JP3901463B2 - An authentication system access device, a public key certificate acquisition method, a public key certificate invalidation confirmation method, an authentication system access program, a public key certificate acquisition program, a public key certificate invalidation confirmation program, and an authentication system access program are stored. Storage medium storing storage medium and public key certificate acquisition program, and storage medium storing public key certificate revocation confirmation program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an authentication system access device, a public key certificate acquisition method, a public key certificate invalidation confirmation method, an authentication system access program, a public key certificate acquisition program, a public key certificate invalidation confirmation program, and an authentication system. The present invention relates to a storage medium that stores an access program, a storage medium that stores a public key certificate acquisition program, and a storage medium that stores a public key certificate revocation confirmation program, and in particular, secure and reliable EDI (electronic An authentication system access device for verifying the acquisition and validity of public key certificates necessary for electronic signature communication and encryption communication technology using public key cryptography to realize data exchange) and EC (electronic commerce); Public key certificate acquisition method, public key certificate invalidation confirmation method, and authentication system Program, public key certificate acquisition program, public key certificate revocation confirmation program, storage medium storing authentication system access program, storage medium storing public key certificate acquisition program, and public key certificate revocation confirmation program It relates to the storage medium which stored.
[0002]
[Prior art]
Conventionally, in a system for verifying the identity of a user, checking for tampering on a communication path, preventing eavesdropping, etc., using an electronic signature technology using public key cryptography or encryption communication technology, the public key used at that time is It is necessary to confirm that it is a public key of the communication partner, and a method of using a public key certificate issued by a CA (Certification Authority) is usually used as a method of confirming the owner of this public key. Is used.
[0003]
In this method, first, the public key certificate of the communication partner is acquired, and the public key certificate issuer is verified by verifying the CA signature and the certificate chain given to the acquired public key certificate. Check the reliability. Further, by confirming that the target public key certificate has not been revoked by the CA, it is possible to determine that the acquired public key certificate is a valid and reliable certificate.
[0004]
Here, there are several methods with different access destinations and access protocols for the method of obtaining public key certificate acquisition and invalidation confirmation processing, and the method for realizing the former processing is as follows: In addition to acquiring from a communication partner, there is a method of acquiring by accessing a CA or a directory system. The latter method includes a method of acquiring a CRL by accessing a CA or directory, and a VA (Validation Authority). : There is a method to check by accessing the verification authority.
[0005]
In addition, which method the user system uses for these processes is usually determined by the service content provided by a trusted organization such as CA or the policy of the system operator.
[0006]
[Problems to be solved by the invention]
However, in the conventional user system that handles public key certificates, the method used in the public key certificate acquisition processing and the invalidation confirmation processing is usually within the range of available methods provided by the trust authority. Since each is uniquely determined in advance according to the policy of the system operator, for example, in the situation where there are a plurality of different CAs and the user system uses the public key certificate issued from each of them, each of the certification bodies If the acquisition of available public key certificate and the invalidation confirmation method provided in the above are different, the fixed method is assumed in the public key certificate acquisition process and invalidation confirmation process. The user system has a problem that these different methods cannot be used properly.
[0007]
The present invention has been made in view of the above points, and a user system that handles public key certificates even in an environment in which users who have issued public key certificates from a plurality of CAs having different operational policies coexist is provided. Authentication system access that enables processing for public key certificate acquisition and invalidation confirmation without being aware of the difference between the public key certificate acquisition method and invalidation confirmation method according to the issuer's management policy Apparatus, public key certificate acquisition method, public key certificate invalidation confirmation method, authentication system access program, public key certificate acquisition program, public key certificate invalidation confirmation program, and storage medium storing authentication system access program And a storage medium storing a public key certificate acquisition program and a storage medium storing a public key certificate revocation confirmation program .
[0008]
In addition, even if a new CA appears, an object of the present invention is to easily realize public key certificate acquisition processing and invalidation confirmation processing necessary for using a public key certificate issued by a new CA. Authentication system access apparatus, public key certificate acquisition method, public key certificate invalidation confirmation method, authentication system access program, public key certificate acquisition program, public key certificate invalidation confirmation program, and authentication system To provide a storage medium storing an access program, a storage medium storing a public key certificate acquisition program, and a storage medium storing a public key certificate revocation confirmation program.
