WO2010106860A1

WO2010106860A1 - Communication system, certificate verifying apparatus, and service providing method

Info

Publication number: WO2010106860A1
Application number: PCT/JP2010/052213
Authority: WO
Inventors: 光浩笈川; 厚大塚; 信治三浦; 信夫五十嵐; 克之梅澤; 順史木下
Original assignee: 日立公共システムエンジニアリング株式会社
Priority date: 2009-03-19
Filing date: 2010-02-15
Publication date: 2010-09-23
Also published as: JP2010220175A; JP5425496B2; WO2010106860A9

Abstract

Provided is a technique that can easily receive a verification using an electronic certificate having a high reliability for a service provider. When an electronic certificate having a low reliability for a service provider is received from a first user apparatus (1) or a second user apparatus (2) via a service providing apparatus (4), a provider-side certificate verifying apparatus (6) acquires, from a user information managing apparatus (5), an electronic certificate of a high reliability associated with the received electronic certificate. When the provider-side certificate verifying apparatus (6) has successfully verified the electronic certificate of the high reliability, the service providing apparatus (4) provides the service for the first user apparatus (1) or the second user apparatus (2).

Description

[Supplement based on Rule 26 08.09.2010] Communication system, certificate verification device and service provision method

The present invention relates to a signature data verification technique.

With the spread of IT in recent years, various information has been digitized and exchanged via a network. Such exchange of information via a network can be performed easily and at high speed even with a distant person, but there is also a threat that a communication partner impersonates another person. As one method for preventing spoofing of a communication partner, there is an authentication method using an electronic certificate.

Here, for example, in Patent Document 1, subscriber line identification information of a communication line and an electronic certificate are stored in association with each other, and both verification of the subscriber line identification information and verification of the electronic certificate are successful. A technique for determining that the user is a legitimate user is described.

JP 2003-122720 A (FIG. 4, paragraphs 0025 to 0034)

In the technology described in Patent Document 1, both verification of subscriber line identification information and verification of an electronic certificate are performed. However, some certificate authorities that issue electronic certificates include public personal authentication services and electronic certificates. Some certificate authorities perform strict identity verification, as in the case of accredited certification services based on the signature law. Other certificate authorities allow anyone to obtain an electronic certificate upon application, and the reliability of electronic certificates varies. is there.

Therefore, some service providers accept only electronic certificates issued by specific certificate authorities.

In this regard, for example, in the case where an electronic certificate trusted by a service provider is stored in an IC card, a mobile phone that cannot read the IC card can provide the service from the service provider. I can't receive it.

The present invention provides a technology that allows a service provider to easily receive verification with a highly reliable electronic certificate.

For example, when a low-trust electronic certificate is presented to a service provider, there is a technology for verifying a high-trust electronic certificate associated with the presented low-trust electronic certificate. Disclosed.

For example, disclosed in accordance with one aspect is a communication system including a user device and a service providing device that provides a service to the user device,
The control unit of the service providing apparatus includes, from the user apparatus, signature data signed with a first private key (Private key) and a public key of a first public key paired with the first private key When the first user certificate, which is a certificate, is sent, the signature data and the first user certificate are successfully verified to provide a service to the user device. The signature data signed with a second secret key different from the first secret key and the public key certificate of the second public key paired with the second secret key from the user device When the second user certificate is sent, the first user certificate associated with the second user certificate is successfully verified, so that the use Providing a service to a user device.

As described above, according to the present invention, verification by an electronic certificate having a high reliability can be easily received for a service provider.

1 is a diagram illustrating an outline of a communication system 100. FIG. The figure which illustrates the outline of the 1st user apparatus. The figure which illustrates the outline of the computer 180. The figure which illustrates the outline of the device 120 for user authentication. The figure which illustrates the outline of the IC card. The figure which illustrates the outline of the 2nd user apparatus. The figure which illustrates the outline of the mobile telephone terminal 290. 2 is a diagram illustrating an outline of a certificate authority device 3. FIG. The figure which illustrates the outline of the computer 390. The figure which illustrates the outline of the service provision apparatus 4. The figure which illustrates the outline of the user information management apparatus 5. The figure which illustrates the outline of the user information table 502a. The figure which illustrates the outline of the provider certificate verification apparatus 6. The sequence diagram which illustrates the registration process of a user certificate. The sequence diagram which illustrates the registration process of a user certificate. The sequence diagram which illustrates the authentication process at the time of service utilization. The sequence diagram which illustrates the update process of association of a user certificate. The sequence diagram which illustrates the change process of certificate correlation. The sequence diagram which illustrates the change process of certificate correlation. The sequence diagram which illustrates the cancellation process of the association of a user certificate. The sequence diagram which illustrates the cancellation process of the association of a user certificate. The flowchart which illustrates a user certificate verification process. The sequence diagram which illustrates the verification process of a user certificate. The sequence diagram which illustrates the verification process of a user certificate.

FIG. 1 is a schematic diagram of a communication system 100 according to an embodiment of the present invention. As illustrated, the communication system 100 includes a first user device 1, a second user device 2, a first certificate authority device 3A, a second certificate authority device 3B, a service providing device 4, and user information. A management device 5, a providing side certificate verification device 6, a first certificate verification device 7 A, and a second certificate verification device 7 B are provided, and these transmit and receive information to and from each other via the network 8. Have been able to.

FIG. 2 is a schematic diagram of the first user device 1. As illustrated, the first user device 1 includes a storage unit 101, a control unit 102, an input unit 108, an output unit 109, a communication unit 110, and a user authentication device input / output unit 111. Prepare.

The storage unit 101 stores information necessary for processing in the first user device 1.

The control unit 102 includes an overall control unit 103, a service use unit 104, a user authentication device control unit 105, and a first user device authentication unit 106.

The overall control unit 103 controls the entire processing in the first user device 1. For example, in this embodiment, processing such as file management, process management, and device management is performed.

The service using unit 104 controls processing for receiving service provision from the service providing apparatus 4 via the network 8. For example, in this embodiment, the service is described as being provided on the Web, but the present invention is not limited to the Web form. In this case, the service using unit 104 performs processing using a Web browser, downloads an HTML file, an image file, a music file, etc. released to a Web server on the network, analyzes the layout, displays or reproduces the file, etc. And using a form to send data to a Web server, and run a program written in a predetermined programming language (for example, including an object-oriented language such as Java (registered trademark)) It is also possible to make it. In addition, a function for performing cryptographic processing necessary for performing SSL or TLS communication, and processing for managing a key and a user certificate are also performed.

The user authentication device control unit 105 communicates with the user authentication device 120 as shown in FIG. 4 (schematic diagram of the user authentication device 120) via a user authentication device input / output unit 111 described later. Controls the process of inputting and outputting information between them.

The first user device authentication unit 106 controls authentication processing in the first user device 1. For example, the first user device authentication unit 106 transmits / receives information to / from the user authentication device 120, acquires electronic signature data and a user certificate necessary for authentication when using the service, and The data is output to the utilization unit 104.

The input unit 108 receives input of information.

The output unit 109 outputs information.

The communication unit 110 transmits and receives information via the network 8.

The user authentication device input / output unit 111 inputs / outputs information to / from the user authentication device 120 as shown in FIG.

The first user device 1 described above includes, for example, a CPU (Central Processing Unit) 181, a memory 182, an HDD (Hard Disk Drive), etc. as shown in FIG. 3 (schematic diagram of the computer 180). A storage device 183, a reading device 185 for reading / writing information from / to a portable storage medium 184 such as a CD (Compact Disk) or a DVD (Digital Versatile Disk), an input device 186 such as a keyboard or a mouse, a display, etc. Reader / writer for reading / writing information from / to a storage medium such as an IC card in a general computer 180 having an output device 187 and a communication device 188 such as a NIC (Network Interface Card) for connecting to a communication network This can be realized by connecting the writer 184.

For example, the storage unit 101 can be realized by the CPU 181 using the memory 182 or the external storage device 183, and the control unit 102 loads a predetermined program stored in the external storage device 183 to the memory 182. The input unit 108 can be realized by using the input device 186 by the CPU 181, and the output unit 109 can be realized by using the output device 187 by the CPU 181. The communication unit 110 can be realized by the CPU 181 using the communication device 188, and the user authentication device 111 can be realized by the CPU 181 using the reader / writer 189.

The predetermined program is downloaded from the storage medium 184 via the reading device 185 or from the network via the communication device 188 to the external storage device 183, and then loaded onto the memory 182 and executed by the CPU 181. You may do it. Alternatively, the program may be directly loaded on the memory 182 from the storage medium 184 via the reading device 185 or from the network via the communication device 188 and executed by the CPU 181.

FIG. 4 is a schematic diagram of the user authentication device 120. As illustrated, the user authentication device 120 includes a storage unit 121, a control unit 125, and an I / F unit 129.

The storage unit 121 includes a first user private key storage area 122 and a first user certificate storage area 123.

The first user private key storage area 122 stores information for specifying a private key paired with the public key included in the user certificate stored in the first user certificate storage area 123 described later. The Here, in the present embodiment, the first user secret key storage area 122 stores a secret key generated in the first certificate authority device 3A described later.

In the first user certificate storage area 123, information specifying a user certificate including a public key paired with the private key stored in the first user private key storage area 122 is stored. Here, in the present embodiment, the first user certificate storage area 123 stores a user certificate issued by the first certificate authority device 3A described later. For example, the user certificate describes the public key of the user and information for identifying the user, and the electronic signature is given using the private key of the certificate authority with these information as the scope of signature. Data.

The control unit 125 includes an overall control unit 126 and a device authentication unit 127.

The overall control unit 126 controls the entire processing in the user authentication device 120.

When the device authentication unit 127 receives a request to generate electronic signature data from the first user device 1 via the I / F unit 129, the device authentication unit 127 obtains the secret key stored in the first user secret key storage area 122. When the electronic signature is generated and the user certificate output request is received from the first user device 1 via the I / F unit 129, the usage stored in the first user certificate storage area 123 is used. Process to output the user certificate.

The I / F unit 129 inputs / outputs information to / from the user authentication device input / output unit 111 of the first user device 1.

The user authentication device 120 described above is an interface for transmitting / receiving data to / from an IC unit 191 having a CPU 192 and an external storage device 193 as shown in FIG. 5 (schematic diagram of an IC card 190). / F195 and an IC card 190.

For example, the control unit 125 can be realized by the CPU 192 of the IC unit 191, the storage unit 121 can be realized by using the external storage device 193 by the CPU 192 of the IC unit 191, and the I / F unit 129 can be This can be realized by the CPU 192 of the IC unit 191 using the I / F 195.

FIG. 6 is a schematic diagram of the second user device 2. As illustrated, the second user device 2 includes a storage unit 201, a control unit 205, an input unit 210, an output unit 211, and a wireless communication unit 212.

The storage unit 201 includes a second user private key storage area 202 and a second user certificate storage area 203.

The second user private key storage area 202 stores information for specifying a private key paired with the public key included in the user certificate stored in the second user certificate storage area 203 described later. The Here, in the present embodiment, the second user secret key storage area 202 stores a secret key generated in the second certificate authority device 3B described later.

In the second user certificate storage area 203, information for specifying a user certificate including a public key paired with the private key stored in the second user private key storage area 202 is stored. Here, in the present embodiment, the second user certificate storage area 203 stores a user certificate issued by the second certificate authority device 3B described later.

The control unit 205 includes an overall control unit 206, a service use unit 207, and a second user device authentication unit 208.

The overall control unit 206 controls the entire processing in the second user device 2. For example, in this embodiment, processing such as file management, process management, and device management is performed.

The service using unit 207 controls processing for receiving service provision from the service providing apparatus 4 via the network 8. For example, in this embodiment, the service is described as being provided on the Web, but the present invention is not limited to the Web form. In this case, the service using unit 207 performs processing using a Web browser, downloads an HTML file, an image file, a music file, and the like released to a Web server on the network, analyzes the layout, displays or reproduces the file, and the like. And using a form to send data to a Web server, and run a program written in a predetermined programming language (for example, including an object-oriented language such as Java (registered trademark)) It is also possible to make it. In addition, a function for performing cryptographic processing necessary for performing SSL or TLS communication, and processing for managing a key and a user certificate are also performed.

The second user device authentication unit 108 controls authentication processing in the second user device 2. For example, in the present embodiment, an electronic signature is generated using a private key stored in the second user private key storage area 202, and a use stored in the second user certificate storage area 203 is used. The process of outputting the user certificate to the service using unit 207 is performed.

The input unit 210 receives input of information.

The output unit 211 outputs information.

The wireless communication unit 212 connects to the network 8 via wireless and transmits / receives information.

