JP7283614B1 - Certification authority management system, certification authority management method, and program - Google Patents

Abstract

Kind Code: A1 To provide a certificate authority management device that enables a certificate authority to issue certificate information without relying on an API provided by the certificate authority. A request for certificate authority generated data generated by a certificate authority, a request receiving unit for receiving a request from another device, and a module associated with the certificate authority, the certificate authority generated data A certification authority management device comprising a module selection unit that selects a module that executes a procedure for acquiring from a certification authority, and a data transmission unit that transmits certification authority generated data acquired by the selected module to another device be. [Selection drawing] Fig. 1

Description

The present invention relates to a certificate authority management system , a certificate authority management method, and a program.

Conventionally, there is a certificate issuance method for the purpose of making it possible to issue certificate information even from a certificate authority that has not received the issuance of electronic certificate information (see Patent Document 1). In this certificate issuance method, first, the end entity sends the examination certificate information issued by the first certificate authority to the certificate issuance requesting device together with the issuance request for the certificate authority certificate information. The certificate issuance requesting device trusts the examination certificate information transmitted by the end entity and requests the second certificate authority to issue certificate authority certificate information. The second certificate authority trusts the certificate issuance requesting device and issues certificate authority certificate information based on the request of the certificate issuance requesting device.

Japanese Patent Application Laid-Open No. 2007-028061

However, in the conventional certificate issuance method, the certificate issuance requesting device only holds a URL (Universal Resource Locator) as information of the connection destination of the second certificate authority. There is a problem that connection may not be possible depending on the (Application Programming Interface).

The present invention has been made in view of such circumstances, and provides a certificate authority management system, a certificate authority management method, and a certificate authority management system that enable the certification information to be issued from the certification authority without relying on the API provided by the certification authority. and provide programs.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-described problems, and one aspect of the present invention is a request for certificate authority generated data generated by a certificate authority, which receives a request from another device. a module selection unit that selects a module that is associated with the certification authority and executes a procedure for acquiring the certification authority generated data from the certification authority; and a data transmission unit that transmits the certification authority generated data to the other device.

Further, another aspect of the present invention is the certificate authority management device described above, wherein the request includes information indicating the certificate authority, and the certificate authority manages the management certificate authority based on the information indicating the certificate authority. or an external certification authority, and when it is determined that the certification authority is an external certification authority, the module selection unit is instructed to select a module associated with the certification authority. It has a station judgment section.

Another aspect of the present invention is the certificate authority management device described above, wherein the request includes information indicating the certificate authority, and is associated with the certificate authority based on the information indicating the certificate authority. determining whether or not there is a module associated with the certification authority, and instructing the module selection unit to select a module associated with the certification authority when it is determined that there is a module associated with the certification authority It has a station judgment section.

Another aspect of the present invention is the certificate authority management device described above, wherein the certificate authority generation data includes an electronic certificate or a certificate revocation list.

Another aspect of the present invention is a certificate authority management method by a certificate authority management device, which is a request for certificate authority generated data generated by a certificate authority, the process of receiving a request from another device. selecting a module associated with the certification authority and executing a procedure for acquiring the certification authority generated data from the certification authority; and the certification authority acquired by the selected module. and transmitting the generated data to the other device.

Another aspect of the present invention provides a computer, a request receiving unit for receiving a request for certificate authority generated data generated by a certificate authority and a request from another device, and a request receiving unit associated with the certificate authority. a module selection unit that selects a module that executes a procedure for acquiring the certification authority generated data from the certification authority; It is a program for functioning as a data transmission unit that transmits data to.

According to this invention, it is possible to issue certificate information from the certificate authority without relying on the API provided by the certificate authority.

