JP3696445B2 - Public key certificate issuance method, user terminal, authentication center apparatus, and medium storing these programs - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a public key certificate issuance method capable of issuing a public key certificate even in communication means with a limited communication band, a user terminal, an authentication center apparatus , and a medium on which these programs are recorded.
[0002]
[Prior art]
In user authentication using a certification authority (Certification Authority: hereinafter abbreviated as CA), a connection between a public key and its owner is guaranteed by the authentication center, and a digital signature of the authentication center is given. User authentication is performed based on the electronic certificate, so-called public key certificate.
[0003]
This public key certificate is created and issued at the time the user applies for registration of the public key to the authentication center, until it expires or until the private key is invalidated due to harm used. Between actual users (between the sender and the receiver), the receiver obtains a public key certificate issued by the authentication center through some communication means, and uses it to create a signature created with the private key of the sender By performing verification, user authentication (sender authentication) is performed.
[0004]
The format of this public key certificate is X. It is defined by standard organizations such as ISO / IEC and ITU-T as a 509 recommendation. Since the definition of Version 1 in 1986, it has been revised to Version 2 and Version 3, and Version 3 is mainly used at present.
[0005]
[Problems to be solved by the invention]
Currently, the utility of public key certificates is recognized in the field of wireless communications such as mobile phones, and user authentication using such public key certificates is being used.
[0006]
However, currently used X.X. 509 Version 3 public key certificate has two major elements: a basic part which is basically a collection of essential fields and an extension part which is a collection of fields for facilitating each process in user authentication. As shown in FIG. 1, there are many elements in each large element.
[0007]
In addition, although the field to be used can be selected depending on the intended use and any field can be not used for the extension part, it is a mandatory field (except for the issueUniqueIdentifier and subjectIdentifier fields) only in the basic part, and is omitted. I can't do it. In FIG. 509 shows an example of a public key certificate based on the provisions of Version 3.
[0008]
As described above, the communication data amount (size) of the public key certificate is large, and an environment in which communication means such as wireless communication with limited communication speed or communication capacity (communication bandwidth) is often used, such as a mobile environment. However, it is inefficient to communicate and issue a public key certificate as it is between the authentication center and the user.
[0009]
An object of the present invention is to provide a public key certificate issuance method, a user terminal, an authentication center apparatus , and a medium on which these programs are recorded, which can efficiently issue a public key certificate even in an environment where the communication band is limited. It is to provide.
[0010]
[Means for Solving the Problems]
In the present invention, 1) when a public key certificate is created and searched based on an application form from a user on the authentication center side, only the fields not included in the application form are returned to the user side, and 2) the user The public key certificate sent by the authentication center is added to the public key certificate created and applied to the authentication center by itself to restore the public key certificate, and the signature of the restored public key certificate is valid. The main feature is to reduce the amount of communication data related to the public key certificate between the authentication center and the user by confirming the authenticity.
[0011]
The conventional technique is that the communication amount of the public key certificate can be reduced by transmitting only necessary information of the public key certificate managed by the authentication center between the authentication center and the user. different.
[0012]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[0013]
FIG. 3 shows the configuration of the entire apparatus of the present invention. In the figure, 10 is a user terminal device (user terminal), 20 is an authentication center device (CA device), and these are communication means not shown. Connected by
[0014]
The user terminal 10 includes a common item definition / setting unit 11 that defines and sets common items for the application and certificate for each service accepted by the CA device 20, and a service application that holds the application filed to the CA device 20. Service that extracts the items defined and set in the common item definition / setting unit 11 from the application held by the service application holding unit 12 when the certificate is received from the certificate holding unit 12 and the CA device 20 Service application for restoring the public key certificate by adding the application / certificate common item extracting means 13 and the field corresponding to the item extracted by the service application / certificate common item extracting means 13 to the received certificate. Certificate / certificate common item adding means 14 and CA signature verification means 15 for verifying the signature of the restored public key certificate.
[0015]
The CA device 20 includes a common item definition / setting unit 21 for defining / setting common items for the application and certificate for each service to be accepted, and a public key created / searched based on the application received from the user terminal 10 A service application / certificate for creating a public key certificate that is actually transmitted to the user terminal 10 by deleting the field corresponding to the item defined / set in the common item definition / setting means 21 from the certificate Common item deletion means 22.