[0009]
Further, an object of the present invention is to provide an authentication system that can easily use a new method for acquiring a new public key certificate or a revocation confirmation process even when a new method is developed. Access device, public key certificate acquisition method, public key certificate invalidation confirmation method, authentication system access program, public key certificate acquisition program, public key certificate invalidation confirmation program, and storage storing authentication system access program It is to provide a storage medium storing a medium and a public key certificate acquisition program and a storage medium storing a public key certificate revocation confirmation program.
[0010]
[Means for Solving the Problems]
FIG. 1 is a principle configuration diagram of the present invention.
[0011]
The present invention (Claim 1) is an authentication system access device for obtaining a public key certificate or confirming revocation necessary for performing electronic signature communication or cryptographic communication using public key cryptography,
For each certificate authority that creates a method definition table 16 for each certificate authority that defines the available public key certificate acquisition and invalidation confirmation methods with priorities for each certificate authority that issued the public key certificate System definition table definition means 11;
Issuing certification authority name acquisition means 12 that acquires information of the certification authority name of the issuing source that issued the processing target public key certificate when performing public key certificate acquisition processing and invalidation confirmation processing;
Processing method determination means 13 for referring to the method definition table 16 for each certificate authority and determining the acquisition and invalidation confirmation method of the public key certificate corresponding to the issuer certificate authority name of the public key certificate to be processed according to the priority order. When,
Using the method determined by the processing method determining means 13, a public key certificate acquiring means 14 for acquiring a public key certificate to be processed;
Using the method determined by the processing method determining means 13, there is a public key certificate revocation confirmation means 15 for confirming whether or not the public key certificate to be processed is invalidated.
[0012]
FIG. 2 is a diagram for explaining the principle of the present invention.
[0013]
  The present invention (Claim 2) obtains a public key certificate necessary for electronic signature communication and encryption communication using public key cryptography.In the authentication system access device for performingIn the public key certificate acquisition method,
  The CA-specific method definition table definition sectionAt the initial setting, each public key certificate issuer's certificate authority defined the available public key certificate acquisition methods with priorities.CACreate another method definition table (Step 1)
  When the issuer CA name acquisition unit performs public key certificate acquisition processing,Issued public key certificate to be processedPublisher'sObtain the certificate authority name information (step 2)
  The processing method determination unitAnother method definition tableIssuing a public key certificate to be processedA public key certificate acquisition method corresponding to the certificate authority name is determined in accordance with the priority order (step 3),
  Public key certificate acquisition departmentAccording to the determined public key certificate acquisition method,processingA target public key certificate is acquired (step 4).
[0014]
  In the present invention (Claim 3), when the public key certificate cannot be obtained,Public key certificate acquisition departmentThe public key certificate acquisition process is performed again by an acquisition method corresponding to the next priority order of the determined public key certificate acquisition method.
[0015]
  According to the present invention (Claim 4), the public key certificate invalidation in the authentication system access device for confirming the invalidation of the public key certificate, which is necessary when performing electronic signature communication or cryptographic communication using public key cryptography, is provided. In the confirmation method,
  The CA-specific method definition table definition sectionAt the time of initial setting, for each CA that issued the public key certificate, the available public key certificate invalidation confirmation methods were defined with priorities.CACreate another method definition table,
  When the issuer CA name acquisition unit performs the public key certificate invalidation confirmation process,Issued public key certificate to be processedPublisher'sObtain the certificate authority name information,
  The processing method decision unitCA-specific method definition tableAnd refer to the publisherDecide the public key certificate invalidation confirmation method corresponding to the certificate authority name according to the priority,
  Public key certificate revocation confirmationAccording to the determined revocation confirmation method of public key certificate,processingCheck whether the target public key certificate is invalidated.
[0016]
  The present invention (Claim 5)Executed in the authentication system access device,An authentication system access program for obtaining a public key certificate or confirming revocation, which is necessary when performing electronic signature communication or encrypted communication using public key cryptography,
  Computer
  For each certificate authority that issued the public key certificate, the available public key certificate acquisition and invalidation confirmation methods were defined with priorities.CACreate another method definition tableCAAnother method definition table definitionPartWhen,
  When performing public key certificate acquisition processing and invalidation confirmation processing, acquire information on the name of the CA that issued the public key certificate to be processedIssuer CA name acquisition departmentWhen,
  CARefer to another method definition table and determine the processing method to determine the public key certificate acquisition and invalidation confirmation method corresponding to the issuing CA name of the processing target public key certificate according to the priority orderPartWhen,
  Processing method decisionPartObtain public key certificate to be processed using the method determined byPartWhen,
  Processing method decisionPartCheck whether the public key certificate to be processed is invalid or not using the method determined byFunction as a part.