1 is a schematic block diagram showing the configuration of a certificate authority management system 100 according to a first embodiment of the invention; FIG. 2 is a schematic block diagram showing the configuration of a certificate authority management device 20 according to the same embodiment; FIG. It is a table showing an example of contents stored in a connection information storage unit 202 in the same embodiment. 4 is a flowchart for explaining the operation of the certificate authority management system 100 in the embodiment; It is a sequence diagram showing a first example of an authentication procedure in the same embodiment. It is a sequence diagram showing a second example of the authentication procedure in the same embodiment. FIG. 4 is a schematic block diagram showing the configuration of a certificate authority management system 100a according to a second embodiment of the present invention; FIG. 4 is a table showing an example of a correspondence relationship between a client device 10a and a certificate authority stored by a front end 21 in the embodiment;

<First Embodiment>
A first embodiment of the present invention will be described below with reference to the drawings. FIG. 1 is a schematic block diagram showing the configuration of a certificate authority management system 100 according to the first embodiment of the invention. The certificate authority management system 100 includes one or more client devices 10 , a certificate authority management device 20 , one or more management certificate authorities 30 , one or more external certificate authorities 40 , and a network 50 . The certificate authority management system 100 transmits certificate authority generated data such as electronic certificates and certificate revocation lists generated by the management certificate authority 30 or the external certificate authority 40 to the client device 10 via the certificate authority management device 20. can be distributed. As a result, if the client device 10 has been authenticated by the certificate authority management device 20, the client device 10 can receive the certificate authority generated data from the management certificate authority 30 or the external certificate authority 40 regardless of whether it is authenticated by these certificate authorities. can be obtained without The external certification authority 40 may be a private certification authority or a public certification authority.

The client device 10 is a computer that requires certification authority-generated data, and includes IoT (Internet of Things) devices (devices that can connect to the Internet, such as IoT sensor devices, smart speakers, and automobiles), smartphones, tablet terminals, and personal computers. , a server machine, or the like. The client device 10 is communicably connected to the certificate authority management device 20 via the network 50 . The client device 10 transmits a request for certificate authority generated data to the certificate authority management device 20 and receives certificate authority generated data as a response. The request for certificate authority generated data includes CA_id, which is information indicating the certificate authority. In addition, this request is a CSR (Certificate Signing Request) and similar information, information indicating the requested certificate authority generated data, such as a client certificate, a server certificate, a data signature certificate, a program verification certificate, It may also contain information indicating any such as a certificate revocation list. This request may also include any of authentication information, connection protocol information, connection destination URL, and various input parameters for connecting to the management certification authority 30 or the external certification authority 40 . Which information is included in this request may depend on the specifications of the certificate authority to which the request is made.

The certificate authority management device 20 is implemented by one or more computers executing software. The certificate authority management device 20 is communicably connected to the client device 10 and the external certificate authority 40 via the network 50 . The certificate authority management device 20 is communicably connected to the management certificate authority 30 by means (not shown) different from the network 50 or the network 50 . The certificate authority management device 20 receives a request for certificate authority generated data from the client device 10 . The certificate authority management device 20 acquires certificate authority generation data from the management certificate authority 30 or the external certificate authority 40 corresponding to the CA_id included in the received request, and transmits it to the client device 10 .

The management certification authority 30 is a certification authority managed and operated by an organization that manages and operates the certification authority management device 20, and issues certificates, certificate revocation lists, etc. via the certification authority management device 20. conduct. The external certificate authority 40 is a certificate authority managed and operated by an organization different from the organization that manages and operates the certificate authority management device 20. can be different. Network 50 is a network such as the Internet.

FIG. 2 is a schematic block diagram showing the configuration of the certificate authority management device 20 according to this embodiment. The certificate authority management device 20 includes a request reception unit 201, a connection information storage unit 202, a CA judgment unit (certification authority judgment unit) 203, a management certificate authority connection unit 204, a data transmission unit 205, a module selection unit 206, and a module execution unit 207. , and a module storage unit 208 . The request receiving unit 201 receives a request from the client device 10 for certification authority generated data. The connection information storage unit 202 stores the connection information of the certificate authority of the CA_id in association with the CA_id. The connection information is information identifying whether the certification authority is the management certification authority 30 or the external certification authority 40, and if it is the external certification authority 40, the certification authority generated data is acquired from the external certification authority 40. contains information indicating which module performs the procedure to This module may be a script such as JAVASCRIPT (registered trademark) or an executable file.