The second user device 2 described above includes, for example, a CPU 291, a memory 292, an external storage device 293, and an input device 294 such as a key device as shown in FIG. 7 (schematic diagram of the mobile phone terminal 290). A general portable device including an output device 295 such as a display, a radio communication device 296 including an RF (Radio Frequency) unit, a BB (Base Band) unit, and a MAC (Media Access Controller) unit, and an antenna 297. This can be realized by the telephone terminal 290.

For example, the storage unit 201 can be realized by the CPU 291 using the memory 292 or the external storage device 293, and the control unit 205 loads a predetermined program stored in the external storage device 293 into the memory 292. The input unit 218 can be realized by using the input device 294 by the CPU 291, and the output unit 211 can be realized by using the output device 295 by the CPU 291. The wireless communication unit 212 can be realized by the CPU 291 using the wireless communication device 296 and the antenna 297.

The predetermined program may be downloaded from the network to the external storage device 293 via the wireless communication device 296, and then loaded onto the memory 292 and executed by the CPU 291. Alternatively, it may be directly loaded onto the memory 292 from the network via the wireless communication device 296 and executed by the CPU 291.

Referring back to FIG. 1, the first certificate authority device 3A and the second certificate authority device 3B issue the user's electronic certificate. Here, the domain of the electronic certificate issued by the first certificate authority device 3A will be described as domain A, and the domain of the electronic certificate issued by the second certificate authority device 3B will be described as domain B.

Note that it is assumed that domain A and domain B do not perform mutual authentication, and the certification paths configured when verifying the electronic certificate are independent of each other. Here, it is assumed that an electronic certificate having high reliability for a service provider who provides a service via the service providing apparatus 4 is a domain A, and an electronic certificate having no high reliability is a domain B. In the present embodiment, the electronic certificate of domain A will be described as being stored in a secure device such as an IC card and used using a computer such as a PC. The domain B electronic certificate is stored in an IC chip connected to the mobile phone terminal, and is used using the mobile phone terminal.

Here, since the first certificate authority device 3A and the second certificate authority device 3B have the same functional configuration, these functional configurations will be described with reference to FIG. 8 (schematic diagram of the certificate authority device 3).

FIG. 8 is a schematic diagram of the certificate authority device 3. As illustrated, the certificate authority device 3 includes a storage unit 301, a control unit 307, an input unit 312, an output unit 313, and a communication unit 314.

The storage unit 301 includes a certificate authority private key storage area 302, a certificate authority certificate storage area 303, a user certificate storage area 304, and a certificate revocation information storage area 305.

In the certification authority private key storage area 302, information for identifying a certification authority private key that is a private key owned by the certification authority 3 is stored.

Note that the CA private key is an encryption key used to give an electronic signature of the CA 3 when issuing a user certificate (public key certificate). The certificate authority private key is secret key information owned by the certificate authority of each domain, and is securely managed in the certificate authority of each domain. In the present embodiment, management is performed inside the storage unit 301 of the certificate authority device 3, but management may be performed using a dedicated device having tamper resistance such as a hardware security module.

The certificate authority certificate storage area 303 stores information for specifying a certificate authority certificate that is a public key certificate of the certificate authority 3 corresponding to the certificate authority private key stored in the certificate authority private key storage area 302. .

The certificate authority certificate is a self-signed public key certificate issued by the certificate authority 3 to itself. The public key described in the public key certificate and the CA private key form a pair of keys.

The user certificate storage area 304 stores information for specifying a user certificate that is an electronic certificate issued to the user.

In the certificate revocation information storage area 305, information specifying revocation information related to the user certificate issued by the certificate authority 3 is stored.

The certificate revocation information is information used to confirm whether the user certificate (public key certificate) has been revoked. The certificate revocation information corresponds to a certificate revocation list (CRL).

In the present embodiment, the CA private key, CA certificate, and certificate revocation information are handled by different CA devices 3 for each domain.

The control unit 307 includes an overall control unit 308, an authentication processing unit 309, and a revocation information providing unit 310.

The overall control unit 308 controls the entire processing in the certificate authority device 3. For example, in this embodiment, processes such as file management, process management, and device management are controlled.

The authentication processing unit 309 controls authentication processing in the certificate authority device 3. For example, in the present embodiment, for a certain user, the user's identification name and the public key owned by the user are linked, and a digital signature is applied to the linked information using a certification authority private key. Process to issue a user certificate (public key certificate).

In addition, the authentication processing unit 309 manages user certificates issued by the certificate authority device 3, and further, regarding the user certificate (public key certificate) issued by the certificate authority device 3, a revoked user certificate Certificate revocation information is generated by digitally signing the certificate (public key certificate) information list using the certificate authority private key of the certificate authority device 3.

In this embodiment, the authentication processing unit 309 issues a certificate authority certificate that is a root certificate and a user certificate.

In the present embodiment, the description will be made in two layers, that is, the certificate authority certificate and the user certificate. However, the hierarchy structure of the certificate authority may be three or more layers. It is not limited.

The revocation information providing unit 310 controls processing for providing the certificate revocation information generated by the authentication processing unit 309 via the communication unit 314. For example, the revocation information providing unit 310 transmits the certificate revocation information via the communication unit 314 in response to a request from one that verifies the public key certificate.

For example, the revocation information providing unit 310 has a function such as an LDAP server. In the present embodiment, the certificate revocation information is described as a certificate revocation list (CRL). However, the present embodiment is not limited to such a mode, and the revocation information providing unit 310 uses the online certificate status protocol. As in (OCSP), a process for accepting a request for certificate validity confirmation and returning a response in response to the request may be performed.

The input unit 312 accepts input of information.

The output unit 313 outputs information.

The communication unit 314 transmits and receives information via the network 8.

The certificate authority device 3 described above has, for example, a CPU 391, a memory 392, an external storage device 393 such as an HDD, and a portable device such as a CD and a DVD as shown in FIG. 9 (schematic diagram of the computer 390). A reading device 395 that reads and writes information from and on the storage medium 394, an input device 396 such as a keyboard and a mouse, an output device 397 such as a display, and a communication device 398 such as a NIC for connecting to a communication network. This can be realized by a general computer 390 provided.

For example, the storage unit 301 can be realized by the CPU 391 using the memory 392 or the external storage device 393, and the control unit 307 loads a predetermined program stored in the external storage device 393 into the memory 392. The input unit 312 can be realized by the CPU 391 using the input device 396, and the output unit 313 can be realized by the CPU 391 using the output device 397. The communication unit 314 can be realized by the CPU 391 using the communication device 398.

This predetermined program is downloaded from the storage medium 394 via the reading device 395 or from the network via the communication device 398 to the external storage device 393, and then loaded onto the memory 392 and executed by the CPU 391. You may do it. Alternatively, the program may be directly loaded on the memory 392 from the storage medium 394 via the reading device 395 or from the network via the communication device 398 and executed by the CPU 391.

FIG. 10 is a schematic diagram of the service providing apparatus 4. As illustrated, the service providing apparatus 4 includes a storage unit 401, a control unit 405, and a communication unit 410.

The storage unit 401 includes a certificate authority certificate storage area 402 and an access control policy information storage area 403.

The certificate authority certificate storage area 402 stores all certificate authority certificates necessary for signature verification of user certificates.

The access control policy information storage area 403 stores information for specifying the access right for each service provided by the service providing apparatus 4. For example, an access control list or the like that determines whether or not access is permitted according to each URI of the service and the user or the attribute of the user is stored.

The control unit 405 includes an overall control unit 406, a service providing unit 407, and an authentication cooperation processing unit 408.

The overall control unit 406 controls the entire processing in the service providing apparatus 4. For example, in this embodiment, processes such as file management, process management, and device management are controlled.

The service providing unit 407 controls processing for providing a service to the user via the network 8. For example, it includes a Web server program and a Web application program.

When the user accesses the service providing program, the authentication cooperation processing unit 408 requests information necessary for authentication to the user and provides the electronic signature data and the user certificate transmitted from the user side. It controls the process of requesting verification from the side certificate verification apparatus 6 and the like and the process of associating a plurality of electronic certificates.

The communication unit 410 transmits and receives information via the network 8.

The service providing apparatus 4 described above can be realized by, for example, a general computer 390 as shown in FIG.

For example, the storage unit 401 can be realized by the CPU 391 using the memory 392 or the external storage device 393, and the control unit 405 loads a predetermined program stored in the external storage device 393 into the memory 392. The communication unit 410 can be realized by the CPU 391 using the communication device 398.

FIG. 11 is a schematic diagram of the user information management device 5. As illustrated, the user information management device 5 includes a storage unit 501, a control unit 504, and a communication unit 508.

The storage unit 501 includes a user information storage area 502.

In the user information storage area 502, for each user of the service provided by the service providing apparatus 4, the user certificate of the user, another user certificate that uses the user certificate as a cooperation destination, Is stored. For example, in the present embodiment, a user information table 502a as shown in FIG. 12 (schematic diagram of the user information table 502a) is stored.

As illustrated, the user information table 502a includes a registration ID field 502b, a personal information field 502c, a linked certificate storage area 502d, a linked certificate storage area 502e, a notification destination field 502n, and an authentication code field 502o. And a registration date / time field 502p and a status flag field 502q.

In the registration ID field 502b, information for identifying a user of a service provided by the service providing apparatus 4 is stored. Here, in the present embodiment, a registration ID assigned so as to be unique to the user is stored as information for identifying the user of the service.

In the personal information field 502c, user attribute information specified in the registration ID field 502b is stored. Here, in the present embodiment, name, address, date of birth, sex, and the like are stored as user attribute information.

The linked certificate storage area 502d stores information that identifies a user certificate to which another user certificate is linked. Here, in the present embodiment, a domain A user certificate (a user certificate provided by the first certificate authority device 3A) on which the service provider that provides the service using the service providing device 4 places high trust. Information for identifying is stored.

Here, the linked certificate storage area 502d has a user certificate field 502f, an issuer name field 502g, a serial number field 502h, and an owner name field 502i.

The user certificate field 502f stores information for identifying a domain A user certificate (a user certificate provided by the first certificate authority device 3A).

The issuer name field 502g stores information for specifying the issuer name of the user certificate extracted from the user certificate stored in the user certificate field 502f.

The serial number field 502h stores information for identifying the serial number of the user certificate extracted from the user certificate stored in the user certificate field 502f.

The owner name field 502i stores information for identifying the owner of the user certificate extracted from the user certificate stored in the user certificate field 502f.

In the cooperation certificate storage area 502e, information for specifying a user certificate that uses the user certificate specified in the linked certificate storage area 502d as a cooperation destination is stored. Here, in the cooperation certificate storage area 502e, information for specifying at least one user certificate having the user certificate specified in the cooperation certificate storage area 502d as a cooperation destination is stored. In the present embodiment, the domain B user certificate (the user certificate provided by the second certificate authority device 3B) that the service provider that provides the service using the service providing device 4 does not have very high trust. ) Is stored.

Here, in the linked certificate storage area 502e, the user certificate field 502j, the issuer name field 502k, the serial number field 502l, and the owner name field 502m are specified in the linked certificate storage area 502d. It is provided according to the number of user certificates that use the user certificate to be linked.

In the user certificate field 502j, information for specifying a user certificate (here, a domain B user certificate) that uses the user certificate specified in the linked certificate storage area 502d as a link destination. Stored.

The issuer name field 502k stores information for specifying the issuer name of the user certificate extracted from the user certificate stored in the user certificate field 502j.

The serial number field 502l stores information for specifying the serial number of the user certificate extracted from the user certificate stored in the user certificate field 502j.

The owner name field 502m stores information for identifying the owner of the user certificate extracted from the user certificate stored in the user certificate field 502j.

The notification destination field 502n stores information for specifying a communication address when notifying the user specified in the registration ID field 502b of a URL for requesting the main registration. Here, in the present embodiment, the mail address of the second user device 2 used by the user specified by the registration ID field 502b is stored.

The authentication code field 502o stores information for specifying an authentication code used when the user specified in the registration ID field 502b changes the association of the domain A user certificate. Here, the authentication code is information for uniquely identifying which user certificate is associated with the authentication code, and uses a value that does not substantially collide with the value of the authentication code in another row. For example, a random number or a hash value is used as the authentication code.

In the registration date / time field 502p, information for specifying the date / time when information is registered in the linked certificate storage area 502d is stored.

