JPH11331142A - Method and device for managing public key certificate - Google Patents

Abstract

PROBLEM TO BE SOLVED: To accelerate the examining processing of a public key certificate by dispensing with the examination of a public key certificate, which is examined by an examination device inside a LAN, at the other examination device on the LAN to which plural public key certificate examination devices are connected. SOLUTION: A public key certificate managing device 10 is installed inside a LAN and prior to performing the examining processing of the public certificate, each of examination devices 20, 21, 22 and so on inquires whether or not this public key certificate is registered in the public key certificate managing device. When it has been already registered, the examining processing is omitted. When the examining processing of the public key certificate is made successful each examination device registers such a public key certificate in the public key certificate managing device. By sharing the examined public key, the examining processing of the shared public key certificate can be omitted so that enciphering processing using the public key cryptograph can be acceleted.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a public key certificate management method and a verification method in a cryptographic communication system using public key cryptography, and more particularly to a public key certificate management suitable for use in an encrypted electronic mail system and an electronic commerce system. Method and assay method.

[0002]

2. Description of the Related Art In recent years, the Internet has exploded as a new information communication medium, and various companies and individuals have been using the WWW.
(World Wide Web) and information exchange using e-mail. Also,
The Internet has begun to be used as a new sales channel for products and services because information can be exchanged regardless of geographical restrictions and unspecified number of people can freely access it. 2. Description of the Related Art A sales form in which a service is advertised or sold and a payment process is performed by inputting a credit card number has been adopted. In addition, because software that assumes the Internet, such as WWW browsers, has been reduced in price,
Many companies have begun to consider the exchange of contract information, which used to be performed using a dedicated line, on the Internet. As described above, the Internet has begun to be used not only as a simple exchange of e-mails and transmission of information, but also as a communication medium for transmitting information such as settlement information and contract information directly related to the transfer of money.

However, since the Internet has originally developed as an inter-organizational network between research institutions,
Inadequate consideration has been given to the security of the communication channel. Therefore, the following two problems must be solved in order to send and receive settlement information and contract information using the Internet. The first problem is that outsiders may be able to impersonate themselves and gain unauthorized access to corporate computers. The second problem is that communications may be intercepted or tampered with. .

As a method of solving the first problem, there is known a method of using a firewall which is a device which permits only a specific communication designated in advance and rejects other communication. According to the firewall, since unauthorized communication from the Internet to the LAN can be blocked, unauthorized entry of the outsider into the LAN can be prevented. At present, most companies that use the Internet intervene a firewall between the Internet and a company LAN to prevent an outsider from illegally entering the company LAN.

As a method for solving the second problem, there is known a method of encrypting data to be transmitted and received by using an encryption technique to prevent interception and falsification of communication contents. Ciphers are broadly classified into symmetric key ciphers and public key ciphers. The common key encryption is an encryption using a common key for encryption and decryption. Public key cryptography uses two different keys for encryption and decryption. The common key cryptosystem has a disadvantage that a key must be secretly shared between parties performing communication in advance. On the other hand, in public key cryptography, since the encryption key and the decryption key are different, as long as the decryption key is kept secret, there is no danger of decrypting the encrypted data even if the encryption key is made public. For this reason, public key cryptography has the advantage that the encryption key can be sent as public information over the Internet. In addition to this property, public key cryptography can create electronic signatures, which are ciphertexts that can detect data tampering, so it is particularly attracting attention as a technology for preventing interception and tampering of communication contents on the Internet. Have been. Regarding public key cryptography, see Network Security, 1995, pp. 48-53 (Char
lie Kaufman, Radia Perlman,
Mike Spencer: “Network Se
currency ", 1995, Prentice Hal
1, pp. 48-53) (hereinafter referred to as reference [1]).

Hereinafter, a method of preventing communication contents from being intercepted and tampered with using public key cryptography, which is currently proposed, will be described in detail. A cryptographic communication system that uses public key cryptography to prevent interception and tampering of communication content will be referred to as a public key cryptosystem in this specification. In a public key cryptosystem, a communicating party creates a pair of keys called a public key and a secret key. The public key is a key to be sent to the communication partner, and the secret key is a key that only the user himself / herself keeps secret.
These two keys work in pairs so that data encrypted with one key can be decrypted with the other key.

[0007] A method for preventing interception of communication using these keys will be described below. First, the data receiver sends his public key to the data sender. The data sender then encrypts the data using the data recipient's public key and sends the encrypted data to the data recipient. Finally, the data receiver decrypts the received encrypted data using his / her private key. According to the above procedure, the encrypted data can be decrypted only by the data receiver holding the secret key, so that interception of the communication is prevented.

Next, a method for preventing falsification of communication using a pair of a public key and a secret key will be described. First, the data sender sends his public key to the data receiver. The data sender then encrypts the data using his or her private key, and sends both the unencrypted data and the encrypted data to the data receiver. Finally, the data receiver decrypts the encrypted data with the data sender's public key and compares it with the transmitted data before encryption to confirm that there is no discrepancy.
According to the above procedure, the above encrypted data can be created only by the data sender holding the secret key, so if the data is tampered on the communication path, the above comparison will not match, Data tampering can be detected. This falsification detection technique is known as an electronic signature technique.

In order to use public key cryptography, it is necessary to send a public key to a communication partner prior to communication as described above. However, if the public key itself is falsified at the time of transmission, a third party who has falsified the public key can decrypt the encrypted data. For this reason, the transmission of the public key must be performed without fear of tampering. As a method of preventing falsification of a public key, there is known a method in which a public key itself is given an electronic signature by an organization called a certificate authority, and the public key with the electronic signature is sent. A public key digitally signed by a certificate authority is called a public key certificate. The recipient of the public key certificate obtains the public key of the certification authority in advance by means other than the Internet, and verifies the electronic signature applied to the received public key certificate using the public key. According to the above procedure, the recipient of the public key certificate uses the public key after confirming that the received public key has not been tampered with. The above-described series of operations for confirming that the obtained public key has not been falsified is referred to as public key authentication in this specification.

In a typical public key cryptosystem, FIG.
A plurality of certificate authorities are provided as shown in FIG. Here, the hierarchical relationship is a relationship in which a higher-level certificate authority issues a public key certificate for a public key of a certain certificate authority. By establishing a hierarchical relationship between the certificate authorities in this way, the recipient of the encrypted data can obtain the public key certificate of the highest-level certificate authority in advance by means other than the Internet, and other certificate authorities and The user's public key can be authenticated by examining the public key certificate obtained using the Internet.

As described above, in the public key cryptosystem, the communicating party needs to hold and manage at least the highest-order public key certificate in order to authenticate the public key. The following is an encrypted email standard that implements a typical public key certificate management method, Privacy Enhancement For Internet Electronic Email: Part I, II, III, IV, Request For Comments: 1421-1424, 1993 (Privac)
y Enhancement for Internet
Electronic Mail: Part I, I
I, III, IV, Request for Comme
nts: 1421-1424, 1993)
PEM (Privacy Enhancement Mai) described in [2]
The public key certificate management method will be described by taking l) as an example.

