JP4012841B2 - Public key certificate creation method, attribute certificate creation method, certificate relevance verification method, public key certificate creation device, attribute certificate creation device, certificate relevance verification device, public key certificate creation program, attribute certificate Creation program, certificate relevance verification program, and program recording medium - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a public key certificate creation method, an attribute certificate creation method, a certificate relevance verification method, a public disclosure when using an attribute certificate in an environment where authentication based on use of a public key certificate is performed. The present invention relates to a key certificate creation device, an attribute certificate creation device, a certificate relevance verification device, a public key certificate creation program, an attribute certificate creation program, a certificate relevance verification program, and a program recording medium.
[0002]
[Prior art]
In an environment where authentication based on the use of public key certificates is performed, when using an attribute certificate that includes the attribute information of the public key certificate user, the attribute authority that issues the attribute certificate must Information about the certificate is stored in the attribute certificate, and the relevance with the public key certificate is guaranteed. As a method for providing such a relationship between a public key certificate and an attribute certificate, RFC 4281 (Non-Patent Document 1), which is a standard rule defining an attribute certificate profile, describes in 4.2.2. Three types of methods are defined, and the public key certificate and the attribute certificate are associated (linked) by using one or more of these methods.
[0003]
(1) baseCertificateID
A method of storing the public key certificate serial number and issuer name in the attribute certificate.
[0004]
(2) entityName
A method of storing the subject name of the public key certificate in the attribute certificate.
[0005]
(3) objectDigestInfo
A method of storing the hash value of some object in the attribute certificate. As a method of linking with a public key certificate, RFC 281 chapter 7.3 describes (3-A) a method using a hash value of a public key in a public key certificate, and (3-B) a public key certificate. A method using a hash value is described.
[0006]
Among these methods, (1) a method using baseCertificateID or (3-B) a method using a hash of a public key certificate for objectDigestInfo associates the attribute certificate with the public key certificate in a one-to-one relationship. For this reason, when the public key certificate is updated, the relationship between the updated public key certificate and the attribute certificate is lost.
[0007]
On the other hand, in the method using (2) entityName or the method using the hash value of the public key for (3-A) objectDigestInfo, the attribute certificate and the public key certificate do not have a one-to-one relationship. Even if is updated, if the same entityName or the same public key is used for the updated public key certificate, the relationship between the attribute certificate and the public key certificate can be maintained.
[0008]
Normally, the validity period of a public key certificate is often longer than the validity period of an attribute certificate, but the attribute is longer than the validity period of a public key certificate, for example, when an attribute certificate is used as a doctor's license. You may want to set a longer certificate validity period. In such a case, as is apparent from the above description, either (2) or (3-A) is used as a method for associating the attribute certificate with the public key certificate.
[0009]
[Non-Patent Document 1]
S. Farrell, R. Housley, "An Internet Attribute Certificate Profile for Authorization", [online], RFC 3281, April 2002, [March 18, 2003 search], Internet <URL: http: //www.ietf .org / rfc / rfc3281.txt>
[0010]
[Problems to be solved by the invention]
However, when the attribute certificate and the public key certificate are linked using either (2) or (3-A) described above, the following problem may occur.
[0011]
(2) Method using entityName
When another person is issued a public key certificate with the same entityName from the certificate authority that is the public key certificate issuing authority, the attribute certificate and the public key certificate of the other person, even though they are not the same person The connection will occur. More specifically, as shown in the explanatory diagram of FIG. 8, authentication different from the certificate authority CA1 that issued the public key certificate owned by the user A using the subject name “A” by the user B When the public key certificate is issued from the station CA2, there is a relationship between the attribute certificate that the user A is the original owner and the public key certificate of the user B.
[0012]
(3-A) Method of using public key hash value for objectDigestInfo
If another person creates the same public key and corresponding private health as the attribute certificate owner, or steals the attribute certificate owner's private key and is issued a public key certificate with the same public key, the same person Nevertheless, the association between the attribute certificate and another person's public key certificate occurs. More specifically, as shown in the explanatory diagram of FIG. 9, when the user B acquires or creates the key pair of the user A and uses the key pair to acquire the public key certificate, the user A There is a relationship between the attribute certificate that is the original owner and the public key certificate of user B.