[0017]
  The present invention (Claim 6)Executed on the authentication system access device,A public key certificate acquisition program for acquiring a public key certificate necessary for electronic signature communication and encryption communication using public key cryptography,
  Computer
  At the initial setting, each public key certificate issuer's certificate authority defined the available public key certificate acquisition methods with priorities.CACreate another method definition tableCA-specific method definition table definition sectionWhen,
  When obtaining a public key certificate, obtain information on the name of the certificate authority that issued the public key certificate to be processed.Issuer CA name acquisition department and,
  CAAnother method definition tableIssuing a public key certificate to be processedThe public key certificate acquisition method corresponding to the certificate authority name is determined according to priority.Processing method decision sectionWhen,
  By the processing method decision unitAcquisition method of decided public key certificateWith processingGet the target public key certificatePublic key certificate acquisition departmentWhenAnd make it work.
[0018]
  The present invention (Claim 7)In the public key certificate acquisition program, the public key certificate acquisition unitIf the public key certificate cannot be obtained, the public key certificate acquisition process is performed again using the acquisition method corresponding to the next priority of the determined public key certificate acquisition method.meansincluding.
[0019]
  The present invention (Claim 8)Executed on the authentication system access device,A public key certificate invalidation confirmation program required for electronic signature communication and encryption communication using public key cryptography,
  Computer
  At the time of initial setting, for each CA that issued the public key certificate, the available public key certificate invalidation confirmation methods were defined with priorities.CACreate another method definition tableCA-specific method definition table definition sectionWhen,
  The public key certificate to be processed was issued during the public key certificate invalidation confirmation processPublisher'sAcquires the certificate authority name informationIssuer CA name acquisition departmentWhen,
  CARefer to another method definition tableIssue public key certificate to be processedDecide the public key certificate invalidation confirmation method corresponding to the certificate authority name according to priority.Processing method decision sectionWhen,
  By the processing method decision unitDetermined invalidation confirmation methodUsing,Check whether the public key certificate to be processed is invalidatedIt functions as a public key certificate invalidation confirmation unit.
[0020]
  The present invention (Claim 9)Executed in the authentication system access device,A storage medium that stores an authentication system access program for obtaining a public key certificate or confirming revocation, which is necessary when performing electronic signature communication or encryption communication using public key cryptography,
  Computer
  For each certificate authority that issued the public key certificate, the available public key certificate acquisition and invalidation confirmation methods were defined with priorities.CACreate another method definition tableCAAnother method definition table definitionPartWhen,
  When performing public key certificate acquisition processing and invalidation confirmation processing, acquire information on the name of the CA that issued the public key certificate to be processedIssuer CA name acquisition departmentWhen,
  CARefer to another method definition table and determine the processing method to determine the public key certificate acquisition and invalidation confirmation method corresponding to the issuing CA name of the processing target public key certificate according to the priority orderPartWhen,
  Processing method decisionPartObtain public key certificate to be processed using the method determined byPartWhen,
  Processing method decisionPartCheck whether the public key certificate to be processed is invalid or not using the method determined byStores a program that functions as a section.
[0021]
  The present invention (Claim 10)Executed on the authentication system access device,A storage medium storing a public key certificate acquisition program for acquiring a public key certificate necessary for performing electronic signature communication and cryptographic communication using public key cryptography,
  Computer
  At the initial setting, each public key certificate issuer's certificate authority defined the available public key certificate acquisition methods with priorities.CACreate another method definition tableCA-specific method definition table definition sectionWhen,
  When obtaining a public key certificate, obtain information on the name of the certificate authority that issued the public key certificate to be processed.Issuer CA name acquisition department and,
  CAAnother method definition tableIssuing a public key certificate to be processedThe public key certificate acquisition method corresponding to the certificate authority name is determined according to priority.Processing method decision sectionWhen,
  By the processing method decision unitAcquisition method of decided public key certificateUsing,Obtain the public key certificate to be processedStores a program that functions as a public key certificate acquisition unit.
[0022]
  The present invention (claim 11)The public key certificate acquisition unit in the storage medium storing the public key certificate acquisition program,If the public key certificate cannot be obtained, the public key certificate acquisition process is performed again using the acquisition method corresponding to the next priority of the determined public key certificate acquisition method.meansincluding.
