System and method for cross directory authentication in public key infrastructure

Description: TECHNICAL FIELD [Detailed description of the invention]

【0001】

[Technical field to which the invention belongs]

The present invention relates to a public key infrastructure (PKI) and, more specifically, to mutual directory authentication in a PKI.

【0002】

[Conventional technology]

This application claims priority to US Patent Provisional Application No. 60 / 210,461 filed June 9, 2000, and US Patent Provisional Application No. 60 / 229,336 filed September 1, 2000. The contents are incorporated herein by reference.

【0003】

Public Key Infrastructure (PKI) distributes and manages thousands of unique public / private cryptographic keys to an organization, company or company, allowing users to trust the identity of the owner of each public / private key pair. It is a collection of servers and software that enables high-quality judgment. If each member of the enterprise has a unique key, the paper-based business process can be transitioned to an online electronic equivalent. The public / private key pair has the property that for any given public key, there is only one private key and vice versa. Public key cryptography (ie, the ability to publicly distribute cryptographic keys) allows documents to be digitally signed. If one member of the key pair can be used to decrypt a particular message, it can be assumed that the message must have been encrypted using the other member. Assuming that only one person knows the key that was initially used to encrypt the document, the recipient who can decrypt the document must be the sender of the document. I can be sure that there is no such thing.

【0004】

However, in order for a digital signature to be significant, the recipient of the object on which the digital signature is signed must first determine its owner and the integrity of the key used to sign the object. You must be able to judge with high reliability. Public infrastructure accomplishes this with electronic documents called digital authentication. The authentication can include information that identifies the owner of the key pair, the public part of the key pair, and the time period during which the authentication is valid. Authentication can also identify technical information about the key itself, such as the algorithm used to generate the key, the length of the key, and so on. It is the organization, company, or company that generates the certificate, which is responsible for verifying the identity of the individual (or possibly the organization) for which the certificate is issued. The certification organization is known as a certificate authority. The certificate authority signs each certificate using a public key known only to the certificate authority itself. This allows PKI users to verify both the integrity of the authentication and the identity of the station that issued it. By issuing the certificate, the certificate authority states that it has verified that the public key (further, the corresponding private key) found within the certificate belongs to the individual listed within the certificate. .. Therefore, the integrity of the registration process in operation is very important. This process must provide a mechanism to reliably identify an individual and to verify that the public key listed in the certificate belongs to that individual.

【0005】

FIG. 1 is a block diagram showing an example of a PKI system architecture. The current PKI, which provides strong authentication of user identity, is responsible for achieving this with the local registration authority (LRAO). officer) 12 is used. LRAO12 runs on a workstation or server platform 14 running the local registry software application 16. The server platform 14 may be any known computer capable of functioning as a server, and examples thereof include a computer and a workstation. The local registrar application 16 interfaces with other server platforms that include applications such as certificate authority application 18, registrar application 20, and / or key recovery authority application 22. Each application may be on the same server flat form or on a separate individual server platform 14. User 10 accesses the system through a web browser 22 on the client platform 24 if he / she is using or wants to access the PKI system architecture. A hardware token 26, such as a smart card, may be operationally connectable to the client platform 24. Typically, in the current system, the user 10 presents the photo ID to the local registrant officer 12 to authenticate the user's identity. The local registrant officer 12 then uses workstation 14 and the local registrant application 16 to instruct the registrant application 20 to register a new user 10 in the system. The local registration authority application 16 can be a commercially available software product typically bundled with certificate authority application 18, registration authority application 20, and key recovery authority 22 software.

【0006】

It is either the Local Registry Application 16 or the Registry Application 20 that generates the public / private key pair (depending on the product selected and how they are configured). The public key is sent to the certificate authority application 18 to be signed, thereby generating an authentication for the new user 10. A backup copy of the private key can also be sent to the key recovery station application 22, but the private key is typically held on token 26 or by user 10 on client platform 24. Once the public key is sent to Certificate Authority 18 and signed, user authentication is generated and supplied to the local Registration Authority server. The Local Registry Officer 12 copies the authentication (including the private key) onto a floppy disk, hardware token, or other storage medium, and then gives the user the authentication and private key.

【0007】

Individual companies use different PKIs. For example, if Company A wants to grant access to a server that is part of Company A's PKI for a user from a different company, eg Company B, Server A will identify the user from Company B. Unable to authenticate. This is because the user from company B is not a part of company A's PKI, but presents the signature authentication from company B's PKI and asks for authentication.