In PEM, the e-mail creator attaches all public key certificates, from his public key certificate to the public key certificate of the top-level certificate authority, to the e-mail. Therefore, if the e-mail recipient obtains only the public key certificate of the highest-level certificate authority by means other than the Internet, the e-mail recipient verifies the public key certificate attached to the e-mail in order from the highest order, It is possible to authenticate the creator's public key. However, the RSA public key encryption algorithm described in the above-mentioned reference [1], pp. 129 to 144, which is a typical public key encryption algorithm, requires an exponentiation of an integer of several hundred bits for encryption processing. [2]: It takes 100 times or more processing time as compared with the DES common key encryption algorithm described on pages 60 to 73. Therefore, when a plurality of public key certificates are verified as described above, a problem occurs that it takes time to verify a target electronic signature.

In order to solve this problem and speed up the public key certificate verification process, in the above-mentioned document [2]: Part II, pages 24 to 26, once a table on the verified information processing apparatus is stored. A public key certificate management method has been proposed in which public key certificates that have been successfully verified are accumulated, and verification is omitted when the same public key certificate is received again. By using this method, when an e-mail is received from the same communication partner a plurality of times, the public key certificate verification process can be omitted in the second and subsequent communications, so that the public key certificate verification process can be speeded up. is there.

In the above, the management method of the public key certificate has been described.
Although the PEM has been described as an example, other public key cryptosystems employ the same method as the PEM.

[0015]

The above-described conventional public key certificate management method has the following problems.

Consider a case where a plurality of information processing devices connected to a LAN perform encrypted communication using public key encryption with a communication partner outside the LAN. In this case, in the conventional public key certificate management method, each information processing device in the LAN individually performs a public key certificate verification process. For this reason, even when a plurality of information processing apparatuses receive the same public key certificate, each of the information processing apparatuses must duplicately verify the same public key certificate. The RSA public key encryption algorithm, which is a typical public key encryption algorithm, requires a modular exponentiation calculation of an integer of several hundred bits, so that the encryption process takes a long time. For this reason, when each information processing apparatus performs the verification of the public key certificate in duplicate, there is a problem that the verification process takes a long time and the throughput of the entire cryptographic communication system is reduced.

To solve this problem, a method of sharing a storage area used by a public key encryption application on each information processing apparatus by a directory sharing system is considered. However, there are various types of directory sharing systems that have been put into practical use, and in order to use the above method, end users must manually set directory sharing or specialize in specific directory sharing systems. You need to use a public key encryption application. In the case of the former, the end user must bear the burden of setting up directory sharing. In the case of the latter, the public key encryption application loses versatility. Must be developed. Therefore, if the above method is used, the burden on the end user or the developer of the public key cryptographic application increases.

The present invention has been made in view of the above problems, and in a LAN to which a plurality of information processing devices are connected, a public key certificate already verified by any one of the information processing devices in the LAN is: It is an object of the present invention to eliminate the need for verification in other information processing apparatuses and to speed up the verification processing of public key certificates.

[0019]

SUMMARY OF THE INVENTION A public key certificate management method provided by the present invention has been devised to achieve the above object, and is a public key certificate management device connected to an information processing device via a network. The public key certificate management method according to the above, wherein the public key certificate received from the information processing device, the certification is successful, is stored, and when a registration inquiry is received from the information processing device, the stored public key certificate It is determined whether or not a matching public key certificate exists therein, and a response is made as to whether or not there is a corresponding public key certificate as a response to the registration inquiry.

A public key certificate verification method provided by the present invention is a public key certificate verification method in an information processing device connected to a public key certificate management device via a network, the method including receiving a public key certificate and receiving the public key certificate. When the certificate is verified, the public key certificate management device is inquired as to whether the public key certificate is registered. If the certificate is registered, the verification process is omitted, and if the certificate is not registered, the public key certificate is not registered. The certificate is verified, and when the verification is successful, the public key certificate that has been successfully verified is transmitted to the public key certificate management device.

According to the above method, in a LAN to which a plurality of information processing apparatuses are connected, all public key certificates verified by any of the information processing apparatuses in the LAN are registered in the public key certificate management apparatus. Any information processing device in the LAN, upon receiving the public key certificate, inquires of the public key certificate management device that the received public key certificate has already been verified by another information processing device in the LAN. You can know whether or not. Here, if the public key certificate has already been verified, the duplicate verification process can be omitted, so that the speed of the public key certificate verification process can be increased. Therefore, according to the above method, in a LAN to which a plurality of information processing devices are connected,
The object of the present invention is achieved in that the public key certificate verified by any one of the information processing devices in the LAN need not be verified by another information processing device, and the verification processing of the public key certificate is speeded up.

[0022]

DESCRIPTION OF THE PREFERRED EMBODIMENTS First Embodiment An embodiment of the present invention will be described below in detail with reference to the drawings. The present embodiment is an example in which the present invention is applied to an electronic mail system with a digital signature using public key cryptography. Similarly, the present invention is also applied to a public key cryptosystem such as an electronic commerce system. can do.

First, the configuration of this embodiment will be described with reference to FIG. In this embodiment, the LAN 30 and the Internet 50 are connected via a firewall 40. The LAN 30 has a public key certificate management device 10 for storing verified public key certificates, and an electronic signature-email verification device 20, 21, 22,... For receiving an electronic signature electronic mail and verifying the electronic mail.・ Is connected,
The Internet 50 is connected to an electronic mail creation device 60 with an electronic signature that applies an electronic signature to an electronic mail and transmits the electronic mail. According to the above configuration, the firewall 40
Because the LAN 50 cannot be directly accessed from the Internet 50, the public key certificate can be exchanged on the LAN 30 without being tampered with.

Next, the outline of the public key certificate management processing in the configuration of this embodiment will be described with reference to FIG. .. Operate in the same manner, the following description will be made on the case where the e-mail verification apparatus 20 with an electronic signature operates out of these apparatuses.

When receiving the electronic mail 510 with the electronic signature, the electronic mail verification device 20 with the electronic signature receives the public key certificate registered in the public key certificate management device 10 for each public key certificate attached to the electronic mail 510 with the electronic signature. The certificate inquiry data 520 is transmitted, and an inquiry is made as to whether the same public key certificate has already been registered. Next, upon receiving the registered public key certificate response data 530, which is a response to the above inquiry, from the public key certificate management device 10, the e-mail verification device 20 with the electronic signature, if the public key certificate has been registered, The public key certificate is trusted, and the public key certificate itself is omitted from the verification process. If the public key certificate has not been registered, the public key certificate is verified. If the verification of the public key certificate succeeds, the public key certificate registration data 540 is transmitted to the public key certificate management device 10, and the verified public key certificate is registered. Finally, the e-mail verification apparatus 20 with the electronic signature verifies the electronic signature using the public key certificate of the e-mail creator attached to the e-mail.

On the other hand, upon receiving the registered public key certificate inquiry data 520, the public key certificate management device 10 searches the public key certificate management table on the secondary storage device storing the verified public key certificate, and It is checked whether or not a matching public key certificate exists, and the result is registered as public key certificate response data 530, and the e-mail verification device 20 with an electronic signature is used.
Reply to. Further, upon receiving the public key certificate registration data 540, the public key management device 10 accumulates the verified public key certificate included in the public key certificate registration data 540.

According to the above-mentioned procedure, all the public key certificates verified by the electronic mail verification devices 20, 21, 22,... Email verification device 20, 2
Since the verification process of the public key certificate is omitted in 1, 22,..., The verification process of the public key certificate can be speeded up.

