JPH10285157A - Registration key duplex preventing device in authentication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To recognize whether an applied open key is justly generated or not and to prevent the duplex of a registration key by receiving application information where an electronic signature is given by a secret key, extracting filled open key information, certifying it with the electronic signature and recognizing the validity or invalidity of application. SOLUTION: An open key length calculation means 63 is called for recognizing whether open key information 62c filled in an application open key certificate issuing application 62a is valid application or not in a registration key validity verification processing part 53. The key length of the open key obtained in an application reception analysis processing part 52 is calculated and whether it is within the range of a registration possible open key length which is set in a system initial generation processing part 51 or not is verified. When verification justly terminates, the issuing processing of the open key certificate is executed by setting application to be just. Since the open key in length different from specified key length is registered, the registration of the open key duplexed with the open key is avoided. Even if the user imitates and applies the specified open key, the verification system easily recognizes it and rejects application.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an apparatus for preventing registration key duplication in an authentication system for certifying the validity of a public key used in a public key cryptosystem.

[0002]

2. Description of the Related Art When realizing electronic data exchange (EDI) and electronic commerce (EC) on a computer network, threats such as eavesdropping / spoofing / falsification / transmission denial are assumed. . Therefore, in order to protect the system from these threats, encryption communication and digital signature communication are generally used. This encryption method is described in, for example, the reference document “Diff
ie, W. and Helman, M .: New Directions in Cryptograph
y, IEEE Trans.Inf.Theory, IT-22,6 pp.644-654,1976 ''
It has been widely known in the world.

In such a public key cryptosystem, communication is performed using two types of keys: a public key that is widely publicized in general and a secret key that can be known only by the user. Here, simply by publicizing the public key, there is a threat called "spoofing" that disguises itself as another person, so it is necessary to have a third party certifying that the public key is legitimate owner, That is what is called a certification authority (CA).

[0004] An authentication system including this certificate authority performs electronic data exchange for electronically exchanging transactions between companies having a business relationship on a computer network, and transmits and processes information on a computer network to perform commercial transactions such as electronic settlement. This is a system that issues / manages a public key certificate for a public key cryptosystem used for the purpose of confidentiality of transmitted data and prevention of falsification when implementing electronic commerce. In other words, the authentication system issues a public key certificate that certifies the owner of a public key in the world of digital communications, in the same way that a government office issues a seal certificate that certifies the owner of a real seal in the real world of Japan. It can be said that the system has functions.

Generally, the following four functions are known as functions of an authentication system. (1) Public key registration function: A public key certificate is created / registered / issued for a public key applied by a user. (2) Certificate reference function: A public key certificate managed by an authentication system can be referred to from a user. (3) Public key revocation function: The public key certificate is revoked and posted on the revocation list. (4) Revocation list reference function: A user can refer to a list of revoked public key certificates.

[0006] These functions can be constructed using general means already provided by a computer system or a cryptographic algorithm, making a request using an application form at the time of application, and providing an authentication system and a user. It has already been recognized that the basic configuration method such as performing digital signature communication and managing public key certificates and revocation lists in directories and databases is also a general method.

When a user requests the authentication system to issue a public key certificate, the user presents information of a public key to be registered to the authentication system, and the authentication system receives the received public key information. Will issue a certificate to the customer. Here, the public key information presented to the authentication system is information that has already been made public. Therefore, for example, the user imitates the public key information of another person who has already been registered, and registers the exact same key as the public key in the authentication system, that is, the public key that the user has not properly created himself. May be registered in the authentication system.

In this way, when the same public key as the already registered public key is registered, the same public key information is described in the public key certificates of a plurality of different users. Situation will occur. As a result, the user of the public key certificate cannot distinguish which is a valid public key certificate, causing confusion. Further, when the above-described problem occurs with respect to a specific public key that is important in the authentication system, such as the public key of the authentication system, the confusion is further increased.

[0009] Therefore, as the most basic method for solving this problem, the same public key as the public key information which the applicant has applied for registration has already been managed by the authentication system. There is a method of searching for and confirming whether or not it exists in the.

[0010]

However, all the public key certificates managed by the above-mentioned authentication system are read out, and the public key certificate described in the public key certificate is referred to. In the method of searching for the presence or absence of the same public key, it is expected that the number of public key certificates will be enormous in the near future. Not.

