JP4768338B2 - Certificate issuing request device, certificate issuing program, and certificate issuing method - Google Patents

Description

  The present invention relates to electronic certificate information issuance processing by a certificate authority or the like.

When a certificate authority issues certification information, it is necessary to verify the identity of the applicant who requests the certification information. Conventionally, there is a method of using already-issued certification information as a method of identity verification. Japanese Laid-Open Patent Publication No. 7-160198 discloses a method in which an agent who has already issued certification information from a certificate authority requests to issue certification information in place of the applicant himself / herself who requests the certification information. . In Japanese Patent Laid-Open No. 7-160198, first, application information signed by an agent is transmitted to a certificate authority. Next, the certificate authority confirms the signature of the agent, and if it can be confirmed, issues certification information to the applicant. Since the agent is a reliable person who has received identity verification from the CA before issuing the applicant's certification information, the CA trusts the signature.
JP 7-160198 A

In the conventional method, since the certificate authority has already confirmed the identity of the agent, the signature of the agent is trusted and the certification information is issued. Therefore, in the conventional method, there has been a problem that the applicant cannot issue certification information from a person other than the certificate authority whose agent has been verified.
The present invention has been made to solve the above-described problems, and an object of the present invention is to make it possible to issue certification information from a certificate authority that has not received certification information.

  A certificate issuance request apparatus according to the present invention includes a first certificate authority storage unit that stores information of a first certificate authority that issues examination certificate information in a storage device, and certificate request information having examination certificate information as an input receiving apparatus. The certification request information received by the certification request receiving unit is based on the certification request receiving unit received via the certification request receiving unit and the first certification authority information stored in the first certification authority storage unit. A first certification authority determination unit that determines whether or not the certification information is issued by a certification authority by a processing device, and a second certification authority memory that stores information on a second certification authority that issues certification authority certification information in a storage device And the second certificate stored in the second certificate authority storage unit when the first certificate authority determination unit determines that the certification information included in the certificate request information is examination certificate information issued by the first certificate authority. Certificate authority certificate to the second certificate authority based on the authority information The issuance request information of information, characterized in that it comprises a certification request transmission unit for transmitting through an output transmission device.

  According to the certification issuance requesting apparatus according to the present invention, it is possible to make a certification request to the second certification authority by confirming that it is examination certification information issued by the first certification authority. Therefore, according to the certificate issuance request apparatus according to the present invention, it is possible to issue certification information from a certificate authority that has not received certification information.

  Hereinafter, the present invention will be described based on embodiments shown in the drawings.

FIG. 1 is a diagram illustrating an example of a hardware configuration of a certificate issuance request apparatus 100 according to the first embodiment.
In FIG. 1, the certificate issuance request apparatus 100 includes a CPU (Central Processing Unit) 911 that executes a program. The CPU 911 is connected to a ROM 913, a RAM 914, a CRT 901, a K / B (keyboard) 902, a mouse 903, a COMM (communication board) 915, and a magnetic disk device 920 via a bus 912.
The CPU 911 is an example of a processing device.
The RAM 914 is an example of a volatile memory. The ROM 913 and the magnetic disk device 920 are examples of a nonvolatile memory. These volatile memory and nonvolatile memory are examples of a storage device.
The communication board 915 is connected to a LAN, a wireless antenna, or the like.
For example, the communication board 915, K / B 902, and the like are examples of the input reception device.
Further, for example, the communication board 915, the CRT 901, and the like are examples of the output transmission device.

Here, the communication board 915 is not limited to the LAN, and may be directly connected to the Internet or a WAN (wide area network) such as ISDN.
The magnetic disk device 920 stores an operating system (OS) 921, a window system 922, a program group 923, and a file group 924. The program group 923 is executed by the CPU 911, the OS 921, and the window system 922.

The program group 923 stores a program for executing a function described as “˜unit” in the description of the embodiment described below. The program is read and executed by the CPU 911.
In the file group 924, what is described as “determination of” and “specification of” in the description of the embodiment described below is stored as “˜file”.
In addition, the arrow portion of the flowchart described in the description of the embodiment described below mainly indicates input / output of data, and for the input / output of the data, the data is a magnetic disk device 920, an FD (Flexible Disk), an optical disk. , CD (compact disc), MD (mini disc), DVD (Digital Versatile Disk) and other recording media. Alternatively, it is transmitted through a signal line or other transmission medium.

  In addition, what is described as “unit” in the description of the embodiment described below may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented by software alone, hardware alone, a combination of software and hardware, or a combination of firmware.

