JP3584875B2 - Personal certificate issuing device and method - Google Patents

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a technology for processing an application for issuing a personal certificate.
[0002]
[Prior art]
ITU-T Recommendation X. Reference numeral 509 specifies directory model authentication, and it is necessary to perform a complicated input in order for a certificate authority to issue a personal certificate in accordance with the directory model authentication. In particular, with the spread of the intranet, when issuing personal certificates across organizations when working together with external contractors, if complicated procedures are required, it will not be possible to use them sufficiently, and application errors will occur. Will occur frequently.
[0003]
[Problems to be solved by the invention]
The present invention has been made in view of the above circumstances, and has as its object to provide a technology that enables a simple application for a personal certificate.
[0004]
[Means for Solving the Problems]
According to the present invention, in order to achieve the above object, a configuration as described in the claims is adopted. Here, before describing the invention in detail, the description of the claims will be supplementarily described.
[0005]
According to one aspect of the present invention, in order to achieve the above object, a personal certificate issuing device includes: a project, an organization participating in the project, and a template identifier for specifying a template of the personal certificate. First storage means for storing the information in association with each other; second storage means for storing the project and information defining a template of a personal certificate used for the project in association with each other; means for receiving the personal information; for personal certificate and means for receiving said model identifier corresponding to; project and join corresponding with reference to the first storage means based on the model identifier received to tissue Is determined, and information defining the template of the personal certificate is obtained by referring to the second storage means based on the determined project, and the template of the personal certificate is defined. According to the information, form a personal certificate containing the project name of the project, the name of the organization participating in the project to which the individual to be issued belongs, and at least a part of the received personal information. And means for generating electronic data .
[0006]
In this configuration, the person applying for the issuance of the personal certificate is notified of the template identifier in advance. The applicant can simply notify (specify) necessary information to the personal certificate issuing device side only by inputting a model identifier together with a name and an individual identifier at the time of application.
[0007]
The applicant can easily obtain a personal certificate in an extranet environment or an intranet environment using a commonly used web browser.
[0008]
The present invention can be realized not only as an apparatus or a system but also as a method. A part of such a method may be realized as a computer program.
[0009]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described.
[0010]
FIG. 1 shows an embodiment of a personal certificate issuing system according to the present invention. In this figure, a certificate issuing center 10, a cooperating company site 20 and the like are connected to the Internet 30. The cooperating company site 20 has an intranet constructed by a private network (LAN) or the like, and a client terminal 201 is connected to each intranet. The certificate issuing center 10 is provided in a company (also referred to as a secretary company) or an Internet service provider (hosting service) that takes an initiative in relation to the issuance of a personal certificate. Here, for convenience, it is assumed that the certificate issuing center 10 is provided in the office of the managing company.
[0011]
In this example, the certificate issuing center 10 receives an application for issuing a personal certificate from the client terminal 201 or the like of the cooperating company site 20, and performs an issuing process.
[0012]
The certificate issuing center 10 includes a web server 101, an application server 102, a database management system 103, a mail server 104, a client terminal 105, a router 106, and the like. These computer resources are connected to the LAN 107.
[0013]
The web server 101 receives a request from a client (client terminals 201 and 105) in accordance with the HTTP (Hypertext Transfer Protocol) protocol, and transfers an HTML document (XML document) 101a corresponding to the request to the client. The HTML document to be transmitted includes, for example, a project registration web page (FIG. 6), a company registration (application template registration) web page (FIG. 7), and a personal certificate issuance application web page (FIGS. 8 and 9). Etc. The application server 102 executes various processes based on the program name and the argument sent from the client via the web server 101. A CGI (Common Gate Interface) program of the web server 101 may be used instead of the application server 102. The database management system 103 manages various databases related to certificate issuance. The databases are, for example, a project database (project information) 108, a template database (template information) 109, a certificate database 110, and the like.