Next, the configuration of the public key certificate management device 10 will be described. The public key certificate management device 10 stores all the public key certificates verified by the electronic signature verification devices 20, 21, 22,.
10 and an electronic signature verification device 20 with an electronic signature,
21, 22,... When an inquiry is received from 21, 22,...
FIG. 3 is a configuration diagram of the public key certificate management device 10. The public key certificate management device 10 includes a secondary storage device control circuit 110,
CPU 120 and network interface circuit 1
30, a secondary storage device 140, and a main storage device 150. The secondary storage device 140 stores a public key certificate management table 1410 for storing verified public key certificates. The main memory 150 starts the public key certificate registration program 1520 when the public key certificate registration data 540 is received from the e-mail verification device 20 with the electronic signature, and receives the registered public key certificate inquiry data 520. The public key certificate communication control program 1510 for starting the public key certificate reference program 1530 and the public key for adding the verified public key certificate to the public key certificate management table 1410 when the public key certificate registration data 540 is received. A certificate registration program 1520, a public key certificate reference program that searches whether or not the public key certificate is stored in the public key certificate management table 1410 when the registered public key certificate inquiry data 520 is received, Work area 15 used by other programs
Forty is stored.

According to the above configuration, the public key certificate management device 10 can control the electronic mail verification devices 20 and 21
22 are stored in the public key certificate management table 1410, and when an inquiry is received from the e-mail verification devices 20, 21, 22,. Can be responded to whether has already been tested.

Next, the configuration of the public key certificate management table 1410 will be described. Public key certificate management table 141
0 is a table for storing verified public key certificates. FIG. 4 is a configuration diagram of the public key certificate management table 1410. The public key certificate management table 1410 has a public key certificate field 1411 and stores a verified public key certificate in this field.

With the above configuration, the public key certificate management device 1
0 is an e-mail verification device 20, 21, 2 with an electronic signature.
The certified public key certificate received from 2,... Is stored in this table, and the electronic signature verification device 2
When an inquiry is received from 0, 21, 22,..., By searching this table, it is possible to check whether or not the public key certificate has been verified and respond.

Next, an electronic mail verification device 2 with an electronic signature
0 will be described. The electronic signature-added e-mail verification device 20 is a device that verifies the electronic signature-added e-mail 510. In order to verify the electronic mail 510 with the electronic signature, it is necessary to verify the public key certificate attached to the electronic mail 510 with the electronic signature. In this apparatus, however, the public key certificate has been verified by the public key certificate management device. By inquiring whether or not there is, the verification process of the public key certificate is speeded up. FIG. 5 is a configuration diagram illustrating the configuration of the electronic mail verification device 20 with an electronic signature. The e-mail verification device with an electronic signature 20 includes a CPU 210, a network interface circuit 220, and a main storage device 230. In the main storage device, a communication control program 231 for starting the electronic signature verification program 2320 when receiving the electronic signature electronic mail 510 is received.
0, an electronic signature verification program 2320 for verifying the electronic signature electronic mail, a public key certificate verification program 2330 for verifying the public key certificate attached to the electronic signature electronic mail 510, and work used by the program. An area 2340 is stored. In particular, in the public key certificate verification program 2330, the public key certificate that has been successfully verified is registered in the public key certificate management device 10 so that it can be referred to from the other electronic mail verification devices 21, 22,. . In addition, the public key certificate verification program 2330 attempts to speed up the public key certificate verification process by inquiring of the public key certificate management device 10 before performing the public key certificate verification process.

With the above configuration, the electronic signature-certified electronic mail certification device 20 registers the verified public key certificate in the public key certificate management device 10, and refers to the public key certificate from another electronic signature-added electronic mail certification device. You can do it. In addition, an electronic mail verification device 20 with an electronic signature
Can omit the public key certificate verification process by inquiring of the public key certificate management device 10, so that the verification process of the electronic mail 510 with the electronic signature can be performed at high speed.

Next, the configuration of the electronic mail 510 with an electronic signature will be described. The electronic mail 510 with an electronic signature is data obtained by applying an electronic signature to the electronic mail, and is transmitted from the electronic mail with the electronic signature creating device 60 to the electronic mail with the electronic signature verification device 20. FIG. 6 is a configuration diagram of an electronic mail with an electronic signature. The electronic mail 510 with the electronic signature is composed of an electronic mail body 5101, an electronic signature 5102, and all public key certificates from the highest certificate authority to the e-mail creator, that is, the public key certificate 5103 of the highest certificate authority.
A public key certificate 5104 of a higher-level certificate authority authenticated by the public key of the highest-level certificate authority, a public-key certificate 5105 of a certificate authority authenticated by the public key of the higher-level certificate authority, and a public key certificate of the certificate authority. And a public key certificate 5106 of the e-mail creator to be authenticated.

By using the electronic mail 510 with the electronic signature having the above configuration, even a user who holds only the public key certificate of the highest certificate authority can verify the electronic mail with the electronic signature. it can.

Next, the configuration of the registered public key certificate inquiry data 520 will be described. The registered public key certificate inquiry data 520 is transmitted when the e-mail verification device 20 with the electronic signature inquires the public key certificate management device 10 whether the public key certificate has already been verified. FIG. 7 shows registered public key certificate inquiry data 520.
FIG. The registered public key certificate inquiry data 520 includes a public key certificate field 5201. The public key certificate field 5201 stores the public key certificate that the e-mail verification device with electronic signature 20 wants to inquire.

By using the public key certificate inquiry data 520 having the above configuration, the electronic mail verification device 20 with the electronic signature can check whether the specific public key certificate has been registered in the public key certificate management device 10. You can inquire.

Next, the registered public key certificate response data 530
Will be described. When the public key certificate management device 10 receives the registered public key certificate inquiry data 520 from the e-mail verification device 20 with an electronic signature, the registered public key certificate response data 530 is transmitted from the public key certificate management device 10 as a reply. The e-mail is sent to the e-mail verification device 20 with an electronic signature. FIG. 8 is a configuration diagram of the registered public key certificate response data 530. The registered public key certificate response data 530 is a public key certificate search result 5301 that is a logical value.
Consists of The value of the public key certificate search result 5301 is TRUE if the public key certificate included in the registered public key certificate inquiry data 520 has been verified, and FALSE if it has not been verified.

Public key certificate response data 5 having the above configuration
30 transmitted by the public key certificate management device 10,
The e-mail verification device 20 with the electronic signature can know whether or not the public key certificate has already been registered in the public key certificate management device 10, that is, whether or not the public key certificate has been verified.

Next, the processing contents of the public key certificate registration program 1520 will be described. The public key certificate registration program 1520 executes the communication control program 1 when receiving the registration of the public key certificate from the electronic mail verification device 20 with the electronic signature.
510 is activated. Public Key Certificate Registration Program 1
The input 520 is the public key certificate registration data 540 received from the electronic mail verification device 20 with the electronic signature, and there is no output. The public key certificate registration program 1520 includes the public key certificate 540 included in the input public key certificate registration data 540.
1 is added to the public key certificate management table 1410. The structure of the public key certificate 5401 is shown in FIG. The detailed processing contents of the public key certificate registration program 1520 are shown in FIG.
This will be described with reference to the drawings.

In step 50101, the public key certificate registration data 540 received from the electronic mail verification device 20 with the electronic signature is stored in the work area 1540.

In step 50102, the public key certificate management table 1410 is searched using the public key certificate 5401 included in the public key certificate registration data 540 as a key.

In step 50103, if the same record as the public key certificate 5401 exists in the public key certificate management table 1410, the process ends, and if no record exists, step 50104 is executed.

In step 50104, the public key certificate registration program 1520 adds the public key certificate 5401 as a record to the public key certificate management table 1410.