The program for carrying out the embodiment described below is also a magnetic disk device 920, FD (Flexible Disk), optical disk, CD (compact disk), MD (mini disk), DVD (Digital Versatile Disk), and the like. You may memorize | store using the recording device by this recording medium.
The end entity 400, the first certificate authority 200, and the second certificate authority 300 to be described later are, for example, computers having the hardware configuration shown in FIG.

Embodiment 1 FIG.
First, the first embodiment will be described. In the first embodiment, a certificate issuance request apparatus 100 that enables issuance of certification information from a certificate authority that has not been issued certification information will be described.

First, the certificate issuing system 1000 according to the first embodiment will be described. FIG. 2 is an overall schematic diagram of the certificate issuing system 1000 according to the first embodiment.
The certificate issuance system 1000 includes a certificate issuance request apparatus 100, a first certificate authority 200, a second certificate authority 300, and an end entity 400. The certificate issuance request apparatus 100, the first certificate authority 200, the second certificate authority 300, and the end entity 400 are connected via a network.
The certificate issuance request apparatus 100 receives a request from the end entity 400 and requests the certificate authority to issue certification information. That is, the certificate issuance request apparatus 100 mediates between the end entity 400 and the certificate authority.
The first certificate authority 200 is a certificate authority that has already issued certification information to the end entity 400. The certificate issuance requesting apparatus 100 trusts the certification information issued by the first certificate authority 200. Here, the certification information issued by the first certificate authority 200 is referred to as examination certification information 530. There may be a plurality of first certificate authorities 200.
The second certificate authority 300 is a certificate authority that has not issued certification information to the end entity 400. The second certificate authority 300 is a certificate authority that trusts the certificate issuance request apparatus 100 and issues the certificate information when the certificate issuance request apparatus 100 receives a certificate information issuance request. Here, the certification information issued by the second certification authority 300 is referred to as certification authority certification information. There may be a plurality of second certificate authorities 300.
The end entity 400 makes a request for issuing certification information. Here, the end entity 400 requests the second certificate authority 300 to issue certification information via the certification issuance request apparatus 100.
That is, the end entity 400 sends the examination certificate information 530 issued by the first certificate authority 200 to the certificate issue request apparatus 100 together with the certificate authority certificate information issue request. The certificate issuance request apparatus 100 trusts the examination certificate information 530 transmitted by the end entity 400 and requests the second certificate authority 300 to issue the certificate authority certificate information. The second certificate authority 300 issues certificate authority certificate information based on the request from the certificate issuance request apparatus 100.

Next, the function of the end entity 400 will be described. FIG. 3 is a functional block diagram showing functions of the end entity 400.
The end entity 400 includes a key pair generation unit 410, an entity storage unit 420, an input unit 430, and a certification request information generation unit 440.
The key pair generation unit 410 generates a public key / private key pair.
The entity storage unit 420 includes a key storage unit 421, a certification information storage unit 422, and a certification request storage unit 423. The key storage unit 421 stores a public key / private key pair generated by the key pair generation unit 410 and a private key paired with the public key included in the certification information issued by the certificate authority. The certification information storage unit 422 stores certification information issued by the certificate authority. Here, the certification information storage unit 422 stores examination certification information 530 issued by the first certification authority 200 and registration certification information issued by any certification authority. That is, the key storage unit 421 stores a secret key that is paired with the public key of each of the examination certification information 530 and the registration certification information. Further, since the registration certificate information is issued by an arbitrary certificate authority, even if it is issued by the first certificate authority 200 or the second certificate authority 300, it is issued by another certificate authority. It does not matter. The registration certificate information may be issued by any certificate authority as long as the end entity 400 includes a public key and the end entity 400 has a private key paired with the public key. The certification request storage unit 423 stores certification request information 500 generated by the end entity 400. The certification request information 500 will be described later.
The input unit 430 inputs identification information of the end entity 400 and the like.
The certification request information generation unit 440 generates certification request information 500 described later.