[0014]
Note that a project is a task or activity managed collectively, and here refers to a task performed between the managing company and another cooperating company for convenience. A partner company is registered in connection with the project. Of course, projects or non-business activities in the managing company may be treated as “projects”. By doing so, it is possible to issue a certificate apart from the organizational structure.
[0015]
FIGS. 2 to 4 show simplified examples of information stored in the project database 108, the template database 109, and the certificate database 110 managed by the database management system 103. Here, before describing these, a description will be given of a DN (distinguish name, hereinafter also referred to as a subject name; X.501) used in this example. In this example, the subject names are the country name (C), the organization name (O), the first organizational unit name (OU1), the second organizational unit name (OU2), the third organizational unit name (OU3), It is defined by a common name (CN). For applicants other than the secretary company, for example, "Partner" or the like is described as OU1. For the employees of the secretary company, OU1 is omitted or a predetermined department name is described as OU1. OU2 describes a project name. However, if there is no relationship with the project, OU2 is omitted. OU3 describes the name of the cooperating company. Of course, OU3 is omitted for persons inside the managing company (eg, employees). In this way, the project and the cooperating company can be described using the subject name. Note that the OU suffix is used in accordance with the attribute of the OU. For example, the OU1 representing a department (an organization outside the company) may adopt a more hierarchical configuration according to the hierarchy of the department. For example, a plurality of OU1s such as “jinji” (HR department) and “jinji1” (first personnel section) can be defined.
[0016]
The project database 108 managed by the database management system 103 includes information of (C, O, OU1, OU2), for example, as shown in FIG. Project information is managed by the project database 108. In the example of FIG. 2, C is “JP”, O is the company name of the managing company “XYZ”, OU1 is “Partner” representing the cooperator, and OU2 is “Xnetproject” representing the project.
[0017]
As shown in FIG. 3, the template database 109 includes a project management ID, a company name, and a template management ID. This company name is the name of the organization registered as participating in the project. The name of the company participating in the project corresponds to OU3 of the subject name. Therefore, for example, "C = JP, O = XYX, OU1 = Partner, OU2 = Xnetproject, OU3 = ABC" is defined by the project identifier and the company name. “ABC” is the name of the participating company.
[0018]
The certificate database 110 holds certificate information as shown in FIG. In FIG. 4, the subject name is (C, O, OU1, OU2, OU3, CN), and the common name CN is, for example, CN = 12345 001 Taro Yamada. “12345” is a unique identifier in the cooperating company ABC, for example, an employee number. “001” is an ID indicating the type of business at the managing company (for example, procurement business, trial work). “TaroYamada] is the name of the applicant. The certificate database 110 holds the certificate ID, the subject name (C, O, OU1, OU2, OU3, CN), the expiration date, and the like. , Subject name, issuer name, public key, issuer signature, and the like.
[0019]
Using the web server 101, the application server 102, and the database management system 103, a specific certificate issuing function is realized. These functions will be described later in detail. The client can use various functions of the certificate issuing system on a web basis.
[0020]
The mail server 104 executes an SMTP (Simple Mail Transfer Protocol) daemon or the like, and performs mail delivery.
[0021]
The client terminal 105 has a web browser and receives the service of the certificate issuing center 10 in the certificate issuing system.
[0022]
The client terminal 201 is a personal computer, a workstation, or the like arranged at the cooperating company site 20, and has a web browser installed. The client terminal 201 can access a certificate issuing system provided by the certificate issuing center 10 and perform template registration (company registration), personal certificate issuance application, and the like. Since the certificate issuing center 10 is open to the public on the Internet 30, it is desirable that a security mechanism such as a firewall be appropriately provided.
