a reader / writer and a data processing apparatus are connected, in most cases, a management PC is not connected to the reader / writer, and an electronic certificate cannot be set in the reader / writer. Although it is possible to set an electronic certificate at the time of shipment of the reader / writer, it is not possible to cope with the expiration of the electronic certificate. At present, there is no known data processing system that can perform reader / writer authentication.

  In view of the above background, an object of the present invention is to provide a data processing system that can set an electronic certificate in a reader / writer in a data processing system including a reader / writer and a data processing device.

  The data processing system of the present invention includes a reader / writer including a key generation unit that generates a public key / private key pair, and a public key transmission unit that transmits the public key to a card for generating an electronic certificate, and the reader / writer An electronic signature generation unit that generates an electronic signature by encrypting the public key received from the private key of the electronic key, an electronic certificate generation unit that generates an electronic certificate including the electronic signature, and the electronic certificate A data processing system comprising: the card having a sending unit to be sent to a writer; and a data processing device connected to the reader / writer, wherein the reader / writer receives the electronic certificate from the card A receiving unit; an electronic certificate storage unit that stores the electronic certificate; and a sending unit that sends the electronic certificate when communicating with the data processing apparatus. Has the configuration and the reader-writer by the electronic certificate authentication section provided in the device to authenticate the electronic certificate and the data processing apparatus performs communication.

  With this configuration, the electronic certificate generation card encrypts the reader / writer's public key to generate the electronic certificate, so that the electronic certificate signed by the card can be stored in the reader / writer.

  The data processing system of the present invention has a configuration in which the reader / writer generates a public / private key pair within a predetermined period before the expiration date of the electronic certificate stored in the reader / writer.

  With this configuration, a new electronic certificate can be generated before the validity period of the electronic certificate expires, and communication between the reader / writer and the data processing apparatus can be performed without any trouble.

  The data processing system according to the present invention has a configuration in which the reader / writer generates a public key / private key pair when an electronic certificate stored in the reader / writer has expired.

  With this configuration, a new electronic certificate can be generated even when the validity period of the electronic certificate has expired. Note that even if a configuration is adopted in which the electronic certificate is renewed before the electronic certificate expires, if the electronic certificate generation card does not access the reader / writer before the expiration date expires, a new electronic certificate can be obtained. Since the document is not generated, the configuration of the present invention is effective.

  In the data processing system of the present invention, when the reader / writer is newly connected to the network to which the data processing apparatus is connected, the key generation unit of the reader / writer newly connected has a public key and a secret key. It has the structure which produces | generates a pair.

  With this configuration, the electronic certificate can be stored when the reader / writer is used without storing the electronic certificate in the reader / writer in advance.

  In the data processing system of the present invention, the card includes an application storage unit that stores an application that uses the electronic certificate.

  With this configuration, the electronic certificate can be automatically saved when trying to execute another application using the card.

  In the data processing system of the present invention, the data processing device includes a data processing device encryption unit that encrypts data using a public key included in the electronic certificate, and the data processing device encryption unit encrypts the data. And a transmitter for sending the converted data to the reader / writer.

  With this configuration, it is possible to realize secure communication between the reader / writer and the data processing device.

  The reader / writer of the present invention includes a key generation unit that generates a pair of a public key and a private key, a public key transmission unit that sends a public key to the card when an electronic certificate generation card is detected, and the electronic A configuration comprising an electronic certificate receiving unit that receives an electronic certificate including an electronic signature obtained by encrypting the public key, and an electronic certificate storage unit that stores the electronic certificate, sent from a certificate generation card Have

  With this configuration, as with the data processing system of the present invention, it is possible to store an electronic certificate generated by a card for generating an electronic certificate. Various configurations of the data processing system of the present invention can also be applied to the reader / writer of the present invention.

  The electronic certificate generating card of the present invention is a card for reading the reader / writer and generating the electronic certificate of the reader / writer, and receiving a public key of the reader / writer from the reader / writer A receiving unit; an electronic certificate generating unit configured to generate an electronic signature by encrypting the public key with a private key of the card; and generating an electronic certificate including the electronic signature; and And an electronic certificate sending unit to be sent to the writer.