FIG. 4 is a block diagram showing a configuration of certification request information 500 generated by the end entity 400 and transmitted to the certification issuance request apparatus 100.
The certification request information 500 includes a signature 510 using examination certification information versus a private key, a signature 520 using public key information versus a private key, examination certification information 530, public key information 540, and identification information 550.
The signature 510 by the examination certification information versus the secret key is signature data attached by a secret key paired with the public key included in the examination certification information 530 stored in the certification information storage unit 422.
The signature 520 using the public key information versus the private key is signature data attached by a private key that is paired with the private key generated by the key pair generation unit 410 or the public key included in the registration certification information stored in the certification information storage unit 422. is there.
The examination certification information 530 is examination certification information 530 stored in the certification information storage unit 422.
The public key information 540 is public key generated by the key pair generation unit 410 or registration certification information stored in the certification information storage unit 422.
The identification information 550 is a subject name of identification information or certification information of the end entity 400 input by the input unit 430. The subject name of the certification information is information indicating the owner of the certification information attached to the certification information. The subject name of the certification information is, for example, the name, address, and mail address of the certification information owner. For example, when the input unit 430 omits input of the identification information of the end entity 400, the identification information 550 may use the subject name of the certification information as the identification information 550. The certification information is a so-called electronic certificate, such as registration certification information, examination certification information 530, and certification authority certification information. That is, when the public key information 540 is used as registration certification information, the subject name of the registration certification information may be used as the identification information 550. The identification information 550 is transmission source identification information that identifies the transmission source of the certification request information 500.

Next, functions of the certificate issuance request apparatus 100 will be described. FIG. 5 is a functional block diagram illustrating functions of the certificate issuance request apparatus 100.
The certificate issuance request apparatus 100 includes a reception unit 110, a transmission unit 120, an issuance request information generation unit 130, a determination unit 140, and a storage unit 150.

  The receiving unit 110 receives information from the certificate authority, the end entity 400, and the like. The receiving unit 110 receives information via, for example, the input receiving device illustrated in FIG. The receiving unit 110 includes a certification request receiving unit 111, a designation information receiving unit 112, and a certification information receiving unit 113. The certification request reception unit 111 receives certification request information 500 including examination certification information 530 generated by the end entity 400 via the input reception device. When there are a plurality of second certificate authorities 300, the designation information receiving unit 112 receives designation information for designating the second certificate authority 300 that requests the issuance of certification information via the input reception device. The certification information reception unit 113 receives certification authority certification information that is certification information transmitted by the second certification authority 300 via the input reception device.

  The transmission unit 120 transmits information and the like to the certificate authority, the end entity 400, and the like. The transmission unit 120 transmits information via, for example, the output transmission device illustrated in FIG. The transmission unit 120 includes a certification request transmission unit 121. The certification request transmission unit 121 transmits certification information issuance request information to the second certification authority 300 based on the information of the second certification authority 300 stored in the second certification authority storage unit 153 described later via the output transmission device. .

  The issue request information generation unit 130 generates issue request information for requesting the second certificate authority 300 to issue certification information. The issue request information generation unit 130 includes a certificate authority identification unit 131. Based on the designation information received by the designation information receiving unit 112, the certification authority identification unit 131 identifies the second certification authority 300 that requests the issuance of certification information by the processing device. That is, the certification request transmission unit 121 transmits certification information issue request information to the second certification authority 300 identified by the certification authority identification unit 131 via the output transmission device.

  The determination unit 140 includes a first certificate authority determination unit 141, a certification information determination unit 142, and a secret key determination unit 143. Based on the information of the first certificate authority 200 stored in the first certificate authority storage unit 152 (to be described later), the first certificate authority determination unit 141 stores the examination certificate information 530 included in the certificate request information 500 received by the certificate request reception unit 111. The processing apparatus determines whether or not the examination certification information 530 is issued by the first certificate authority 200. The certification information determination unit 142 determines by the processing device that the certification authority certification information received by the certification information reception unit 113 is certification authority certification information transmitted by the second certification authority 300 that has requested the issuance of certification information. The certification information determination unit 142 determines the above based on the information of the second certificate authority 300 stored in the second certificate authority storage unit 153. The secret key determination unit 143 publishes whether or not the end entity 400 that has transmitted the certification request information includes a secret key that is paired with the public key information included in the certification request information 500 received by the certification request reception unit 111. Based on the key information, the processing device determines. The secret key determination unit 143 determines whether or not the end entity 400 has a secret key, for example, by confirming the signature generated by the end entity 400 using the secret key with the public key information.

  The storage unit 150 stores information related to the certificate authority, certification information, a public key, and the like in a storage device. The storage unit 150 includes a certificate authority certificate storage unit 151, a first certificate authority storage unit 152, and a second certificate authority storage unit 153. The certificate authority certificate storage unit 151 stores the certificate authority certificate information transmitted by the second certificate authority 300 in the storage device. When the certification information determination unit 142 determines that the certification authority certification information is transmitted by the second certification authority 300, the certification authority certification storage unit 151 stores the certification authority certification information in the storage device. The first certificate authority storage unit 152 stores information on the first certificate authority 200 that issues the examination certification information 530 in the storage device. Here, the first certificate authority storage unit 152 stores certification information issued by the first certificate authority 200 as information of the first certificate authority 200 as shown in FIG. The second certificate authority storage unit 153 stores information of the second certificate authority that issues the certificate authority certification information in the storage device. Here, the second certificate authority storage unit 153 stores certification information issued by the second certificate authority 300 as information of the second certificate authority, as shown in FIG. 7 described later.