The CA determination unit 203 reads the connection information associated with the CA_id included in the request received by the request reception unit 201 from the connection information storage unit 202, and using the read connection information, the certificate authority of the CA_id manages the It is determined whether it is the certification authority 30 or the external certification authority 40 . When the CA determination unit 203 determines that the CA_id certificate authority is the management certification authority 30, it instructs the management certification authority connection unit 204 to acquire the certification authority generated data. Further, when the CA determination unit 203 determines that the certificate authority of CA_id is the external certificate authority 40, it instructs the module selection unit 206 to select a module associated with the certificate authority. When the CA determination unit 203 determines that the CA_id certificate authority included in the request received by the request receiving unit 201 is the management certificate authority 30, the management certificate authority connection unit 204 receives authentication from the management certificate authority 30 of the CA_id. Get station generated data.

When the CA determination unit 203 determines that the CA_id certificate authority included in the request received by the request reception unit 201 is the external certificate authority 40, the module selection unit 206 selects the module associated with the CA_id certificate authority. is selected, and the module execution unit 207 is instructed to execute the module. Note that the module associated with the CA_id certificate authority is the module indicated by the connection information associated with the CA_id. Select a module. A module associated with a certification authority is an API provided by the certification authority, and executes a procedure according to the API for acquiring certification authority generated data from the certification authority. As a result, the certificate authority generated data can be obtained even if the procedure is unique to the certificate authority.

The module execution unit 207 reads the module instructed to be executed by the module selection unit 206 from the module storage unit 208 and executes it. The module execution unit 207 acquires certificate authority generated data from the external certificate authority 40 by executing the module. When the request received by the request receiving unit 201 contains authentication information, connection protocol information, connection destination URL, various input parameters, etc., the module executed by the module executing unit 207 receives the certificate from the external certificate authority 40 . These pieces of information may be used when obtaining generated data. The data transmission unit 205 transmits the CA generation data acquired by the management CA connection unit 204 or the module execution unit 207 to the client device 10 as a response to the request received by the request reception unit 201 .

Note that the CA determination unit 203 reads the connection information associated with the CA_id included in the request received by the request reception unit 201 from the connection information storage unit 202, and uses the read connection information to identify the certificate authority of the CA_id. It may be determined whether there is a module associated with . When the CA determination unit 203 determines that there is no module associated with the CA_id certificate authority, it instructs the management certificate authority connection unit 204 to acquire certificate authority generated data. Further, when the CA determination unit 203 determines that there is a module associated with the CA_id certificate authority, it instructs the module selection unit 206 to select the module associated with the certificate authority. Also, in this case, the connection information includes, if there is a module associated with the certification authority, information indicating the module that executes the procedure for acquiring the certification authority generated data from the external certification authority 40 . As a result, regardless of whether the certificate authority is the management certificate authority 30 or the external certificate authority 40, it is possible to acquire certificate authority generated data using the module.

FIG. 3 is a table showing an example of contents stored in the connection information storage unit 202 in this embodiment. The connection information storage unit 202 stores connection information in association with CA_id. In the example of FIG. 3, the connection information includes the item "management CA" and the item "connection module". The item “management CA” is information indicating the management certification authority 30 of the CA_id associated with the connection information, and is information for calling the management certification authority 30 . The item “management CA” may be identification information of the management certification authority 30 or may be the URL of the management certification authority 30 . Also, if the management certification authority 30 is installed on the same computer as the certification authority management device 20, the file name of the program for causing the computer to function as the management certification authority 30 may be used.

The item "connection module" is information indicating a module that executes a procedure for acquiring certificate authority generated data from the external certificate authority 40 of the CA_id associated with the connection information, and is information for calling the module. be. The item "connection module" may be the identification information of the module or the file name of the module.

In the example of FIG. 3, the value "management CA0001" of the item "management CA" is stored as the connection information in association with the value "0001" of the item "CA_id", but the item "connection module" has no value. . This indicates that the CA whose CA_id is "0001" is the management certification authority 30, and the information indicating the management certification authority 30 is "management CA0001". Similarly, the value "management CA0003" of the item "management CA" is stored as connection information in association with the value "0003" of the item "CA_id", but the connection module has no value. This indicates that the CA whose CA_id is "0003" is the management certification authority 30, and the information indicating the management certification authority 30 is "management CA0003".

Also, the value "module 0004" of the item "connection module" is stored as connection information in association with the value "0004" of the item "CA_id", but the item "management CA" has no value. This indicates that the certificate authority with CA_id "0004" is the external certificate authority 40, and the information indicating the external certificate authority 40 is "module 0004". Similarly, the value "module 0008" of the item "connection module" is stored as connection information in association with the value "0008" of the item "CA_id", but the item "management CA" has no value. This indicates that the certificate authority with CA_id "0008" is the external certificate authority 40, and the information indicating the external certificate authority 40 is "module 0008".