[0013]
Also, during the validity period of the attribute certificate, it is necessary to continue using the same public key as the public key of the public key certificate after updating the public key certificate (in this case, the private key corresponding to the public key must also be used). Need to continue to use). However, the possibility of compromising the key algorithm within the validity period of the attribute certificate by continuing to use the same key pair is that compromising occurs when the public key is updated with each renewal of the public key certificate. Higher than the probability of occurrence.
[0014]
The present invention has been made in view of the above-described circumstances, and an object of the present invention is to provide a public key certificate creation method and attribute certificate that can accurately determine the relevance between a public key certificate and an attribute certificate. Creation method, certificate relevance verification method, public key certificate creation device, attribute certificate creation device, certificate relevance verification device, public key certificate creation program, attribute certificate creation program, certificate relevance verification program, And providing a program recording medium.
[0015]
[Means for Solving the Problems]
In order to achieve the above object, the invention described in claim 1 is a public key registration application transmitted from a user device for a computer connected to the user device via a communication network to apply for registration of a public key. A public key certificate creating method for creating a public key certificate according to a certificate, wherein the computer newly adds a public key certificate to the public key certificate created based on the contents of the public key registration application. The hash value storage step to store the hash value of And the hash value storing step, if the public key registration application has applied for an update to a public key certificate that has already been registered, the public key certificate stored in the registered public key certificate The hash value of the key certificate is extracted, and the hash value of the extracted public key certificate is stored in the newly created public key certificate. This is the gist.
[0016]
The public key certificate creation method of the present invention is not limited to a case where one electronic device executes, but a system constructed from two or more electronic devices by appropriately dividing the execution of each step. This includes the case of executing the entire program. In other words, the “computer” in the present invention is a general term for devices composed of one or more electronic devices. The same applies to all inventions described later.
[0018]
Claim 2 In the described invention, in the hash value storing step, when the public key registration application has applied for a new registration of a public key, a public key certificate newly created based on the contents of the public key registration application The gist is to calculate the hash value of the certificate and store the calculated hash value of the public key certificate in the newly created public key certificate.
[0021]
Claim 3 The described invention is a public key that is connected to a user device via a communication network and creates a public key certificate in response to a public key registration application sent from the user device in order to apply for public key registration. A key certificate creation device, comprising hash value storage means for storing a hash value of a public key certificate in a public key certificate newly created based on the contents of the public key registration application When the hash value storage means has applied for an update to the public key certificate already registered in the public key registration application, the public key stored in the registered public key certificate The hash value of the certificate is extracted, and the hash value of the extracted public key certificate is stored in the newly created public key certificate. This is the gist.
[0023]
Claim 4 In the described invention, the hash value storage means newly creates a public key certificate based on the contents of the public key registration application when the public key registration application has applied for new registration of a public key. The gist is to calculate the hash value of the certificate and store the calculated hash value of the public key certificate in the newly created public key certificate.
[0026]
Claim 5 The present invention relates to a public key that is connected to a user device via a communication network and that creates a public key certificate in accordance with a public key registration application sent from the user device to apply for registration of the public key. Let the certificate creation device function as hash value storage means for storing the hash value of the public key certificate in the public key certificate newly created based on the contents of the public key registration application. When the hash value storage means has applied for an update to the public key certificate already registered in the public key registration application, the public key stored in the registered public key certificate The hash value of the certificate is extracted, and the hash value of the extracted public key certificate is stored in the newly created public key certificate. This is the gist.
[0028]
Claim 6 According to the present invention, the hash value storage means newly creates a public key certificate based on the contents of the public key registration application when the public key registration application has applied for new registration of the public key. And the hash value of the calculated public key certificate is stored in the newly created public key certificate.
[0031]
Claim 7 The described invention Claim 5 or claim 6 The gist is that the program described in 1 was recorded.
[0032]
The recording medium in the present invention means a computer-readable recording medium such as a flexible disk, a CD-ROM (Compact Disc Read Only Memory), a DVD (Digital Versatile Disk), a magneto-optical disk, and a PC card. .
[0033]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of the present invention will be described below with reference to the accompanying drawings.