The present invention has been made in view of the above-mentioned problems, and when a user makes a registration application for a public key, the public key to be registered is properly generated by the applicant himself, and the public key of another person is registered. The purpose of the present invention is to provide a device for preventing registration key duplication in an authentication system that enables an authentication system to easily and simply confirm that they are not the same, and to reject an improper application. And

[0012]

In order to achieve the above-mentioned object, the invention according to claim 1 of the present invention provides a public key certificate for issuing a public key certificate certifying that the user has a specified public key. An apparatus for preventing registration key duplication in an authentication system using a key encryption method, which receives application information that includes a public key to be registered and that has been electronically signed using a secret key corresponding to the public key. The electronic signature attached to the application is verified by the public key information obtaining means in the application for extracting the public key information described in the application, and the public key extracted by the public key information obtaining means in the application. The gist of the present invention is to have an application signature verification means for validating a case where the verification is normal and an improper application when the verification is abnormal.

[0013] According to the first aspect of the present invention, a private key corresponding to a registration key (public key) possessed only by a valid applicant is used for an application when the applicant registers a public key. Create an electronic signature, attach it to the application form, and send it to the authentication system.The accepted authentication system verifies the electronic signature attached to the application form to confirm that the registration is valid. Thus, it is possible to easily confirm that the applied public key is properly generated by the applicant and does not imitate the public key of another person, thereby preventing registration key duplication.

According to a second aspect of the present invention, there is provided a method for preventing registration key duplication in an authentication system using a public key cryptosystem for issuing a public key certificate for proving that a specified public key is owned. A device that receives a public key certificate issuance application from a user and extracts the public key information described in the issuance application, and obtains the public key information in the application. The key information obtaining means calculates the key length of the extracted public key, and a public key key length calculating means that regards only keys having a key length different from the key length of the specific key whose duplication is to be avoided as a legitimate application. It is the gist to have.

According to the second aspect of the present invention, only the public key having a key length different from the key length of the specific key is defined as a public key that can be registered, so that the applied public key overlaps with the specific key. The feature is that it is possible to easily confirm that no operation is performed.

[0016]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing a configuration of an authentication system according to one embodiment of the present invention. In FIG. 1, the user-side device 1 includes a processing unit 10 and an execution unit 20 provided corresponding to the processing unit 10. The processing unit 10 includes an application form creation processing unit 11. A public key certificate issuance application form creation means 21 is provided corresponding to the certificate creation processing unit 11. Similarly, the authentication system 3 includes a processing unit 30 and an execution unit 40 provided corresponding to the processing unit 30. The processing unit 30 includes an application reception analysis unit 31 and a registration key validity verification unit 32.
The execution means 40 includes an application form reception analysis processing unit 31
Public key certificate issuance application form reception analysis means 41 corresponding to
However, an application signature verification unit 42 is provided corresponding to the registration key validity verification processing unit 32.

The operation of the execution means in each processing unit will be described below with reference to FIGS.
First, in the application form creation processing section 11 of the user device 1, in step S1, the public key certificate issuance application form 21a describing the public key information to be registered is written by using the public key certificate issuance application form creation means 21. The electronic signature 21b is created using the secret key corresponding to the public key, and an application 21c obtained by attaching the electronic signature 21b to the application is sent to the authentication system 3.

On the other hand, in the application receiving / analyzing processing section 31 of the authentication system, the public key certificate issuance application receiving / analyzing means 41 is used to open the application sent from the user side apparatus 1 in step S2. An application relating to a key certificate issuance request, that is, a public key certificate issuance application 21c is received, and an application information section 41a and an electronic signature section 41b are separated and extracted from the public key certificate issuance application 21c. The public key information 41c is obtained from the application information section 41a.

Further, in step S3, the registration key validity verification processing unit 32 uses the application signature verification unit 42 to convert the electronic signature given to the application into the public key acquired by the application reception analysis unit 31. Is used to verify its validity. If this process is completed successfully, the applicant can generate a private key and a public key, and it can be considered that the public key has been applied for registration. If there is an abnormal termination, the applicant can deem that the registration does not have the private key corresponding to the public key for which registration was applied, and it is considered to be improper registration. The application pertaining to is rejected. This rejected public key certificate issuance application 2
The information relating to 1c is registered in the rejection list and is referred to when verifying the validity of the public key.

Next, the processing in this embodiment will be described in detail for each processing unit. First, the application form creation processing in the application form creation processing unit 11 on the user side will be described with reference to FIG.

Application form creation processing unit 1 performed by user side device 1
In 1, an application is created and sent to the authentication system 3 in order to receive the authentication system service. When requesting a service for issuing a public key certificate, first, a public key certificate issuance application Call the creation means 21. Here, the information (public key information, applicant name, etc.) required to create a public key certificate is described in the application form, and the application content described using the private key corresponding to the public key to be registered , A digital signature 21b is created, the digital signature 21b is attached to the public key certificate issuance application 21a, an application 21c is created, and this is sent to the authentication system 3. Here, generation of the electronic signature 21b to be attached to the application form 21a can be easily realized by using a method generally performed in a public key cryptosystem.