[0023]
  The present invention (Claim 12)Executed on the authentication system access device,A storage medium storing a public key certificate invalidation confirmation program necessary for performing electronic signature communication and encryption communication using public key cryptography,
  Computer
  At the time of initial setting, for each CA that issued the public key certificate, the available public key certificate invalidation confirmation methods were defined with priorities.CACreate another method definition tableCA-specific method definition table definition sectionWhen,
  The public key certificate to be processed was issued during the public key certificate invalidation confirmation processPublisher'sAcquires the certificate authority name informationIssuer CA name acquisition departmentWhen,
  CAAnother method definition tableIssuing a public key certificate to be processedDecide the public key certificate invalidation confirmation method corresponding to the certificate authority name according to priority.Processing method decision sectionWhen,
  By the processing method decision unitDetermined invalidation confirmation methodWith processingCheck whether the target public key certificate is invalidatedStores a program that functions as a public key certificate invalidation confirmation unit.
[0024]
Based on the above, even in a situation where a plurality of different methods must be used for the public key certificate acquisition process and the invalidation confirmation process, an appropriate method is dynamically selected according to the public key certificate to be processed. It is possible to perform processing based on this.
[0025]
DETAILED DESCRIPTION OF THE INVENTION
In the present invention, for each public key certificate issuer CA, a table defining available public key certificate acquisition and invalidation confirmation methods is prepared in advance, and at the time of public key certificate acquisition and invalidation confirmation processing By referring to the table, the public key certificate acquisition and invalidation confirmation method is dynamically determined according to the issuer CA name of the public key certificate to be processed.
[0026]
FIG. 3 shows the configuration of the authentication system access apparatus of the present invention.
[0027]
The authentication system access apparatus shown in FIG. 1 has a public certificate acquisition and invalidation confirmation processing unit 10, and the public certificate acquisition and invalidation confirmation processing unit 10 includes a CA-specific method definition table definition unit 11, an issuer It comprises a CA name acquisition unit 12, a processing method determination unit 13, a public key certificate acquisition unit 14, a public key certificate invalidation confirmation unit 15, and a CA-specific method definition table 16.
[0028]
The CA-specific method definition table definition unit 11 defines a CA-specific method definition table 16 in which public key certificate acquisition and revocation confirmation methods that can be used for each public key certificate issuer CA are defined with priorities. Create Note that when the CA-specific method definition table 16 is created, it is not always necessary to define all available methods, and it is also possible to define the methods to be used by narrowing down the method to be used according to the user policy.
[0029]
The issuer CA name acquisition unit 12 acquires information on the issuer CA name that issued the public key certificate to be processed when performing the public key certificate acquisition process and the invalidation confirmation process. The processing method determination unit 13 refers to the CA-specific definition table 16 and determines the acquisition of the public certificate corresponding to the issuer CA name of the public key certificate to be processed and the invalidation confirmation method according to the priority order. .
[0030]
The public key certificate acquisition unit 14 acquires the target public key certificate using the method determined by the processing method determination unit 13.
[0031]
The public key certificate invalidation confirmation unit 15 uses the method determined by the processing method determination unit 13 to check whether the target public key certificate is invalidated.
[0032]
Next, public key certificate acquisition processing and revocation confirmation processing in the above configuration will be described.
[0033]
FIG. 4 is a flowchart of the public key certificate acquisition process and the invalidation confirmation process of the present invention.
[0034]
Step 101) At the time of initialization, the CA-specific method definition table definition unit 11 obtains an available public key certificate and invalidation confirmation method for each public key certificate issuer CA as shown in FIG. The CA-specific method definition table 16 defined with priorities is created.
[0035]
Step 102) The authentication system access device uses the issuer CA name acquisition unit 12 when performing the public key certificate acquisition process or the invalidation confirmation process, and determines the CA name that issued the public key certificate to be processed. Get information.
[0036]
Step 103) Next, in order to determine the public key certificate acquisition processing and the invalidation confirmation processing method, the processing method determination unit 13 is used to perform the step 102 on the CA-specific method definition table 16 created in Step 101. The public key certificate acquisition method and the invalidation confirmation method corresponding to the CA name acquired in step 1 are determined according to the priority order. If it is determined in the subsequent processing that the determined method is unusable, the method corresponding to the next priority order of the previously determined method is selected and the subsequent processing is executed again. To do.