【0008】

Currently, a process called cross-certification is used to allow a large number of companies to coordinate certifications between specific company PKIs. In the current system, the certificate authority from the 1st PKI signs the public key of the certificate authority from the 2nd PKI. Similarly, the certificate authority from the 2nd PKI signs the public key of the certificate authority from the 1st PKI. Then, when the user or server in the PKI of the first company receives the signature authentication from the user from the PKI of the second company, the signature authentication of the user from the PKI of the second company is signed by the signing authority from the first company. Will be done. Usually, the user or server from the first company does not know whether or not the signature authentication from the second company can be trusted. This is because the signature authentication is from a different PKI. However, since the signature from the certificate authority from the second company is itself signed by the certificate authority from the first company, the user and server from the first company are authenticated in the signature authentication from the second company. The signature of the station turns out to be reliable.

【0009】

[Problems to be Solved by the Invention]

However, such current systems have the problem that they cannot be scaled up well. For example, if there are N PKIs, then N²Individual mutual authentication signatures must be made. Therefore, within the network of the first company, it is necessary to enable the first company to authenticate the identity of the user from the second company.

【0010】

[Means for solving problems]

The present invention relates to a mutual directory authentication method in a public key infrastructure (PKI), and is a step of configuring a first directory so as to inquire the second directory when receiving an inquiry about signature authentication from the PKI of a second company. The first directory is part of the first company's PKI, the second directory is part of the second company's PKI, the step and the step in which the user attempts to access the server, and the server is the first. It is a part of one company's PKI, and the user presents the signature authentication from the second company PKI to the server, asks for authentication, and sends a query from the server to the first directory, allowing the user to access the server. A step of determining whether or not the user has been authenticated, a step of sending an inquiry from the first directory to the second directory and determining whether or not the user is a member of the second company PKI, and a step of determining whether or not the user is a member of the second company PKI. If a member, the first directory includes a step of notifying the server that the user is allowed access to the server.

【0011】

The present invention also relates to a mutual directory authentication system in a public key infrastructure (PKI). One or more servers are part of the PKI of the first company. One or more client platforms can be used for at least one user to request access to at least one server. The second directory contains information about users who have signature authentication for the second company's PKI. The second directory is part of the second company PKI. The first directory sends an inquiry to the second directory when it receives an inquiry from the server regarding the signature authentication for the PKI of the second company received from one user for authentication on at least one server. Inquiries from the server are sent to the first directory to determine if the user is allowed access to the server. The first directory is part of the first company's PKI. Inquiries sent from the first directory to the second directory are sent to determine whether the user is a member of the PKI of the second company. The first directory notifies the server that the user is authorized to access the server if the user is a member of the second company PKI. The first directory and / or server can be configured to have access to the server and information about users with signature authentication from a second company PKI.

【0012】

Further, the present invention relates to an article composed of a storage medium in which an instruction is stored, and when these instructions are executed, the processing apparatus receives an inquiry regarding signature authentication for a second company's PKI, and the processing apparatus queries the directory. The step of receiving the configuration information to send, the processing device is part of the first company PKI, and the directory is part of the second PKI, and whether the user is allowed access to the server. Whether or not the user is a member of the PKI of the second company by sending the inquiry to the step and the directory, which is the step of receiving the inquiry from the server and the server is a part of the PKI of the first company. If the user is a member of the PKI of the second company, the step of determining whether or not the server is executed and the step of notifying the server that access to the server is permitted are executed.

【0013】

In the following detailed description, the present invention will be described in more detail with reference to a plurality of representative drawings with reference to examples of non-limiting embodiments of the present invention. In the drawings, similar reference numbers shall represent similar parts throughout.

【0014】

BEST MODE FOR CARRYING OUT THE INVENTION

The specific matters shown below are merely examples, and an object of the present invention is to exemplify an embodiment of the present invention. By explaining with reference to the drawings, it will be clear to those skilled in the art how the present invention is actually embodied.

【0015】

Further, in order to avoid obscuring the present invention, and in consideration of the fact that the specific matters concerning the implementation of such a block diagram configuration are highly dependent on the platform on which the present invention is implemented, the configuration is configured as a block diagram. Shown in form. That is, the specific matters should be within the range that can be understood by those skilled in the art. When specific details (eg, circuits, flowcharts) are specified to illustrate examples of embodiments of the invention, it will be appreciated by those skilled in the art that the invention is feasible without these specific details. Is an obvious invention. Finally, any combination of hard wire circuits and software instructions can be used to implement embodiments of the invention, i.e. the invention is specific to any of the hardware circuits and software instructions. It is also clear that it is not limited to combinations.

【0016】

In explaining an example of the embodiment of the present invention, an example of a system block diagram in an example of a host unit environment will be used, but the implementation of the present invention is not limited to this. That is, the present invention can be implemented using other types of systems and in other types of environments (eg, servers).

【0017】

When referring to "one embodiment" or "embodiment" in the specification, it means that the specific function, structure, or property described with respect to the embodiment is included in at least one embodiment of the present invention. The appearance of the phrase "in one embodiment" in various places in the specification does not necessarily mean all the same embodiments.