Here, an example of information of the first certificate authority 200 stored in the first certificate authority storage unit 152 will be described. FIG. 6 is an example of information on the first certificate authority 200 stored in the first certificate authority storage unit 152.
The first certificate authority storage unit 152 includes a subject name, certificate information issue certificate authority name, serial number, and certificate information. The subject name is identification information of the first certificate authority 200. The issuing certificate authority name is the name of the certificate authority that issued the certification information. The issuing certificate authority name is not limited to the name of the certificate authority, but may be any other name as long as it identifies the certificate authority. The serial number is a key item for identifying data stored in the first certificate authority storage unit 152. The certification information is certification information such as a public key and is made up of binary data or the like.

Next, an example of information on the second certificate authority 300 stored in the second certificate authority storage unit 153 will be described. FIG. 7 is an example of information on the second certificate authority 300 stored in the second certificate authority storage unit 153.
An example of information of the second certificate authority 300 stored in the second certificate authority storage unit 153 shown in FIG. 7 is substantially the same as that in FIG. The second certificate authority storage unit 153 has information on the issuing method for each certificate authority in addition to the information shown in FIG. In FIG. 7, as one example, online flag information is stored. In FIG. 7, when the online flag is true, information on the connection destination is also stored.

  Like the certificate authority C shown in FIG. 6 and FIG. 7 described above, both the first certificate authority 200 and the second certificate authority 300 may have corresponding certificate authorities.

  Next, the operation of the certification request information generation process in which the end entity 400 generates the certification request information 500 will be described. FIG. 8 is a flowchart showing the operation of the certification request information generation process in which the end entity 400 generates the certification request information 500. When the end entity 400 requests the second certificate authority 300 to issue the certificate authority certification information as described above, the end entity 400 generates the certificate request information 500. Then, the end entity 400 transmits the generated certification request information 500 to the certification issuance request apparatus 100.

  In step ST100, the certification request information generation unit 440 selects a public key to be used as the public key information 540 of the certification request information 500. In other words, the certification request information generation unit 440 selects which of the public key generated by the key pair generation unit 410 or the registration certification information stored in the certification information storage unit 422 is to be used. When the certification request information generation unit 440 selects to use the public key generated by the key pair generation unit 410, the key pair generation unit 410 generates a public key / private key pair.

  In step ST101, the input unit 430 inputs the identification information of the end entity 400 as the identification information 550. Step ST101 can be omitted. As described above, when the input unit 430 omits the input of the identification information of the end entity 400, the subject name of the certification information can be used as the identification information 550.

  In step ST102, the certification request information generation unit 440 signs the public key information 540 and the identification information 550 selected in step ST100. The certification request information generation unit 440 performs a signature with the private key that is paired with the public key selected in step S100. The secret key used for certifying here is the public key information versus the secret key. The data signed here is a signature 520 using public key information versus a private key.

  In step ST103, the certification request information generation unit 440 signs the public key information versus private key signature 520 generated in step ST102 with a private key that is paired with the public key included in the examination certification information 530. The data signed here is a signature 510 with examination certification information versus a private key.

  In step ST104, the certification request information generation unit 440 generates the generated certification certificate information vs. secret key signature 510, public key information vs. private key signature 520, public key information 540, identification information 550, and examination certification information 530. The combined certification request information 500 is generated.

  The steps of the flowchart are summarized as follows. Step ST100 is a public key selection step. Step ST101 is an identification information input step. Step ST102 is a public key information vs. private key signing step. Step ST103 is an examination certificate information versus private key signature step. Step ST104 is a certification request information generation step.

  Next, the operation of the certification information issuing process in which the certification information issuing system 1000 issues certification information will be described. FIG. 9 and FIG. 10 are flowcharts showing the operation of the certification information issuing process in which the certification information issuing system 1000 issues certification information.

  In step ST200, the first certificate authority storage unit 152 stores the information of the first certificate authority 200 in the storage device. Here, the first certificate authority storage unit 152 stores certification information issued by the first certificate authority 200 shown in FIG. 6 as information of the first certificate authority 200.