The status flag field 502q stores information indicating the registration status of the user specified in the registration ID field 502b. Here, in this embodiment, as information indicating the registration status, a user certificate is registered in the linked certificate storage area 502d, and the user certificate is still registered in the linked certificate storage area 502e. After the “temporary registration” and “temporary registration” indicating that the user ID is not registered, the user specified in the registration ID field 502b is notified of the registration request, and the registration of the user certificate is still in the cooperation certificate storage area 502e. “Unverified” indicating that the user ID is not registered, “Main Registration” indicating that the user specified in the registration ID field 502b has registered the user certificate in the cooperation certificate storage area 502e, “Main Registration” "A" indicating that the user certificate stored in the linked certificate storage area 502d is invalid in the state of "A", and stored in the linkage certificate storage area 502e in the state of "main registration" It indicates that use's certificate is invalid "B invalid", such as but shall have five status, but is not limited to this embodiment the content of the status. Further, the status of “main registration” indicates that the user certificate association is valid.

By having the above data structure, multiple user certificates used by the same user are associated.

The communication unit 508 transmits and receives information via the network 8.

The user information management apparatus 5 described above can be realized by a general computer 390 as shown in FIG. 9, for example.

For example, the storage unit 501 can be realized by the CPU 391 using the memory 392 or the external storage device 393, and the control unit 504 loads a predetermined program stored in the external storage device 393 into the memory 392. The communication unit 508 can be realized by the CPU 391 using the communication device 398.

FIG. 13 is a schematic diagram of the providing-side certificate verification device 6. As shown in the figure, the providing-side certificate verification device 6 includes a storage unit 601, a control unit 605, and a communication unit 610.

The storage unit 601 includes a verification access destination information storage area 602 and a certificate authority certificate information storage area 603.

In the verification access destination information storage area 602, a certificate verification apparatus (in this embodiment, the first certificate verification apparatus 7A or the second certificate verification apparatus 7B) for requesting verification of the validity of the user certificate. Or information for specifying the URI of the inquiry destination for confirming the validity of the user certificate is stored for each issuer of the user certificate.

The certificate authority certificate information storage area 603 stores information for specifying the certificate authority certificate of the certificate authority necessary for verifying the user certificate.

The control unit 605 includes an overall control unit 606, a certificate verification unit 607, and an additional verification unit 608.

The overall control unit 606 controls the entire processing in the providing side certificate verification apparatus 6. For example, in this embodiment, processes such as file management, process management, and device management are controlled.

The certificate verification unit 607 controls the process of verifying the validity of the user certificate and responding to the result in response to a request from another device and the additional verification unit 608. Here, the verification of the validity of the user certificate is to construct and verify the certification path of the certificate requested to be verified, and to confirm the validity of the user certificate.

Further, the certificate verification unit 607 has a certificate verification device for a specific domain (in this embodiment, the first certificate verification device 7A and the second certificate verification device 7B). If the setting is to request, the verification of the validity of the user certificate of the specific domain is requested to the certificate verification apparatus, and the process of receiving the verification result as a response is controlled.

The additional verification unit 608 controls processing for verifying the validity of another user certificate associated with the user certificate whose request for verification has been received by the certificate verification unit 607.

The communication unit 610 transmits and receives information via the network 8.

The providing side certificate verification device 6 described above can be realized by, for example, a general computer 390 as shown in FIG.

For example, the storage unit 601 can be realized by the CPU 391 using the memory 392 or the external storage device 393, and the control unit 605 loads a predetermined program stored in the external storage device 393 into the memory 392. The communication unit 610 can be realized by using the communication device 398 by the CPU 391.

The first certificate verification device 7A verifies the user certificate (domain A user certificate) issued by the first certificate authority device 3A in response to a request from another device, and the second certificate. The verification device 7B verifies the user certificate (domain B user certificate) issued by the second certificate authority device 3B in response to a request from another device.

The first certificate verification device 7A and the second certificate verification device 7B can be realized by a publicly known verification server that verifies public key certificates, and thus detailed description thereof is omitted.

14 and 15 are sequence diagrams showing user certificate registration processing.

As a premise for registering the user certificate, the user has been issued a user certificate 392 from the first certificate authority device 3A in domain A and the second certificate authority device 3B in domain B. Shall. In the present embodiment, the first user device 1 and the second user device 2 are described as being owned by the user, but the first user device 1 and the second user device 2 themselves. May be a window terminal on the service provider side or a form in which the user owns the user authentication device 120.

First, the service use unit 104 of the first user device 1 accepts an input of a URL for performing use registration of the service provided by the service providing device 4 via the input unit 108, and via the communication unit 110, A user registration request is transmitted to the service providing apparatus 4 (S10).

Next, in the service providing device 4, the service providing unit 407 receives the user registration request transmitted by the first user device 1 via the communication unit 410 (S11).

Subsequently, the service providing unit 407 of the service providing apparatus 4 transmits user registration screen data necessary for user registration to the first user apparatus 1 (S12).

In the first user device 1, the service use unit 104 receives the user registration screen data transmitted in step S12 via the communication unit 110 and displays it on the output unit 109 (S13).

Next, the first user device 1 receives input of information necessary for registration from the user via the input unit 108 (S14). The information for accepting the input includes user attribute information stored in the personal information field 502c of the user information table 502a shown in FIG. 12 and the notification destination of the main registration request (in this embodiment, the mail address of the second user device 2). Etc.

Next, the service using unit 104 generates electronic signature data using the domain A private key with the input information as a signature target. The service using unit 104 then receives the user information received in step S14 via the communication unit 110, the generated electronic signature data, and the domain A corresponding to the private key used to generate the electronic signature data. The user certificate is transmitted to the service providing apparatus 4 (S15).

Here, in the generation of the electronic signature data, the service use unit 104 performs the device authentication unit of the user authentication device 120 via the first user device authentication unit 106 and the user authentication device control unit 105. By requesting the generation of electronic signature data to 127, the device authentication unit 127 generates electronic signature data, and then the domain corresponding to the generated electronic signature data and the private key used to generate the electronic signature data A user certificate is returned to the service use unit 104 of the first user device 1.

Next, in the service providing device 4, the service providing unit 407 receives the user information, the electronic signature data, and the domain A user certificate transmitted from the first user device 1 via the communication unit 410 ( S16).

Next, the service providing apparatus 4 uses the authentication cooperation processing unit 408 to verify the signature of the electronic signature data received from the first user apparatus 1 using the domain A user certificate (S17). If the verification of the signature is successful, the process proceeds to step S19. If the verification of the signature fails, error screen data indicating that the signature verification has failed is generated, and the error screen data is transferred to the first user. The data is transmitted to the device 1, and the process proceeds to step S18.

In step S18, the service utilization unit 104 of the first user device 1 displays the error screen data received via the communication unit 110 on the output unit 109. In the present embodiment, the process ends in step S18, but the process may be repeated by returning to step S10 as necessary.

On the other hand, in step S19, the authentication cooperation processing unit 408 of the service providing apparatus 4 sends a verification request message requesting the providing side certificate verification apparatus 6 to verify the user certificate used for verifying the signature in S17. Send. Here, it is assumed that the verification request message includes request type data indicating a verification request in the user registration request and a user certificate to be verified.

Next, the certificate verification unit 607 of the providing side certificate verification apparatus 6 receives the user certificate verification request message transmitted by the service providing apparatus 4 via the communication unit 610 (S20).

Next, the certificate verification unit 607 of the providing side certificate verification apparatus 6 verifies the validity of the user certificate in the verification request message received in step S20 (S21). Details of the verification process in step S21 will be described with reference to FIG.

Further, the certificate verification unit 607 of the providing-side certificate verification device 6 generates a user certificate verification response message according to the verification result in step S 21, and sends it to the service providing device 4 via the communication unit 610. Transmit (S22). The verification response message for the user certificate includes success / failure verification of the user certificate.

Then, the authentication cooperation processing unit 408 of the service providing apparatus 4 receives the user certificate verification response message transmitted in step S22, and confirms the verification result of the validity of the user certificate (S23). If it is confirmed as a result of the validity verification of the user certificate that there is no problem with the user certificate, the process proceeds to step S25, where the result of the validity verification of the user certificate indicates failure. If there is, error screen data that indicates that the verification of the certificate has failed is generated, and the error screen data is transmitted to the first user device 1.

In step S24, the service utilization unit 104 of the first user device 1 displays the error screen data received via the communication unit 110 on the output unit 109. In the present embodiment, the process ends at this step, but the process may be repeated by returning to step S10 as necessary.

In step S25, the authentication cooperation processing unit 408 of the service providing apparatus 4 transmits a user information temporary registration message for requesting temporary registration of user information to the user information management apparatus 5. The user information temporary registration request message includes identification information indicating that it is a user information temporary registration request message, user information received in step S16 (personal information, notification destination, etc.), a domain A user certificate, and The issuer name, serial number, owner name, etc. extracted from the user certificate are included.

Next, the user information management unit 506 of the user information management device 5 receives the user information temporary registration request message transmitted by the service providing device 4 via the communication unit 508 (S26).

Then, the user information management unit 506 of the user information management device 5 stores the information included in the user information temporary registration request message received in step S26 in the user information table 502a (S27).

Here, in step S27, a new record is added to the user information table 502a as shown in FIG. 12, and the registration ID, personal information, user certificate, issuer name, serial number, ownership are added to the added record. The user name, notification destination, registration date and time, and registration status flag are respectively registered ID field 502b, personal information field 502c, user certificate field 502f, issuer name field 502g, serial number field 502h, owner name field 502i, The information is stored in the notification destination field 502n, the authentication code field 502o, the registration date / time field 502p, and the status flag field 502q.

The registration ID field 502b is stored with a number that is not registered in the user information table 502a, and the registration date / time field 502p receives the user information temporary registration request message in step S26. From the current date to the current time, and the status flag field 502q stores the status of “provisional registration”.

Then, the user information management unit 506 of the user information management device 5 generates a temporary registration result message including the temporary registration result of the user information via the communication unit 508, and transmits it to the service providing device 4 (S28).

The authentication cooperation processing unit 408 of the service providing apparatus 4 receives the temporary registration result message transmitted in step S28 via the communication unit 410, and confirms the success or failure of temporary registration (S29). As a result, if the temporary registration has succeeded, the process proceeds to step S31. If the temporary registration has failed, error screen data notifying that the temporary registration has failed is generated, and the error screen data is It transmits to one user apparatus 1, and progresses to step S30.

In step S30, the service using unit 104 of the first user device 1 receives the error screen data via the communication unit 410 and displays the error screen data on the output unit 109. In this embodiment, the process ends at this step, but the process may be repeated by returning to step S10 as necessary.

On the other hand, in step S31, the service providing unit 407 of the service providing apparatus 4 generates temporary registration result screen data indicating that the temporary registration has been successful, and transmits the temporary registration result screen data to the first user apparatus 1. .

Next, the service using unit 104 of the first user device 1 receives the temporary registration result screen data via the communication unit 110 and displays it on the output unit 109 (S32). Then, the process proceeds to the sequence of FIG.

Next, the service providing unit 407 of the service providing apparatus 4 transmits an access destination for the user to perform the registration procedure to the second user apparatus 2 (S33). As the transmission destination, the notification destination included in the user information received in step S16 in FIG. 14 is used. In the present embodiment, since the notification destination is the mail address associated with the second user device 2, the service providing unit 407 is for performing the procedure of the main registration on the text of the mail to the second user device 2. The URL that is the access destination is described and transmitted.

In addition, the URL includes information that can specify the user of the second user device 2, such as a registration ID or a notification destination.

Further, although not shown, after performing step S40, the service providing unit 407 of the service providing apparatus 4 transmits an access destination notified registration request message to the user information managing apparatus 5. It is assumed that the notified registration request message of the access destination includes a registration ID and the like in addition to data indicating the notified registration request message.

In the user information management apparatus 5 that has received such a notified registration request message, the user information management unit 506 specifies and specifies a record of the user information table 502a corresponding to the registration ID included in the notified registration request message. The status flag field 502q of the record is updated to the “notified” status.

Then, the user information management unit 506 of the user information management device 5 generates a notified registration result message including the notified registration result of the access destination, and transmits it to the service providing device 4.

Next, the second user device 2 receives the access destination of the main registration transmitted in step S33 by the service utilization unit 207 (S34).

Then, the service using unit 207 of the second user device 2 displays the access destination on the output unit 211, and receives an execution instruction for selecting the displayed access destination via the input unit 210. A main registration request message for performing the main registration of the user is transmitted to the service providing apparatus 4 (S35). Note that the processing in step S35 is performed at a timing convenient for the user, and is not necessarily performed immediately.

Next, the service providing unit 407 of the service providing apparatus 4 receives the main registration request message transmitted by the second user apparatus 2 via the communication unit 410 (S36).

Then, the service providing unit 407 of the service providing apparatus 4 transmits to the second user apparatus 2 authentication request data for requesting a domain B user certificate or the like necessary for authentication for performing the main registration of the user. (S37). For example, a request for client authentication by SSL (Secure Socket Layer) or TLS (Transport Layer Security) corresponds to step S37.

The service utilization unit 207 of the second user device 2 receives the authentication request data transmitted in step S37 via the wireless communication unit 212 (S38).