Next, an application reception analysis process in the application reception analysis processor 31 of the authentication system 1 will be described with reference to FIG. The application form reception / analysis processing unit 31 first uses the public key certificate issuance application form reception / analysis means 41 to receive a request application form for a public key certificate issuance service sent from a user. Next, as an application analysis process, a process of extracting and extracting information necessary for service execution from the public key certificate issuance application 21a is performed. Here, first, the application form 21a is separated into an application information section 41a and an electronic signature section 41b, and then the public key information 41c is obtained from the application information section 41a.

The reception of the application form can be realized by a method generally provided by a computer system, for example, e-mail, and the acquisition of necessary items from the application form can also be performed by using the electronic information reading function. And can be easily realized.

Next, the registration key validity verification processing in the registration key validity verification processing unit 32 will be described with reference to FIG. In the registration key validity verification processing unit 32, in order to confirm whether the public key information 41c described in the application is not a copy of an already registered one and is a valid application,
The application information verification unit 42 is called, and the application information unit 41a and the electronic signature unit 4 acquired by the application reception analysis unit 31 are called.
1b, using the public key information 41c as input, verifies the validity of the electronic signature. If the verification has been completed successfully,
The application determines that the applied public key is valid and issues a public key certificate. If the verification is abnormally completed, the application will be deemed to be invalid and the application will be rejected.

The verification of the electronic signature attached to the application can be realized by using a method generally performed in a public key cryptosystem.

According to the apparatus of the present embodiment, when a user does not generate a public key properly by himself / herself and applies for registration by imitating a public key of another person, for example, the authentication system simply confirms this. Then, the application can be rejected, thereby preventing duplication of the registration key.

Next, another embodiment according to the present invention will be described with reference to FIGS. 4, the authentication system 5 includes a processing unit 50 and an execution unit 60 provided corresponding to the processing unit 50. The processing unit 50 includes a system initial generation processing unit 51, an application form reception analysis processing unit 52, and a registration key validity verification processing unit 53. In addition, a registerable public key length setting unit 61 corresponding to the system initial generation processing unit 51, a public key certificate issuance application reception acceptance unit 62 corresponding to the application reception analysis unit 52, a registration key validity verification In correspondence with the processing unit 53, a public key key length calculating unit 63 and a processing unit for calling these functions are provided.

Hereinafter, the operation of the execution means in each processing unit will be described according to the processing procedure. First, in step S11, the system initial generation processing unit 51 uses the registrable public key length setting means 61 to change the range of the key length of the public key permitted to be registered by the user to the specific key for which the duplication is to be avoided. Remove the key length and set.

In step S12, the application form receiving / analyzing processing section 52 uses the public key certificate issuance application form receiving / analyzing means 62 to issue an application form relating to a request for issuing a public key certificate from a user, ie, a public key. The certificate issuance application 62a is accepted, and the public key information 63c is extracted from the public key certificate issuance application 62a.

Subsequently, in step S13, the registration key validity verification processing unit 53 causes the public key key length calculation unit 63
, The key length of the applied public key is calculated from the public key information 63c, and the registrable public key key set by the recordable public key length setting means 61 with reference to the system initial generation setting value table 61a. Check if the length is within the range. If the request is for a public key with a key length outside the setting range, this will be rejected. This rejected public key certificate issuance application form 62a
Is registered in a rejection list provided in the system initial generation setting value table 61a, for example, and is referred to when verifying the validity of the public key.

Next, the processing in this embodiment will be described in detail for each processing unit with reference to FIG. First, a system initial generation process in the system initial generation processing unit 51 will be described. In the initial generation process of the authentication system in the system initial generation processing unit 51, various initialization processes are performed, and as a part of the process, the registerable public key length setting unit 61 is called. Registerable public key key length setting means 61
In the system initial generation setting value table 61a for managing system initial generation values, an item of registrable public key length is provided, and the key length of a specific key that the authentication system 5 wants to avoid duplicate registration from a user is provided here. A key length in a range not included is set as a key length that can be registered.

Here, management of the system initial generated value can be easily realized by using functions provided in a general computer system.

Next, the application form reception analysis processing in the application form reception analysis processing section 52 will be described. The application form reception / analysis processing unit 52 first uses the public key certificate issuance application form reception / analysis means 62 to receive a request application form 62a for a public key certificate issuance service sent from a user. Next, this public key certificate issuance application form 62
As the analysis process a, a process of extracting information necessary for service execution from the application form is performed. Here, the public key information 62c is obtained from the public key certificate issuance application 62a.

The reception of the application form can be realized by a method generally provided by a computer system, for example, e-mail, and the acquisition of necessary items from the application form can also be performed by using the electronic information reading function. And can be easily realized.