  With this configuration, similarly to the data processing system of the present invention, the electronic certificate generation card generates an electronic certificate by encrypting the public key of the reader / writer, so that the electronic certificate signed by the card is generated. be able to. The card may have a function of executing an application other than the electronic certificate generation.

  An electronic certificate generation method according to the present invention includes a reader / writer, a data processing device connected to the reader / writer, and a card for generating an electronic certificate of the reader / writer, the reader / writer Generating a public key / private key pair, sending a public key from the reader / writer to the card, and the card encrypting the public key received from the reader / writer with the private key of the card Generating an electronic signature, generating an electronic certificate including the electronic signature, sending the electronic certificate to the reader / writer, and receiving and storing the electronic certificate sent from the card by the reader / writer A step in which the reader / writer sends the electronic certificate to the data processing device; and And it has a configuration in which the step of authenticating the writing.

  With this configuration, as in the data processing system of the present invention, the electronic certificate generation card encrypts the public key of the reader / writer to generate an electronic certificate, so that the electronic certificate signed by the card is read by the reader / writer. Can be saved. Various configurations of the data processing system of the present invention can be applied to the electronic certificate generation method of the present invention.

  The program of the present invention is a program installed in a reader / writer that communicates with a card for generating an electronic certificate, and generates a public / private key pair in the reader / writer, and detects the card Sending the public key from the reader / writer to the card, receiving an electronic certificate including an electronic signature obtained by encrypting the public key, and storing the electronic certificate in a storage unit. And a step of communicating with the data processing device using the electronic certificate.

  With this configuration, as with the data processing system of the present invention, it is possible to store an electronic certificate generated by a card for generating an electronic certificate. Note that various configurations of the data processing system of the present invention can be applied to the program of the present invention.

  A program according to another aspect of the present invention is a program installed in a card for generating an electronic certificate that communicates with a reader / writer, and the public key created by the reader / writer on the card from the reader / writer. , Encrypting the public key with a private key of the card to generate an electronic signature, generating an electronic certificate including the electronic signature, and converting the electronic certificate to the reader / writer The step of sending to is executed.

  With this configuration, as in the data processing system of the present invention, the electronic certificate generation card encrypts the public key of the reader / writer to generate an electronic certificate, so that the electronic certificate signed by the card is read by the reader / writer. Can be saved. The card may have a function of executing an application other than the electronic certificate generation.

  According to the present invention, the electronic certificate generation card encrypts the reader / writer's public key to generate the electronic certificate, so that the electronic certificate signed by the card can be stored in the reader / writer. It has the effect.

  Hereinafter, a data processing system according to an embodiment of the present invention will be described with reference to the drawings. First, an environment to which the data processing system of this embodiment is applied will be described. The data processing system of the present embodiment is applied to a system that performs settlement using, for example, an IC card or a credit card. In a store or the like, a reader / writer for reading the contents of an IC card or the like is installed for each counter. Each reader / writer is connected to a data processing device that counts sales and the like. Hereinafter, an example in which an electronic certificate used for authentication between a reader / writer and a data processing apparatus in such a system is given to the reader / writer will be described.

  FIG. 1 is a diagram showing a configuration of a data processing system 1 according to the present embodiment. The data processing system 1 according to the present embodiment includes a plurality of reader / writers 20, a data processing device 10 connected to the reader / writer 20, and an IC card 30 that is read by the reader / writer 20. The data processing apparatus 10 and the plurality of reader / writers 20 are connected to form a network. The IC card 30 includes a user IC card 30 for receiving services such as electronic money, and an IC card 30 used by maintenance personnel for maintenance of the reader / writer 20. Of these, the IC card 30 for maintenance has a function of generating an electronic certificate of the reader / writer 20.

  The data processing apparatus 10 and each reader / writer 20 have electronic certificates 15 and 28a to 28c, respectively. The data processing apparatus 10 and each reader / writer 20 can authenticate the communication partner by transmitting the electronic certificates 15 and 28a to 28c to each other. Also, secure SSL communication can be realized by encrypting transmission data using the public key encrypted in the electronic certificates 15 and 28a to 28c.