By the above procedure, the public key certificate registration program 1520 stores the public key certificate transmitted from the electronic signature verification apparatus 20 with the electronic signature in the public key certificate management table 14.
Add to 10.

By the above procedure, the public key certificate registration program 1520 inputs the public key certificate registration data 540
Can be added to the public key certificate management table 1410.

Next, the public key certificate reference program 1530
The details of the processing will be described. The public key certificate reference program 1530 is started by the communication control program 1510 when an inquiry about the registered public key certificate is received from the electronic signature verification apparatus 20 with an electronic signature. The input of the registered public key certificate inquiry program 150 is the registered public key certificate inquiry data 520 received from the e-mail verification device 20 with the electronic signature, and the output is the registered value holding the logical value representing the search result of the public key certificate. Public key certificate response data 530. The public key certificate reference program 1530 searches the public key certificate management table 1410 using the public key certificate 5201 described in the input registered public key certificate inquiry data 520 as a key, and determines whether or not the same certificate has been verified. A check is made, and the registered public key certificate response data 530 having the result as the public key certificate search result 5301 is transmitted to the e-mail verification device 20 with the electronic signature. The detailed processing contents of the public key certificate reference program 1530 will be described with reference to the PAD diagram of FIG.

At step 50201, the registered public key certificate inquiry data 520 received from the electronic mail verification apparatus 20 with the electronic signature is stored in the work area 1540.

At step 50202, the public key certificate reference program 1530 searches the public key certificate management table 1410 using the public key certificate 5201 included in the registered public key certificate inquiry data 520 as a key.

In step 50203, step 502
If the search process in step 02 is successful, that is, if the same public key certificate as the public key certificate 5201 already exists in the public key certificate management table 1410, step 50204 is executed.
Is executed, that is, if the search process fails, that is, if the same public key certificate as the public key certificate 5201 does not already exist in the public key certificate management table 1410, step 50205 is performed.
Execute

In step 50204, the registered public key certificate response data 530 in which the public key certificate verification result 5301 is TRUE is created and transmitted to the electronic mail verification device 20 with the electronic signature.

In step 50205, the registered public key certificate response data 530 whose public key certificate verification result 5301 is FALSE is created and transmitted to the electronic mail verification device 20 with the electronic signature.

In accordance with the above procedure, the public key certificate reference program 1530 is executed by the electronic signature verification apparatus 20 with the electronic signature.
If you receive an inquiry for a registered public key certificate from
A response can be made as to whether the public key certificate is registered in the public key certificate management table 1410.

Next, the processing contents of the e-mail verification program with electronic signature 2320 will be described. The e-mail verification program with electronic signature 2320 transmits the e-mail 51 with the electronic signature from the e-mail creation device 60 with the electronic signature.
It is started by the communication control program 2310 when 0 is received. The input of the electronic signature verification program is an electronic signature electronic mail 510 received from the electronic signature electronic mail creation device 60, and the output is a logic representing the verification result of the electronic signature 5102 included in the electronic signature electronic mail. Value. The e-mail verification program with electronic signature 2320 verifies the electronic signature 5102 included in the input electronic mail 510 with electronic signature, and outputs the logical value of the result. The detailed processing contents of the e-mail verification program with electronic signature 2320 will be described with reference to the PAD diagram of FIG.

In step 50301, the electronic mail with electronic signature 510 received from the electronic mail with electronic signature creation device 60 is stored in the work area 1540.

In step 50302, the public key certificate 5 of the highest certificate authority included in the electronic mail 510 with the electronic signature
Steps 50303 to 103 for all public key certificates from 103 to the public key certificate 5106 of the e-mail creator.
Repeat 50304.

In step 50303, the public key certificate verification program 2320 is called using the public key certificate as an argument.

In step 50304, when the return value of the public key certificate verification program 2320 is TRUE, that is, when the verification of the public key certificate is successful, the next public key certificate is processed, and when the return value is FALSE, that is, the verification of the public key certificate is performed. If it fails, step 50305 is executed.

In step 50305, a logical value FALSE representing failure of the e-mail verification processing with the electronic signature is output.

In step 50306, the electronic signature 5102 included in the electronic mail 510 with the electronic signature is verified using the public key certificate 5106 of the electronic mail creator.

In step 50307, if the digital signature verification succeeds, step 50308 is executed. If the digital signature verification fails, step 50309 is executed.

In step 50308, a logical value TRUE indicating the success of the e-mail verification process with the electronic signature is output.

In step 50309, a logical value FALSE representing failure of the electronic mail verification process with the electronic signature is output.

According to the above procedure, the electronic signature verification program 2320 with the electronic signature verifies the electronic signature 5102 included in the input electronic mail 510 with the electronic signature.
The logical value of the result can be output.

Next, the processing contents of the public key certificate verification program 2330 will be described. The public key certificate verification program 2330 is activated from the electronic signature verification email program 2320 when the electronic signature verification email device 20 receives the electronic signature verification email 510. The input of the public key certificate verification program 2330 is a public key certificate, and the output is a logical value representing the verification result of the public key certificate. The public key certificate verification program 2330 omits the verification process for the public key certificate registered in the public key certificate management device 10, performs the verification process for the unregistered public key certificate, and executes the public key that is successfully verified. The certificate is registered in the public key certificate management device 10. The public key certificate verification program 2330 will explain the detailed processing contents of the public key certificate verification program 2330 with reference to the PAD diagram of FIG.

In step 50401, registered public key certificate inquiry data 520 having the input public key certificate as the public key certificate 5201 is created and transmitted to the public key certificate management device 10.

In step 50402, step 5
As a response to the registered public key certificate inquiry data 520 transmitted at 0401, the registered public key certificate response data 530 is received and stored in the work area 2340.

In step 50403, if the public key certificate search result 5301 included in the public key certificate response data 530 is TRUE, step 50404 is executed, and FA
In the case of LSE, step 50405 is executed. That is, if the public key certificate is registered in the public key certificate management device 10, the public key certificate verification process is omitted, and if the public key certificate is not registered, the process proceeds to the normal public key certificate verification process.

In step 50404, a logical value TRUE indicating successful verification of the public key certificate is returned to the e-mail verification program with electronic signature 2310 as a return value.

In step 50405, since the public key certificate has not been registered in the public key certificate management device 10, a public key certificate verification process is performed.

In step 50406, if the public key certificate verification processing succeeds, step 50408 is executed, and if it fails, step 50407 is executed.

In step 50407, a logical value FALSE indicating a failure in verification of the public key certificate is returned as a return value to the e-mail verification program with electronic signature 2310.

In step 50408, public key certificate registration data 540 including the public key certificate that succeeded in the verification as the public key certificate 5401 is created and transmitted to the public key certificate management device 10.

In step 50409, a logical value indicating the success of the public key certificate verification is returned as a return value to the electronic mail verification program 2310 with the electronic signature.

By the above procedure, the public key certificate verification program 2330 omits the verification process for the public key certificate registered in the public key certificate management device 10 and performs the verification process for the unregistered public key certificate. The public key certificate that has been successfully verified can be registered in the public key certificate management device 10.

According to the above configuration, when one of the e-mail verification devices with a digital signature in the LAN verifies the public key certificate, the verified public key certificate is registered in the public key certificate management device 10, Thereafter, when another e-mail verification device with an electronic signature uses the public key certificate, the verification process of the public key certificate is speeded up because the public key certificate need not be verified,
The object of the present invention is achieved.