Next, the second user device 2 generates an electronic signature using the private key of the domain B based on the authentication request (S39).

When generating the electronic signature, the second user device authentication unit 208 uses the second user secret key stored in the second user secret key storage area 202 in response to an instruction from the service use unit 207. To generate electronic signature data.

Then, the service utilization unit 207 of the second user device 2 extracts the domain B user certificate corresponding to the second user private key used in step S39 from the second user certificate storage area 203, The digital signature data generated in step S39, the extracted user certificate, and the service providing apparatus 4 are transmitted (S40). For example, processing for transmitting a client certificate by SSL or TLS corresponds to this step.

Next, the service providing unit 407 of the service providing apparatus 4 receives the electronic signature data, the domain B user certificate, and the like transmitted by the second user apparatus 2 via the communication unit 410 (S41).

Then, the authentication cooperation processing unit 408 of the service providing apparatus 4 performs signature verification of the received electronic signature data using the domain B user certificate (S42). If the signature verification is successful, the process proceeds to step S44. If the signature verification is unsuccessful, error screen data indicating that the signature verification has failed is generated, and the error screen data is stored in the second user device. 2 and proceeds to step S43.

In step S43, the service utilization unit 207 of the second user device 2 displays the transmitted error screen data on the output unit 211. In this embodiment, the process ends at this step, but the process may be repeated by returning to step S35 as necessary.

On the other hand, in step S44, the authentication cooperation processing unit 408 of the service providing apparatus 4 transmits a verification request message for the user certificate used for verifying the signature in step S42 to the providing side certificate verification apparatus 6. It is assumed that the verification request message includes request type data indicating that this is a main registration request and a user certificate to be verified.

Next, the certificate verification unit 607 of the providing side certificate verification apparatus 6 receives the user certificate verification request message transmitted by the service providing apparatus 4 via the communication unit 610 (S45).

Then, the certificate verification unit 607 of the providing side certificate verification apparatus 6 verifies the validity of the user certificate in the verification request message received in step S45 (S46). Details of this step will be described with reference to FIG.

Further, according to the verification result in step S46, the certificate verification unit 607 of the providing side certificate verification apparatus 6 generates a user certificate verification response message and transmits it to the service providing apparatus 4 (S47). The verification response message for the user certificate includes success / failure verification of the user certificate.

Next, the authentication cooperation processing unit 408 of the service providing apparatus 4 receives the user certificate verification response message transmitted in step S47 and confirms the verification result of the validity of the user certificate (S48). As a result of verifying the validity of the user certificate, if it can be confirmed that there is no problem with the user certificate, the process proceeds to step S50, and the result of verifying the validity of the user certificate indicates failure. In this case, error screen data that indicates that the verification of the user certificate has failed is generated, the error screen data is transmitted to the second user device 2, and the process proceeds to step S49.

In step S49, the service utilization unit 207 of the second user device 2 displays the error screen data transmitted in step S48 on the output unit 211. In this embodiment, the process ends at this step, but the process may be repeated by returning to step S35 as necessary.

On the other hand, in step S50, the authentication cooperation processing unit 408 of the service providing apparatus 4 transmits a user information main registration request message to the user information management apparatus 5. In the main registration request message of the user information, in addition to data indicating the main registration request message, the domain B user certificate received in step S41 and the issuer name extracted from the user certificate, The serial number, owner name, etc. shall be included.

Next, the user information management unit 506 of the user information management apparatus 5 receives the user information main registration request message transmitted by the service providing apparatus 4 via the communication unit 508 (S51).

Then, the user information management unit 506 of the user information management device 5 updates the user information table 502 based on the information included in the registration request message received in step S51 (S52). For example, the user information management unit 506 performs a search on the registration ID field 502b of the user information table 502 using the transmitted registration ID as a search key, specifies a record in which the registration ID is stored, and specifies The information received in step S51 is stored in the user certificate field 502j, the issuer name field 502k, the serial number field 502l, and the owner name field 502m of the recorded record, and the status flag field 502q is “main registration”. Update to status.

If the domain B user certificate to be registered is already associated with another domain A user certificate, registration fails.

Further, after executing step S52, the user information management unit 506 of the user information management apparatus 5 generates a main registration result message including the main registration result of the user information and transmits it to the service providing apparatus 4 (S53).

The authentication cooperation processing unit 408 of the service providing apparatus 4 receives the main registration result message transmitted in step S53 via the communication unit 410, and confirms the success or failure of the main registration (S54). As a result, if the main registration is successful, the process proceeds to step S56. If the main registration is unsuccessful, error screen data indicating that the main registration has failed is generated, and the error screen data is stored in the second user device 2. The process proceeds to step S55.

In step S55, the service use unit 207 of the second user device 2 displays the error screen data transmitted in step S54 on the output unit 211. In this embodiment, the process ends at this step, but the process may be repeated by returning to step S35 as necessary.

On the other hand, in step S56, the service providing unit 407 of the service providing apparatus 4 generates main registration result screen data indicating that the main registration is successful, and transmits the main registration result screen data to the second user apparatus 2. (S56).

Next, the service utilization unit 207 of the second user device 2 receives the main registration result screen data transmitted in step S56 via the wireless communication unit 212 and displays it on the output unit 211 (S57).

Next, as described above, by performing the procedure shown in FIGS. 14 and 15, the association between the user certificate having high reliability and the user certificate having low reliability for the service provider is completed. In the present embodiment, association may be expressed as cooperation.

FIG. 16 is a sequence diagram showing an authentication process when using the service.

Here, an example in which the second user device 2 is used is shown, but the same applies to the case where the first user device 1 is used. In addition, as a premise for using the service, it is assumed that the user performs the registration process of the user certificate shown in FIGS.

First, the service using unit 207 of the second user apparatus 2 receives an input of a URL for using the service provided by the service providing apparatus 4 via the input unit 210 and sends a service request message to the service providing apparatus 4. Transmit (S60).

The service providing unit 407 of the service providing apparatus 4 receives the service request message transmitted by the second user apparatus 2 via the communication unit 410 (S61).

Next, the service providing unit 407 of the service providing apparatus 4 transmits authentication request data for requesting a user certificate or the like necessary for authentication at the time of service use to the second user apparatus 2 (S62).

Next, the service utilization unit 207 of the second user device 2 receives the authentication request data transmitted in step S62 via the wireless communication unit 212 (S63).

Next, the service use unit 207 of the second user device 2 issues an instruction to the second user device authentication unit 208, and the second user device authentication unit 208 performs the second use based on the authentication request. The electronic signature data is generated using the private key of the domain B stored in the person private key storage area 202 (S64). For example, processing on the client side required for client authentication by SSL or TLS corresponds to this step.

Next, the service use unit 207 of the second user device 2 generates the electronic signature data generated in step S64, the user certificate corresponding to the private key used to generate the electronic signature data, and the service providing device 4 (S65). For example, processing for transmitting a client certificate by SSL or TLS corresponds to this step.

Then, the service providing unit 407 of the service providing device 4 receives the electronic signature data, the user certificate, and the like transmitted by the second user device 2 via the communication unit 410 (S66).

Next, the authentication cooperation processing unit 408 of the service providing apparatus 4 performs signature verification of the electronic signature data received from the second user apparatus 2 using the user certificate received together (S67). If the signature verification is successful, the process proceeds to step S69. If the signature verification is unsuccessful, error screen data indicating that the signature verification has failed is generated, and the error screen data is stored in the second user device. 2 and proceeds to step S68.

In step S68, the service utilization unit 207 of the second user device 2 displays the error screen data transmitted in step S67 on the output unit 211. In this embodiment, the process ends at this step, but the process may be repeated by returning to step S60 as necessary.

On the other hand, in step S69, the authentication cooperation processing unit 408 of the service providing apparatus 4 transmits to the providing side certificate verifying apparatus 6 a verification request message for the user certificate used for verifying the signature in step S67. The verification request message includes request type data indicating a service request and a user certificate.

The certificate verification unit 607 of the providing side certificate verification device 6 receives the user certificate verification request message transmitted by the service providing device 4 via the communication unit 610 (S70).

Next, the certificate verification unit 607 of the providing side certificate verification apparatus 6 verifies the validity of the user certificate in the verification request message received in step S70 (S71). Details of this step will be described with reference to FIG.

Then, according to the verification result of step S71, the certificate verification unit 607 of the providing side certificate verification apparatus 6 generates a certificate verification response message and transmits it to the service providing apparatus 4 (S72). The certificate verification response message includes the success or failure of the validity verification of the second user certificate 2, and if the user certificate with low reliability is verified in step S71, According to FIG. 22, it is assumed that the verification response also includes the validity verification result of the user certificate with high reliability associated with the user certificate.

Next, the authentication cooperation processing unit 408 of the service providing apparatus 4 receives the certificate verification response message transmitted in step S72, and confirms the verification result of the validity of the user certificate (S73). If it is confirmed that there is no problem with the certificate as a result of the validity verification of the user certificate, the process proceeds to step S75, and the result of the validity verification of the user certificate indicates failure. In this case, error screen data that indicates that the verification of the user certificate has failed is generated, the error screen data is transmitted to the second user device 2, and the process proceeds to step S74.

In step S74, the service utilization unit 207 of the second user device 2 displays the error screen data transmitted in step S73 on the output unit 211. In this embodiment, the process ends at this step, but the process may be repeated by returning to step S60 as necessary.

On the other hand, in step S75, the service providing unit 407 of the service providing apparatus 4 refers to the access control policy stored in the access control policy information storage area 403, and accesses the service for the user of the user certificate. Judgment is made. As a result of the access determination, if it is confirmed that the user has the access authority, the process proceeds to step S77. If the access determination fails, error screen data that indicates that there is no access authority to the service is generated. The error screen data is transmitted to the second user device 2 and the process proceeds to step S76.

In step S76, the service utilization unit 207 of the second user device 2 displays the error screen data transmitted in step S75 on the output unit 211. In this embodiment, the process ends at this step, but the process may be repeated by returning to step S60 as necessary.

On the other hand, in step S77, the service providing unit 407 of the service providing apparatus 4 generates service providing screen data for providing the service, and transmits the service providing screen data to the second user apparatus 2 (S77). .

Then, the service utilization unit 207 of the second user device 2 displays the service provision screen data transmitted in step S77 on the output unit 211 (S78).

By performing the above procedure, it is possible to provide a service after performing authentication with high reliability for the service provider.

FIG. 17 is a sequence diagram showing a user certificate association update process.

Suppose that the user has already registered the user certificate shown in FIGS. 14 and 15 as a premise of this sequence. In this sequence, the first user device 1 is used for explanation, but the second user device 2 can perform the same processing.

If it is necessary to update the association of the user certificate, a new user certificate will be issued from the same certificate authority that issued the user certificate when the user certificate expires. Applicable when issued. Here, the user certificate for which the association of the user certificate is to be updated may be the domain A or the domain B, but the user certificate in the old user certificate and the new user certificate The issuer name and owner name of the certificate shall be the same.

However, even if at least a part of the issuer name or owner name does not match between the old and new user certificates, it is determined from other matching parts according to the naming rules for the issuer name or owner name of the certificate. If it can be determined that they are the same issuer or owner, they can be updated.

First, the service using unit 104 of the first user device 1 receives an input of a URL for updating the association of the user certificate in the service provided by the service providing device 4 via the input unit 108 and provides the service. A certificate update request message for updating the association of the user certificate is transmitted to the device 4 (S80).

Next, the service providing unit 407 of the service providing device 4 receives the certificate update request message transmitted by the first user device 1 via the communication unit 410 (S81).

Next, the service providing unit 407 of the service providing apparatus 4 transmits authentication request data requesting a user certificate or the like necessary for authentication at the time of certificate update to the first user apparatus 1 (S82).

Next, the service utilization unit 104 of the first user device 1 receives the authentication request data transmitted in step S82 via the communication unit 110 (S83).

Next, the first user device 1 generates an electronic signature using the user's private key based on the received authentication request data (S84). For example, the service use unit 104 requests the device authentication unit 127 of the user authentication device 120 to generate electronic signature data via the first user device authentication unit 106 and the user authentication device control unit 105. To do. Then, after the device authentication unit 127 generates electronic signature data using the user's private key stored in the first user private key storage area 122, the generated electronic signature data and the electronic signature data are generated. The user certificate corresponding to the secret key used for generating the message is returned to the service using unit 104 of the first user device 1. In this step, client-side processing necessary for client authentication by SSL or TLS corresponds to this step.

Note that the user certificate and private key used here are a newly issued user certificate and a private key corresponding to the user certificate. That is, a user certificate or a private key that is assumed to be used after the association is updated.