  In step ST201, the second certificate authority storage unit 153 stores the information of the second certificate authority 300 in the storage device. Here, the second certificate authority storage unit 153 stores certification information issued by the second certificate authority 300 shown in FIG. 7 as information of the second certificate authority 300.

  In step ST202, the certification request reception unit 111 receives the certification request information 500 generated by the end entity 400 via the input reception device. That is, the certification request receiving unit 111 receives the certification request information 500 generated by the end entity 400 by the operation shown in FIG.

  In step ST203, the first certification authority determination unit 141 confirms whether the examination certification information 530 included in the certification request information 500 received in step ST202 is issued by the first certification authority 200. The first certification authority determination unit 141 is based on the certification information of the first certification authority 200 stored in the first certification authority storage unit 152, and the examination certification information 530 included in the certification request information 500 is that of the first certification authority 200. Determine whether. When the certification information 530 included in the certification request information 500 is that of the first certification authority 200, the first certification authority determination unit 141 proceeds to step ST204, and the certification information 530 included in the certification request information 500 is the first certification certification information 530. If it is not from one certificate authority 200, an error is returned to the end entity 400, and the process is terminated.

  In step ST204, first, the first certification authority determination unit 141 verifies the signature of the examination certification information 530 included in the certification request information 500 with the certification information of the first certification authority 200 stored in the first certification authority storage unit 152. . For example, the first certification authority determination unit 141 verifies the signature attached to the examination certification information 530 by using the public key included in the certification information of the first certification authority 200 stored in the first certification authority storage unit 152. is there. Next, the first certification authority determination unit 141 verifies the signature 510 using the certification information versus the private key included in the certification request information 500 using the public key included in the certification information 530. If it is determined that there is no error in both of the above two verifications, the first certification authority determination unit 141 proceeds to step ST205, and if it is determined that either of them results in an error, the first certificate authority determination unit 141 returns an error to the end entity 400. To end the process.

  In step ST <b> 205, the private key determination unit 143 verifies the signature 520 with the public key information versus the private key included in the certification request information 500 using the public key information 540 included in the certification request information 500. If the verification does not result in an error, the secret key determination unit 143 proceeds to step ST206. If the verification results in an error, the secret key determination unit 143 returns an error to the end entity 400 and ends the process.

  In step ST206, the storage unit 150 stores identification information included in the certification request information 500.

  In step ST207, the designation information receiving unit 112 receives an inquiry from a certificate authority that can issue certification information from the end entity 400. That is, the designation information receiving unit 112 receives an inquiry about the second certificate authority 300 stored in the second certificate authority storage unit 153.

  In Step ST208, the second certificate authority storage unit 153 reads the information of the second certificate authority 300 that is stored.

  In step ST209, the transmission unit 120 transmits the list of information of the second certificate authority 300 read in step ST208 to the end entity 400.

  In step ST210, the designation information receiving unit 112 receives designation information for designating the second certificate authority 300 that requests the issuance of certification information from the end entity 400.

  In step ST211, issue request information generating section 130 generates issue request information including public key information and identification information. Here, the public key information is the original data of the certificate authority certification information generated by the second certificate authority 300. The identification information is the original data of the subject name of the certification authority certification information. That is, the identification information is used to indicate ownership information of the certification authority certification information.

  In step ST212, the certificate authority specifying unit 131 specifies the second certificate authority 300 that requests issuance based on the designation information. The certification request transmission unit 121 acquires information on the second certification authority 300 identified by the certification authority identification unit 131 from the second certification authority storage unit 153.

  In step ST213, the certification request transmission unit 121 transmits certification information issuance request information to the second certification authority 300 identified by the certification authority identification unit 131 based on the information of the second certification authority 300 acquired in step ST212.

  In step ST214, the certification information receiving unit 113 receives the certification authority certification information from the second certification authority 300.

  In step ST215, the certification information determination unit 142 verifies the signature of the certification authority certification information received by the certification information reception unit 113 with the certification information stored in the second certification authority storage unit 153. Here, verifying with the certification information stored in the second certification authority storage unit 153 means, for example, verifying the signature of the certification authority certification information with the public key of the certification information stored in the second certification authority storage unit 153. It is. In other words, it is confirmed here that the other is not impersonating the second certificate authority 300. The certification authority certification storage unit 151 stores certification authority certification information when the certification information determination unit 142 determines that no error occurs in the verification. If it is determined that no error occurs in the verification, the certification information determination unit 142 proceeds to step ST216. If it is determined that an error occurs in the verification, the certification information determination unit 142 returns an error to the end entity 400 and performs processing. finish.