In this embodiment, the public key certificate management device and the electronic mail certificate with electronic signature are separate devices. However, one of the electronic mail certificate verification devices with the electronic signature also serves as the public key certificate management device. It is also possible to

<< Second Embodiment >> In the first embodiment, only the public key certificate management device intensively stores the verified public key certificate.
Even if the public key certificate has been verified by itself in the past, the public key certificate management device must be inquired about whether or not the certificate has been verified, and there has been a problem that communication with the public key certificate management device occurs.

The purpose of the present embodiment is to solve the above-mentioned problem. A secondary public key certificate management table is separately provided in each electronic mail verification device with an electronic signature, and the verified public key certificate is Not only the public key certificate management device but also the secondary public key certificate management table are registered. Also, when verifying the public key certificate, first, it is asked whether or not the public key certificate is registered in the secondary public key certificate management table on the verification device. I am trying to ask.

This embodiment is based on the configuration of the first embodiment, and differs from the first embodiment only in the electronic mail verification device with an electronic signature. Hereinafter, differences between the first embodiment and the e-mail verification apparatus with an electronic signature according to the present embodiment will be described with reference to the drawings.

The difference between the electronic signature verification apparatus 20a with an electronic signature and the electronic verification apparatus 20 with an electronic signature in the first embodiment will be described. The e-mail verification device with electronic signature 20a is a public key certificate management device if it is a public key certificate that has been verified by itself in the past, in addition to the functions of the e-mail verification device with electronic signature 20 in the first embodiment. This is a device to which a function of omitting the verification process without inquiring to 10 is added. FIG. 15 is a configuration diagram of the electronic mail verification apparatus 20a with an electronic signature according to the present embodiment.
The e-mail verification device with electronic signature 20a adds a secondary storage device 250 and a secondary storage device control circuit 240 for controlling the secondary storage device 250 to the e-mail verification device with electronic signature 20 in the first embodiment. Device. The secondary storage device 250 stores a secondary public key certificate management table 2510 in which public key certificates verified by the present verification device are stored. The main storage device 230 searches the secondary public key certificate management table 2510 in addition to the verification process performed by the public key certificate verification program 2330 in the first embodiment, and omits the verification process according to the search result. Public key certificate verification program 23 that performs processing for adding a public key certificate that has been successfully verified to the secondary public key certificate management table
30a is stored instead of the public key certificate verification program 2330 in the first embodiment. With the above configuration, the e-mail verification apparatus with electronic signature 20a can omit the verification processing without inquiring the public key certificate management apparatus 10 if the public key certificate has been verified by itself in the past.

Next, the configuration of the secondary public key certificate management table 2510 added in this embodiment will be described. The secondary public key certificate management table is a table for locally caching the public key certificate verified by the e-mail verification device with electronic signature 20a by itself. FIG. 16 is a configuration diagram of the secondary public key certificate management table 2510. The secondary public key certificate management table 2510 is
It is a table which accumulates the public key certificate verified by this verification device in the public key certificate field 2511. The addition of the public key certificate to this table and the search of this table are performed by the public key certificate verification program 2330a.

By storing the verified public key certificate locally in the secondary public key certificate management table having the above configuration, the e-mail verification device 20a with a digital signature can
The public key certificate verified by itself can be cached locally, and the verification process can be omitted without inquiring to the public key certificate management device 10.

Next, the processing contents of the public key certificate verification program 2330a changed in this embodiment will be described. The public key certificate verification program 2330a omits the public key certificate verification process without inquiring of the public key certificate management device 10 if the public key certificate has been verified in the past by itself. The public key certificate verification program 2330a stores the secondary public key certificate management table 2 in the public key certificate verification program 2330 in the first embodiment.
This program is a program added with a process of searching for 510 and omitting the verification process according to the search result, and a process of registering the public key certificate that has passed the verification in the secondary public key certificate management table.
The detailed processing contents of the public key certificate verification program 2330a will be described with reference to the PAD diagram of FIG.

In step 50501, the secondary public key certificate management table 25 is set using the input public key certificate as a key.
10 to check whether or not the same public key certificate has already been verified by the present verification apparatus.

In step 50502, step 505
If the public key certificate is found as a result of the search of step 01, step 5
0503 is executed, and if not found, step 5050
Execute Step 4. That is, if the same public key certificate has already been verified by the present verification apparatus, the verification of the public key certificate is omitted, and the e-mail verification program 23 with the electronic signature is executed.
20 is notified of the success of the verification, and if the verification is not completed, the public key certificate management device 10 is inquired.

In step 50503, a logical value TRUE indicating successful verification of the public key certificate is returned as a return value to the electronic mail verification program with electronic signature 2320.

In step 50504, the registered public key certificate inquiry data 520 having the input public key certificate as the public key certificate 5201 is created and transmitted to the public key certificate management device 10.

In step 50505, step 5
As a response to the registered public key certificate inquiry data 520 transmitted at 0504, the registered public key certificate response data 530 is received and stored in the work area 2340.

In step 50506, if the public key certificate search result 5301 included in the public key certificate response data 530 is TRUE, step 50507 is executed, and FA
In the case of LSE, step 50409 is executed. That is, if the public key certificate is registered in the public key certificate management device 10, the public key certificate is registered in the secondary public key certificate management table and the public key certificate verification process is omitted. Move to public key certificate verification processing.

In step 50507, since the public key certificate has been registered in the public key certificate management device, the secondary public key certificate management table 251 is used as a trusted public key certificate.
Add to 0.

In step 50508, a logical value TRUE indicating successful verification of the public key certificate is returned as a return value to the e-mail verification program with electronic signature 2320.

In step 50509, since the public key certificate has not been registered in the secondary public key certificate management table 2510 or the public key certificate management device 10, the public key certificate is verified.

In step 50510, if the verification of the public key certificate succeeds, step 50512 is executed, and if it fails, step 50511 is executed.

In step 50511, a logical value FALSE indicating a failure of the public key certificate verification is returned to the electronic mail verification program with electronic signature 2310 as a return value.

At step 50512, the public key certificate that has passed the verification is added to the secondary public key certificate management table 2510.

At step 50513, the public key certificate registration data 540 including the public key certificate that succeeded in the verification as the public key certificate 5401 is created and transmitted to the public key certificate management device 10.

In step 50414, a logical value TRUE indicating successful verification of the public key certificate is returned as a return value to the electronic mail verification program with electronic signature 2320.

According to the above procedure, the public key certificate verification program 2330a registers the verified public key certificate in the secondary public key certificate management table, and registers the public key certificate registered in the secondary public key certificate management table. The authentication process can be omitted without communicating with the public key certificate management device. When the public key certificate is not registered in the secondary public key certificate management table, the public key certificate verification program 2330a operates in the same manner as the public key certificate verification program 2330 in the first embodiment. An inquiry can be made to the management device.

According to the above configuration, the public key certificate verified on the electronic signature verification device 20a with the electronic signature is registered in the public key certificate management device 10 and the public key certificate on the electronic signature verification device 20a with the electronic signature is also registered. Since it is also registered in the table, the e-mail verification device with the electronic signature can perform the verification processing of the same public key certificate without communicating with the public key certificate management device 10 thereafter. The purpose of the example is achieved.