[0034]
FIG. 1 is a block diagram showing a schematic configuration of a communication system in an environment where a public key certificate creation method, an attribute certificate creation method, and a certificate relevance verification method according to an embodiment of the present invention can be executed. is there. The communication system 100 shown in FIG. 1 includes a public key certificate creating apparatus 1 that creates a public key certificate, an attribute certificate creating apparatus 3 that creates an attribute certificate, and a connection between a public key certificate and an attribute certificate ( Certificate relevance verification devices 5 for verifying relevance) are connected to each other via a communication network 101 such as the Internet or a dedicated line.
[0035]
In the following description, it is assumed that the function of the certificate relevance verification device 5 is realized by an application that operates on a general user device. Therefore, a function as a device for a general user to create and send a public key registration application and an attribute certificate issuance request without specializing in the function of the certificate relevance verification device 5 will be described. In some cases, the user apparatus 5 is simply called to avoid complication.
[0036]
A more specific configuration of each device will be described with reference to the block diagrams of FIGS.
[0037]
As shown in the block diagram of FIG. 2, the public key certificate creating apparatus 1 generates a public key certificate based on the application content of the public key registration application form transmitted from the user apparatus 5 via the communication network 101. A public key certificate creating unit 11 to be created, an authenticity determining unit 13 for determining the authenticity of the public key certificate applied from the user device 5, and a new registration according to the determination result in the authenticity determining unit In the case of an application, a hash value of a new public key certificate is generated, while in the case of an update, the hash value of the public key certificate to be updated is extracted, and the generated hash value is used as a public key certificate. Public key certificate hash value storage unit 15 (hash value storage means) stored in a public key certificate newly created by the certificate creation unit 11 and a public key certificate storage which is a database for storing issued public key certificates With part 17 There. The function of the public key certificate creating apparatus 1 is assumed to be realized as one function of a certificate authority server provided in a certification authority (CA), which is an organization that issues public key certificates, for example. .
[0038]
The public key certificate creation unit 11 includes, as basic elements of a public key certificate, a serial number assigned by a certificate authority to identify the certificate, information about the certificate authority that issues the certificate, a public key to be certified and its A certificate is created that includes at least an expiration date, information about the owner of the private key corresponding to the public key, and a digital signature of the issuing certificate authority. As a format of such a public key certificate, for example, a configuration based on a format defined in the ITU (International Telecommunication Union) X.509 standard can be assumed, but this embodiment is not necessarily in such a standard. The scope is not limited only to the format. In addition, as a digital signature method using a public key applied in this embodiment, an RSA signature method, an ElGamal signature method, a DSA (Digital Signature Algorithm) method, a Fiat-Shamir signature method, and an elliptic curve on a finite field are used. A signature scheme based on the above is assumed, and the effect obtained by the present invention is the same regardless of which one is applied.
[0039]
As shown in the block diagram of FIG. 3, the attribute certificate creation device 3 includes an attribute certificate creation unit 31 that creates an attribute certificate based on the application contents of the attribute certificate issuance application received from the user device 5. A public key certificate hash value extracting unit 33 (hash value extracting means) for extracting the hash value of the public key certificate stored in the public key certificate applied by the user apparatus 5, and the public key certificate A public key certificate hash value storage unit 35 (hash value storage means) for storing the hash value of the public key certificate extracted by the hash value extraction unit 33 in the attribute certificate newly created by the attribute certificate creation unit 31; And an attribute certificate storage unit 37 that is a database for storing the attribute certificate that has been completed. The function of the attribute certificate creation device 3 may be realized as one function of an attribute certificate authority server provided in an attribute authority (AA) that is an authority that issues attribute certificates. is assumed.
[0040]
The attribute certificate creation unit 31 includes, as basic elements of the attribute certificate, a serial number assigned by the attribute authority to identify the certificate, information about the attribute authority that issues the certificate, certificate expiration date, attribute , And at least the digital signature of the issuing attribute certificate authority. The format of the attribute certificate conforms to the format of the public key certificate. For example, it is assumed that the attribute certificate is configured based on the format defined in the ITU X.509 standard as described above. It is not the same as a public key certificate. In addition, the format of the digital signature of the attribute certificate authority given to the attribute certificate only needs to be compatible with that of the public key certificate, and the various methods described above can be applied, and the same effects can be obtained.