[0016]
Note that both the user terminal 10 and the CA device 20 are actually provided with configurations other than those described above, but only the portions related to the present invention are shown here.
[0017]
Hereinafter, the operation of the apparatus of the present invention will be described.
[0018]
(1) Public key registration and public key in both the CA device 20 and the user terminal 10 using the common item definition / setting means 11 and 21 as a pre-operation for exchanging between the CA device 20 and the user terminal 10 A common part of each field included in the application form and public key certificate for various services such as certificate reference is defined and set for each service.
[0019]
(2) When the user terminal 10 makes a service application such as public key registration and public key certificate reference to the CA device 20, a service application is created and transmitted to the CA device 20. In this case, the service application form holding means 12 is used to hold the service application form for the CA device 20.
[0020]
(3) After the CA device 20 creates and retrieves the public key certificate based on the service application received from the user terminal 10, the service application / certificate common item deletion means 22 is used to define the common item. Delete the field corresponding to the common item between the service application form set by the setting means 21 and the public key certificate from the created / searched public key certificate.
[0021]
(4) At the user terminal 10, after receiving the public key certificate created using the service application / certificate common item deletion means 22 from the CA device 20, the service application / certificate common item extraction means 13 The field corresponding to the common item of the service application and public key certificate set by the common item definition / setting unit 11 from the service application held by using the service application holding unit 12 in (2) To extract.
[0022]
(5) The field extracted by the service application / certificate common item extracting means 13 is added to the public key certificate received from the CA device 20 using the service application / certificate common item adding means 14, and the public key Restore the certificate.
[0023]
(6) The CA signature of the public key certificate restored by the service application / certificate common item adding means 14 is verified using the CA signature verification means 15.
[0024]
The present invention is realized by software (program) having the procedures shown in the flowcharts of FIGS. 4 and 5 together with hardware such as a well-known CPU, memory, and external storage device. Here, FIG. 4 is a flowchart showing a program for realizing the user terminal, and FIG. 5 is a flowchart showing a program for realizing the CA device.
[0025]
Hereinafter, embodiments of the present invention will be described in more detail with reference to FIGS.
[0026]
(1) Common item definition / setting processing 201
As pre-work to be exchanged between the CA device and the user terminal, the CA device and the user terminal make various settings such as the setting of an E-mail address. Among them, the public key certification between the CA device and the user terminal is performed. Common item definition / setting means 11 and 21 are called as settings for reducing the data amount (size) of the certificate, and are used for application forms and public key certificates in various services such as public key registration and public key certificate reference. Define and set the common part of each included field for each service.
[0027]
The common items defined by the common item definition / setting means 11 and 21 are preferably defined / created by the CA device, that is, the common item definition / setting means 21, and are used in the public world such as the Internet. For CA devices that perform interoperability, X. It is desirable not to include the public key certificate extension elements defined in each standard such as 509.
[0028]
For example, there is a PKCS # 10 shown in FIG. 6 as a defining element of an application form that is generally used in public key registration applications. The items defined and set as common items of the public key registration service when using this are as follows. As shown by hatching in FIG. 7, version (version number), issuer (issuer name), subject (target person name), and publicPublicKeyInfo (public key information authenticated by CA).
[0029]
The common item definition is distributed from the CA device to the user in the form of a table, and the user sets the common item definition in the terminal without being aware of the common item definition by setting the file. be able to.
[0030]
This common item definition / setting can be easily realized by using a table creation / reference technique or the like generally used in an existing computer or the like.
[0031]
(2) Application creation / retention processing 202
When a user performs user authentication between users using a CA device, the user (user) obtains a public key certificate by some means and performs user authentication by using it. At that time, in public key registration, public key certificate reference, etc. performed in a series of processes in user authentication, each service application is made to the CA device using an application form. As an operation, the service application holding means 12 is called, and the service application created at the time of each service application is held in the user terminal.
[0032]
In addition, about the calling of the service application holding means 12 and each service application holding method, the module calling function built in the existing computer application and the function such as HDD built in / external to the computer are used. It is feasible.