[0023]
Next, a processing mechanism for processing a certificate issuance application will be described. FIG. 5 schematically shows this processing mechanism. In this figure, the web server 101 provides an interface, and the application server 102 constitutes a specific processing unit. 110 is used. First, a project registration application is made from the client terminal 105 of the certificate issuing center (secretary company) 10. The screen for project application is, for example, as shown in FIG. The project registration unit 102a of the application server 102 receives this and registers it in the project database 108. In practice, the project registration unit 102a sends the application number to the registration applicant by e-mail, and when this is notified to the system administrator from the registration applicant under the predetermined security guidelines, the project registration Register. As a result, for example, (JP, XYZ, Partner, Xnetproject) is registered.
[0024]
After the project registration is completed, register the cooperating companies participating in the project. This determines the template of the certificate. That is, a template registration (company registration) application is performed from the client terminal 105 of the certificate issuing center 10. The template registration screen is, for example, as shown in FIG. The template registration unit 102b of the application server 102 receives this and registers it in the template database 109. Note that template registration is also performed under predetermined security guidelines. At this stage, the predetermined administrator who has registered the template at the client terminal 105 is notified of the template management ID. Alternatively, the related project and the template management ID can be browsed from the name of the cooperating company. The administrator notifies the partner company of the template management number. When there are a plurality of related projects, a project management number related to which project is notified.
[0025]
The cooperating company uses the client terminal 201 to apply for issuance of a personal certificate. The application screen at this time is as shown in FIG. 8, for example. The applicant inputs the personal ID, name, mail address, and contact information, and further inputs the template management ID on the next screen (FIG. 9). The application content synthesizing unit 102c of the application server 102 receives the application content, and further refers to the template database 109 and the project database 108 from the template management ID of the application content to obtain directory information necessary for applying for a personal certificate. Are registered in the certificate database 110. Further, the certificate issuing unit 102d receives the public key from the public encryption key generation mechanism of the browser of the client terminal 201 of the applicant, generates a certificate, and transmits the certificate to the applicant.
[0026]
As described above, according to this embodiment, even when a personal certificate is issued on a project basis beyond one organization, complicated input can be avoided by merely inputting the template management ID. The remaining input items, such as personal IDs and names, can be easily and definitely input, and are very convenient.
[0027]
The present invention is not limited to the above-described embodiment, but can be variously modified. It can be applied to the issuance of a personal certificate in a normal organization. For example, the present invention can be similarly applied to a case where a personal certificate is issued for each department or project.
[0028]
【The invention's effect】
As described above, according to the present invention, it is possible to easily apply for a personal certificate without fail even when subject names are varied.
[Brief description of the drawings]
FIG. 1 is a system diagram showing an embodiment of the present invention as a whole.
FIG. 2 is a diagram illustrating a project database according to the embodiment.
FIG. 3 is a diagram illustrating a template database according to the embodiment.
FIG. 4 is a diagram illustrating a certificate database according to the embodiment.
FIG. 5 is a block diagram schematically showing functions of the above embodiment.
FIG. 6 is an example of a display screen for explaining the above embodiment.
FIG. 7 is an example of a display screen for explaining the above embodiment.
FIG. 8 is an example of a display screen for explaining the above embodiment.
FIG. 9 is an example of a display screen for explaining the above embodiment.
[Explanation of symbols]
10 Certificate Issuing Center 20 Cooperating Company Site 30 Internet 101 Web Server 102 Application Server 102a Project Registration Unit 102b Template Registration Unit 102c Application Content Synthesizing Unit 102d Certificate Issuing Unit 103 Database Management System 104 Mail Server 105 Client Terminal 106 Router 108 Database 108 Project database 109 Template database 110 Certificate database 201 Client terminal

Claims (9)

Information specifying project, a first storage means for storing information specifying the organization participating in this project, implicate a template identifier identifying the template personal certificate,
Second storage means for storing information specifying the project and information specifying a template of a personal certificate used for the project in association with each other;
Means for receiving the personal information required to issue a personal certificate,
Means for receiving the template identifier corresponding to the desired personal certificate;
Said based on the received based on the template identifier determines the information identifying the tissue information and participating identifying the relevant project with reference to the first storage means, determining the information that identifies the project The information defining the template of the personal certificate is obtained with reference to the second storage means, and the project name of the project and the organization participating in the project are obtained in accordance with the information defining the template of the personal certificate. Personal certificate, characterized by having means for generating electronic data forming a personal certificate including, as contents, the name of the person to whom the issuance target belongs and at least a part of the received personal information. Document issuing device. The information specifying the project and the information specifying the organization stored in the first storage means are a project management ID and a name of the organization, respectively, assigned to the project.