[0037]
Step 104) When performing the public key certificate acquisition process, the public key certificate acquisition unit 14 is used to acquire the target public key certificate by the processing method determined in step 103.
[0038]
Step 105) When performing the public key certificate invalidation confirmation process, the public key certificate invalidation confirmation unit 15 determines whether or not the target public key certificate is invalidated by the processing method determined in step 103. Check.
[0039]
Even in a situation where a plurality of different methods must be used for the public key certificate acquisition process and the invalidation confirmation process by using the processing methods shown above and the means for reading them, It is possible to dynamically select a snow-covered method according to the public key certificate and to perform processing based on this method.
[0040]
【Example】
Embodiments of the present invention will be described below with reference to the drawings.
[0041]
In the present embodiment, it is assumed that a user system verifies the electronic signature of user A using a public key certificate.
[0042]
FIG. 6 is a flowchart of public key certificate acquisition processing and invalidation confirmation processing according to an embodiment of the present invention, and FIG. 7 shows an example in the CA-specific method definition table according to an embodiment of the present invention.
[0043]
Step 201) Prioritize access protocol and access destination information as a method for obtaining and invalidating available public key certificates for each public key certificate issuer CA using the table registration function. To the CA-specific method definition table 16. Examples of access protocols for acquiring public key certificates include an acquisition method using LDAP (Light-weight Directory Access protocol) for a directory system and an acquisition method using CMP (Certificate Managment Protocols: RFC2510) for a CA. There is. The access protocol for confirming the invalidation of the public key certificate is, for example, an invalidation confirmation method by OCSP (Onlinge Certificate Status Protocol: RFC2560) for VA, or LDAP (Light-weight for the directory system). There is a confirmation method using a CRL (Certificate Revocation List) acquired by Directory Access Protocol. The table registration function of the CA-specific method definition table definition unit 11 can be easily realized by using a function provided by the database system, for example. In the present embodiment, the following description will be given assuming that the definition shown in FIG. 7 is performed.
[0044]
Next, processing when the authentication system access device verifies the electronic signature given by the user A will be described.
[0045]
Step 202) The authentication system access apparatus uses the data analysis function from the signature verification information attached to the electronic data together with the electronic signature, and issues the issuer name (CA name) of the public key certificate used for verification of the electronic signature. Get information. The signature verification information includes identification information of a public key certificate for use in normal signature verification, but may also include an entity of a public key certificate. When the actual public key certificate is included, the issuer name of the public key certificate can be obtained by analyzing the contents. The data analysis function can be easily realized in a general computer system.
[0046]
In the present embodiment, the public key certificate of user A is not included in the signature verification information, and the following processing is performed assuming that the issuer of the public key certificate of user A is “CA1”. explain.
[0047]
Step 203) The processing method determination unit 13 uses the table reference function to determine the method for executing the acquisition and invalidation confirmation processing of user A's public key certificate. The method definition table 16 is searched for the public key certificate acquisition method and invalidation confirmation method corresponding to the CA name acquired in step 202, and the access protocol and access destination information for each are acquired according to the priority order. In the present embodiment, as a result of searching the method information corresponding to “CA1” acquired in step 202, information on the access protocol “LDAP” and the access destination “host 1” is acquired as the public key certificate acquisition method. Thus, as the public key certificate invalidation confirmation method, information with the access protocol “OCSP” and the access destination “host 2” is acquired. The table reference function for searching for information in the CA-specific method definition table 16 set in step 201 can be easily realized in an existing database system.
[0048]
Step 204) Next, the public key certificate acquisition unit 14 issues the public key certificate of the user A by the method according to the access protocol and the access destination information determined in step 203. In this embodiment, the public key certificate of the user A is acquired for the “host 1” by the “LDAP” access protocol.
[0049]
The public key certificate acquisition unit 14 includes in advance modules that implement various defined access protocols in the CA-specific method definition table 16, and allows the modules to be used to be switched according to the determination in step 203. It is feasible. A module for realizing various access protocols for obtaining a public key certificate such as LDAP is a function used in an existing CA system or directory system.
[0050]
Step 205) Next, after confirming the authenticity of the issuer by verifying the CA signature given to the public key certificate acquired in step 204, the public key certificate revocation confirmation unit 15 determines in step 203 Whether or not the target public key certificate is invalidated is confirmed by a method according to the access protocol and access destination information.