Thus, in the example of FIG. 3, which of the item "management CA" and the item "connection module" has a value indicates which of the management certificate authority 30 and the external certificate authority 40. ing. Note that the connection information may include information explicitly indicating which of the management certification authority 30 and the external certification authority 40 .

FIG. 4 is a flow chart for explaining the operation of the certificate authority management system 100 in this embodiment. First, authentication is performed between the client device 10 and the CA management function unit 210 of the certificate authority management device 20 (sequence S1). This authentication may be authentication of the client device 10 by the certificate authority management device 20, or may be mutual authentication.

Next, the client device 10 transmits a request for certificate authority generated data to the certificate authority management device 20 (sequence S2). Upon receiving this request, CA management function unit 210 of certificate authority management device 20 reads connection information associated with CA_id included in the request from connection information storage unit 202 (sequence S3). The CA management function unit 210 refers to the read connection information and determines whether the CA_id certificate authority included in the request sent in sequence S2 is the management certificate authority 30 or the external certificate authority 40 . If it is the external certification authority 40, the sequence S4a is performed, and if it is the management certification authority 30, the sequence S4b is performed.

Sequence S4a includes sequence Sa1 to sequence Sa6. In sequence S4a, first, the CA management function unit 210 instructs the module execution unit 207 to execute the module indicated by the connection information read out in sequence S3 (sequence Sa1). The module execution unit 207 reads the instructed module from the module storage unit 208 and executes it (sequence Sa2). By executing the module, the module execution unit 207 authenticates with the external certificate authority 40 corresponding to the module (sequence Sa3). This authentication may be authentication of the certificate authority management device 20 by the external certificate authority 40, or may be mutual authentication.

The module execution unit 207 executing the module requests certificate authority generated data from the external certificate authority 40 (sequence Sa4), and acquires the certificate authority generated data transmitted as a response (sequence Sa5). The procedures, protocols, etc. of these sequences Sa3, Sa4, and Sa5 correspond to the external certification authority 40 and are defined by modules. The module execution unit 207 passes the acquired certificate authority generation data to the CA management function unit 210 (sequence Sa6).

Sequence S4b includes sequence Sb1 and sequence Sb2. In sequence S4b, the CA management function unit 210 requests certificate authority generated data from the management certificate authority 30 indicated by the connection information read out in sequence S3 (sequence Sb1), and acquires the transmitted certificate authority generated data as a response. (Sequence Sb2).

After sequence S4a or sequence S4b, the CA management function unit 210 transmits the acquired certificate authority generated data to the client device 10 as a response to the request of sequence S2 (sequence S5).

FIG. 5 is a sequence diagram showing a first example of an authentication procedure in this embodiment. The authentication procedure in FIG. 5 is a procedure for B device 600 to authenticate A device 500, and can be used in sequences S1 and Sa3 in FIG. For example, in the sequence S<b>1 in which the certificate authority management device 20 authenticates the client device 10 , the certificate authority management device 20 corresponds to the B device 600 and the client device 10 corresponds to the A device 500 .

In the sequence shown in FIG. 5, first, device B 600 generates a challenge code (sequence Sc1). The challenge code is, for example, a random number, preferably a different value each time. Device B 600 transmits the generated challenge code to device A 500 (sequence Sc2). Device A 500 encrypts the received challenge code with the key it holds (sequence Sc3). This key may be a common key between A device 500 and B device 600 or may be a secret key of A device 500 .

A device 500 transmits the encrypted challenge code to B device 600 (sequence Sc4). Device B 600 receives the encrypted challenge code sent in sequence Sc4 and decrypts it with the key it holds. This key is a key corresponding to the key used in sequence Sc3, and is a common key of A device 500 and B device 600 or a public key of A device 500. FIG. Device B 600 compares the decryption result with the challenge code generated in sequence Sc1, and if they match, determines that device A 500 has been successfully authenticated (sequence Sc5).