  FIG. 2 is a diagram showing a format of the electronic certificates 15 and 28a to 28c. The electronic certificates 15, 28a to 28c are "certificate version", "certificate serial number", "electronic signature algorithm", "certificate authority identification name", "expiration date (start / end)" (1) Public key algorithm "," Public key "," Extended area "," Digest electronic signature data generated from public key and certificate information ". Here, “certificate information” means “version of certificate format” “serial number of certificate” “digital signature algorithm” “identification name of certificate authority” “expiration date (start / end)” “(covered) Data that consists of a public key algorithm (of the prover) and an extension field. The format of the electronic certificate is ITU-T (International Telecommunication Union-Telecommunication Standardization Sector). It conforms to the standard of 509. “Public key” is the public key of the prover, and “the electronic signature data of the digest generated from the public key and the certificate information” is the public key of the prover (including the digest data of the public key. This is information obtained by encrypting a public key or the like) with the private key of the certificate authority. If the information obtained by decrypting the electronic signature with the public key of the certificate authority matches the “public key”, it can be confirmed that the sender of the electronic certificate is the person confirmed by the certificate authority. In the present embodiment, the certificate authority of the electronic certificate 28 of the reader / writer 20 is the IC card 30.

  FIG. 3 is a diagram illustrating a configuration of the data processing apparatus 10. The data processing apparatus 10 includes a CPU 11, a memory 12, a network communication unit 13, and a database 14. The memory 12 stores the electronic certificate 15 described above. The electronic certificate 15 may be obtained from a host device (not shown) or may be obtained via a recording medium such as a CD-ROM. The network communication unit 14 has a function of performing communication with the reader / writer 20. The database 14 stores data necessary for providing services by the data processing system 1. For example, in the example of electronic money, information such as the sales amount processed by the reader / writer 20 and the purchase history of each user is acquired from each reader / writer 20 and stored.

  FIG. 4 is a diagram illustrating a configuration of the reader / writer 20. The reader / writer 20 includes a CPU 21, a memory 22, an encryption processing unit 23, a network communication unit 24, a command generation unit 25, a key generation unit 26, and a card communication unit 27.

  An electronic certificate 28 and key information 29 are stored in the memory 22 (the electronic certificates 28a to 28c shown in FIG. 1 are collectively referred to as an electronic certificate 28). The key information 29 is information on a public key / private key pair generated by the key generation unit 26.

  The encryption processing unit 23 has a function of encrypting and decrypting data. For example, when the data is transmitted, the encryption processing unit 23 encrypts the data using the public key of the transmission destination device, and when receiving the data, the encryption processing unit 23 uses the secret key stored in the key information 29. To decrypt the data. The network communication unit 24 has a function of communicating with the data processing apparatus 10 or another reader / writer 20. The command generation unit 25 has a function of generating a command to be transmitted to the IC card 30. The key generation unit 26 has a function of generating a new public key and secret key. The card communication unit 27 has a function of communicating with the IC card 30. The reader / writer 20 corresponding to the non-contact IC card 30 always transmits a polling signal from the card communication unit 27 to detect the approach of the card.

  FIG. 5 is a diagram showing the configuration of the IC card 30. The IC card 30 may be a contact type IC card 30 or a non-contact type IC card 30. In this embodiment, the non-contact type IC card 30 will be described as an example. The IC card 30 includes a CPU 31, a memory 32, an encryption processing unit 33, a reader / writer communication unit 34, and a power generation unit 35.

  The reader / writer communication unit 34 has a function of communicating with the reader / writer 20. The power generation unit 35 is configured by an antenna coil and has a function of generating power by electromagnetic induction.

  FIG. 6 is a diagram illustrating an example of the memory 32. As shown in FIG. 6, the memory 32 stores key information 36, a card OS 37, a log acquisition application 38, a setting update application 39, and a certificate generation application 40. In addition to the applications shown in FIG. 6, other application programs may be stored in the memory 32 as necessary. The key information 36 is a pair of an IC card private key and public key. The log acquisition application 38 has a function of acquiring a log stored in the reader / writer 20 and storing it in the IC card 30. The setting update application 39 has a function of updating the setting of the reader / writer 20 with the setting update information stored in the IC card 30. The certificate generation application 40 has a function of generating an electronic certificate for the reader / writer using the public key received from the reader / writer 20. The certificate generation application 40 corresponds to the card program of the present invention. The application illustrated in FIG. 6 is an example, and the card OS 37 may store an application other than that illustrated in FIG.