[0041]
The certificate relevance verification device 5 is a device on the general user side as described above, and the public key certificate stored in the public key certificate from the public key certificate created by the public key certificate creation device 1. Certificate hash value extraction that extracts the hash value of the corresponding public key certificate stored in the attribute certificate from the attribute certificate created by the attribute certificate creation device 3 Section 51 (hash value extracting means), and a hash for collating two hash values (of the public key certificate) extracted from the public key certificate and attribute certificate by the public key certificate hash value extracting section 51 A value verification unit 53 (hash value verification unit) and a certificate storage unit 55 that stores at least each certificate and verification result are provided.
[0042]
Each device having the above functions has a central processing unit (CPU) having at least an arithmetic function and a control function, a function for storing programs and data, and is mainly composed of a RAM (Random Access Memory) and the like. Needless to say, it is composed of a storage device (memory), an input device such as a keyboard and a mouse, and an electronic device having an output function such as a liquid crystal display.
[0043]
Note that the various processes according to the present embodiment are not only performed by one electronic device, but the entire system constructed from two or more electronic devices by appropriately dividing the execution of each step. Including the case of executing. In this sense, in this embodiment, a device composed of one or a plurality of electronic devices is collectively referred to as a “computer”.
[0044]
A program for executing various processes according to the present embodiment is stored in the main storage device or the hard disk described above.
[0045]
Further, it is assumed that each of the above devices includes auxiliary storage devices such as a hard disk drive, a flexible disk drive, a CD-ROM drive, a DVD drive, a magneto-optical disk drive, and a PC card drive. In this sense, it is of course possible to record a program for performing various processes described later on a computer-readable recording medium such as a flexible disk, a CD-ROM, a DVD, a magneto-optical disk, and a PC card and widely distribute it. is there.
[0046]
Next, the operation of each device having the above configuration will be described.
[0047]
FIG. 5 is a flowchart showing an outline of public key certificate creation processing executed by the public key certificate creation apparatus 1.
[0048]
When a public key registration application is received from the user device 5 that applies for the creation of a public key certificate (step S11), the public key certificate creation unit 11 executes a certificate creation process using this as a trigger (step S111). ). At this stage, the public key certificate may not include the hash value and the digital signature (simply described as signature in FIG. 5).
[0049]
On the other hand, the authenticity determination unit 13 applies whether the received public key registration application has applied for a new public key registration (new), or applied for an update (update) to an already registered public key certificate. Is determined with reference to the contents of the public key registration application form (step S131).
[0050]
If new, the process proceeds to the public key certificate hash value storage unit 15 (step S152) described later.
[0051]
In the case of updating in step S131, it is determined whether or not the public key certificate generating apparatus 1 itself that has received the public key registration application has issued the corresponding public key certificate from the information on the public key certificate. A determination is made (step S132). In the determination of this step, when registered as “update” in the public key registration application, when the public key certificate corresponding to the contents of the public key registration application is found by referring to the public key certificate storage unit 17 Is a public key certificate issued by itself. Otherwise, it is determined as a certificate issued by another certificate authority.
[0052]
In addition, the information regarding the public key certificate used for the determination of this step may be transmitted from the user device 5 together with the public key registration application form, or may be described in the public key registration application form. In some cases. In some cases, the user goes to the certificate authority, and the staff of the certificate authority inputs the contents that the user has applied in writing or verbally to the certificate authority server. Thus, since it is assumed that various information related to the public key certificate is used in the determination in step S132, the information related to the public key certificate used for such determination is hereinafter referred to as public key certificate. Collectively referred to as information.
[0053]
If the public key certificate information has already been input and stored in the public key certificate storage unit 17 in step S132 (YES), that is, if it is determined that it has been issued by itself, the public key certificate is subsequently issued. The validity of the certificate is determined by referring to the data stored in the public key certificate storage unit 17 (step S133).