FIG. 6 is a sequence diagram showing a second example of the authentication procedure in this embodiment. The authentication procedure in FIG. 6 is a procedure for mutually authenticating the A device 500 and the B device 600, and can be used in the sequences S1 and Sa3 in FIG. For example, in sequence S1, when the client device 10 and the certificate authority management device 20 mutually authenticate, one of the client device 10 and the certificate authority management device 20 corresponds to the A device 500, and the other corresponds to the B device 600. . Sequences Sc1 to Sc5 in FIG. 6 are the same as those in FIG. 5, so description thereof will be omitted. After sequence Sc5, device B 600 encrypts the challenge code generated in sequence Sc1 with the retained key (sequence Sc6). This key may be a common key between A device 500 and B device 600 or may be a private key of B device 600 .

B device 600 transmits the encrypted challenge code to A device 500 (sequence Sc7). Device A 500 receives the encrypted challenge code sent in sequence Sc7 and decrypts it with the key it holds. This key is a key corresponding to the key used in sequence Sc6, and is a common key of A device 500 and B device 600 or a public key of B device 600. FIG. Device A 500 compares the decryption result with the challenge code received in sequence Sc2, and if they match, determines that device B 600 has been successfully authenticated (sequence Sc8).

As described above, the certificate authority management device 20 in this embodiment includes the request reception unit 201 , the module selection unit 206 and the data transmission unit 205 . The request receiving unit 201 receives a request for certification authority-generated data generated by a certification authority, which is a request from another device. The module selection unit 206 selects a module that is associated with a certification authority and executes a procedure for acquiring certification authority generated data from the certification authority. A data transmission unit 205 transmits the certificate authority generated data acquired by the selected module to another device. As a result, when acquiring CA-generated data from a CA, modules corresponding to each CA can be used. , the certificate authority management device 20 can acquire the certificate authority generated data.

<Second embodiment>
In the first embodiment, the request for certificate authority generated data transmitted by the client device 10 includes information indicating the certificate authority. In the second embodiment, a front end 21 is arranged between the client device 10 a and the certificate authority management device 20 . The request for certificate authority generation data transmitted by the client device 10a does not include information indicating the certificate authority, and the front end 21 selects a certificate authority corresponding to the client device 10a.

FIG. 7 is a schematic block diagram showing the configuration of a certificate authority management system 100a according to the second embodiment of the invention. Certificate authority management system 100 a includes one or more client devices 10 a , certificate authority management device 20 a , front end 21 , management certificate authority 30 , external certificate authority 40 and network 50 . In FIG. 7, parts corresponding to those in FIG. 1 are denoted by the same reference numerals, and descriptions thereof are omitted. The client device 10a is similar to the client device 10 of FIG. 1, but does not include information indicating the certificate authority in the request for certificate authority generated data.

The front end 21 is arranged between the client device 10a and the certificate authority management device 20a. The front end 21 is, for example, a front end for a plurality of services including services provided by the certificate authority management device 20a. Note that the front end 21 and the certificate authority management device 20a may be connected to the network 50, and the front end 21 may be arranged between the client device 10a and the certificate authority management device 20a in a logical connection. . The front end 21 distributes a request from the client device 10a to a service device according to the content of the request.

The front end 21 also stores the correspondence between the client device 10a and the certificate authorities. Upon receiving a request for certificate authority generated data from the client device 10a, the front end 21 transmits the request to the certificate authority management device 20 together with information indicating the certificate authority associated with the client device 10a. The certificate authority management device 20a communicates with the client device 10a via the front end 21, but otherwise is the same as the certificate authority management device 20 of FIG. The certificate authority management device 20a may not authenticate the client device 10a, and the front end 21 may authenticate the client device 10a.

FIG. 8 is a table showing an example of the correspondence relationship between the client device 10a and the certificate authority stored by the front end 21 in this embodiment. As shown in FIG. 8, the front end 21 associates and stores Device_id, which is the identification information of the client device 10a, and CA_id, which is the identification information of the certificate authority. In the example of FIG. 8, the CA_id value “0001” is stored in association with the Device_id value “01010”, the CA_id value “0003” is stored in association with the Device_id value “01021”, and the Device_id value “0003” is stored. The CA_id value "0001" is stored in association with the value "03215".

In this embodiment, as in the first embodiment, even if the procedure for acquiring certificate authority generated data from the certificate authority differs depending on the certificate authority, the certificate authority management device 20a acquires the certificate authority generated data. be able to.

