Public key certificate searching apparatus, public key certificate searching method, computer program, and recording medium with computer program recorded thereon

Description: TECHNICAL FIELD [Detailed description of the invention]

【0001】

[Technical field to which the invention belongs]

The present invention records a public key certificate search device, a public key certificate search method, a computer program, and a computer program that can reliably search a public key certificate in various collation rules environments used in PKI. Regarding recording media.

【0002】

[Conventional technology]

In PKI (Public Key Infrastructure), a public key certificate that certifies a user's public key is issued by a certificate authority and stored in a computer system called a directory. The directory searches for the public key certificate in response to a search request from the business system used when the user performs business, and sends this to the search request source to enable verification of the user's signature. There is.

【0003】

FIG. 4 is a diagram for explaining a method of searching a public key certificate in a conventional directory. In FIG. 4, the public key certificate is abbreviated as a certificate.

【0004】

The certificate authority (CA) 2 generates a public key certificate based on the application from the user terminal 4 used by the user A, and sends the public key certificate to the user terminal 4 to which the application has been made. In addition, the owner name of the public key certificate is converted into the search label of the public key certificate by the conversion method according to the collation rule adopted by the CA. Then, the public key certificate and the search label are sent to the directory 100 and stored in association with each other.

【0005】

When CA2 registers a public key certificate, the user name that is the owner name of the public key certificate and the pre-registered registrant name are converted according to the collation rules and then collated and used. Performs various processes such as determining whether the person's name belongs to a new registrant or an existing registrant. In other words, the user name that becomes the owner name of the public key certificate is specified by DistinguishedName (DN) with various StringTypes such as PrintableString and UTF8String, so these can be converted by the collation rule adopted by the CA. It is collated after making it a unified format.

【0006】

By the way, when the user of the user terminal 4 uses the business system 3, a signature document including the signature of the user A is transmitted from the user terminal 4 to the business system 3, and the user name A is used. , Notified as the owner name of this user's public key certificate. The business system 3 sends this owner name as a search key to the directory 100 when requesting a search for a public key certificate.

【0007】

The directory 100 searches for the public key certificate corresponding to the same search label as this search key and sends it to the business system 3.

【0008】

The business system 3 can verify the signature of the signature document with this public key certificate, and when it reaches the trusted public key certificate of the business system 3 by verifying the path of the public key certificate, Allow use from user terminal 4. Therefore, the business system 3 can be used from the user terminal 4.

【0009】

By the way, typical collation rules adopted by CA are X.500 collation and RFC2459 collation, both of which are stipulated in RFC2459 as follows.

【0010】

[Number 1]

1) X.500 collation String type distinction: None Case sensitive: None Space normalization: Yes 2) RFC2459 collation String type distinction: Yes Case sensitive: None (for PrintableString) Yes (other than PrintableString) Space normalization: Yes (for PrintableString) None (other than PrintableString) here, String type distinction: Yes: If the StringType is different, it is considered different None: If the StringTypes are different, they are considered the same Case Sensitive: Yes: Consider the same case as different characters None: Consider the same uppercase and lowercase letters as the same letter Space normalization: Yes: If there are two or more spaces in between Consider one and remove the leading and trailing spaces None: Do nothing (do not normalize) Also, in RFC2253, "Applications that require DER-formatted reconstruction of values (that is, those that make string distinctions as shown in RFC2459) should not be accessed in strings, but in hexadecimal notation." It is stipulated.

【0011】

Therefore, if CA2 in Figure 4 employs X.500 collation, or if that CA employs RFC2459 collation and the string type of the owner name of the issued public key certificate is PrintableString. , This CA2 converts the owner name of the public key certificate of user A described above into a search label of the character string "A" and stores it in the directory 100. Then, the business system 3 also transmits the search key (A) of the character string to the directory 100 in the same manner. As described above, since the directory 100 searches for the public key certificate with this search key and sends it to the business system 3, the business system 3 can verify the signature document and the like.

【0012】

On the other hand, if RFC2459 verification is adopted and the string type of the owner name of the issued public key certificate is other than PrintableString, the owner name of the public key certificate is converted to a hexadecimal search label. A business system that stores in a directory and adopts such a collation rule sends a "character string" search key to this directory.

【0013】

Note that case-sensitivity and space normalization of character strings can be collated according to collation rules by performing them when they are stored in the directory by CA.