  Next, the operation of the data processing system 1 of the present embodiment will be described. The data processing system 1 reads information on the IC card 30 by the reader / writer 20 and provides an application such as electronic money. The reader / writer 20 communicates with the data processing device 10 and transmits information such as the sales amount and sales history to the data processing device 10. In communication between the reader / writer 20 and the data processing apparatus 10, mutual authentication and encrypted communication (SSL communication) using the electronic certificates 15 and 28a to 28c are performed. The data processing apparatus 1 according to the present embodiment generates a new electronic certificate 28 and stores it in the reader / writer 30 when the expiration date of the electronic certificate 28 is approaching. Hereinafter, the operation of generating the electronic certificate 28 in the data processing system 1 of the present embodiment will be described.

  FIG. 7 is a diagram showing an outline of the operation of generating the electronic certificate 28 in the present embodiment. First, (1) the reader / writer 20 generates a key set A of a secret key A and a public key A, and (2) transmits the generated public key A to the IC card 30. (3) The IC card 30 generates electronic signature data by encrypting the received public key A and the digest data of the certificate information using the private key B of the IC card 30, and (4) the public key A, An electronic certificate 28 including the encrypted public key A composed of the certificate information and the electronic certificate 28 is generated. (5) The IC card 30 transmits the generated electronic certificate 28 to the reader / writer 20, and (6) the reader / writer 20 stores the electronic certificate 28.

  FIG. 8 is a diagram illustrating operations of the reader / writer 20 and the IC card 30 when the electronic certificate 28 is generated. The reader / writer 20 determines whether or not an IC card 30 for generating an electronic certificate has been detected (S10). If the IC card 30 is not detected (NO in S10), the process of determining whether or not the IC card 30 has been detected is repeated until the IC card 30 is detected.

  When the IC card 30 is detected (YES in S10), the reader / writer 20 determines whether or not an electronic certificate is stored (S12). When the electronic certificate is not stored (NO in S12), the process proceeds to step S16 of key pair generation. When the electronic certificate is stored (YES in S12), the reader / writer 20 determines whether or not the electronic certificate is about to expire (S14). Whether or not the expiration date is near is determined using the expiration date information of the electronic certificate and a predetermined threshold. For example, when a period of one month is used as the threshold value, the reader / writer 20 determines that the expiration date is near when the current time is included in the one month period before the expiration date.

  If it is determined in the determination as to whether the expiration date is near or not (NO in S14), the reader / writer 20 does not perform the electronic certificate generation processing, but performs processing for other applications. Transition (S36).

  When it is determined that the expiration date is close in the determination of whether or not the expiration date is close (YES in S14), or when it is determined that there is no electronic certificate in the determination of the presence or absence of the electronic certificate (NO in S12), The reader / writer 20 generates a key pair of a public key and a secret key (S16). Next, the reader / writer 20 transmits a certificate generation application activation command to the IC card 30 (S18).

  FIG. 10 is a diagram showing a format 50 of data transmitted / received between the reader / writer 20 and the IC card 30. As shown in the data format 50, the header includes a class CLA, an instruction byte INS, and parameter bytes P1 and P2. The main body following the header is composed of data Data, an Lc field added before and after the data Data, and a Le field. The Lc field represents the byte length sent to the IC card 30 as an instruction part. The Le field represents the byte length of the response sent back from the IC card 30. The public key and electronic certificate are transmitted in the data of the main body.

  Upon receiving the certificate generation application activation command transmitted from the reader / writer 20, the IC card 30 activates the certificate generation application 40 in the memory 32 (S22). Subsequently, the reader / writer 20 transmits the public key generated in step S16 to the IC card 30 (S24). Upon receiving the public key transmitted from the reader / writer 20 (S26), the IC card 30 generates an electronic certificate using the received public key (S28). Specifically, as described above, the IC card 30 encrypts the received public key and certificate information using the private key of the IC card 30 to generate an electronic signature of the public key, and the public key And an electronic certificate (see FIG. 2) including an electronic signature composed of certificate information and electronic signature data.