Next, the service using unit 104 of the first user apparatus 1 receives the electronic signature data generated in step S84 and the user certificate corresponding to the private key used for generating the electronic signature data. 4 (S85). For example, processing for transmitting a client certificate by SSL or TLS corresponds to this step.

Next, the service providing unit 407 of the service providing device 4 receives the electronic signature data, the user certificate, etc. transmitted by the first user device 1 via the communication unit 410 (S86).

Next, the authentication cooperation processing unit 408 of the service providing apparatus 4 performs signature verification of the electronic signature data received from the first user apparatus 1 using the user certificate received together (S87). If the signature verification is successful, the process proceeds to step S89. If the signature verification is unsuccessful, error screen data indicating that the signature verification has failed is generated, and the error screen data is stored in the first user device. 1 and proceeds to step S88.

In step S88, the service using unit 104 of the first user device 1 displays the error screen data transmitted in step S87 on the output unit 109. In this embodiment, the process ends at this step, but the process may be repeated by returning to step S80 as necessary (S88).

On the other hand, in step S89, the authentication cooperation processing unit 408 of the service providing apparatus 4 transmits to the providing side certificate verifying apparatus 6 the verification request message for the user certificate used for verifying the signature in step S87 ( S89). This verification request message includes request type data indicating a certificate update request and a user certificate to be verified.

Next, the certificate verification unit 607 of the providing side certificate verification device 6 receives the user certificate verification request message transmitted by the service providing device 4 via the communication unit 610 (S90).

The certificate verification unit 607 of the providing side certificate verification apparatus 6 verifies the validity of the user certificate in the verification request message received in step S90 (S91). Details of this step will be described with reference to FIG.

Further, according to the verification result in step S91, the certificate verification unit 607 of the providing-side certificate verification apparatus 6 generates a user certificate verification response message and transmits it to the service providing apparatus 4 (S92). The user certificate verification response message includes information for specifying whether or not the validity verification of the user certificate is successful.

Next, the authentication cooperation processing unit 408 of the service providing apparatus 4 receives the user certificate verification response message transmitted in step S92 via the communication unit 410, and the verification result of the validity of the user certificate. Is confirmed (S93). As a result of verifying the validity of the user certificate, if it can be confirmed that there is no problem with the user certificate, the process proceeds to step S95, and the result of verifying the validity of the user certificate indicates failure. In this case, error screen data that indicates that the verification of the user certificate has failed is generated, the error screen data is transmitted to the first user device 1, and the process proceeds to step S95.

In step S94, the service utilization unit 104 of the first user device 1 displays the error screen data transmitted in step S93 on the output unit 109 via the communication unit 110. In this embodiment, the process ends in this step, but the process may be repeated by returning to step S80 as necessary.

On the other hand, in step S95, the authentication cooperation processing unit 408 of the service providing apparatus 4 transmits a search request message for searching for user information to the user information management apparatus 5. In the user information search request message, in addition to the data indicating that it is a search request message, the issuer name extracted from the user certificate received in step S86 or a part thereof (part that can identify the issuer) ) And the owner name or a part thereof (part that can identify the owner).

Next, the user information management unit 506 of the user information management device 5 receives the user information search request message transmitted by the service providing device 4 via the communication unit 508 (S96).

Next, the user information management unit 506 of the user information management device 5 searches the user information table 502a based on the information received in step S96 (S97). For example, the user information management unit 506 determines to which domain the issuer name or part of the user certificate received in step S96 belongs, and the user information table 502a has the corresponding domain. A record that matches the received owner name with the search key is searched from the columns of the person name fields 502i and 502m (S97). In addition, as described in the preconditions of this flow, for a part of the owner name that can uniquely identify the user according to the certificate naming rules, a part of the owner name is used as the search key. .

Next, the user information management unit 506 of the user information management device 5 generates a search result message including the search result of the user information and transmits it to the service providing device 4 (S98). Here, if a corresponding record exists in the search result message, the registration ID stored in the registration ID field 502b of the record is included. If there is no corresponding record, it indicates that the record does not exist. Information indicating the effect shall be included.

In addition, according to the condition of the update target of the certificate association which is the premise of this sequence, it is assumed that there are not a plurality of corresponding records. Therefore, when a plurality of corresponding records are searched in step S97, in this step A message indicating an error is generated as a search result to be generated.

Next, the authentication cooperation processing unit 408 of the service providing apparatus 4 receives the search result message transmitted in step S98 via the communication unit 410, and whether or not user information is included in the received search result message. Is confirmed (S99). If the search result message includes a registration ID that is user information, the process proceeds to step S101. If the user information (registration ID) cannot be acquired from the search result, the user certificate to be updated is registered. Error screen data that indicates that no error has occurred is generated, the error screen data is transmitted to the first user device 1, and the process proceeds to step S100.

In step S100, the service utilization unit 104 of the first user device 1 displays the error screen data transmitted in step S99 on the output unit 109. In this embodiment, the process ends in this step, but the process may be repeated by returning to step S80 as necessary.

On the other hand, in step S 101, the authentication cooperation processing unit 408 of the service providing apparatus 4 transmits a user information change request message to the user information management apparatus 5. The user information change request message includes data indicating the change request message, the registration ID acquired in step S99, the user certificate received in step S86, and the issue extracted from the user certificate. The name, serial number, owner name, etc. shall be included. In addition, for the user certificate, issuer name, serial number, and owner name columns requesting the change, the corresponding domain is identified from the issuer name, and the column to be changed is designated.

Next, the user information management unit 506 of the user information management device 5 receives the user information change request message transmitted by the service providing device 4 via the communication unit 508 (S102).

Next, the user information management unit 506 of the user information management device 5 updates the information stored in the user information table 502 with the information received in step S102 (S103). In this step, the record of the user information table 502 is specified using the registration ID included in the received information as a search key, and information on the user certificate, issuer name, serial number, owner name is included in the specified record. Update. For the user certificate, issuer name, serial number, and owner name fields to be updated, the corresponding domain is identified from the issuer name, and the field corresponding to the identified domain is identified.

Then, the user information management unit 506 of the user information management device 5 generates a message including the change result of the user information and transmits it to the service providing device 4 (S104).

Next, the authentication cooperation processing unit 408 of the service providing apparatus 4 receives the change result message transmitted in step S104, and confirms the success or failure of the change (S105). If the change is successful, the process proceeds to step S107. If the change is unsuccessful, error screen data notifying that the change has failed is generated, and the error screen data is transmitted to the first user device 1, and step S106 is performed. Proceed to

In step S106, the service utilization unit 104 of the first user device 1 displays the error screen data transmitted in step S105 on the output unit 109. In this embodiment, the process ends in this step, but the process may be repeated by returning to step S80 as necessary.

On the other hand, in step S107, the service providing unit 407 of the service providing apparatus 4 generates change result screen data indicating that the change is successful, and transmits the screen data to the first user apparatus 1 (S107).

Then, the service using unit 104 of the first user device 1 displays the change result screen data transmitted in step S107 on the output unit 109 (S108).

By performing the above procedure, the update of user certificate association is completed. In this sequence, the user information is searched (steps S95 to S100) and then the user information change request message is transmitted (step S101). However, the user information searching step (steps S95 to S100) is performed. Step S100) can be skipped.

FIG. 18 and FIG. 19 are sequence diagrams showing the user certificate association changing process.

Here, as a premise of this sequence, it is assumed that the user has completed the registration process of the user certificate shown in FIGS.

In addition, it is necessary to change the user certificate association when it does not meet the conditions for updating the user certificate association. For example, the certificate authority that issued the already registered user certificate Corresponds to the case of associating a user certificate issued from another certificate authority, or when the user certificate information has been changed, the user certificate is reissued, and the user certificate is associated To do.

Note that the target of this sequence is when the user certificate with high reliability is changed without changing the user certificate with low reliability. Therefore, in this embodiment, a case where a new domain A user certificate is associated with a domain B user certificate will be described. On the other hand, when changing the association of a low-trust user certificate (domain B user certificate) without changing the high-trust user certificate (domain A user certificate) for the service provider , The cooperation release sequence shown in FIGS. 20 and 21 and the registration sequence shown in FIGS. 14 and 15 are performed.

First, the service using unit 104 of the second user apparatus 2 receives an input of a URL for changing the association of the user certificate in the service provided by the service providing apparatus 4 via the input unit 210, and provides the service. A certificate linkage change request message for changing the user certificate is transmitted to the device 4 (S110).

Next, the service providing unit 407 of the service providing apparatus 4 receives the certificate cooperation change request message transmitted by the second user apparatus 2 via the communication unit 410 (S111).

Next, the service providing unit 407 of the service providing apparatus 4 transmits to the second user apparatus 2 authentication request data for requesting a user certificate or the like necessary for authentication at the time of certificate linkage change (S112).

Then, the service use unit 104 of the second user device 2 receives the authentication request data transmitted in step S112 via the wireless communication unit 212 (S113).

Next, in response to the authentication request data, the second user device 2 generates electronic signature data using the domain B private key stored in the second user private key storage area 202 (S14). When providing the electronic signature, the service using unit 104 instructs the second user device authentication unit 208 to generate the electronic signature data and then the generated electronic signature data. The signature data, the user certificate corresponding to the secret key used to generate the electronic signature data, and the service utilization unit 207 are returned. For example, processing on the client side required for client authentication by SSL or TLS corresponds to this step.

Next, the service using unit 207 of the second user apparatus 2 receives the electronic signature data generated in step S114 and the user certificate corresponding to the private key used for generating the electronic signature data. 4 (S115). For example, processing for transmitting a client certificate by SSL or TLS corresponds to this step.

Next, the service providing unit 407 of the service providing apparatus 4 receives the electronic signature data, the user certificate, and the like transmitted by the second user apparatus 2 via the communication unit 410 (S116).

Next, the authentication cooperation processing unit 408 of the service providing apparatus 4 performs signature verification of the electronic signature data received from the second user apparatus 2 using the user certificate received together (S117). If the verification of the signature is successful, the process proceeds to step S119. If the verification of the signature fails, error screen data indicating that the signature verification has failed is generated, and the error screen data is stored in the second user device. 2 and proceeds to step S118.

In step S118, the service use unit 207 of the second user device 2 displays the error screen data transmitted in step S117 on the output unit 211. In this embodiment, the process ends at this step, but the process may be repeated by returning to step S110 as necessary.

On the other hand, in step S119, the authentication cooperation processing unit 408 of the service providing apparatus 4 transmits to the providing side certificate verifying apparatus 6 a verification request message for the user certificate used for verifying the signature in step S117. This verification request message includes request type data indicating a cooperation change request and a user certificate.

Next, the certificate verification unit 607 of the providing side certificate verification device 6 receives the user certificate verification request message transmitted by the service providing device 4 via the communication unit 610 (S120).

Then, the certificate verification unit 607 of the providing-side certificate verification apparatus 6 verifies the validity of the user certificate in the verification request message received in step S120 (S121). Details of this step will be described with reference to FIG.

Next, according to the verification result of step S91, the certificate verification unit 607 of the providing side certificate verification apparatus 6 generates a user certificate verification response message and transmits it to the service providing apparatus 4 (S122). The verification response message for the user certificate includes success / failure verification of the user certificate.

Next, the authentication cooperation processing unit 408 of the service providing apparatus 4 receives the user certificate verification response message transmitted in step S122, and confirms the verification result of the validity of the user certificate (S123). As a result of verifying the validity of the user certificate, if it can be confirmed that there is no problem with the user certificate, the process proceeds to step S125, and the result of verifying the validity of the user certificate indicates failure. In this case, error screen data that indicates that the verification of the user certificate has failed is generated, the error screen data is transmitted to the second user device 2, and the process proceeds to step S124.

In step S124, the service utilization unit 207 of the second user device 2 displays the error screen data transmitted in step S123 on the output unit 211. In this embodiment, the process ends at this step, but the process may be repeated by returning to step S110 as necessary.

On the other hand, in step S125, the authentication cooperation processing unit 408 of the service providing apparatus 4 generates an authentication code that is unique to the user of the user certificate.

Then, the authentication cooperation processing unit 408 of the service providing apparatus 4 transmits an authentication code registration request message to the user information management apparatus 5 via the communication unit 410 (S126). The authentication code registration request message includes, in addition to data indicating the authentication code registration request message, the issuer name and serial number extracted from the user certificate received in step S116, and the authentication code. It shall be assumed.

Next, the user information management unit 506 of the user information management device 5 receives the registration request message of the authentication code transmitted by the service providing device 4 via the communication unit 508 (S127).

Next, the user information management unit 506 of the user information management device 5 updates the user information table 502a stored in the user information storage area 502 based on the information received in step S127 (S128). Here, the user information table 502a is searched using the issuer name and serial number as search keys, and the authentication code included in the received information is registered in the record in which the issuer name and serial number are registered.