  In step ST216, the transmission unit 120 transmits the certification authority certification information to the end entity 400.

  In step ST217, the end entity 400 receives the certification authority certification information. The certification information storage unit 422 stores the certification authority certification information.

  The steps of the flowchart are summarized as follows. Step ST200 is a first certificate authority storage step. Step ST201 is a second certificate authority storage step. Step ST202 is a certification request receiving step. Steps ST203 and ST204 are first certificate authority determination steps. Step ST205 is a secret key determination step. Step ST206 is an identification information storage step. Steps ST207 to ST210 are designation information receiving steps. Steps ST211 to ST213 are certification request transmission steps. Steps ST214 and ST215 are certification information reception steps. Steps ST216 and ST217 are certificate authority certification information transmission steps.

  As described above, by issuing the certificate issuance request apparatus 100 and requesting the issuance of the certification information, it is possible to receive the certification information from the certificate authority that has not received the certification information until now. Become. Further, since the certificate issuance requesting apparatus 100 stores a plurality of second certificate authorities 300, the end entity 400 can select a plurality of certificate authorities from which certificate authority certificate information is requested.

  The above-described first embodiment is summarized as follows.

  The certificate issuance request apparatus 100 shown in the first embodiment is a public key registration method having the following functions (a) to (f). (A) It has an examination trust point database (first certificate authority storage unit 152) that registers the issuing certificate authority of certification information used for signature verification for identity verification as a trust point. (B) It has examination trust point confirmation means (first certificate authority determination unit 141) for confirming whether certification information used for signature verification is already registered in the examination trust point database. (C) It has an issuance trust point database (second certificate authority storage unit 153) for registering a certificate authority requesting issuance of certification information as a trust point. (D) It has an issuance trust point selection means (certificate authority specifying unit 131) that obtains information of the issuance trust point database and makes it possible to select an issue certificate authority from the end entity 400. (E) It has an issue certificate information database (certificate authority certificate storage unit 151) that stores the certificate information that is issued and requested by itself. (F) Issuing certificate information confirmation means for verifying the acquired certification information using the certification information of the certificate authority registered in the issuing trust point database before storing the acquired certification information in the issuing certification information database ( A certification information determination unit 142).

  In addition to the functions (a) to (f) described above, the certificate issuance request apparatus 100 shown in the first embodiment has a pair of public keys to which certification information is issued in addition to signature verification for identity verification. Signature verification means (secret key determination unit 143) for confirming possession of the secret key to be used.

  Furthermore, in addition to the functions (a) to (f) described above, the certificate issuance request apparatus 100 shown in the first embodiment enables certification information to be issued as a target for issuing certification information.

  Furthermore, in addition to the functions (a) to (f) described above, the certificate issuance request apparatus 100 shown in the first embodiment includes the identity information that is the original information of the subject name of the certification information, the input information by the end entity, Either the subject name of the certification information to be issued certification information or the subject name of the certification information used for signature verification for verifying the identity is made possible.

Embodiment 2. FIG.
Next, a second embodiment will be described. In the second embodiment, a process when examination certification information 530 included in certification request information 500 received from the end entity 400 is not issued by the first certificate authority 200 will be described.

  When the certification certificate information 530 included in the certification request information 500 is not issued by the first certification authority 200, the certification issuance request apparatus 100 determines that the certification certificate information 530 included in the certification request information 500 has previously received certification authority certification information. It is confirmed whether the certificate is issued by the issued second certificate authority 300. That is, the certification issuance request apparatus 100 checks whether the examination certification information 530 included in the certification request information 500 is the second certification authority 300 that issued the certification authority certification information stored in the certification authority certification storage unit 151. When the certification certificate information 530 included in the certification request information 500 is issued by the second certification authority 300 that has previously issued the certification authority certification information, the certification issuance request apparatus 100 checks the certification certification information included in the certification request information 500. The issuance of the certification authority certification information from the same second certification authority 300 as the second certification authority 300 that issued 530 is permitted.

  According to the second embodiment, the certificate issuing system 1000 authenticates from the certificate authority that issued the certification information 530 even if the end entity 400 has only the certification information 530 that is not registered as the first certification authority 200. It is possible to receive the certificate information.