[0054]
If it is determined in step S133 that the public key certificate is valid (YES), it is determined whether or not the issuer's digital signature is added to the public key registration application (step S135). This determination process is performed because the applicant for the public key registration application may come directly to the certificate authority and apply for public key registration in writing or verbally. In such a case, the CA staff may enter the contents of the public key registration application form into the CA server, so the subject's digital signature is not necessarily included in the public key certificate to be updated. It is not always given to the public key registration application. Therefore, if a digital signature is assigned to the public key registration application (YES in step S135), the authenticity of the digital signature is verified (step S136), while if the digital signature is not assigned (step S136). In step S135, the user information (for example, the user's address, name, etc.) related to the user described in the corresponding public key certificate information is extracted from the public key certificate storage unit 17 (step S135). In step S137, the extracted user information is compared with the user information described or presented in the public key registration application form (step S139).
[0055]
As a result of the determination in step S133, even when the public key certificate is not valid (NO), as in the case of NO in step S135 described above, it relates to the user described in the corresponding public key certificate information. After the user information is extracted from the public key certificate storage unit 17 (step S137), the extracted user information is collated with the user information described or presented in the public key registration application (step S139). .
[0056]
Up to this point, the case where the determination in step S132 is YES has been described. On the other hand, as a result of the determination in step S132, the public key certificate issued by another certificate authority (the public key certificate creating apparatus 1) has If it is found out (NO in step S132), user information related to the corresponding public key certificate is issued based on the public key certificate information of the public key certificate, and the public key certificate is issued. Inquiry is sent to the certification authority (the public key certificate creating apparatus 1) that has been received (step S134), the user information received as a result of the inquiry and the user described in the public key registration application received in step S11 Collation with information is performed (steps S138 and S139).
[0057]
When the verification in step S136 or the collation in step S139 is performed (step S140), the processing of the authenticity determination unit 13 ends.
[0058]
Using the end of the process in the authenticity determination unit 13, that is, the output of the verification or verification result as a trigger, the process proceeds to the process of the public key certificate hash value storage unit 15.
[0059]
If the verification / verification result in step S140 is OK, that is, if the digital signature in step S136 is authentic or if it matches in the verification of user information in step S139, it is referred to by the public key certificate information. The hash value of the public key certificate stored in the public key certificate is extracted (step S151). Thereafter, the hash value of the extracted public key certificate is stored in the public key certificate (hash value, no digital signature) created in step S111, and then the digital signature of the public key certificate creating apparatus 1 that is the issuer is stored. (Step S154). In FIG. 5, the process of reading the created public key certificate is represented by a double line. The public key certificate created in step S111 is stored at least in the memory of the public key certificate creation apparatus 1, but an area for storing in the public key certificate storage unit 17 is provided and read from there. It is also possible to do.
[0060]
On the other hand, if the verification / verification result is NG in step S140, that is, if the digital signature authenticity verification in step S136 or the user information verification in step S139 does not match, the verification / verification result is created in step S111. After the digital signature of the public key certificate creation device 1 that is the issuer is assigned to the public key certificate (step S152), the hash value of the public key certificate to which the digital signature is assigned is provided in the device. The calculation is performed using the calculated calculation function (step S153). For the calculation of the hash value here, the calculation of the hash value that is normally performed can be used. Note that the public key certificate (without the hash value) to which the digital signature is assigned in step S152 corresponds to a conventional public key certificate, and the public key certificate finally generated by the public key certificate creating apparatus 1 Hereinafter, it may be referred to as a “public key certificate prototype” in order to distinguish it from a certificate.
[0061]
The calculated hash value is stored in the public key certificate created in step S111, and the digital signature of the public key certificate creating apparatus 1 that is the issuer is assigned (step S154).
[0062]
Even when it is determined in step S131 that the received public key registration application is new, the processes in steps S152, S153, and S154 described here are performed in the public key certificate hash value storage unit 15. Do.
[0063]
Through the above processing, a public key certificate storing its own hash value can be created.
[0064]
FIG. 6 shows a case where the attribute certificate creation device 3 creates an attribute certificate related to the public key certificate using the public key certificate including the hash value created by the public key certificate creation device 1. It is a flowchart figure which shows the outline | summary of a process.
[0065]
When the attribute certificate issuance application and the public key certificate of the attribute certificate issuance user are received from the user device 5 as the applicant (steps S31 and S32), the attribute certificate creation unit 31 registers the attribute certificate. An attribute certificate is created based on the contents of the application form (step S311). Here, the hash value and the digital signature (denoted as signature in FIG. 6) may not be included.