Means for inputting a project name for identifying a personal certificate template and the name of an organization participating in the project;
In response to the input of the name of the organization to participate in the project name and project further and means for assigning a template identifier corresponding to the name of the organization to participate in the project name and project, corresponding to the project name 2. The personal certificate issuing device according to claim 1, wherein the project management ID to be stored, the name of the participating organization and the assigned template identifier are stored in the first storage means. 3. The personal certificate issuing device according to claim 2, wherein the project name and the name of an organization participating in the project to which the individual to be issued belongs are described as an organizational unit name. 2. The personal certificate issuing device according to claim 1, wherein the personal information necessary for issuing the personal certificate includes an identifier and a name of the individual. 5. The personal certificate issuing device according to claim 4, wherein the personal information required for issuing the personal certificate includes a personal mail address. 6. The personal certificate issuing device according to claim 4, wherein the personal information required for issuing the personal certificate includes a telephone number of an individual. Information specifying project, a first storage means for storing information specifying the organization participating in this project, implicate a template identifier identifying the template personal certificate,
Second storage means for storing information specifying the project and information specifying a template of a personal certificate used for the project in association with each other;
Means for receiving the personal information required to issue a personal certificate,
Means for receiving the template identifier corresponding to the desired personal certificate;
Said based on the received based on the template identifier determines the information identifying the tissue information and participating identifying the relevant project with reference to the first storage means, determining the information that identifies the project The information defining the template of the personal certificate is obtained with reference to the second storage means, and the project name of the project and the organization participating in the project are obtained in accordance with the information defining the template of the personal certificate. Means for synthesizing the directory information including the name of the individual to which the issuance target belongs and the received personal information,
Directory means for storing the directory information and managing personal information. Information specifying project, and storing information specifying the organization participating in this project, in the first storage means related to the model identifier identifying the template personal certificate,
Storing the information specifying the project in association with information defining a template of a personal certificate used for the project in a second storage unit;
Receiving personal information required for issuing a personal certificate by means of personal information input means;
Means for receiving the template identifier corresponding to the target personal certificate by the template identifier input means;
Said based on the received based on the template identifier determines the information identifying the tissue information and participating identifying the relevant project with reference to the first storage means, determining the information that identifies the project The information defining the template of the personal certificate is obtained with reference to the second storage means, and the project name of the project and the organization participating in the project are obtained in accordance with the information defining the template of the personal certificate. A personal certificate, comprising the step of generating electronic data forming a personal certificate including, as contents, the name of an individual to which the issuance target belongs and at least a part of the received personal information. Certificate issuance method. Information specifying project, and storing information specifying the organization participating in this project, in the first storage means related to the model identifier identifying the template personal certificate,
Storing the information specifying the project in association with information defining a template of a personal certificate used for the project in a second storage unit;
Receiving personal information required for issuing a personal certificate by means of personal information input means;
Receiving the template identifier corresponding to the target personal certificate by a template identifier input unit;
Said based on the received based on the template identifier determines the information identifying the tissue information and participating identifying the relevant project with reference to the first storage means, determining the information that identifies the project The information defining the template of the personal certificate is obtained with reference to the second storage means, and the project name of the project and the organization participating in the project are obtained in accordance with the information defining the template of the personal certificate. Is used to cause the computer to execute a step of generating electronic data forming a personal certificate including the name of the personal belonging to the issuance target and at least a part of the received personal information as content. A recording medium in which a computer program for issuing a personal certificate is recorded so as to be readable by a computer.

Images