Third Embodiment In a general electronic mail system, an electronic mail is collectively received by a mail server and then transferred to each client when requested. Therefore, when transferring the electronic mail with the electronic signature to the client, the mail server can analyze which public key certificate is delivered. However, in the first embodiment and the second embodiment, since the public key certificate management device and the mail server are independent, the public key certificate management device sends any public key certificate to the e-mail verification device with the electronic signature. If the e-mail verification device with the e-signature receives the e-mail with the e-signature and the e-mail verification device with the e-signature does not explicitly contact the public key certificate management device, the data related to the verified public key certificate cannot be obtained. There was a problem that the amount increased.

In this embodiment, in order to solve the above problem, the public key certificate management device also serves as a mail server, and when the electronic signature verification device with the electronic signature downloads the electronic mail from the mail server, the verification is performed at the same time. The public key certificate is notified.

First, the configuration of this embodiment will be described with reference to FIG. In this embodiment, the LAN 30 and the Internet 50 are connected via a firewall 40. The LAN 30 has a public key certificate management function for accumulating verified public key certificates, a public key management mail server 10b having an e-mail delivery function for receiving an e-mail once and delivering it to a client, and an e-mail with an electronic signature. The e-mail verification devices 20b, 21b, 22b,... With the electronic signature for receiving and verifying the e-mail are connected,
The Internet 50 is connected to an electronic mail creation device 60 with an electronic signature that applies an electronic signature to an electronic mail and transmits the electronic mail.

With the above configuration, it becomes possible to exchange public key certificates without being falsified on the LAN 30, as in the first embodiment.

Next, the operation of this embodiment will be described with reference to FIG. Email verification device 20b, 21 with electronic signature
, 22b,... operate in the same manner, so that the following description will be made on the case where the e-mail verification apparatus 20b with an electronic signature among these apparatuses operates.

Upon receiving the delivery request for the electronic mail 510 with the electronic signature from the electronic mail verification device 20b with the electronic signature, the public key certificate management mail server 10b receives the public key certificate attached to the electronic mail 510 with the electronic signature. But,
It is determined whether or not the certificate has already been verified, and registered public key certificate notification data 550 which is a list of verified public key certificates is created. Send to When receiving the public key certificate registration data 540b, the public key certificate management mail server 10b accumulates the verified public key certificate included in the public key certificate registration data 540b.

Upon receiving the electronic mail 510 with the electronic signature and the registered public key certificate notification data 550, the electronic mail verification device with electronic signature 20b makes the public key certificate described in the registered public key certificate notification data 550 public. Since the key certificate is credible, the verification process of the public key certificate itself is omitted. A verification process is performed on a public key certificate that is not described in the registered public key certificate notification data. If the public key certificate verification is successful, the public key certificate registration data 540 is stored in the public key certificate management mail server 1.
0b to register the verified public key certificate. Finally, the e-mail verification device with electronic signature 20b verifies the electronic signature by using the public key certificate of the e-mail creator attached to the e-mail.

According to the above procedure, in order to check whether or not the public key certificate has been verified, the e-mail verification device with electronic signature 20b transmits the public key certificate management mail server 10b.
b, it is not necessary to inquire about the e-mail verification device 20b with the electronic signature and the public key certificate management mail server 10b.
b, it is possible to reduce the communication amount.

Next, the public key certificate management mail server 10b
Will be described. The public key certificate management mail server 10b is a device in which the public key certificate management device in the first embodiment also functions as a mail server, and confirms whether the attached public key certificate has been verified at the time of delivery of the electronic mail 510 with the electronic signature. By notifying at the same time whether or not this is the case, the amount of communication with the e-mail verification device 20 with an electronic signature is reduced. FIG. 20 shows a public key certificate management mail server 10b.
FIG. Public key certificate management mail server 10b
Are the secondary storage device control circuit 110b and the CPU 120b
, A network interface circuit 130b, a secondary storage device 140b, and a main storage device 150b. The secondary storage device 140b stores a public key certificate management table 1410b for accumulating verified public key certificates. In the main storage device 150b, when the electronic signature-added electronic mail 510 is received from the electronic signature-added electronic mail creation device 60, the electronic signature-added electronic mail receiving program is started, and the electronic signature-added electronic mail verification device 20b sends the electronic mail. When there is a delivery request, the electronic signature-added electronic mail delivery program 1550 is started, and the public key certificate registration data 5
40 is received and the public key certificate registration program 152 is received.
0b, a public key certificate registration program 1520b that adds a verified public key certificate to the public key certificate management table 1410b when the public key certificate registration data 540 is received, and an e-mail with an electronic signature. An electronic mail delivery program 1550 for delivering an electronic mail 510 with an electronic signature when receiving a request from the verification device 20b, and an electronic mail receiving an electronic mail with an electronic signature transmitted from the electronic mail creating device with an electronic signature. E-mail receiving program with signature 15
70, it is determined whether the public key certificate attached to the electronic signature-attached e-mail is registered in the public key certificate management table 1410b when the electronic signature-attached e-mail is delivered, and the result is registered as a registered public key. As the certificate notification data 550, a registered public key certificate notification program 1560 to be transmitted to the electronic mail verification apparatus 20b with an electronic signature, and a work area 1540b used by these programs are stored.

With the above configuration, the public key certificate management mail server 10b notifies the attached public key certificate of whether or not the attached public key certificate has been verified at the time of delivery of the electronic mail 510 with the electronic signature. Testing device 20b
And the amount of communication between them can be reduced.

Next, the public key certificate management table 1410b
Will be described. Public key certificate management table 14
Reference numeral 10 denotes a table for storing verified public key certificates. FIG. 21 is a configuration diagram of the public key certificate management table 1410b. The public key certificate management table 1410b has the same configuration as the public key certificate management table 1410 in the first embodiment, and is a table for storing verified public key certificates in the public key certificate field 1411b. The addition of the public key certificate to this table is performed by the public key certificate registration program 1520b, and the search of this table is performed by the registered public key certificate notification program 1560.

With the above-described configuration, the public key certificate management mail server 10b is able to use the electronic signature verification apparatus 20 with the electronic signature.
b, 21b, 22b, ..., the verified public key certificate is stored in this table, and by searching this table, the attached public key certificate at the time of delivery of the e-mail 510 with the electronic signature is attached. Can be notified whether or not has been tested.

Next, an electronic mail verification device 2 with an electronic signature
The configuration of Ob will be described. The e-mail verification device with electronic signature 20b is a device that verifies the e-mail with electronic signature 510. In order to verify the electronic mail 510 with the electronic signature, it is necessary to verify the public key certificate attached to the electronic mail 510 with the electronic signature. By simultaneously receiving the registered public key certificate 550 indicating whether the key certificate has been verified from the public key certificate management mail server 10b and omitting the verification of the public key certificate,
The certification key certification process is accelerated. FIG. 5 is a configuration diagram illustrating the configuration of the electronic mail verification device 20b with an electronic signature. Email verification device 20 with electronic signature
b includes a CPU 210b, a network interface circuit 220b, and a main storage device 230b. The main storage device has an electronic mail 510b with an electronic signature.
Communication control program 2310b that activates e-mail verification program with electronic signature 2320b upon receipt of
An electronic signature verification program 2320b for verifying the electronic signature electronic mail, a public key certificate verification program 2330b for verifying the public key certificate attached to the electronic signature electronic mail 510b, and a work area used by the program. 2340b is stored.

With the above configuration, the electronic mail verification apparatus with electronic signature 20b receives the registered public key certificate 550 from the public key certificate management mail server 10b, and omits the verification of the public key certificate. The certificate verification process can be sped up.