[0033]
(3) Public key certificate size reduction processing 203
On the CA device side, various service processes such as public key registration and public key certificate reference desired by the user are executed using the input 31 of various service applications from the user as a trigger, and a public key certificate is created and searched. After that, the service application / certificate common item deletion means 22 is called, and the input 32 of the service application / certificate common item defined and set by the common item definition / setting means 21 and the input of the public key certificate Using the field 33 as a trigger, the field corresponding to the item described in the service application form / certificate common item is deleted from the field described in the public key certificate, and the public key certificate is reconfigured with the remaining fields.
[0034]
If the example of (1) is used, version, issuer, subject, and subjectPublicKeyInfo are deleted, and in particular, the subjectPublicKeyInfo that stores the entity of the public key that caused the public key certificate size to increase is deleted. When other elements, that is, version, issuer, and subject are added, one or two extension elements (the number of extension element uses generally used in CA in the world. Extension element unused CAs also exist) are used. Even so, the size of the public key certificate is about half or less.
[0035]
It should be noted that in this processing, when reconfiguring the public key certificate after deleting the service application form / certificate common item from the created / searched public key certificate, the public key The CA signature attached to the certificate means that the CA signature signed when the public key certificate is created and searched must be used. If a new certificate is reassigned here, the public key certificate created and searched based on the application from the user will not make any sense, and will demonstrate the capabilities of the present invention. You can't do that.
[0036]
The various service processes used in the public key certificate size reduction process and the process of deleting the service application / certificate common item from the public key certificate are common in the reference function and CA apparatus incorporated in the existing computer. This can be realized by using the Delete function used in the above.
[0037]
(4) Public key certificate restoration processing 204
When the user terminal receives the public key certificate created by the public key certificate size reduction processing 203 from the CA device, the service application / certificate common item extraction unit 13 is called and the service application holding unit 12 The service application corresponding to the public key certificate received from the CA device is drawn out of the service application group that the user applied to the CA device held by (34), and common item definition / setting After the service application / certificate common item defined and set by means 11 is input (35), and the field corresponding to the service application / certificate common item is extracted from the fields described in this service application The service application / certificate common item adding means 14 is called and received from the CA device (36) Public key certificate (public) The field extracted by the service application / certificate common item extraction means 13 is added to the public key certificate from which the service application / certificate common item has been deleted by the certificate size reduction process (in (1)). If an example is used, version, issuer, subject, and subjectPublicKeyInfo are added.)
[0038]
Thereafter, the CA signature verification means 15 is called, and the public key created and searched based on the application from the user in the CA device by confirming the validity of the CA signature of the restored public key certificate by signature verification. The exact same certificate is created.
[0039]
Corresponds to the service application / certificate common item from the process described in the process for retrieving the service application corresponding to the public key certificate received from the CA device used in the public key certificate restoration process and the field described in the service application. The process of extracting the field, the process of adding the extracted field, and the CA signature verification process of the restored public key certificate can be achieved by using a search algorithm and an additional algorithm generally possessed by existing computers. .
[0040]
【The invention's effect】
As described above, according to the present invention, when the public key certificate is created and searched based on the application form from the user on the authentication center side, only the fields not included in the application form are stored on the user side. 2) Restore the public key certificate by adding the application information created and applied to the authentication center to the public key certificate sent from the authentication center on the user side. By confirming the validity of the signature of the public key certificate, the same certificate as the public key certificate created and searched based on the application from the user in the authentication center is created. As a result, it is possible to reduce the amount of communication data related to the public key certificate between the authentication center and the user. It becomes possible to issue a public key certificate efficiently in environments with limited communication band.
[Brief description of the drawings]
FIG. 509 is a diagram showing elements of a public key certificate specified in Version 3; FIG. 509 is a diagram showing an example of a public key certificate based on the provisions of version 3; FIG. 3 is a block diagram showing the entire apparatus of the present invention; FIG. FIG. 6 is a flowchart showing a program for realizing the authentication center of the present invention. FIG. 6 is a diagram showing prescribed elements of a public key registration application form (PKCS # 10). 509 Diagram showing an example of common items that can be omitted in public key certificates based on the provisions of Version 3
10: User terminal, 11, 21: Common item definition / setting means, 12: Service application holding means, 13: Service application / certificate common item extracting means, 14: Service application / certificate common item adding means 15: CA signature verification means, 20: CA device, 22: Service application / certificate common item deletion means, 201: Common item definition / setting process, 202: Service application creation / holding process, 203: Public key certification Certificate size reduction processing, 204: Public key certificate restoration processing.