[0051]
In this embodiment, the revocation confirmation information of the public key certificate of the user A is acquired from the “host 2” by using the access protocol “OCSP”, and the presence / absence of revocation is confirmed using this information. .
[0052]
Similar to the public key certificate acquisition unit 14, the public key certificate invalidation confirmation unit 15 includes in advance modules for implementing various defined access protocols in the CA-specific method definition table 16, and follows the determination in step 203. This can be realized by switching the module to be used. A module that implements various access protocols for public key certificate invalidation confirmation, such as OCSP, is a function used in existing VA systems and directory systems.
[0053]
Step 206) In Step 204 or Step 205, if the target processing is not completed by the method according to the access protocol and the access destination information determined in Step 203, the processing returns to Step 203, and is selected first. The processing in step 204 or step 205 is executed again by a method according to the access protocol and the access destination information registered in the next priority order of the method.
[0054]
As described above, when the user system uses the other party's public key certificate for signature verification, etc., the access protocol and access destination for public key certificate acquisition processing and invalidation confirmation processing are disclosed. It is possible to automatically use the key certificate according to the issuer name.
[0055]
Further, the functions of the CA-specific method definition table definition unit 11, the issuer CA name acquisition unit 12, the processing method determination unit 13, the public key certificate acquisition unit 14, and the public key certificate invalidation confirmation unit 15 are constructed as programs, It can be installed on the CPU of a computer of the public certificate utilization system or distributed via a network.
[0056]
Further, the present invention can be easily obtained by storing the built program in a portable storage medium such as a disk device connected to a computer, a floppy disk, or a CD-ROM, and installing it when the present invention is carried out. Can be realized.
[0057]
The present invention is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the claims.
[0058]
【The invention's effect】
As described above, according to the present invention, a user system that handles public key certificates can be used even in an environment where users who have issued public key certificates from a plurality of CAs with different operational policies coexist. It is possible to obtain a public key certificate and check for invalidation without being aware of the difference between the public key certificate acquisition method and the invalidation confirmation method according to the management policy.
[0059]
In addition, even when a new CA appears, it is possible to add a public key certificate issued by a new CA to the CA-specific method definition table simply by adding information on the acquisition and invalidation confirmation method for the CA. It is possible to easily realize the public key certificate acquisition process and the revocation confirmation process necessary for use. In addition, even if a new method has been developed for obtaining public key certificates and checking for invalidation, a module that implements the new method can be used as a public key certificate acquisition unit or public key certificate invalidation. It is possible to easily use a new system simply by incorporating it into the means and defining in which CA the system is used in the CA-specific system definition table.
[Brief description of the drawings]
FIG. 1 is a principle configuration diagram of the present invention.
FIG. 2 is a diagram for explaining the principle of the present invention.
FIG. 3 is a configuration diagram of an authentication system access apparatus according to the present invention.
FIG. 4 is a flowchart of public key certificate acquisition processing and invalidation confirmation processing according to the present invention.
FIG. 5 shows an example of a method definition table for each CA according to the present invention.
FIG. 6 is a flowchart of public key certificate acquisition processing and invalidation confirmation processing according to an embodiment of the present invention.
FIG. 7 is an example of a method definition table for each CA according to an embodiment of the present invention.