Then, the user information management unit 506 of the user information management device 5 generates a message including the authentication code registration result and transmits it to the service providing device 4 (S129).

The authentication cooperation processing unit 408 of the service providing apparatus 4 receives the registration result message transmitted in step S129 via the communication unit 410, and confirms the success or failure of registration (S130). If registration has succeeded, the process proceeds to step S132. If registration has failed, error screen data notifying that registration has failed is generated, the error screen data is transmitted to the second user device 2, and step S131. Proceed to

In step S131, the service utilization unit 207 of the second user device 2 displays the error screen data transmitted in step S130 on the output unit 211. In this embodiment, the process ends at this step, but the process may be repeated by returning to step S110 as necessary.

On the other hand, in step S132, the service providing unit 407 of the service providing device 4 generates authentication code notification screen data describing the authentication code, and transmits the authentication code notification screen data to the second user device 2 (S132). .

The service usage unit 207 of the second user device 2 displays the authentication code notification screen data transmitted in step S132 on the output unit 211 (S133). In addition, after implementing this step, the timing which transfers to following step S134 of FIG. 19 shall be implemented at a timing convenient for a user, and does not necessarily need to be implemented immediately. Further, after this step, the user uses the first user device 1.

Next, the service using unit 104 of the first user apparatus 1 accepts an input of a URL for making a certificate change request for a service provided by the service providing apparatus 4 via the input unit 108, as shown in FIG. Then, a certificate change request message is transmitted to the service providing apparatus 4 (S134).

Next, the service providing unit 407 of the service providing device 4 receives the certificate change request transmitted by the first user device 1 via the communication unit 410 (S135).

Next, the service providing unit 407 of the service providing apparatus 4 transmits the authentication code input screen data necessary for changing the user certificate to the first user apparatus 1 (S136).

Then, the service using unit 104 of the first user device 1 receives the authentication code input screen data transmitted in step S136 and displays it on the output unit 109 (S137).

Next, the service utilization unit 104 of the first user device 1 accepts input of information necessary for the change via the input unit 108, and uses the new secret key of the domain A with the input information as a signature target. Electronic signature data is generated (S138). For example, the service use unit 104 requests the device authentication unit 127 of the user authentication device 120 to generate electronic signature data via the first user device authentication unit 106 and the user authentication device control unit 105. To do. Then, the device authentication unit 127 generates electronic signature data using the new private key stored in the first user private key storage area 122, and then generates the generated electronic signature data and the electronic signature data. A new user certificate corresponding to the secret key used for the service is returned to the service using unit 104 of the first user device 1.

Then, the service utilization unit 104 of the first user apparatus 1 creates a new user corresponding to the information input by the user in step S138, the generated electronic signature data, and the private key used to generate the electronic signature data. The certificate is transmitted to the service providing apparatus 4 (S139).

Next, the service providing unit 407 of the service providing apparatus 4 receives the user information, electronic signature data, new user certificate, and the like transmitted by the first user apparatus 1 via the communication unit 410 (S140). .

Next, the authentication cooperation processing unit 408 of the service providing apparatus 4 performs signature verification of the electronic signature data received from the first user apparatus 1 using the user certificate of the new domain A (S141). Here, if the signature verification is successful, the process proceeds to step S143. If the signature verification is unsuccessful, error screen data indicating that the signature verification has failed is generated, and the error screen data is stored in the first user device. 1 and proceeds to step S142.

In step S142, the service using unit 104 of the first user device 1 displays the error screen data transmitted in step S141 on the output unit 109. In this embodiment, the process ends at this step, but the process may be repeated by returning to step S110 as necessary.

On the other hand, in step S143, the authentication cooperation processing unit 408 of the service providing apparatus 4 transmits a verification request message for the user certificate used for verifying the signature in step S141 to the providing side certificate verification apparatus 6. The verification request message includes request type data indicating a certificate change request and a new domain A user certificate to be verified.

Next, the certificate verification unit 607 of the providing side certificate verification apparatus 6 receives the user certificate verification request message transmitted by the service providing apparatus 4 via the communication unit 610 (S144).

Next, the certificate verification unit 607 of the providing side certificate verification apparatus 6 verifies the validity of the user certificate in the verification request message received in step S144 (S145). Details of this step will be described with reference to FIG.

Further, according to the verification result in step S145, the certificate verification unit 607 of the providing-side certificate verification apparatus 6 generates a user certificate verification response message and transmits it to the service providing apparatus 4 (S146). The verification response message for the user certificate includes success / failure verification of the validity of the user certificate for the new domain A.

Then, the authentication collaboration processing unit 408 of the service providing apparatus 4 receives the user certificate verification response message transmitted in step S146 and confirms the verification result of the validity of the new domain A user certificate ( S147). As a result of the validity verification of the user certificate 382, if it can be confirmed that there is no problem with the certificate, the process proceeds to step S149, and the validity verification result of the user certificate indicates failure. Generates error screen data indicating that the certificate verification has failed, transmits the error screen data to the first user device 1, and proceeds to step S148.

In step S148, the service utilization unit 104 of the first user device 1 displays the error screen data transmitted in step S147 on the output unit 109 (S148). In this embodiment, the process ends at this step, but the process may be repeated by returning to step S134 as necessary.

On the other hand, in step S149, the authentication cooperation processing unit 408 of the service providing apparatus 4 transmits a search request message for searching for an authentication code to the user information management apparatus 5. In the authentication code search request message, in addition to the data indicating that it is a search request message, the issuer name extracted from the user certificate received in step S140 or a part thereof (part that can identify the issuer), and , The owner name or a part of it (part that can identify the owner) shall be included.

The user information management unit 506 of the user information management apparatus 5 receives the authentication code search request message transmitted by the service providing apparatus 4 (S150).

Next, the user information management unit 506 of the user information management device 5 searches the user information table 502a stored in the user information storage area 502 based on the information received in step S150 (S151). In this step, in the user information table 502a, it is determined to which domain the issuer name of the user certificate or a part thereof belongs, and the received owner is obtained from the column of the owner name of the corresponding domain. Search for records whose names match the search key. In addition, as described in the preconditions of this flow, for a part of the owner name that can uniquely identify the user by the certificate naming rules, use a part of the owner name as the search key. .

Then, the user information management unit 506 of the user information management device 5 generates a search result message including the search result of the authentication code and transmits it to the service providing device 4 (S152). Here, if there is a corresponding record in step S151, the authentication code registered in the record is included in the search result message, and if there is no corresponding record, or there is an authentication code in the corresponding record. If not, information indicating that the authentication code does not exist is included in the search result message.

In addition, since it is assumed that there are not a plurality of corresponding records based on the update target condition of the user certificate association which is the premise of this sequence, when a plurality of corresponding records are searched in step S151, A message indicating an error is generated as a search result generated in the step.

Then, the authentication cooperation processing unit 408 of the service providing apparatus 4 receives the search result message transmitted in step S152, and verifies whether the received authentication code matches the authentication code received in step S140. (S153). If the verification succeeds, the process proceeds to step S155. If the verification fails (including the case where the verification result message transmitted in step S146 does not include an authentication code), the fact that the certificate change has failed is indicated. The error screen data to be transmitted is generated, the error screen data is transmitted to the first user device 1, and the process proceeds to step S154.

In step S154, the service using unit 104 of the first user device 1 displays the error screen data transmitted in step S153 on the output unit 109. In this embodiment, the process ends at this step, but the process may be repeated by returning to step S134 as necessary.

On the other hand, in step S155, the authentication cooperation processing unit 408 of the service providing apparatus 4 transmits a user information change request message to the user information management apparatus 5. In the user information change request message, in addition to the data indicating the change request message, the authentication code acquired in step S140, the user certificate, and the issuer name and serial number extracted from the user certificate. , Owner name, etc. shall be included. For the user certificate, issuer name, serial number, and owner name columns requesting the change, the corresponding domain is identified from the issuer name, and the column to be changed is designated.

The user information management unit 506 of the user information management device 5 receives the user information change request transmitted by the service providing device 4 via the communication unit 508 (S156).

Then, the user information management unit 506 of the user information management device 5 stores the information received in step S156 in the user information table 502a stored in the user information storage area 502 (S157). In this step, the user information table 502a is searched using the authentication code as a search key, and the user certificate, issuer name, serial number, and owner name information are stored in the record in which the authentication code is registered. Update. Also, the authentication code of the record is deleted.

Next, the user information management unit 506 of the user information management device 5 generates a change result message including the change result of the user information and transmits it to the service providing device 4 (S158).

The authentication cooperation processing unit 408 of the service providing apparatus 4 receives the change result message transmitted in step S158 and confirms the success or failure of the change (S159). If the change is successful, the process proceeds to step S161. If the change is unsuccessful, error screen data notifying that the change has failed is generated, and the error screen data is transmitted to the first user device 1, and step S160. Proceed to

In step S160, the service using unit 104 of the first user device 1 displays the error screen data transmitted in step S159 on the output unit 109. In this embodiment, the process ends at this step, but the process may be repeated by returning to step S134 as necessary.

On the other hand, in step S161, the service providing unit 407 of the service providing apparatus 4 generates change result screen data indicating that the change is successful, and transmits the screen data to the first user apparatus 1.

And the service utilization part 104 of the 1st user apparatus 1 displays the change result screen data transmitted in step S161 on the output part 109 (S162).

By performing the above procedure, the change of the association of the user certificate having high reliability for the service provider is completed. In this sequence, user information is searched (steps S149 to S154), and a user information change request message is transmitted (step S155). However, a user information search step (steps S149 to S154) is performed. Step S154) can be skipped.

FIG. 20 and FIG. 21 are sequence diagrams showing a user certificate association release process. As a premise for using the service, it is assumed that the user has already performed the registration process of the user certificate shown in FIGS. Here, the sequence when the user uses the first user device 1 will be described, but the second user device 2 may be used.

First, the service using unit 104 of the first user device 1 receives an input of a URL for releasing the association of the user certificate in the service provided by the service providing device 4 via the input unit 108 and provides the service. A cooperation cancellation request message for canceling the association of the user certificate is transmitted to the apparatus 4 (S170).

Next, the service providing unit 407 of the service providing device 4 receives the association cancellation request message transmitted by the first user device 1 via the communication unit 410 (S171).

Next, the service providing unit 407 of the service providing apparatus 4 transmits to the first user apparatus 1 authentication request data requesting a user certificate or the like necessary for authentication at the time of cancellation of linkage (S172).

Then, the service utilization unit 104 of the first user device 1 receives the authentication request data transmitted in step S172 via the communication unit 110 (S173).

Next, the first user device 1 generates an electronic signature using the secret key based on the received authentication request data (S174). For example, the service use unit 104 requests the device authentication unit 127 of the user authentication device 120 to generate electronic signature data via the first user device authentication unit 106 and the user authentication device control unit 105. To do. Then, the device authentication unit 127 generates electronic signature data using the private key stored in the first user private key storage area 122, and then generates the generated electronic signature data and the electronic signature data. The user certificate corresponding to the used private key is returned to the service using unit 104 of the first user device 1. For example, processing on the client side required for client authentication by SSL or TLS corresponds to this step. The user certificate and private key used here are a valid user certificate and a private key corresponding to the certificate.

Next, the service using unit 104 of the first user apparatus 1 receives the electronic signature data generated in step S174 and the user certificate corresponding to the private key used for generating the electronic signature data. 4 (S175). For example, processing for transmitting a client certificate by SSL or TLS corresponds to this step.

Next, the service providing unit 407 of the service providing apparatus 4 receives the electronic signature data, the user certificate, and the like transmitted by the first user apparatus 1 via the communication unit 410 (S176).

Then, the authentication cooperation processing unit 408 of the service providing apparatus 4 performs signature verification of the electronic signature data received from the first user apparatus 1 using the user certificate received together (S177). Here, if the signature verification is successful, the process proceeds to step S179. If the signature verification is unsuccessful, error screen data indicating that the signature verification has failed is generated, and the error screen data is stored in the first user device. 1 and proceeds to step S178.

In step S178, the service using unit 104 of the first user device 1 displays the error screen data transmitted in step S177 on the output unit 109. In this embodiment, the process ends at this step, but the process may return to step S170 and be repeated as necessary.

On the other hand, in step S179, the authentication cooperation processing unit 408 of the service providing apparatus 4 transmits to the providing side certificate verifying apparatus 6 a verification request message for the user certificate used for verifying the signature in step S177. It is assumed that the verification request message includes request type data indicating a cooperation cancellation request message and a user certificate to be verified.

Next, the certificate verification unit 607 of the providing side certificate verification device 6 receives the user certificate verification request message transmitted by the service providing device 4 via the communication unit 610 (S180).