Next, the registration key validity verification processing in the registration key validity verification processing unit 53 will be described. The registration key validity verification processing unit 53 confirms whether the public key information 62c described in the application form public key certificate issuance application form 62a does not imitate a specific key and is a valid application. In order to do so, the public key key length calculating means 63 is called to calculate the key length of the public key acquired by the application reception analysis processing unit 52, and the registrable public key key length set by the system initial generation processing unit 51 is calculated. Verify that it is within range. If the verification is properly completed here, it is confirmed that the applied public key and the specific key are clearly different, and the application is deemed to be valid, and the public key certificate issuance process is performed. I do. If the verification is abnormally completed, the application will be deemed to be invalid and the application will be rejected.

The calculation of the key length of the public key can be easily and quickly realized by a bit processing function provided by a computer system.

According to the present embodiment, since only the public key having a key length different from the key length of the specific key is registered, it is possible to easily avoid registration of a public key duplicated with the specific key. it can. Therefore, when the user imitates a specific public key and applies, the authentication system can easily confirm this and reject the application.

[0038]

As described above, the registration key duplication preventing apparatus in the authentication system according to the first aspect of the present invention receives application information electronically signed using a secret key corresponding to a public key, The public key information described in the application form is extracted, and the electronic signature attached to the application form is verified by using the public key information. The application can be easily verified that the applied public key is properly generated by the applicant and does not imitate the public key of another person, preventing the registration key from being duplicated. Play.

The registration key duplication prevention device in the authentication system according to claim 2 of the present invention extracts the public key information described in the application form for issuing a public key certificate,
The key length of this public key is calculated, and only keys with a key length different from the key length of the specific key whose duplication is to be avoided are regarded as valid applications. There is an effect that it is possible to easily confirm that no operation is performed.

As described above, according to the present invention, when a user makes an application for registration of a public key to the authentication system,
Quickly and easily check whether the applied public key is an improper application, such as imitating a registered public key, rather than a public key that was properly generated by the user. It is possible to construct a registration key duplication prevention method that can be performed. By using this method, it is possible to provide a registration key duplication prevention service in an authentication system.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a schematic configuration of an embodiment of an authentication system to which a registration key duplication prevention device according to the present invention is applied.

FIG. 2 is a block diagram for explaining processing on a user side of a registration key duplication preventing device in the authentication system shown in FIG. 1;

FIG. 3 is a block diagram for explaining processing on the authentication system side of the registration key duplication prevention device in the authentication system shown in FIG. 1;

FIG. 4 is a block diagram showing a schematic configuration of another embodiment of an authentication system to which a registration key duplication prevention device according to the present invention is applied.

FIG. 5 is a block diagram for explaining processing in the registration key duplication prevention device shown in FIG. 4;

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 User side apparatus 3,5 Authentication system 10,30,50 Processing part 11 Application creation processing part 20,40,60 Execution means 21 Public key certificate issuance application creation means 21a Public key certificate issuance application 21b Application Electronic signature 21c Application sent to authentication system 31 Application reception analysis unit 32 Registration key validity verification processing unit 41 Public key certificate issuance application reception acceptance analysis means 41a Application information unit 41b Electronic signature unit 41c Public key information 42 Application signature verification means 51 System initial generation processing unit 52 Application reception analysis processing unit 53 Registration key validity verification processing unit 61 Registerable public key key length setting means 61a System initial generation setting value table 62 Public key certificate issuance application Document reception analysis means 62a Application form 63 Public key key length calculation means

 ──────────────────────────────────────────────────続 き Continued on the front page (72) Inventor Shinichi Nakahara 223-1 Yamashita-cho, Naka-ku, Yokohama-shi, Kanagawa Prefecture NTT Software Corporation

Claims (2)

[Claims] Claims 1. An apparatus for preventing registration key duplication in an authentication system using a public key cryptosystem for issuing a public key certificate for proving that a specified public key is owned, including a public key to be registered. And a means for obtaining application key information in an application for receiving application information electronically signed using a private key corresponding to the public key and extracting the public key information described in the application. The electronic signature attached to the application is verified by the public key information extracted by the in-book public key information acquisition means, and the application is determined to be valid if the verification is normal and invalid if the verification is abnormal. An apparatus for preventing registration key duplication in an authentication system, comprising: signature verification means. 2. An apparatus for preventing registration key duplication in an authentication system using a public key cryptosystem for issuing a public key certificate for certifying the owner of a specified public key, comprising: An application public key information obtaining means for receiving a certificate application form and extracting the public key information described in the application form, and a public key extracted by the application public key information obtaining means. A public key key length calculating means for calculating only a key length different from the key length of a specific key whose duplication is to be avoided as a legitimate application. Duplication prevention device.