[0066]
On the other hand, the public key certificate hash value extraction unit 33 extracts the hash value stored in the public key certificate of the attribute certificate issuance target user (step S331).
[0067]
Thereafter, using the attribute certificate created in step S311 as an input, the public key certificate hash value storage unit 35 is called, and after storing the hash value of the public key certificate extracted in step S331 in the attribute certificate, attribute authentication is performed. A digital signature of the station is given (step S351). In FIG. 6, the process of reading the created attribute certificate as an input is shown using double lines as in FIG. That is, this double line processing corresponds to reading the attribute certificate created in step S311 from the memory of the attribute certificate creation device 3 or the attribute certificate storage unit 37.
[0068]
In this way, the attribute certificate storing the hash value of the public key certificate of the attribute certificate issuance target user is created.
[0069]
In the present embodiment, since it is assumed that the validity period of the attribute certificate is longer than the validity period of the public key certificate, the attribute certificate issuance target user first obtained the public key certificate. Later (when the public key certificate obtained at this time is called “first generation public key certificate”), when applying for an attribute certificate, the public key certificate has already been updated one or more times, It may not be one generation. However, the hash value stored in the first generation (this hash value is a value obtained for a conventional public key certificate without a hash value, which is a prototype of the first generation public key certificate). Since each generation is carried over to a later generation, the hash value does not change regardless of the application for the attribute certificate at any time.
[0070]
FIG. 7 is a flowchart showing an outline of the certificate relevance verification process when verifying the relevance (linkage) between the public key certificate and the attribute certificate in the certificate relevance verification apparatus 5 on the user side. It is.
[0071]
When the certificate relevance verification apparatus 5 receives the public key certificate and the attribute certificate including the hash value of the public key certificate (steps S51 and S52), the public key certificate hash value extraction unit 51 makes the public certificate public. The hash values PKCCh and ACh of the public key certificate respectively stored in the key certificate and attribute certificate are extracted (steps S511 and S512).
[0072]
Next, the hash value collating unit 53 collates whether or not the two hash values PKCCh and ACh extracted by the public key certificate hash value extracting unit 51 match (step S531). If they match (YES), it is determined that the attribute certificate has a legitimate relationship with the public key certificate (step S532).
[0073]
If they do not match (NO), it is determined that there is no valid connection between the attribute certificate and the public key certificate (step S533).
[0074]
The determination results in the hash value matching unit 53 are displayed on a display device such as a liquid crystal display provided in the certificate relevance verification device 5, for example.
[0075]
Such a certificate relevance verification process is executed by an application that can be installed in the certificate relevance verification device 5 as a user device that is a general terminal.
[0076]
According to the embodiment of the present invention described above, the hash value obtained for the first generation public key certificate prototype (conventional type without hash value) is stored in the public key certificate, and the attribute certificate is stored. Since the hash value of the corresponding public key certificate is stored at the time of creation, it is possible to verify the relationship between the attribute certificate and the public key certificate using the public key certificate itself.
[0077]
In particular, since the association between the attribute certificate and the public key certificate is one-to-one, in the certificate relevance verification apparatus 5 according to the present embodiment, only when the owner of the attribute certificate and the public key certificate is the same. It is determined that the relevance is valid, and it is possible to determine that there is no relevance between the public key certificate obtained by a third party illegally and the original owner's attribute certificate.
[0078]
In addition, according to the present embodiment, since the hash value required for the prototype of the first generation public key certificate is stored in the public key certificate, the public key certificate is updated even after the public key certificate is updated. The relationship between the key certificate and attribute certificate can be verified. Therefore, it can be applied to cases where the validity period of the attribute certificate is inevitably longer than the validity period of the public key certificate, such as when using an attribute certificate as a doctor's license. it can.
[0079]
Furthermore, according to the present embodiment, it is possible to reduce the possibility of the key algorithm being compromised within the validity period of the attribute certificate by continuing to use the same key pair.
[0080]
【The invention's effect】
As is clear from the above description, according to the present invention, a public key certificate creation method, an attribute certificate creation method, and an attribute certificate creation method capable of accurately determining the relationship between a public key certificate and an attribute certificate, Certificate relevance verification method, public key certificate creation device, attribute certificate creation device, certificate relevance verification device, public key certificate creation program, attribute certificate creation program, certificate relevance verification program, and program record A medium can be provided.