[Explanation of symbols]
10 Public key certificate acquisition and revocation confirmation processing part
11 Certificate Authority-specific method definition table definition means, CA-specific method definition table definition part
12 Issuing CA name acquisition means, issuer CA name acquisition unit
13 Processing method determining means, processing method determining unit
14 Public key certificate acquisition means, public key certificate acquisition unit
Item 15 Akai key certificate revocation checking means, public key certificate revocation checking unit
16 CA-specific method definition table, CA-specific method definition table

Claims (12)

An authentication system access device for obtaining a public key certificate or confirming revocation necessary for performing electronic signature communication or encryption communication using public key cryptography,
Authentication that creates a method definition table for each CA ( Certificate Authority ) that defines the available public key certificate acquisition and invalidation confirmation methods with priorities for each CA that issued the public key certificate. A method definition table defining means for each station (CA);
Issuing certification authority name acquisition means for acquiring information of the certification authority name of the issuer that issued the processing target public key certificate when performing the public key certificate acquisition process and the invalidation confirmation process;
Processing method determination for referring to the method definition table for each certificate authority (CA) and determining the acquisition / invalidation confirmation method of the public key certificate corresponding to the issuing certificate authority name of the public key certificate to be processed according to the priority order Means,
Using the method determined by the processing method determination means, public key certificate acquisition means for acquiring the public key certificate to be processed;
An authentication system access apparatus comprising: a public key certificate revocation checking unit that checks whether or not the processing target public key certificate is revoked using the method determined by the processing method determining unit . In a public key certificate acquisition method in an authentication system access device for acquiring a public key certificate necessary for performing electronic signature communication and cryptographic communication using public key cryptography,
The CA-specific method definition table section defines the available public key certificate acquisition methods for each certificate authority that issued the public key certificate at the time of initial setting, with priorities defined. Create another method definition table,
When obtaining a public key certificate
When the issuing certificate authority (CA) name acquisition unit performs the public key certificate acquisition process, it acquires information on the name of the certificate authority of the issuer that issued the public key certificate to be processed;
A processing method determination unit refers to the CA-specific method definition table, determines a public key certificate acquisition method corresponding to the issuing certificate authority name of the public key certificate to be processed according to priority,
A public key certificate acquisition method, wherein a public key certificate acquisition unit acquires the public key certificate to be processed according to the determined public key certificate acquisition method. When the public key certificate cannot be obtained, the public key certificate obtaining unit again performs the public key certificate by an obtaining method corresponding to the next priority order of the decided public key certificate obtaining method. The public key certificate acquisition method according to claim 2, wherein certificate acquisition processing is performed. In the public key certificate invalidation confirmation method, which is required when performing electronic signature communication and encrypted communication using public key cryptography,
The certificate authority (CA) -specific method definition table definition unit assigns priorities to the public key certificate invalidation confirmation methods that can be used for each certificate authority that issued the public key certificate at the time of initial setting. Create a method definition table for each defined CA (CA)
When the issuer CA name acquisition unit performs invalidation confirmation processing of the public key certificate, acquires information on the name of the certificate authority of the issuer that issued the public key certificate to be processed,
The processing method determination unit refers to the CA-specific method definition table and determines the public key certificate invalidation confirmation method corresponding to the acquired certificate authority name of the issuer according to the priority order.
A public key certificate invalidation confirmation unit confirms whether or not the processing target public key certificate is invalidated according to the determined public key certificate invalidation confirmation method. Confirmation method. An authentication system access program for performing acquisition of public key certificate or revocation confirmation, which is required when performing electronic signature communication or encryption communication using public key encryption, executed by an authentication system access device,
Computer
Authentication that creates a method definition table for each CA (Certificate Authority) that defines the available public key certificate acquisition and invalidation confirmation methods with priorities for each CA that issued the public key certificate. A method definition table definition for each station (CA);
An issuing CA name acquisition unit that acquires information on the name of the certification authority that issued the processing target public key certificate when performing the public key certificate acquisition process and the invalidation confirmation process;
A processing method for referring to the method definition table for each certificate authority (CA) and determining a public key certificate acquisition and invalidation confirmation method corresponding to the issuer certificate authority name of the public key certificate to be processed according to the priority order. A decision unit;
Using the method determined by the processing method determination unit, a public key certificate acquisition unit that acquires the public key certificate to be processed;
An authentication system access program that functions as a public key certificate revocation checking unit that checks whether or not the public key certificate to be processed is revoked, using the method determined by the processing method determining unit . A public key certificate acquisition program for acquiring a public key certificate, which is necessary when performing electronic signature communication or cryptographic communication using public key encryption, executed on an authentication system access device,
Computer
Authentication that creates a method definition table for each certificate authority (CA) that defines the available public key certificate acquisition methods for each certificate authority that issued the public key certificate at the time of initialization. A method table defining unit for each station (CA);
An issuer certificate authority (CA) name acquisition unit that acquires information on the name of the certificate authority that issued the public key certificate to be processed when acquiring the public key certificate;