Claims (5)

In the public key certificate issuance method for issuing a public key certificate signed by the authentication center device to a user terminal that has applied for a service such as public key registration / certificate reference with an application form,
User terminal having common item definition / setting means, service application holding means, service application / certificate common item extraction means, service application / certificate common item adding means and signature verification means, and common item definition / Using an authentication center device provided with setting means and service application / certificate common item deletion means,
The common items of the application and certificate for each service accepted by the authentication center device are defined and set in advance between the common item definition / setting means of the authentication center device and the common item definition / setting means of the user terminal ,
When applying for service on the user terminal side, keep the application form in the service application form holding means of the user terminal ,
When executing a service on the authentication center device side, the above-mentioned definition is performed by the service application form / certificate common item deletion means of the authentication center device from the public key certificate created / searched based on the application received from the user terminal side.・ Delete the field corresponding to the set item and create a public key certificate that is actually sent to the user terminal .
When receiving the certificate on the user terminal side, the service application form / certificate common item extraction means of the user terminal extracts the common items of the defined and set application form and certificate from the held application form. ,
The service application form / certificate common item adding means of the user terminal restores the public key certificate by adding the field corresponding to the extracted item to the received public key certificate,
A method for issuing a public key certificate, characterized in that the signature of the restored public key certificate is verified by the signature verification means of the user terminal to confirm the validity of the public key certificate. A user terminal that applies to the authentication center device for services such as public key registration and certificate reference with an application,
A common item definition / setting means for defining / setting common items for the application and certificate for each service accepted by the authentication center device ;
A service application holding means for holding an application submitted to the authentication center device ;
Service application / certificate common item extraction that extracts the items defined and set in the common item definition / setting means from the application form held by the service application form holding means when the certificate is received from the authentication center device Means,
A service application / certificate common item adding means for restoring the public key certificate by adding a field corresponding to the item extracted by the service application / certificate common item extracting means to the received certificate;
A user terminal comprising signature verification means for verifying a signature of a restored public key certificate. An authentication center device that issues a signed public key certificate to a user terminal that has applied for a service such as public key registration / certificate reference with an application,
Common item definition / setting means for defining / setting common items for the application and certificate for each accepted service,
From the public key certificate created / searched based on the application received from the user terminal, the field corresponding to the item defined / set in the common item definition / setting means is deleted and the user terminal is actually used. An authentication center apparatus comprising a service application form / certificate common item deletion means for creating a public key certificate to be transmitted. In the medium that records the program of the user terminal that applies to the authentication center device for services such as public key registration and certificate reference with the application form,
When the program is read by a computer,
A common item definition / setting means for defining / setting common items for the application and certificate for each service accepted by the authentication center device ;
A service application holding means for holding an application submitted to the authentication center device ;
Service application / certificate common item extraction that extracts the items defined and set in the common item definition / setting means from the application form held by the service application form holding means when the certificate is received from the authentication center device Means,
A service application / certificate common item adding means for restoring the public key certificate by adding a field corresponding to the item extracted by the service application / certificate common item extracting means to the received certificate;
A medium in which a program for functioning as a signature verification means for verifying a signature of a restored public key certificate is recorded. In the medium that records the program of the authentication center device that issues the signed public key certificate to the user terminal that has applied for services such as public key registration and certificate reference with the application form,
When the program is read by a computer,
Common item definition / setting means for defining / setting common items for the application and certificate for each accepted service,
From the public key certificate created / searched based on the application received from the user terminal, the field corresponding to the item defined / set in the common item definition / setting means is deleted and the user terminal is actually used. A medium in which a program that functions as means for deleting a service application / certificate common item for creating a public key certificate to be transmitted is recorded.

Images