In each of the above-described embodiments, the external certificate authority 40 has been described as being a certificate authority managed and operated by an organization different from the organization that manages and operates the certificate authority management device 20. It may be a certification authority managed and operated by an organization that manages and operates the device 20 .

Also, a program for realizing the functions of the certificate authority management devices 20 and 20a shown in FIGS. 1 and 2 is recorded in a computer-readable recording medium, and the program recorded in the recording medium is read into a computer system, The certificate authority management devices 20 and 20a may be realized by executing them. It should be noted that the "computer system" referred to here includes hardware such as an OS and peripheral devices.

The term "computer-readable recording medium" refers to portable media such as flexible discs, magneto-optical discs, ROMs and CD-ROMs, and storage devices such as hard discs incorporated in computer systems. Furthermore, "computer-readable recording medium" refers to a program that dynamically retains programs for a short period of time, like a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line. It also includes those that hold programs for a certain period of time, such as volatile memories inside computer systems that serve as servers and clients in that case. Further, the program may be for realizing part of the functions described above, or may be capable of realizing the functions described above in combination with a program already recorded in the computer system.

Although the embodiment of this invention has been described in detail with reference to the drawings, the specific configuration is not limited to this embodiment, and design changes and the like are included within the scope of the invention.

10, 10a client device 20, 20a certificate authority management device 21 front end 30 management certification authority 40 external certification authority 50 network 100 certification authority management system 201 request reception unit 202 connection information storage unit 203 CA determination unit 204 management certification authority connection unit 205 Data transmission unit 206 Module selection unit 207 Module execution unit 208 Module storage unit 210 CA management function unit

Claims (6)

A certificate authority management system comprising a front end and a certificate authority management device,
The front end stores in advance a correspondence between another device and a certification authority, receives a request for certification authority generated data generated by the certification authority, and receives a request from the other device, transmitting the request to the certificate authority management device together with information indicating the certificate authority associated with the other device by attachment ;
The certificate authority management device
a request receiving unit that receives the request and information indicating the certificate authority from the front end;
a module selection unit that selects a module that is associated with the certification authority indicated by the information and executes a procedure for acquiring the certification authority generated data from the certification authority indicated by the information;
A certification authority management system, comprising: a data transmission unit that transmits the certification authority generated data acquired by the selected module to the other device. The certificate authority management device
Based on the information indicating the certification authority, it is determined whether the certification authority is a management certification authority or an external certification authority, and when it is determined that the certification authority is an external certification authority, the module selection unit a certification authority determination unit that instructs execution of selection of a module associated with the certification authority;
The certificate authority management system according to claim 1. The certificate authority management device
Based on the information indicating the certification authority, it is determined whether or not there is a module associated with the certification authority, and when it is determined that there is a module associated with the certification authority, the module selection unit A certificate authority determination unit that instructs execution of selection of a module associated with a certificate authority,
The certificate authority management system according to claim 1. 4. The certificate authority management system according to any one of claims 1 to 3, wherein said certificate authority generated data includes an electronic certificate or a certificate revocation list. A certificate authority management method by a certificate authority management system comprising a front end and a certificate authority management device,
A front end receives a request for certification authority generated data generated by a certification authority, receives a request from another device, and uses the previously stored correspondence between the other device and the certification authority to sending the request to the certificate authority management device along with information indicating the certificate authority associated with the device of
a process in which the certificate authority management device receives the request and information indicating the certificate authority from the front end;
a step in which the certification authority management device selects a module associated with the certification authority indicated by the information and executing a procedure for acquiring the certification authority generated data from the certification authority indicated by the information;
A certificate authority management method, comprising: sending the certificate authority generated data acquired by the selected module to the other device. the computer,
a request for certificate authority generated data generated by said certificate authority, receiving a request from said other device, and receiving said other device according to said correspondence; a front end that sends the request along with information indicating the certificate authority associated with the device;
a request receiving unit that receives the request and information indicating the certification authority;
A module selection unit that selects a module that is associated with the certification authority indicated by the information and executes a procedure for acquiring the certification authority generated data from the certification authority indicated by the information;
A program for functioning as a data transmission unit that transmits the certification authority generated data acquired by the selected module to the other device.

Images