A processing method determination unit that refers to the method definition table for each certificate authority (CA) and determines the acquisition method of the public key certificate corresponding to the issuing certificate authority name of the public key certificate to be processed according to the priority order;
Using the public key certificate acquisition method determined by the processing method determination unit, the public key certificate acquisition unit functions as a public key certificate acquisition unit that acquires the public key certificate to be processed program. The public key certificate obtaining unit, if it can not obtain the public key certificate, the acquisition scheme corresponding to the next priority acquisition scheme of the determined public key certificate again, public key certificate 7. The public key certificate acquisition program according to claim 6, further comprising means for performing certificate acquisition processing. A public key certificate invalidation confirmation program, which is executed on an authentication system access device and is necessary when performing electronic signature communication or encryption communication using public key cryptography,
Computer
Creates a method definition table for each CA (Certificate Authority) that defines the available public key certificate invalidation confirmation methods with priorities for each certificate authority that issued public key certificates at the time of initialization. A certificate authority (CA) -specific method table definition unit,
An issuer certificate authority (CA) name acquisition unit that acquires information on the name of the certificate authority of the issuer that issued the public key certificate to be processed during the public key certificate invalidation confirmation process;
A processing method determination unit that refers to the method definition table for each certificate authority (CA) and determines the public key certificate invalidation confirmation method corresponding to the issuing certificate authority name of the public key certificate to be processed according to the priority order;
Using the public key certificate invalidation confirmation method determined by the processing method determination unit, functioning as a public key certificate voucher or confirmation unit for confirming whether or not the target public key certificate is invalidated A public key certificate revocation confirmation program, which is a feature. A memory that stores an authentication system access program for obtaining public key certificates and confirming revocation, which is necessary for electronic signature communication and encryption communication using public key cryptography, which is executed by the authentication system access device A medium,
Create a method definition table for each CA that defines the methods for obtaining and revoking available public key certificates for each certificate authority that issued the public key certificate. A certificate authority (CA) -specific method definition table definition section,
An issuing certificate authority (CA) name acquisition unit that acquires information on the name of the certificate authority of the issuer that issued the public key certificate to be processed when performing the acquisition process and the invalidation confirmation process of the public key certificate;
A processing method for referring to the method definition table for each certificate authority (CA) and determining a public key certificate acquisition and invalidation confirmation method corresponding to the issuer certificate authority name of the public key certificate to be processed according to the priority order. A decision unit;
Using the method determined by the processing method determination unit, a public key certificate acquisition unit that acquires the public key certificate to be processed;
A program that functions as a public key certificate revocation checking unit for checking whether or not the public key certificate to be processed is invalidated is stored using the method determined by the processing method determining unit. A storage medium storing an authentication system access program. A storage medium storing a public key certificate acquisition program for acquiring a public key certificate necessary for electronic signature communication and encryption communication using public key encryption, which is executed on an authentication system access device. ,
When initializing the computer, create a method definition table for each certificate authority (CA) that defines the available public key certificate acquisition methods for each certificate authority that issued the public key certificate with priorities. A certificate authority (CA) -specific method definition table definition section,
An issuer certificate authority (CA) name acquisition unit that acquires information on the name of the certificate authority that issued the public key certificate to be processed when acquiring the public key certificate;
A processing method determination unit that refers to the method definition table for each certificate authority (CA) and determines the acquisition method of the public key certificate corresponding to the issuing certificate authority name of the public key certificate to be processed according to the priority order;
A public key storing a program that functions as a public key certificate acquisition unit that acquires the target public key certificate using the public key certificate acquisition method determined by the processing method determination unit A storage medium that stores a certificate acquisition program.   If the public key certificate acquisition unit fails to acquire the public key certificate, the public key certificate acquisition unit again performs the public key certificate by an acquisition method corresponding to the next priority order of the determined public key certificate acquisition method. 11. A storage medium storing a public key certificate acquisition program according to claim 10, including means for performing certificate acquisition processing. A storage medium that stores a public key certificate revocation confirmation program, which is required when performing electronic signature communication or cryptographic communication using public key encryption, executed on an authentication system access device,
Certificate authority (CA) -specific method definition table that defines the available public key certificate invalidation confirmation methods for each certificate authority that issued the public key certificate at the time of initial setting. A method definition table definition section by certificate authority (CA) for creating
An issuer certificate authority (CA) name acquisition unit that acquires information on the name of the certificate authority of the issuer that issued the public key certificate to be processed during the public key certificate invalidation confirmation process;
A processing method determination unit that refers to the method definition table for each certificate authority (CA) and determines the public key certificate invalidation confirmation method corresponding to the issuing certificate authority name of the public key certificate to be processed according to the priority order;
A program that functions as a public key certificate invalidity confirmation unit that confirms whether or not the public key certificate to be processed is invalidated, using the public key certificate invalidation confirmation method determined by the processing method determination unit A storage medium storing a public key certificate revocation confirmation program characterized by storing.

Images