The certificate verification unit 607 of the providing side certificate verification apparatus 6 verifies the validity of the user certificate in the verification request message received in step S180 (S181). Details of this step will be described with reference to FIG.

Next, in response to the verification result in step S181, the certificate verification unit 607 of the providing side certificate verification apparatus 6 generates a user certificate verification response message and transmits it to the service providing apparatus 4 (S182). The verification response message for the user certificate includes success / failure verification of the user certificate.

Next, the authentication cooperation processing unit 408 of the service providing apparatus 4 receives the verification response of the user certificate transmitted in step S182 and confirms the verification result of the validity of the user certificate (S183). As a result of verifying the validity of the user certificate, if it is confirmed that there is no problem with the user certificate, the process proceeds to step S185 (FIG. 21), and the result of verifying the validity of the user certificate has failed. If it is, error screen data indicating that the certificate verification has failed is generated, the error screen data is transmitted to the first user device 1, and the process proceeds to step S184.

In step S184, the service utilization unit 104 of the first user device 1 displays the error screen data transmitted in step S183 on the output unit 109. In this embodiment, the process ends at this step, but the process may return to step S170 and be repeated as necessary.

21, in step S185, the authentication cooperation processing unit 408 of the service providing apparatus 4 transmits a search request message for searching for user information to the user information management apparatus 5. In the user information search request message, in addition to the data indicating that it is a search request message, the issuer name extracted from the user certificate received in step S176 or a part thereof (part that can identify the issuer) ), And the owner name or a part thereof (part that can identify the owner).

The user information management unit 506 of the user information management device 5 receives the user information search request message transmitted by the service providing device 4 (S186).

Next, the user information management unit 506 of the user information management device 5 searches the user information table 502a stored in the user information storage area 502 based on the information received in step S186 (S187). In this step, it is determined to which domain the issuer name or part of the user certificate belongs, and the received owner name is matched with the search key from the column of the owner name of the corresponding domain. Search for the record you want. For a part of the owner name that can uniquely identify the user by the certificate naming rule, a part of the owner name is used as a search key.

Then, the user information management unit 506 of the user information management device 5 generates a search result message including the search result of the user information and transmits it to the service providing device 4 (S188). Here, if the corresponding record exists in the search result message, the registration ID, personal information, issuer name, serial number, and owner name of each domain's user certificate stored in that record When there is no corresponding record, information indicating that it does not exist is included.

In addition, since it is assumed that there are not a plurality of corresponding records based on the condition of the update target of the certificate association that is the premise of this flow, when a plurality of corresponding records are searched in step S187, in this step A message indicating an error is generated as a search result to be generated.

Next, the authentication cooperation processing unit 408 of the service providing apparatus 4 receives the search result message transmitted in step S188, and includes user information (registration ID, personal information, user certificate of each domain) in the received search result message. (Issuer name, serial number, owner name) is included (S189). When the search result message includes user information, the process proceeds to step S191. When the search result message does not include user information, the user is informed that the certificate to be canceled is not registered. Error screen data is generated, the error screen data is transmitted to the first user device 1, and the process proceeds to step S190.

In step S190, the service using unit 104 of the first user device 1 displays the error screen data transmitted in step S189 on the output unit 109. In this embodiment, the process ends at this step, but the process may return to step S170 and be repeated as necessary.

On the other hand, in step S191, the authentication cooperation processing unit 408 of the service providing apparatus 4 generates cooperation cancellation selection screen data for performing the cooperation cancellation, and transmits the cooperation cancellation selection screen data to the first user apparatus 1. The cooperation cancellation selection screen data includes a list of information related to the associated user certificate based on the user information received in step S189, and a result of checking what is to be canceled and a registration ID. Can be transmitted.

And the service utilization part 104 of the 1st user apparatus 1 displays the cooperation cancellation | release selection screen data transmitted in step S191 on the output part 109 (S192).

Next, the service using unit 104 of the first user device 1 accepts a selection via the input unit 108 by, for example, checking a part that specifies a user certificate that the user wants to cancel the cooperation of (1). S193).

Then, the service using unit 104 of the first user device 1 transmits information specified by the content received in step S193 to the service providing device 4 as a cooperation cancellation certificate information message (S194). The cooperation cancellation certificate information message includes a registration ID, an issuer name of a user certificate selected as a cancellation target, a serial number, an owner name, and the like.

Next, the authentication cooperation processing unit 408 of the service providing apparatus 4 receives the cooperation cancellation certificate information message transmitted by the first user apparatus 1 via the communication unit 410 (S195).

Then, the authentication cooperation processing unit 408 of the service providing apparatus 4 transmits a user information change request message to the user information management apparatus 5 (S196). In the user information change request message, in addition to the data indicating that it is a change request message, the registration ID acquired in step S195, the issuer name, serial number, owner name, etc. of the user certificate to be canceled Is included.

The user information management unit 506 of the user information management device 5 receives the user information change request message transmitted by the service providing device 4 via the communication unit 508 (S197).

Next, the user information management unit 506 of the user information management device 5 updates the user information table 502a based on the information included in the change request message received in step S197 (S198). In this step, in the user information table 502a, the registration ID is used as a search key, and the user certificate, issuer name, serial number, and owner name information to be canceled of the record in which the registration ID is registered are stored. delete. For the user certificate, issuer name, serial number, and owner name columns to be deleted, the domain to be deleted is specified from the issuer name, and the column to be deleted is specified.

Next, the user information management unit 506 of the user information management device 5 generates a change result message including the change result of the user information and transmits it to the service providing device 4 (S199).

Then, the authentication cooperation processing unit 408 of the service providing apparatus 4 receives the change result message transmitted in step S199, and confirms the success or failure of the change (S200). If the change is successful, the process proceeds to step S202. If the change is unsuccessful, error screen data notifying that the cooperation cancellation has failed is generated, the error screen data is transmitted to the first user device 1, and step The process proceeds to S201.

In step S201, the service using unit 104 of the first user device 1 displays the error screen data transmitted in step S200 on the output unit 109. In this embodiment, the process ends at this step, but the process may return to step S170 and be repeated as necessary.

On the other hand, in step S <b> 202, the service providing unit 407 of the service providing apparatus 4 generates cooperation cancellation result screen data indicating that the cooperation cancellation is successful, and transmits the cooperation cancellation result screen data to the first user apparatus 1. (S202).

And the service utilization part 104 of the 1st user apparatus 1 displays the cooperation cancellation result screen data transmitted in step S202 on the output part 109 (S203).

The above procedure completes the cancellation of the user certificate association. In this sequence, after searching for user information (steps S189 to S190), the link release selection screen data is transmitted (step S191), but the user information searching step (steps S189 to S190) is performed. S190) can be skipped.

FIG. 22 is a flowchart showing user certificate verification processing.

First, the additional verification unit 608 of the providing-side certificate verification apparatus 6 extracts the issuer name from the user certificate to be verified, and the support that the user certificate to be verified permits use in providing the service. It is confirmed whether it is a user certificate (S210). If it is a user certificate within the support, the process proceeds to step S211. If it is not a user certificate within the support, the process proceeds to step S223.

Next, the additional verification unit 608 identifies the domain from the issuer name extracted from the user certificate to be verified, and the user certificate to be verified is positioned as a highly reliable certificate. It is confirmed whether or not it is a user certificate (here, whether or not it is a domain A user certificate) (S211). If it is a highly reliable user certificate, the process proceeds to step S219. If it is not a highly reliable user certificate, the process proceeds to step S212.

In step S212, the additional verification unit 608 determines whether the request type data received from the first user device 1 or the second user device 2 by the service providing device 4 indicates a cooperation change request message. To do. If the request type data indicates a cooperation change request message, the process proceeds to step S219. If the request type data does not indicate a cooperation change request message, the process proceeds to step S213.

In step S213, the additional verification unit 608 analyzes the user certificate to be verified. In this embodiment, the domain B user certificate is analyzed. The elements to be analyzed here are the issuer name and serial number of the user certificate, and these pieces of information are acquired.

Next, the additional verification unit 608 transmits a search request message for searching for user information to the user information management apparatus 5 (S214). In the user information search request message, the issuer name and serial number of the user certificate acquired in step S213 are included in addition to the data indicating the search request message.

In the user information management device 5 that has received such a search request message, the user information management unit 506 uses the information contained in the received search request message to check the user certificate to be verified from the user information table 502a. The user certificate associated with the certificate is acquired from the linked certificate storage area 502d.

For example, in this step, it is determined to which domain the issuer name of the user certificate belongs, and a record that matches the analyzed serial number with the search key is searched from the serial number column of the corresponding domain. To do. When the corresponding record exists, the user certificate, issuer name, serial number, owner name, etc. stored in the linked certificate storage area 502d of the record are extracted, and further, the record of the record is extracted. Extract status flags.

Furthermore, when the corresponding record exists, the user information management unit 506 generates a search result message for user information including the extracted user certificate, issuer name, serial number, owner name, status flag, etc. Then, the message is returned to the providing side certificate verification device 6.

When the additional verification unit 608 of the providing side certificate verification device 6 receives the search result message from the user information management device 5 (Yes in S215), the status flag included in the received search result message is “main registration”. Is confirmed (S216). If it indicates “main registration”, the process proceeds to step S217. If it does not indicate “main registration”, the process proceeds to step S223.

In step S217, the additional verification unit 608 of the providing side certificate verification apparatus 6 requests the certificate verification unit 607 to verify the validity of the user certificate associated with the verification target certificate, and the certificate verification unit 607 607 performs verification. Here, in the present embodiment, in this step, the domain A user certificate associated with the domain B user certificate is to be verified. Details of the verification process of the validity of the user certificate in the certificate verification unit 607 will be described with reference to FIGS.

Next, the additional verification unit 608 of the providing side certificate verification apparatus 6 determines the verification result of the verification performed in step S217 (S218). If the verification result is successful, the process proceeds to step S219. If the verification result is unsuccessful, the process proceeds to step S221.

In step S219, the additional verification unit 608 of the providing-side certificate verification device 6 requests the certificate verification unit 607 to verify the validity of the user certificate that is the verification target, so that the certificate verification unit 607 607 performs verification. Details of the certificate validity verification processing in the certificate verification unit 607 will be described with reference to FIGS.

Next, the additional verification unit 608 of the providing side certificate verification apparatus 6 determines the verification result of the user certificate verified in step S219 (S220). If the verification result of the user certificate is successful, the process proceeds to step S223, and if the verification result of the user certificate is unsuccessful, the process proceeds to step S221.

In step S221, the additional verification unit 608 transmits a registration status flag change request message to the user information management device 5. The registration status flag change request message includes the data indicating that it is a registration flag change request message, as well as the user certificate that failed verification, the issuer name of the user certificate, the serial number, etc. And

In the user information management apparatus 5 that has received such a registration status flag change request message, the user information management unit 506 stores the information included in the received change request message in the user information table 502a.

For example, the user information management unit 506 of the user information management device 5 is stored in the status flag field 502q of the record searched using the issuer name and serial number of the user certificate in the user information table 502a as a search key. The information is changed to the status specified by the received change request message. For example, if the verification of the domain A user certificate fails, the verification of the domain B user certificate fails with the status of “A invalid” that specifies that the domain A certificate is invalid If it is, the status is changed to a “B invalid” status that specifies that the domain B certificate is invalid.

Note that the user information management unit 506 of the user information management device 5 specifies a domain to be updated by identifying a corresponding domain from the issuer name for the user certificate, issuer name, and serial number columns that request the change. Shall be identified.

Then, the user information management unit 506 of the user information management device 5 generates a change result message including the change result of the registration status flag, and transmits it to the providing side certificate verification device 6.

Next, when the additional verification unit 608 of the providing side certificate verification apparatus 6 receives the change result message from the user information management apparatus 5 (Yes in step S222), the process proceeds to step S223.

In step S223, the additional verification unit 608 of the provider side certificate verification apparatus 6 generates a certificate verification result. For example, if the verification target certificate is an unsupported domain in step S210, if the registration status flag indicates a state other than the main registration in step S216, or a change result message is received in step S222. In this case, a certificate verification result message indicating that the verification has failed is generated. On the other hand, if the verification target certificate is successfully verified in step S222, a certificate verification result message indicating that the verification is successful is generated.

By performing the above processing, even when a low-trust user certificate is used when using the service, the high-trust user certificate related to the user certificate is also verified. It is possible to prevent the authentication reliability from being lowered.

On the other hand, if a highly reliable user certificate is used when using the service, or if it is already known that the user certificate is invalid, multiple user certificates will not be verified. Redundancy in verification can also be eliminated.

23 and 24 are sequence diagrams showing user certificate verification processing.