【0014】

[Problems to be Solved by the Invention]

However, in the PKI environment to which the above-mentioned conventional public key certificate search method is applied, the collation rule adopted by the CA cannot be recognized on the business system side, so the public key certificate is acquired in the business system. It may not be possible.

【0015】

That is, as shown in Fig. 4, when the character string "A" converted from the owner name A having the string type of UTA8String by CA2 adopting X.500 matching is the search label of the directory, the business system 3 If the directory is accessed with the hexadecimal search key "12020041" (12: string type indicating UTF8String, 02: string length, 0041: string "A") by the access method corresponding to RFC2459 matching, this directory 100 Cannot search for the desired public key certificate, and therefore business system 3 cannot obtain this public key certificate either.

【0016】

Therefore, the present invention has been made in view of the above-mentioned conventional problems, and an object thereof is used when a public key is registered with a certificate authority in various collation rule environments used in PKI. Public key certificate search device, public key certificate search method, which can solve the problem caused by the user (including business system) not being able to recognize the verification rule and can reliably search the public key certificate. The purpose is to provide a computer program and a recording medium on which the computer program is recorded.

【0017】

[Means for solving problems]

In order to solve the above-mentioned conventional problems, the present invention of claim 1 is a public key certificate in which a public key certificate and a search label converted from the owner name of the public key certificate are stored in association with each other. The public key certificate search device provided with a storage means and collating the search label of the public key certificate storage means with the search key to search for the public key certificate, is given when the public key certificate is searched. Matching the owner name of the key certificate used when the public key was registered at the certification authority and when the owner name of the public key certificate after registration was converted to the search label of the public key certificate. A public key certificate search device provided with a name conversion means for converting into a search key by a conversion method according to the collation rule information indicating the rule is used as a solution.

【0018】

The present invention of claim 2 is a collation rule information storage means for storing collation rule information transmitted from a certificate authority, and a collation rule information for extracting collation rule information from the collation rule information storage means at the time of conversion to a search key. The public key certificate search device according to claim 1, which includes an extraction means, is used as a solution.

【0019】

The present invention of claim 3 is a collation rule information storage means for storing collation rule information transmitted from a certificate authority and an account name indicating the certificate authority in association with each other, and the owner of the collation rule information when converting to a search key. The public key certificate search device according to claim 1, which includes a collation rule information extracting means for extracting collation rule information corresponding to an account name given together with a name from the collation rule information storage means, is used as a solution.

【0020】

The present invention according to claim 4 comprises the collation rule information setting means for setting the collation rule information transmitted from the certificate authority in the collation rule information storage means. And.

【0021】

The present invention of claim 5 is disclosed by each of the search keys converted from the owner name of the public key certificate given at the time of searching the public key certificate by a conversion method corresponding to each of a plurality of collation rule information. The public key certificate search device described in any one of claims 1 to 4 for searching the key certificate is used as a solution.

【0022】

The public key according to any one of claims 1 to 5, wherein the present invention of claim 6 includes a public key certificate spooling means for temporarily storing the public key certificate searched from the public key certificate storage means. A certificate search device is used as a solution.

【0023】

The present invention of claim 7 is a public key certificate search device including a public key certificate storage means in which a public key certificate and a search label converted from the owner name of the public key certificate are stored in association with each other. However, in the public key certificate search method when searching for a public key certificate by collating the search label of the public key certificate storage means with the search key, the public key given when searching for the public key certificate The collation rule used when the name of the owner of the certificate is registered at the certification authority and when the name of the owner of the public key certificate after registration is converted to the search label of the public key certificate. The solution is a public key certificate search method having a name conversion step of converting to a search key by a conversion method according to the collation rule information indicating.

【0024】

The public key certificate search according to claim 7, wherein the present invention of claim 8 includes a collation rule information extraction step for extracting collation rule information from a collation rule information storage means in which collation rule information transmitted from a certificate authority is stored. The method is the solution.

【0025】

In the present invention of claim 9, the collation rule information transmitted from the certificate authority and the account name indicating the certificate authority are associated with each other in the collation rule information storage means for storing the collation rule information transmitted from the certificate authority. Claim 7 comprising a collation rule information extraction step of extracting collation rule information corresponding to the account name given together with the owner name from the collation rule information storage means at the time of conversion to a search key when stored. The solution is to use the public key certificate search method described.