  The IC card 30 transmits the generated electronic certificate to the reader / writer 20 (S30). The reader / writer 20 receives the electronic certificate received from the IC card 30 (S32), and stores the received electronic certificate in the memory 22 (S34). At this time, the reader / writer 20 may discard the old electronic certificate stored in the memory 22.

  After storing the new electronic certificate, the reader / writer 20 moves to another application process. The reader / writer 20 transmits another application start command to the IC card 30 (S36). The IC card 30 receives another application start command (S38) and executes another application.

  FIG. 9 is a diagram illustrating an operation of the IC card 30 when an application activation command is received from the reader / writer 20. When receiving a command from the reader / writer 20 (S40), the IC card 30 determines whether or not the received command is a certificate generation application activation command (S42). If it is a certificate generation application activation command (YES in S42), the IC card 30 activates the certificate generation application (S44). Next, upon receiving the public key from the reader / writer 20 (S46), the IC card 30 generates an electronic certificate using the received public key or the like (S48), and transmits the generated electronic certificate to the reader / writer 20. (S50).

If the command received by the IC card 30 is not a certificate generation application activation command (NO in S42), the IC card 30 activates the application specified by the received command (S52) and performs application processing (S54).
Heretofore, the data processing system and the generation of the electronic certificate according to the present embodiment have been described.

  In the data processing system 1 of this embodiment, when the IC card 30 for generating an electronic certificate is detected, the public key of the reader / writer 20 is transmitted to the IC card 30 and the electronic certificate is generated by the IC card 30 Therefore, the electronic certificate 28 signed by the IC card 30 can be stored in the reader / writer 20. By using the electronic certificate 28, the data processing apparatus 10 can authenticate the reader / writer 20 and can perform SSL communication between the reader / writer 20 and the data processing apparatus 10.

  In addition, the data processing system 1 according to the present embodiment generates a new electronic certificate 28 by transmitting a public key to the IC card 30 when the existing electronic certificate 28 of the reader / writer 20 is about to expire. Therefore, it is possible to continuously hold the electronic certificate 28 without the user being aware of it.

  In the data processing system 1 according to the present embodiment, the IC card 30 includes the log acquisition application 38 and the setting update application 39 in addition to the certificate generation application 40. Since the electronic certificate is automatically set when trying to execute, the electronic certificate can be set without being conscious of the user.

  In the data processing system 1 according to the present embodiment, since the electronic certificate 28 is generated when the electronic certificate 28 does not exist, it is not necessary to set the electronic certificate 28 in the reader / writer 20 in advance. .

  The data processing system and the electronic certificate generation method of the present invention have been described in detail above with reference to the embodiment, but the present invention is not limited to the above-described embodiment.

  In the above-described embodiment, an example has been described in which the reader / writer 20 generates a key pair and the IC card 30 generates an electronic certificate when the electronic certificate is about to expire. A new electronic certificate may be generated when the time limit has expired. As a result, even if the IC certificate 30 for generating an electronic certificate does not access the reader / writer 20 and the electronic certificate has expired at the time when the expiration date is about to expire, the electronic certificate is sent to the reader / writer 20. Can be set. In addition, when the time for creating a public key / private key pair is linked with the expiration date of the certificate, the security can be improved more than when the key is always created. In addition, it is more preferable to provide a public key, a private key, and a certificate in a secure chip.

  In the embodiment described above, the configuration and operation of the IC card 30 that generates the electronic certificate 28 and the reader / writer 20 that stores the generated electronic certificate 28 have been mainly described. A program for realizing the reader / writer 20 is also included in the scope of the present invention.

  According to the present invention, an electronic certificate signed by a card can be generated, and a reader / writer that requires secure communication between the reader / writer and the data processing apparatus is used. It can be applied to a payment system.