Here, the processing for verifying the domain A user certificate is described, but when verifying the domain B user certificate, the second certificate is used instead of the first certificate verification device 3A. The certificate verification device 3B may be replaced with the second certificate authority device 7B instead of the first certificate authority device 3A.

Note that, as a premise of this sequence, those that can be used as a certificate verification apparatus other than the providing side certificate verification apparatus 6 (in this embodiment, the first certificate verification apparatus 3A and the second certificate verification apparatus 3B) are available. When these certificate verification apparatuses exist and are used, the setting information of the provider certificate verification apparatus 6 is set in advance so that these certificate verification apparatuses are used for user certificate verification. Shall.

First, the certificate verification unit 607 of the provider side certificate verification apparatus 6 determines whether or not to use another certificate verification apparatus corresponding to the domain of the user certificate in the verification of the user certificate. The setting information of the document verification device 6 is confirmed (S230). If it is set to use another certificate verification apparatus, the process proceeds to step S231. If it is set not to use another certificate verification apparatus, the process proceeds to step S244 (FIG. 24).

In step S231, the certificate verification unit 607 of the providing side certificate verification device 6 transmits a certificate verification request message to another certificate verification device (here, the first certificate verification device 3A). The certificate verification request message is a message including a user certificate to be verified and a trusted certificate authority certificate. For example, the certificate verification request message is defined in the government authentication infrastructure (GPKI) government authentication infrastructure interoperability specification. This includes a certificate verification server access protocol and a request message of SCVP (Server-Based Certificate-Validation Protocol) defined as RFC5055.

The certificate verification unit of the first certificate verification device 3A receives the certificate verification request message transmitted by the provider certificate verification device 6 (S232).

Next, the certificate verification unit of the first certificate verification apparatus 3A constructs an authentication path for the user certificate included in the certificate verification request message received in step S232 (S233). Constructing a certification path means configuring the path so that the owner name of the higher-level certificate matches the issuer name of the lower-level certificate from the certificate authority certificate of the trusted certificate authority to the user certificate. And collecting all certificates on the path. If the path from the CA certificate of the trusted CA to the user certificate is not connected, or if the certificate on the certification path cannot be acquired, the certification path construction has failed.

If the authentication path construction is successful, the process proceeds to step S234. If the authentication path construction fails, the process proceeds to step S240.

In step S234, the certificate verification unit of the first certificate verification apparatus 3A verifies the constructed certification path. Verification of certification path means that for each certificate from a trusted CA certificate to a user certificate, the digital signature attached to the lower certificate is verified with the public key of the upper certificate. is there.

If the verification of the authentication path is successful, the process proceeds to step S235. If the verification of the authentication path fails, the process proceeds to step S240.

In step S235, the certificate verification unit of the first certificate verification device 3A checks the validity of the user certificate, so that the certificate authority device that issued the user certificate that is the target of the validity check (here Then, a validity check request message is transmitted to the first certificate authority device 3A).

Here, in the present embodiment, a description will be given on the assumption that a certificate revocation list acquisition request is made as a validity check request, but a request message based on an online certificate status protocol may be transmitted. It should be noted that the inquiry destination of the validity check request is described in each certificate.

Next, the revocation information providing unit 310 of the first certificate authority device 3A receives the validity check request message transmitted by the first certificate verification device 3A via the communication unit 314 (S236).

Next, the revocation information providing unit 310 of the first certificate authority device 3A generates a validity check information message including validity check information for specifying the revoked user certificate, and sends it to the first certificate verification device 3A. Transmit (S237). In this embodiment, the certificate revocation list is transmitted, but this is not the case when the revocation information is provided by a method such as an online certificate status protocol.

Next, the certificate verification unit of the first certificate verification device 3A receives the validity check information message transmitted in step S237 via the communication unit (S238).

Next, the certificate verification unit of the first certificate verification apparatus 3A confirms that the user certificate whose validity is to be verified has not been revoked based on the validity confirmation information message received in step S238, and It is confirmed that the certificate is within the valid period (S239).

Next, the certificate verification unit of the first certificate verification apparatus 3A generates a user certificate verification response message according to the verification results of steps S233, S234, and S239 (S240).

For example, if it is determined in step S239 that the certificate is valid, a message indicating that the certificate has been successfully verified is generated as a certificate verification response. On the other hand, if certification path construction fails in step S233, certification path validation fails in step S234, and if it is determined in step S239 that the certificate is invalid, a certificate validation response is provided. Generate a message that the certificate verification failed.

Next, the certificate verification unit of the first certificate verification device 3A transmits the certificate verification response message generated in step S240 to the providing side certificate verification device 6 (S241).

Next, the certificate verification unit 607 of the providing side certificate verification device 6 receives the certificate verification response message transmitted in step S241 via the communication unit 610 (S242).

Next, the certificate verification unit 607 of the providing side certificate verification apparatus 6 determines the verification result by checking the content of the certificate verification response message received in step S242 (S243).

On the other hand, if it is determined in step S230 that other certificate verification apparatuses are not used, the process proceeds to step S244 in FIG. 24, and the certificate verification unit 607 of the providing side certificate verification apparatus 6 determines the user certificate. An authentication path is constructed (S244). If the authentication path construction is successful, the process proceeds to step S245, and if the authentication path construction fails, the process proceeds to step S251.

In step S245, the certificate verification unit 607 of the providing-side certificate verification device 6 verifies the constructed certification path. If the verification of the authentication path is successful, the process proceeds to step S246. If the verification of the authentication path fails, the process proceeds to step S251.

In step S246, the certificate verification unit 607 of the providing-side certificate verification apparatus 6 performs the verification of the validity of the user certificate, so that the first certificate authority apparatus that has issued the user certificate that is the target of the validity check A validity check request message is transmitted to 3A (S246).

Next, the revocation information providing unit 310 of the first certificate authority device 3A receives the validity confirmation request transmitted by the providing side certificate verification device 6 via the communication unit 314 (Step 7540).

Then, the revocation information providing unit 310 of the first certificate authority device 3A generates a validity check information message including validity check information for specifying the revoked user certificate, and transmits it to the providing side certificate verification device 6. (S248).

Next, the certificate verification unit 607 of the providing side certificate verification apparatus 6 receives the validity check information message transmitted in step S248 (S249).

Next, the certificate verification unit 607 of the providing side certificate verification apparatus 6 confirms that the certificate whose validity is to be verified has not been revoked based on the validity confirmation information message received in step S249, and the certificate It is confirmed that the certificate is within the valid period (S250).

The certificate verification unit 607 of the providing-side certificate verification device 6 determines that the verification of the certificate has been successful when it is determined in step S250 that the certificate is valid. On the other hand, if certification path construction fails in step S244, certification path validation fails in step S245, or if it is determined in step S250 that the certificate is invalid, user certificate validation is performed. It is determined that the process has failed (S251).

This completes the certificate verification process.

In the embodiment described above, when a service provider presents a user certificate issued by a certificate authority that does not have high trust and is about to receive the service, the service provider Service can be provided by successfully verifying both the user certificate issued by the certificate authority with high trust and the user certificate presented when trying to receive the service. However, if any one of these user certificates is successfully verified, it is possible to provide a service according to the reliability of the user certificate that has been successfully verified.

In such a case, in step S72 of FIG. 16, the user certificate that has been successfully verified, the reliability of the user certificate that has been successfully verified, the domain of the user certificate that has been successfully verified, or the like is specified. By transmitting the information to be included in the verification response message, the service providing apparatus 4 can determine the provision of the service according to the reliability of the user certificate that has been successfully verified. At this time, in the service providing apparatus 4, information in which the reliability or domain of the user certificate is associated with the service that can be provided is stored in the storage unit 401.

In the embodiment described above, when providing a service, the service providing apparatus 4, the user information management apparatus 5, and the providing side certificate verification apparatus 6 perform user verification. The present invention is not limited to such an embodiment, and the processing performed in these apparatuses can be integrated into one or a plurality of apparatuses or distributed. For example, the processing performed by the user information management device 5 and the provider certificate verification device 6 can be performed by one device.

Furthermore, in the embodiment described above, the example in which the user who receives the service uses the first user device 1 and the second user device 2 has been described. However, the present invention is not limited to such an example. It is also possible to perform the processing of this embodiment using a single device (for example, the first user device 1). In such a case, the communication address of the one device (for example, the first user device 1) may be registered as the notification destination of the main registration.

100 Communication System 1 First User Device 101 Storage Unit 102 Control Unit 111 User Authentication Device Input / Output Unit 120 User Authentication Device 121 Storage Unit 125 Control Unit 2 Second User Device 201 Storage Unit 205 Control Unit 3 Authentication Station device 301 Storage unit 307 Control unit 4 Service providing device 401 Storage unit 405 Control unit 5 User information management device 501 Storage unit 504 Control unit 6 Providing side certificate verification device 601 Storage unit 605 Control unit 7A First certificate verification device 7B Second certificate verification device

Claims

A communication system comprising a user device and a service providing device that provides a service to the user device,
The control unit of the service providing device includes:
A signature data signed with a first private key from the user device, a first user certificate that is a public key certificate of a first public key paired with the first private key; Is sent to the user device by successfully verifying the signature data and the first user certificate,
A signature data signed with a second secret key different from the first secret key from the user device and a public key certificate of a second public key paired with the second secret key When the second user certificate is sent, the user device is verified by successfully verifying the first user certificate associated with the second user certificate. Providing services to,
A communication system.
The communication system according to claim 1,
The control unit of the service providing device includes:
A signature data signed with a second private key from the user device, and a second user certificate that is a public key certificate of a second public key paired with the second private key; Is successfully sent, the first user certificate associated with the second user certificate, the signature data, and the second user certificate are successfully verified, Providing a service to the user device;
A communication system.
The communication system according to claim 1,
The first user certificate is predetermined in the service providing apparatus as having higher reliability than the second user certificate;
A communication system.
A communication system according to claim 3,
The first user certificate and the second user certificate are issued by different certificate authorities,
A communication system.
The communication system according to claim 1,
A certificate verification device for verifying a user certificate in response to a request from the service providing device;
The control unit of the certificate verification device includes:
When receiving a request for verifying the first user certificate from the service providing device, verifying the first user certificate,
When a request for verification of the second user certificate is received from the service providing device, verification of the first user certificate associated with the second user certificate is performed. ,
A communication system.
The communication system according to claim 5, wherein
The control unit of the certificate verification device includes:
When a request for verification of the second user certificate is received from the service providing apparatus, the first user certificate associated with the second user certificate and the second user certificate Verifying user certificates,
A communication system.
The communication system according to claim 5, wherein
For each user who uses the user device, the first user certificate used by the user and the second user certificate associated with the first user certificate are identified. A user information management device having a storage unit for storing user information to be
The control unit of the certificate verification device includes:
When a request for verification of the second user certificate is received from the service providing device, the first user certificate associated with the second user certificate is stored in the user information management Obtain from the device and verify the obtained first user certificate,
A communication system.
A certificate verification device that verifies a user certificate in response to a request from a service providing device,
The control unit of the certificate verification device includes:
When a request for verification of the first user certificate is received from the service providing apparatus, the first user certificate is verified,
When a request for verification of a second user certificate different from the first user certificate is received from the service providing apparatus, the first associated with the second user certificate Verifying user certificates for
A certificate verification device characterized by
The certificate verification device according to claim 8, comprising:
The control unit of the certificate verification device includes:
When a request for verification of the second user certificate is received from the service providing apparatus, the first user certificate associated with the second user certificate and the second user certificate Verifying user certificates,
A certificate verification device characterized by
The certificate verification device according to claim 8, comprising:
For each user who uses the user device, the first user certificate used by the user and the second user certificate associated with the first user certificate are identified. A storage unit for storing user information
The control unit of the certificate verification device includes:
When a request for verification of the second user certificate is received from the service providing device, the first user certificate associated with the second user certificate is received from the storage unit. Obtain and verify the obtained first user certificate,
A certificate verification device characterized by
The certificate verification device according to claim 8, comprising:
The first user certificate is predetermined in the service providing apparatus as having higher reliability than the second user certificate;
A certificate verification device characterized by
The certificate verification device according to claim 11, comprising:
The first user certificate and the second user certificate are issued by different certificate authorities,
A certificate verification device characterized by
A service providing method performed by a communication system comprising a user device and a service providing device that provides a service to the user device,
The control unit of the service providing device is signature data signed with a first secret key from the user device and a public key certificate of a first public key paired with the first secret key. A process of providing a service to the user device by successfully verifying the signature data and the first user certificate when the first user certificate is sent;
The control unit of the service providing apparatus receives from the user device a signature data signed with a second secret key different from the first secret key and a second pair that is paired with the second secret key. When a second user certificate that is a public key certificate of the public key is sent, the first user certificate associated with the second user certificate is verified. Providing a service to the user device by success, and
A service providing method characterized by the above.