The above-described second embodiment is summarized as follows.
In the certificate issuance request apparatus 100 shown in the second embodiment, in addition to the certificate issuance request apparatus 100 shown in the first embodiment, certification information used for signature verification for identity verification is not registered in the examination trust point database. Even if it is stored in the above issuance trust point certification information database, the certification information is issued from the same certificate authority as the certification information used for signature verification for identity verification.
Similarly, in the certificate issuance request apparatus 100 shown in the second embodiment, in addition to the certificate issuance request apparatus 100 shown in the first embodiment, the certification information used for signature verification for verifying the identity is the above-described examination trust point. Even if it is not registered in the database, if it is stored in the issuance certification information database, the certification information is issued from the same certificate authority as the certification information used for signature verification for identity verification.
Here, the issuance trust point certification information database can register all certificates authenticated by the certificate authority. On the other hand, in the issue certificate information database, only certificates issued via the certificate issue request device 100 can be registered.

2 is a diagram illustrating an example of a hardware configuration of a certificate issuance request apparatus 100 according to Embodiment 1. FIG. 1 is an overall schematic diagram of a certificate issuing system 1000 according to a first exemplary embodiment. 4 is a functional block diagram showing functions of an end entity 400. FIG. It is a block diagram which shows the structure of the certification request information 500 which the end entity 400 produces | generates and transmits to the certification issue request apparatus 100. 3 is a functional block diagram illustrating functions of the certificate issuance request apparatus 100. FIG. It is an example of the information of the 1st certification authority 200 which the 1st certification authority memory | storage part 152 memorize | stores. It is an example of the information of the 2nd certificate authority 300 which the 2nd certificate authority memory | storage part 153 memorize | stores. It is a flowchart which shows the operation | movement of the certification request information generation process in which the end entity 400 produces | generates certification request information 500. It is a flowchart which shows operation | movement of the certification | authentication information issuing process in which the certification | authentication issuing system 1000 issues certification information. It is a flowchart which shows operation | movement of the certification | authentication information issuing process in which the certification | authentication issuing system 1000 issues certification information.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 Certification issue request apparatus, 110 receiving part, 111 Certification request receiving part, 112 Specification information receiving part, 113 Certification information receiving part, 120 Transmitting part, 121 Certification request transmitting part, 130 Issuing request information generating part, 131 Certificate authority specifying part , 140 determination unit, 141 first certificate authority determination unit, 142 certificate information determination unit, 143 secret key determination unit, 150 storage unit, 151 certificate authority certificate storage unit, 152 first certificate authority storage unit, 153 second certificate authority storage 200, first certificate authority, 300 second certificate authority, 400 end entity, 410 key pair generation unit, 420 entity storage unit, 421 key storage unit, 422 certification information storage unit, 423 certification request storage unit, 430 input unit, 440 certification request information generation unit, 500 certification request information, 510 examination certification information vs. signature by private key, 520 public Signature by key information vs. private key, 530 examination certificate information, 540 public key information, 550 identification information, 901 CRT, 902 K / B, 903 mouse, 911 CPU, 912 bus, 913 ROM, 914 RAM, 915 communication board, 920 Magnetic disk unit, 921 OS, 922 window system, 923 program group, 924 file group, 940 Internet, 941 gateway, 942 LAN.

Claims (11)