Next, the registered public key certificate notification data 550
Will be described. The registered public key certificate notification data 550 is transmitted at the same time as the electronic mail 510b with the electronic signature is transmitted from the public key certificate management mail server 10b to the electronic signature verification device 20b with the electronic signature. The registered public key certificate notification data 550 is data indicating whether the public key certificate attached to the electronic mail 510b with the electronic signature is registered in the public key certificate management mail server. FIG. 23 is a configuration diagram of the registered public key certificate notification data 550. Certified public key certificate A550
1. The verified public key certificate B5502 ... is a public key certificate management mail server 10b among public key certificates attached to the electronic mail 510b with the electronic signature transmitted at the same time.
Is a list of public key certificates registered in.

The public key certificate management mail server 10b transmits the registered public key certificate notification data 550 having the above configuration, and the electronic mail verification device 2 with the electronic signature.
0b can know whether the public key certificate attached to the electronic mail 510 with the electronic signature is registered in the public key certificate management mail server 10b, that is, whether the public key certificate has been verified. .

Next, the public key certificate registration program 1520b
The details of the processing will be described. The public key certificate registration program 1520b is an electronic mail verification device 20 with an electronic signature.
b is started by the communication control program 1510b when the public key certificate registration data is received from b. The input of the public key certificate registration program 1520b is based on the public key certificate registration data 54 received from the electronic signature verification device 20b with the electronic signature.
0b, no output. Public Key Certificate Registration Program 1
Reference numeral 520b adds the public key certificate 5401b included in the input public key certificate registration data 540b to the public key certificate management table 1410b. The public key certificate registration program 1520b operates in exactly the same way as the public key certificate registration program 1520 in the first embodiment, and thus a detailed description is omitted.

Next, the processing content of the electronic mail delivery program with electronic signature 1550 will be described. The electronic signature-added electronic mail delivery program 1550 is started by the communication control program 1510 when an electronic mail delivery request is issued from the electronic signature-added electronic mail verification device 20b. Electronic mail delivery program 1550 with electronic signature
Is not input, and the output is an e-mail 510b with an electronic signature transmitted to the e-mail verification device 20b with an electronic signature. Electronic mail delivery program 1550 with electronic signature
The electronic mail 5 with the electronic signature previously received by the electronic mail with the electronic signature receiving program 1570 upon receiving a request from the electronic verification apparatus 20b with the electronic signature.
Send 10b. At this time, it is checked whether the public key certificate attached to the electronic mail with the electronic signature has already been verified.
In order to notify the e-mail verification device 20b with an electronic signature, the registered public key certificate notification program 1560 is called using the e-mail with electronic signature 510b as an argument.
The detailed processing contents of the electronic mail delivery program with electronic signature 1550 will be described with reference to the PAD diagram of FIG.

In step 50601, the electronic mail 510b with the electronic signature is converted into the electronic mail verification device 2 with the electronic signature.
0b.

In step 50602, the registered public key certificate notification program 1560 is called using the electronic mail with electronic signature 510b as an argument, and the public key certificate attached to the electronic mail with electronic signature 510b is stored in the public key certificate management table 1410b. The registered public key certificate is notified to the e-mail verification device 20b with the electronic signature.

According to the above procedure, the electronic signature-added electronic mail delivery program 1550 delivers the electronic signature-added electronic mail 510b to the electronic signature-added electronic mail verification device 20b and, at the same time, sends the registered public key certificate notification program 1
560 can be activated to notify the e-mail verification apparatus with electronic signature 20b whether the public key certificate attached to the e-mail with electronic signature 510b has been verified.

Next, the registered public key certificate notification program 1
The processing contents of 560 will be described. The registered public key certificate notification program 1560 is activated by the electronic signature-added electronic mail delivery program 1550 when delivering the electronic mail 510b with the electronic signature. The input of the registered public key certificate notification program 1560 is an electronic mail 510b with an electronic signature, and the output is registered public key certificate notification data 550 transmitted to the electronic verification apparatus 20b with an electronic signature. The registered public key certificate notification program 1560 sends the electronic mail 51
For each of the public key certificates attached to the public key certificate 0b, it is determined whether or not there is a matching public key certificate in the public key certificate management table 1410b, and all matching public key certificates are stored as verified public key certificates. The key certificate notification data 550 is created and transmitted to the e-mail verification device 20b with an electronic signature. Detailed processing contents of the registered public key certificate notification program 1560 will be described with reference to the PAD diagram of FIG.

In step 50701, the registered public key certificate notification data 550 in the initial state that does not hold the verified public key certificate is created and stored in the work area 1540b.

At step 50702, steps 50703 to 50704 are performed for each public key certificate attached to the electronic mail 510b with the electronic signature as an argument.
repeat.

In step 50703, the public key certificate management table 1410b is searched using the public key certificate as a key.

In step 50704, step 507 is executed.
If the same public key certificate is found in the search of step 03, step 50705 is executed.

In step 50705, the work area 1
Registered public key certificate notification data 5 stored in 540b
The public key certificate is added to 10b as a verified public key certificate.

In step 50706, the work area 1
Registered public key certificate notification data 5 stored in 540b
50 is transmitted to the e-mail verification device 20b with an electronic signature.

According to the above procedure, the registered public key certificate notification program 1560 converts the electronic mail 51 with the electronic signature.
0, the registered public key certificate notification data 510b holding all the public key certificates registered in the public key certificate management table 1410b.
It can be transmitted to the e-mail verification device 20b with an electronic signature.

Next, the processing contents of the electronic mail verification program with electronic signature 2320b will be described. The e-mail verification program with electronic signature 2320b transmits the e-mail with electronic signature 5 from the public key certificate management mail server 10b.
It is started by the communication control program 2310b when it receives the public key certificate notification data 550 and 10b. E-mail certification program with electronic signature 2320b
Is an electronic mail 510b with an electronic signature received from the public key certificate management mail server 10b and registered public key certificate notification data 550, and the output is a verification result of the electronic signature 5102b included in the electronic mail 510b with the electronic signature. Is the logical value to represent. The e-mail verification program with electronic signature 2320b verifies the electronic signature 5102b included in the input electronic mail with electronic signature 510b, and outputs the logical value of the result. The detailed processing contents of the electronic mail verification program with electronic signature 2320b will be described with reference to the PAD diagram of FIG.

In step 50801, the electronic mail 510 with the electronic signature and the registered public key certificate notification data 550 received from the public key certificate management mail server 10b are stored in the work area 1540b.

In step 50802, the public key certificate 5106b of the e-mail creator is obtained from the public key certificate 5103b of the highest certificate authority included in the electronic mail 510b with the electronic signature.
Step 503 for all public key certificates up to b
Repeat steps 03 to 50304.

In step 50803, the public key certificate verification program 2330b is called using the public key certificate and the registered public key certificate notification data 550 as arguments.

In step 50804, if the return value of the public key certificate verification program 2330b is TRUE, that is, if the verification of the public key certificate is successful, the next public key certificate is processed, and if FALSE, that is, the verification of the public key certificate If the step fails, step 50805 is executed.

In step 50805, a logical value FALSE indicating failure of the electronic mail verification process with the electronic signature is output.

In step 50806, the electronic signature 5102b included in the electronic mail 510b with the electronic signature is verified using the public key certificate 5106b of the electronic mail creator.

In step 50807, if the digital signature verification has succeeded, step 50808 is executed. If the digital signature verification has failed, step 50809 is executed.

In step 50808, a logical value TRUE indicating the success of the electronic mail verification process with the electronic signature is output.

In step 50809, a logical value FALSE indicating failure of the electronic mail verification process with the electronic signature is output.