【0018】

FIG. 2 shows a block diagram of Example 100 of a system architecture capable of implementing a public key infrastructure (PKI) process according to an example of an embodiment of the present invention. The present invention is not limited to the system architecture 100 shown in FIG. The box shown in FIG. 2 represents an entity that can be hardware, software, or a combination of both. The entities are operationally connected to each other on the network. Entities that are not shown to be connected to the network represent one or more people performing the functions shown in the box.

【0019】

System architecture 100 includes data entry 102 that performs the data entry function of the authoritative database 104. The base database 104 resides on server platform 106. Although this specification refers to server platform 106, it should be understood that the invention is not limited to any particular server architecture. Server platform 106 can be, for example, a UNIX (R) or Windows (R) NT server.

【0020】

The basic database 104 contains information about members of a group or company (eg, a company) capable of performing the PKI services according to the invention. The present invention is not limited to the structure of a group or company that stores information in the basic database 104. The information contained in the basic database 104 can include, for example, the names, addresses, telephone numbers, boss names, employee identifications, etc. of members of the group or company. Directory 108 contains the same information that is stored in database 104, but is optimized for fast references to internally stored data rather than fast data input. The information contained in directory 108 can be accessed faster than the information from database 104. Directory 108 functions like a fast-accessible online telephone directory that contains reference information about group or company members stored in the base database 104.

【0021】

The certificate authority 110 may be conventional commercially available software that runs on the server platform 106. Certificate authority 110 stores authentication and related information. This will be described in more detail below. The registration authority 112 may also be commercially available software that can be executed on the server platform 106. The registration authority 112 will also be described in more detail below. The key recovery station 114 may also be commercially available server software that can run on server platform 106, with keys for group or corporate members (eg, stored or lost keys). Can be equipped with a function to restore.

【0022】

Windows (R) 2000 Domain Certificate Authority (CA) 116 is shown and connected to the network with a dotted line. This may or may not be part of the system according to the invention. Windows (R) 2000 can use PKI authentication for single sign-on on the network, but Windows (R) 2000 should only use Windows (R) Certificate Authority Windows (R) Is designed for. Therefore, the system according to the present invention may include not only the 2000 domain CA116 but also the conventional certificate authority 110.

【0023】

The legacy server 118 runs the legacy application program 120. Old-fashioned servers 118 can be, but are not limited to, mainframes, minicomputers, workstations, or other servers capable of running legacy (old-fashioned) software applications. Older software applications may generally not be designed to be essentially interoperable with PKIs. Older applications 120 may be made client-side accessible by a custom client 128, such as an emulator or custom database graphic user interface (GUI). Examples of emulators are IBM 3270 terminal emulators or vt100 terminal emulators.

【0024】

The registration web page 122 can be one or more pages and serves as a user interface to the system architecture 100 shown in FIG. A web server 124 is a software application that supports web pages (such as web page 122) or other HTML output to a web browser client (such as web browser 126). The web server 124 can be any software application that supports web pages or HTML output, such as Apache, Microsoft Internet Information Server applications, and so on.

【0025】

The web browser 126 resides on the client platform 128. Client platform 128 can be any user computer or computer. The web browser 126 may be a client software application that browses web pages, such as the THML protocol, XML protocol, or other protocol. Web browser 126 can be programmed to work with PKI certification issued by Certificate Authority 110. Examples of web browsers with this capability include Netscape Navigator and Microsoft Internt Explorer. Token 130 can be a smart card, a device with a universal serial bus (USB), or any other hardware token that can generate, store, and / or use PKI authentication.

【0026】

User 132 is someone who uses or wants access to System Architecture 100. User 132 can migrate through a number of states, including, for example, new users, current users, and old users. Old users are no longer members of a group or company. System architecture 100 is described with reference to two levels of security. Each level corresponds to different security requirements. The number of security levels is not limited to the present invention. Level 1 search engine 134 should be a search engine that is allowed to search system architecture 100, but only to access Level 1 data with the lowest security level. Can be done. Level 1 data is, for example, freely distributable data, while Level 2 data can be considered enterprise-specific. The level 2 search engine 136 can be a search engine that is allowed to search both level 1 and level 2 data. A level N search engine (not shown) can be a search engine that is allowed to search the entire server that processes data from level 1 to N.

【0027】

A protection level server with Level 1 data can be a web server containing only Level 1 data. Level 1 data is protected so that users must have (at least) Level 1 access to access Level 1 data. A protected web server with Level 2 data 140 can be a web server containing Level 2 data. Level 2 data is protected so that users must have at least Level 2 access to access Level 2 servers. Users with Level 2 access can access both Level 1 and Level 2 servers. A protected web server with Level N data (not shown) is a web server that houses Level N data accessible to Level N or higher users. Users of level N and above can access all data levels up to level N data.