A first certificate authority that issues certification information , a first certificate authority storage unit that stores information of the first certificate authority registered in advance in a storage device;
A second certification authority storage unit that stores information of a second certification authority that is a request destination for issuing certification information in a storage device;
The certification request information with certification information, and proof request receiving unit that receives via the input receiving device,
Based on the information on the first certificate authority stored in the first certificate authority storage unit and the information on the second certificate authority stored in the second certificate authority storage unit, the certification request information received by the certification request reception unit is certification information included in said first certificate by the certificate authority issued, or, a first certificate authority determination unit determining the processing unit whether a certificate issued the second certificate authority,
When the first certification authority determination unit determines that the certification information included in the certification request information is certification information issued by the first certification authority or certification information issued by the second certification authority , the second authentication A certification request transmission unit for transmitting, through an output transmission device, new certification information issuance request information to the second certification authority based on the information of the second certification authority stored in the local storage unit Issuance request device. The second certificate authority storage unit stores information about a plurality of second certificate authorities in a storage device,
The certificate issuance request device further includes:
A designation information receiving unit for receiving designation information for designating a second certificate authority requesting certification via an input receiving device;
Based on the designation information received by the designation information receiving unit, a certification authority identifying unit that identifies the second certification authority requesting certification by the processing device,
The certification request transmission unit includes certification information included in the certification request information, certification information issued by a first certification authority, or a second certification authority identified by the certification authority identification unit among the plurality of second certification authorities. When the first certificate authority determination unit determines that the certification information is issued, the request information is transmitted to the second certificate authority specified by the certificate authority specifying unit via the output transmission device. The certificate issuance request apparatus according to claim 1. The certificate issuance request device further includes:
Against issuance request information which the certificate request transmitting unit transmits to the second certification authority, a certification information the second authentication station transmits the certification information receiving unit that receives via the input receiving device,
Based on the second information of the certificate authority that the certification information said proof information receiving unit receives and stores the second authentication station storage unit, that the second certification authority is transmitted certificate information to determine the processing device A certification information determination unit;
2. The certificate issuance request according to claim 1, further comprising a certificate authority certificate storage unit for storing the certificate information when the certificate information determination unit determines that the certificate information is transmitted by the second certificate authority. apparatus. The certification request receiving unit receives certification request information having public key information via an input receiving device,
The certificate issuance request device further includes:
A secret that is determined by the processing device based on the public key information as to whether or not the source of the certification request information has private key information that is paired with the public key information included in the certification request information received by the certification request receiving unit. A key determination unit,
When the secret key determination unit determines that the transmission source has a secret key, the certification request transmission unit transmits the public key information together with the issue request information to the second certificate authority via the output transmission device,
The certificate issuance request device further includes:
A certificate for receiving, via the input receiving device, certification information generated and transmitted by the second certification authority based on the public key information in response to the issuance request information transmitted from the certification request transmitting unit to the second certification authority. The certificate issuance request apparatus according to claim 1, further comprising an information receiving unit. 5. The certificate issuance request apparatus according to claim 4 , wherein the certification request receiving unit receives certificate request information having an electronic certificate including a public key as the public key information via the input receiving apparatus. 5. The certificate issuance request apparatus according to claim 4 , wherein the certification request receiving unit receives certification request information having a public key as the public key information via an input receiving apparatus. The certification request receiving unit receives the transmission source identification information for identifying the transmission source together with the certification request information via the input reception device,
The certification request transmission unit transmits the source identification information together with the issue request information to the second certificate authority via the output transmission device,
It said proof information receiving unit, the transmitting the certification information with source identification information as the own information, certification issue request device according to claim 3, wherein the received via the input reception device. The certification request receiving unit receives certification request information having certification information including identification information via an input receiving device,
The certification request transmission unit transmits the identification information included in the certification information together with the issue request information to the second certification authority via the output transmission device,
4. The certificate issuance requesting apparatus according to claim 3, wherein the certification information receiving unit receives certification information having identification information included in the certification information as possession information via the input receiving apparatus. The certification request receiving unit receives certification request information having an electronic certificate including a public key and identification information as the public key information via an input receiving device,
The certification request transmission unit transmits the identification information included in the electronic certificate together with the issue request information to the second certificate authority via the output transmission device,
4. The certificate issuance requesting apparatus according to claim 3, wherein the certification information receiving unit receives certification information having identification information included in the electronic certificate as possession information through the input receiving apparatus. A proof request receiving step of receiving the certification request information with certification information,
The first certificate authority information stored in the storage device in advance , the registered first certificate authority information and the second certificate authority information stored in the storage device in advance, and issuing the certification information based on the second authentication station information as a request destination, certification information certification request information received by said proof request receiving step has found the first certification information certificate authority issued, or, the second certificate authority whether the issued certificate information and the first authentication station determining step that determine a constant,
When it is determined in the first certification authority determination step that the certification information included in the certification request information is certification information issued by the first certification authority or certification information issued by the second certification authority , the second authentication proof, characterized in that to execute a certification request transmission step of sending a request for issuing information in the second new certificate to the certificate authority on the basis of the second information of the certificate authority stored in the storage device in the station storing step on a computer Issuing program. An input receiving unit, a certificate request receiving step of receiving the certification request information with certification information,
The processing device is information on the first certificate authority stored in the storage device in advance , which is information on the registered first certificate authority, information on the second certificate authority stored in the storage device in advance, and certification information based on the second authentication station information on which to issue the request destination and, certification information certification request information received by said proof request receiving step has found certification information issued by the first certification authority, or the second whether the authentication station is issued by certification information and the first authentication station determining step that determine a constant,
When the output transmitter determines in the first certification authority determination step that the certification information included in the certification request information is certification information issued by the first certification authority or certification information issued by the second certification authority and characterized in that it comprises a certification request transmission step of sending the issue request information of the second second new certificate to the second certification authority based on the information of the certificate authority stored in the storage device in the authentication station storing step How to issue a certificate.

Images