According to the above procedure, the e-mail verification program with electronic signature 2320b can perform the verification processing of the electronic signature included in the electronic mail with electronic signature.

Next, the public key certificate verification program 2330b
The details of the processing will be described. The public key certificate verification program 2330b is started by the e-mail verification program with electronic signature 2320. The input of the public key certificate verification program 2330 is a public key certificate and registered public key certificate notification data 550, and the output is a logical value representing the verification result of the public key certificate. Public Key Certificate Verification Program 233
0 will be described with reference to the PAD diagram of FIG.

In step 50901, a verified public key certificate held by the registered public key certificate notification data 550, which is also an argument, is searched using the public key certificate as an argument as a key.

At step 50902, step 509 is executed.
If the search in step 02 is successful, step 50903 is executed. If the search in step 50902 fails, step 50904 is executed. That is, when the public key certificate related to the registered public key certificate notification data 550 is described, the public key certificate verification process is omitted, and when the public key certificate is not described, the public key certificate verification process is performed.

In step 50903, a logical value TRUE indicating successful verification of the public key certificate is returned to the electronic mail verification program with electronic signature 2310b as a return value.

In step 50904, since the public key certificate has not been registered in the registered public key certificate notification data 550, the public key certificate is verified.

In step 50905, if the verification processing of the public key certificate succeeds, step 50907 is executed, and if it fails, step 50906 is executed.

In step 50906, a logical value FALSE representing a public key certificate verification failure is returned as a return value to the electronic mail verification program with electronic signature 2310b.

In step 50907, public key certificate registration data 540b containing the public key certificate that succeeded in the verification as the public key certificate 5401b is created and transmitted to the public key certificate management mail server 10b.

In step 50908, a logical value TRUE indicating successful verification of the public key certificate is returned as a return value to the e-mail verification program with electronic signature 2320b.

By the above procedure, the public key certificate verification program 2330b sends the registered public key certificate notification data 550
The verification process can be omitted for the public key certificate described in (1), and the verification process can be performed for the public key certificate not described.

According to the above configuration, the e-mail verification device with electronic signature 20b is operated by the public key certificate management mail server 1
At the same time as receiving the electronic signature-added electronic mail 510b from the electronic mail 510b, it is possible to know whether or not the public key certificate attached to the electronic mail is registered in the public key certificate management mail server 10b. Therefore, unlike the first embodiment and the second embodiment, it is not necessary to communicate with the public key certificate management device every time the public key certificate is verified, and the purpose of this embodiment is to reduce the amount of communication. Is achieved.

[0152]

According to the present invention, in a LAN to which a plurality of information processing apparatuses are connected, a public key certificate verified by one of the information processing apparatuses in the LAN is not verified by another information processing apparatus. As a result, public key certificate verification processing is sped up.

[Brief description of the drawings]

FIG. 1 is a system configuration diagram of a first embodiment.

FIG. 2 is an operation explanatory diagram of the first embodiment.

FIG. 3 is a configuration diagram of a public key certificate management device 10.

FIG. 4 is a configuration diagram of a public key certificate officer table 1410.

FIG. 5 is a configuration diagram of an electronic mail verification device 20 with an electronic signature.

FIG. 6 is a configuration diagram of an electronic mail 510 with an electronic signature.

FIG. 7 is a configuration diagram of registered public key certificate inquiry data 520.

FIG. 8 is a configuration diagram of registered public key certificate response data 530.

FIG. 9 is a configuration diagram of a public key certificate 5401.

FIG. 10: PAD of the public key certificate registration program 1520
FIG.

FIG. 11 PAD of public key certificate reference program 1530
FIG.

FIG. 12 shows an e-mail verification program 23 with an electronic signature.
It is a PAD figure of 20.

FIG. 13 PAD of public key certificate verification program 2330
FIG.

FIG. 14 is a configuration diagram showing a structure of a hierarchical certificate authority according to the related art.

FIG. 15 is a configuration diagram of an electronic mail verification device 20a with an electronic signature.

FIG. 16 is a configuration diagram of a secondary public key certificate management table 2510.

FIG. 17 is a PAD diagram of a public key certificate verification program.

FIG. 18 is a system configuration diagram of a third embodiment.

FIG. 19 is an operation explanatory diagram of the third embodiment.

FIG. 20 is a configuration diagram of a public key certificate management mail server 10b.

FIG. 21 is a configuration diagram of a public key certificate management table 1410b.

FIG. 22 is a configuration diagram of an electronic mail verification device 20b with an electronic signature.

FIG. 23 is a configuration diagram of registered public key certificate notification data 550.

FIG. 24 is an electronic mail delivery program 15 with an electronic signature.
It is a PAD figure of 50.

FIG. 25: Registered public key certificate notification program 1560
FIG.

FIG. 26 is an electronic mail verification program 23 with an electronic signature.
It is a PAD figure of 20b.

FIG. 27: PA of public key certificate verification program 2330b
FIG.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 10 ... Public key certificate management device, 20 ... E-mail verification device with electronic signature, 30 ... LAN, 40 ... Firewall, 50 ... Internet, 60 ... E-mail generation device with electronic signature, 510 ... E-mail with electronic signature, 52
0: Registered public key certificate inquiry data, 530: Registered public key certificate response data, 540: Public key certificate registration data, 1520: Public key certificate registration program, 153
0: Public key certificate reference program, 1410: Public key certificate management table, 2320: E-mail verification program with electronic signature, 2330: Public key certificate verification program

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Hiroyuki Wajima 2-2-2 Kagahara, Tsuzuki-ku, Yokohama-shi, Kanagawa Prefecture Within Hitachi, Ltd. System Development Division (72) Kenichi Endo 5030 Totsukacho, Totsuka-ku, Yokohama-shi, Kanagawa Prefecture Address Co., Ltd. Software Development Division, Hitachi, Ltd.

Claims (4)

[Claims] 1. A public key certificate management method in an information processing device connected to a public key certificate verification device via a network, comprising storing a public key certificate that has been successfully verified and received from the information processing device, When a registration inquiry is received from the processing device, it is determined whether or not a matching public key certificate exists in the stored public key certificate, and whether or not there is a matching public key certificate is returned as a response to the registration inquiry. A public key certificate management method. 2. A public key certificate verification method in an information processing device connected to a public key certificate management device via a network, wherein the public key certificate is received and the public key certificate is verified when the public key certificate is verified. Inquires of the management device whether or not the above-mentioned public key certificate has been registered. If registered, omit the verification process. If not, perform the above-described public key certificate verification process. A public key certificate verification method characterized by transmitting the public key certificate that has been successfully verified to the public key certificate management device when the processing is successful. 3. A public key certificate management device connected to an information processing device via a network, comprising: a public key certificate registration means for storing a public key certificate that has been successfully verified and received from the information processing device; When an inquiry is received from the processing device, it is determined whether or not there is a matching public key certificate in the stored public key certificate, and a public key which returns whether or not there is a corresponding public key certificate as a response to the registration inquiry. A public key certificate management device, comprising: certificate reference means. 4. An information processing apparatus connected to a public key certificate management apparatus via a network, wherein the information processing apparatus receives the public key certificate and verifies the public key certificate. Inquires whether the certificate is registered or not. If it is registered, omit the verification process.If it is not registered, perform the above-mentioned public key certificate verification process. An information processing apparatus, comprising: a public key certificate verification unit that transmits the public key certificate that has been successfully verified to the public key certificate management device.