【0028】

VPN Extranet 142 is a software application that acts as a network gateway. As shown, this leads to either the old server 118 and the old application 120, or an external network such as the Internet. The individual abolition authority 144 can be one or more persons engaged in the abolition of members from the system network 100. The individual registration authority 146 can be one or more persons engaged in the registration of members in the system network 100. The personal restoration approver 148 can be one or more persons engaged in obtaining the restoration of certification. The restore agent 150 can be one or more people who restore the authentication, and only needs to restore the authentication when the authentication is first designated as recoverable by another person. Personal role Approver (personal role) approval) 152 can be one or more people who approve different role functions within the system network 100. The web server (manager) administrator can be one or more people engaged in various web functions in the system network 100.

【0029】

The present invention relates to a mutual directory authentication system and method in which a directory in a first company PKI receives an inquiry relating to a user having signature authentication from a second company PKI. The directory in the first company queries the directory in the PKI of the second company to determine the validity of the user from the second company. The directory in the PKI of the first company (company A) has a directory entry for the user from the PKI of the second company (company B), and the PKI of the second company is one of the PKIs of the first company. You can access the above servers. The server that is part of the first company's PKI may contain some data that is unique to the first company, but has data hosted on the server (server A) from company A. A non-disclosure agreement can be entered into with Company B for some specific projects. Therefore, a user from Company B may need access to data on Server A, which is part of Company A.

【0030】

Different companies usually use different PKIs, so if Company A wants to give access to one or more of its servers to a user from Company B, the user from Company B once requests access to the server from Company A. If so, the server from company A sends a query to company A's directory (directory A) to authenticate the user's identity from company B. A directory in company A can contain directory entries for users from company B that may need access to servers in company A, so directory A is received by directory A in relation to users in company B. For all inquiries, it is programmed to query the directory from company B (directory B). Directory B determines whether the user is still a member of company B, and if it is a member, permits user B to access the server of company A in response to an inquiry from directory A. Answer. In addition, the directory A may be composed of all users who are allowed to access the server in the company A, and therefore the user from the company B is a member of the company B, but this user. May not be posted in Directory A as someone who has access to a particular server for Company A, which may deny access to that particular server.

【0031】

FIG. 3 shows a flowchart of an example of a mutual directory authentication process according to an example of the embodiment of the present invention. The directory in company A can be configured to query the directory in company B when it receives a PKI signature authentication inquiry from company B (S1). Company A's web server can be configured to allow Company B's users (who have Company B's PKI signature authentication) access to Company A's web server (S2). A user from Company B presents PKI authentication from Company B in an attempt to access Company A's web server (S3). Company A's web server queries Company A's directory and determines whether users from Company B are allowed access to the server (S4). Note that the directory of company A has the user signing authentication from the PKI of company B, and therefore queries the directory in company B to authenticate the user from company B (S5). The directory of company B determines whether or not the user is a member of company B, and confirms or denies that the user is a member of company B (S6). The directory of company B notifies the directory of company A accordingly. When the user is confirmed, the directory of company A notifies the web server of company A that the user from company B is allowed to access the server (S7). Then, if the web server from company A is configured to allow the user from company B to access this web server, the web server from company A will access the user from company B. Allow (S8).

【0032】

The mutual directory authentication system and method according to the present invention has the advantage of being less complex than the current mutual PKI authentication process. Further, the present invention has an advantage that even if the PKI is completely composed of the PKI of the company B, the present invention only allows access to data on a server shared with each other. Data residing on servers maintained by only one of the two companies is kept secure.

【0033】

It should be noted that the above examples are presented merely for the purpose of explanation and should never be construed as a limitation of the present invention. Although the present invention has been described with reference to preferred embodiments, it will be appreciated that the terms used herein are explanatory and exemplary terms and are not limiting terms. Within the scope of the claims, even after the present description and amendments, the embodiments may be modified without departing from the scope and spirit of the invention. Although the present invention has been described here with reference to specific methods, materials, and embodiments, the present invention is not intended to be limited to the specific matters disclosed herein, and the present invention is patentable. It extends to all functionally equivalent structures, methods and uses that fall within the claims.

[Simple explanation of drawings]

[Figure 1]

It is a block diagram of an example of a PKI system architecture.

[Figure 2]

It is a block diagram of an example of a system architecture in which a PKI process can be carried out according to an example of an embodiment of the present invention.

[Fig. 3]

It is a flowchart of the process example of mutual directory authentication in the public key infrastructure by an example of embodiment of this invention.

[Explanation of symbols]

100 system architecture 102 Data entry 104 Basic database 106 server platform 108 directory 110 Certificate Authority 112 Registration Bureau 114 Key Recovery Bureau 116 Domain Certificate Authority (CA)