【0026】

The present invention of claim 10 is a solution by the public key certificate search method according to claim 8 or 9, further comprising a collation rule information setting step of setting collation rule information transmitted from a certificate authority to the collation rule information storage means. And.

【0027】

The invention of claim 11 searches the public key certificate with each of the search keys converted from the owner name of the public key certificate by the conversion method corresponding to each of the plurality of collation rule information. The solution is to use the public key certificate search method described in any of 10.

【0028】

The public key according to any one of claims 7 to 11, wherein the present invention of claim 12 includes a public key certificate spool stage for temporarily storing the public key certificate retrieved from the public key certificate storage means. The solution is to use the certificate search method.

【0029】

The present invention of claim 13 is a solution by means of a computer program for executing the method according to any one of claims 7 to 12.

【0030】

The present invention of claim 14 is a solution by using a recording medium in which a computer program for executing the method according to any one of claims 7 to 12 is recorded.

【0031】

According to the present invention of claim 1 or claim 7, the owner name of the public key certificate given at the time of searching for the public key certificate is used when the public key is registered at the certificate authority and after the registration. It has a name conversion means / stage for converting the owner name of the public key certificate into a search key by a conversion method according to the collation rule information indicating the collation rule used when the search label of the public key certificate is converted. Therefore, the public key certificate can be reliably searched in various collation rule environments used in PKI.

【0032】

According to the present invention of claim 2, a collation rule information storage means for storing collation rule information transmitted from a certificate authority and a collation rule for extracting collation rule information from the collation rule information storage means at the time of conversion to a search key. Since it is equipped with information extraction means, it is possible to reliably search for a public key certificate.

【0033】

According to the present invention of claim 8, since the collation rule information extraction step of extracting the collation rule information from the collation rule information storage means in which the collation rule information transmitted from the certificate authority is stored is provided, the public key certificate is surely provided. Can be searched.

【0034】

The present invention of claim 3 is a collation rule information storage means in which a collation rule information transmitted from a certificate authority and an account name indicating the certificate authority are stored in association with each other, and an owner name when converting to a search key. Since it is equipped with a collation rule information extraction means that extracts the collation rule information corresponding to the given account name from the collation rule information storage means, a search request is made by specifying the certificate authority that issued the public key certificate by the account name. On the other hand, the public key certificate search device does not perform the process of searching for the public key certificate issued by another certificate authority, and as a result, the target public key certificate can be searched quickly.

【0035】

According to the present invention of claim 9, the collation rule information transmitted from the certificate authority corresponds to the account name indicating the certificate authority in the collation rule information storage means for storing the collation rule information transmitted from the certificate authority. Since it is provided with a collation rule information extraction stage that extracts the collation rule information corresponding to the account name given together with the owner name from the collation rule information storage means at the time of conversion to the search key when it is stored together, it is open to the public. In response to a search request made by specifying the certificate authority that issued the key certificate with the account name, the public key certificate search device will no longer perform the process of searching for the public key certificate issued by another certificate authority. As a result, the desired public key certificate can be searched quickly.

【0036】

According to the present invention of claim 4 or claim 10, since the collation rule information storage means includes the collation rule information setting means / stage for setting the collation rule information transmitted from the certification authority, the transmitted collation rule information can be stored. It can be automatically set as the collation rule information storage means.

【0037】

According to the present invention of claim 5 or claim 11, the name of the owner of the public key certificate given at the time of searching the public key certificate is converted by a conversion method according to each of the plurality of collation rule information. Since the public key certificate is searched by each of the search keys, the public key certificate can be surely searched, and a plurality of public key certificates can be searched.

【0038】

According to the present invention of claim 6 or 12, the public key certificate spool means / stage for temporarily storing the public key certificate searched from the public key certificate storage means is provided, so that the searched public key is provided. The complicated process of sending the certificate to the search request source of the public key certificate one by one becomes unnecessary.

【0039】

According to the thirteenth aspect of the present invention, it is possible to distribute a computer program capable of reliably searching a public key certificate in various collation rules environments used in PKI.

【0040】

According to the invention of claim 14, in various collation rule environments used in PKI, a recording medium recording a computer program capable of reliably searching a public key certificate can be distributed.