The figure which shows the structure of the data processing system of this Embodiment Figure showing an example of the format of an electronic certificate Diagram showing the configuration of the data processing device Diagram showing the configuration of the reader / writer Diagram showing the configuration of the IC card The figure which shows the structure of the memory of the IC card Diagram showing the operation to generate an electronic certificate The figure which shows the operation which generates the electronic certificate with the data processing system The figure which shows the operation of the IC card when the application command is received The figure which shows the format of the data transmitted / received between a reader / writer and an IC card

Explanation of symbols

1 Data Processing System 10 Data Processing Device 11 CPU
12 Memory 13 Network Communication Unit 14 Database 15 Electronic Certificate 20 Reader / Writer 21 CPU
22 Memory 23 Cryptographic Processing Unit 24 Network Communication Unit 25 Command Generation Unit 26 Key Generation Unit 27 Card Communication Unit 28 Electronic Certificate 29 Key Information 30 IC Card 31 CPU
32 Memory 33 Cryptographic processing unit 34 Reader / writer communication unit 35 Power generation unit 36 Key information 37 Card OS
38 Log acquisition application 39 Setting update application 40 Certificate generation application

Claims (9)

A reader / writer including a key generation unit that generates a pair of a public key and a private key, and a public key sending unit that sends the public key to a card for generating an electronic certificate;
An electronic signature generation unit that generates an electronic signature by encrypting the public key received from the reader / writer with a private key that it has, an electronic certificate generation unit that generates an electronic certificate including the electronic signature, and the electronic certificate The card having a sending section for sending the information to the reader / writer;
A data processing device connected to the reader / writer;
A data processing system comprising:
The reader / writer includes an electronic certificate receiving unit that receives the electronic certificate from the card, an electronic certificate storage unit that stores the electronic certificate, and a sending unit that transmits the electronic certificate when communicating with the data processing device And comprising
A data processing system in which the reader / writer and the data processing device communicate with each other when an electronic certificate authenticating unit provided in the data processing device authenticates the electronic certificate.   The key generation unit of the newly connected reader / writer generates a public / private key pair when the reader / writer is newly connected to the network to which the data processing apparatus is connected. The described data processing system.   The data processing system according to claim 1, wherein the card includes an application storage unit that stores an application that uses the electronic certificate.   The data processing device encrypts data using a public key included in the electronic certificate, and a data processing device encryption unit encrypts the data encrypted by the data processing device encryption unit to the reader / writer. The data processing system according to any one of claims 1 to 3, further comprising a transmission unit to be sent. A key generation unit that generates a public key and private key pair;
A public key sending unit that sends a public key to the card when an electronic certificate generation card is detected;
An electronic certificate receiving unit that receives an electronic certificate including an electronic signature obtained by encrypting the public key, sent from the electronic certificate generating card;
An electronic certificate storage unit for storing the electronic certificate;
Reader / writer equipped with. A card that is read by a reader / writer and generates a digital certificate of the reader / writer,
A public key receiving unit that receives a public key of the reader / writer from the reader / writer;
An electronic certificate generation unit that generates an electronic signature by encrypting the public key with a private key of the card, and generates an electronic certificate including the electronic signature;
An electronic certificate sending unit for sending the electronic certificate to the reader / writer;
A card for generating electronic certificates. In a data processing system comprising a reader / writer, a data processing device connected to the reader / writer, and a card for generating an electronic certificate of the reader / writer,
The reader / writer generating a public / private key pair;
Sending a public key from the reader / writer to the card;
The card encrypts the public key received from the reader / writer with a private key of the card to generate an electronic signature, generates an electronic certificate including the electronic signature, and sends the electronic certificate to the reader / writer. Sending step,
The reader / writer receiving and storing the electronic certificate sent from the card;
The reader / writer sends the electronic certificate to the data processing device;
A method for generating an electronic certificate, comprising: a step of authenticating the electronic certificate by the data processing apparatus. A program installed in a reader / writer that communicates with a card for generating an electronic certificate, the reader / writer
Generating a public / private key pair;
Sending the public key from the reader / writer to the card when the card is detected;
Receiving an electronic certificate including an electronic signature obtained by encrypting the public key;
Storing the electronic certificate in a storage unit;
A program for executing communication with the data processing device using the electronic certificate. A program installed in an electronic certificate generation card that communicates with a reader / writer,
Receiving a public key created by the reader / writer from the reader / writer;
Encrypting the public key with a private key of the card to generate an electronic signature; generating an electronic certificate including the electronic signature;
Sending the electronic certificate to the reader / writer;
A program that executes