[Brief description of the drawings]
FIG. 1 is a block diagram showing an outline of the overall configuration of a communication system according to an embodiment of the present invention.
FIG. 2 is a block diagram showing a schematic configuration of a public key certificate creating apparatus according to an embodiment of the present invention.
FIG. 3 is a block diagram showing a schematic configuration of an attribute certificate creating apparatus according to an embodiment of the present invention.
FIG. 4 is a block diagram showing a schematic configuration of a certificate relevance verification apparatus according to an embodiment of the present invention.
FIG. 5 is a flowchart showing an outline of public key certificate creation processing;
FIG. 6 is a flowchart showing an overview of attribute certificate creation processing;
FIG. 7 is a flowchart showing an overview of certificate relevance verification processing;
FIG. 8 is an explanatory diagram showing a problem when using a conventional method (entityName);
FIG. 9 is an explanatory diagram showing a problem when using a conventional method (objectDigestInfo).
[Explanation of symbols]
1 Public key certificate creation device
3 Attribute certificate creation device
5 Certificate relevance verification device (user device)
11 Public Key Certificate Creation Department
13 Authenticity determination unit
15, 35 Public key certificate hash value storage
17 Public key certificate storage
31 Attribute certificate generator
33, 51 Public key certificate hash value extraction unit
37 Attribute certificate storage
53 Hash value verification part
55 Certificate storage
100 communication system
101 communication network
ACh, PKCCh hash value

Claims (7)

A public key certificate in which a computer connected to a user device via a communication network creates a public key certificate in response to a public key registration application sent from the user device in order to apply for public key registration A method for creating a certificate,
The computer is
Executing a hash value storing step of storing a hash value of the public key certificate in a public key certificate newly created based on the contents of the public key registration application ;
The hash value storing step includes
When the public key registration application has applied for an update to a registered public key certificate, the hash value of the public key certificate stored in the registered public key certificate is extracted. ,
The hash value of the extracted public key certificate is stored in the newly created public key certificate.
A public key certificate creation method characterized by: The hash value storing step includes
If the public key registration application has applied for a new public key registration, calculate a hash value of the public key certificate to be newly created based on the contents of the public key registration application,
The public key certificate creating method according to claim 1, wherein the calculated hash value of the public key certificate is stored in the newly created public key certificate. A public key certificate creation device that is connected to a user device via a communication network and creates a public key certificate according to a public key registration application sent from the user device to apply for registration of a public key Because
A hash value storage means for storing a hash value of the public key certificate in a public key certificate newly created based on the contents of the public key registration application ;
The hash value storage means includes
When the public key registration application has applied for an update to a registered public key certificate, the hash value of the public key certificate stored in the registered public key certificate is extracted. ,
A public key certificate creating apparatus , wherein the hash value of the extracted public key certificate is stored in the newly created public key certificate . The hash value storage means includes
If the public key registration application has applied for a new public key registration, calculate a hash value of the public key certificate to be newly created based on the contents of the public key registration application,
4. The public key certificate creating apparatus according to claim 3 , wherein the calculated hash value of the public key certificate is stored in the newly created public key certificate. A public key certificate creation device that is connected to a user device via a communication network and creates a public key certificate according to a public key registration application sent from the user device to apply for registration of a public key The
Function as hash value storage means for storing a hash value of the public key certificate in a public key certificate newly created based on the contents of the public key registration application ,
The hash value storage means includes
When the public key registration application has applied for an update to a registered public key certificate, the hash value of the public key certificate stored in the registered public key certificate is extracted. ,
A public key certificate creating program , wherein the hash value of the extracted public key certificate is stored in the newly created public key certificate . The hash value storage means includes
If the public key registration application has applied for a new public key registration, calculate a hash value of the public key certificate to be newly created based on the contents of the public key registration application,
6. The public key certificate creating program according to claim 5 , wherein the calculated hash value of the public key certificate is stored in the newly created public key certificate. A program recording medium on which the program according to claim 5 or 6 is recorded.

Images