【0041】

BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram showing a configuration of a public key certificate retrieval device according to an embodiment of the present invention and a network configured including this device. In Fig. 1, the public key certificate search device (hereinafter referred to as the directory) 1, the certificate authority (hereinafter abbreviated as CA) 2A and CA2B, and the business system 3 are all computer systems equipped with an arithmetic unit and a storage device, and serve as a network. It is configured to enable mutual communication. Further, the user terminal 4 in FIG. 1 is used by a user with a user name A who intends to use the business system 3 (referred to as user A for convenience), and is an arithmetic unit and a storage device. , A display device and an input device. The storage device is composed of a hard disk device and a semiconductor memory. Input devices are keyboards and mice. The display device is composed of CRT and liquid crystal. The public key certificate is also simply called a certificate, and is indicated by this abbreviation in the drawings.

【0042】

The directory 1 contains the public key certificate storage unit 11, the collation rule information management table 12, the collation rule information setting unit 13, the collation rule information extraction unit 14, the name conversion unit 15, the public key certificate search unit 16, and the public key certificate. A spool portion 17 is provided.

【0043】

The public key certificate storage unit 11 is a storage area in which the public key certificate and the search label for searching the public key certificate are stored in association with each other. The collation rule information management table 12 shows the collation rules used by CA2A and CA2B when registering the public key and when converting the owner name of the public key certificate after the registration into the search label of the public key certificate. A storage area in which collation rule information is set. The collation rule information setting unit 13 is a processing unit that sets the account name and the collation rule information transmitted from CA2A and CA2B in the collation rule information management table 12. The collation rule information extraction unit 14 is a processing unit that extracts the collation rule information set in the collation rule information management table 12.

【0044】

The name conversion unit 15 converts the owner name of the public key certificate given at the time of searching the public key certificate into a search key by a conversion method according to the collation rule information extracted by the collation rule information extraction unit 14. It is a department. The owner name of the public key certificate is specified by Distinguished Name (DN). The DN includes not only the name string (String) but also the "String Type" so that, for example, PrintableString and UTF8String can be distinguished.

【0045】

The public key certificate search unit 16 collates the search key obtained in the conversion process from the owner name by the name conversion unit 15 with the search label of the public key certificate storage unit 11, and the public key certificate storage unit 11 It is a processing unit that searches for public key certificates from.

【0046】

The public key certificate spool unit 17 is a block including a processing unit and a storage area for temporarily storing the public key certificate searched by the public key certificate search unit 16.

【0047】

The directory 1 is provided with a communication unit (not shown) for transmitting and receiving various information, receives information from the communication partner and uses it for processing in the directory 1, and is a public key searched in the directory 1. Certificates and the like can be sent to the communication partner. It also includes a processing unit (not shown) that stores the public key certificate sent from CA2A or CA2B in the public key certificate storage unit 11 in association with the search label.

【0048】

Further, each processing unit of the directory 1 is realized by reading the computer program from the storage medium storing the program into the directory 1 and executing the processing unit of the system.

【0049】

Next, the operation of the embodiment will be described. FIG. 2 is a diagram showing preprocessing of directory 1. From CA2A and CA2B, when converting the account name of each CA and the name of the owner of the public key certificate after registration of the public key at each CA to the search label of the public key certificate. Matching rule information indicating the matching rule to be used is sent. When the directory 1 receives the sent account name and the matching rule information, the matching rule information setting unit 13 sets them in the matching rule information management table 12 (step S1).

【0050】

The collation rule information is specifically a character code such as "RFC2459" or "X.500". The former shows a matching rule called "RFC2459 matching", and the latter shows a matching rule called "X.500 matching". In addition, as the collation rule information, any collation rule such as a collation rule for normalizing voiced sound and long sound peculiar to Japanese (specifically, a collation rule for kana characters such as normalizing "NT" to "NT") It is possible to set something that indicates the matching rule of.

【0051】

Note that CA2A and CA2B use the verification rule when registering the public key, which means that the user name that is the owner name of the public key certificate and the pre-registered registrant name are converted by the verification rule. This means that various processes such as determining whether the user name belongs to a new registrant or an existing registrant are performed by collating after performing the above. In other words, the user name that is the owner name of the public key certificate is specified by DistinguishedName (DN) that has various StringTypes such as PrintableString and UTF8String. It collates from.

【0052】

Here, CA2A uses "RFC2459 matching" when registering the public key and converting it to a search label, and the matching rule information "RFC2459" indicating this matching rule is sent, and this is the CA2A account name. It is assumed that it is set in the collation rule information management table 12 in association with "CA-A". In addition, CA2B uses "X.500" when registering the public key and converting it to a search label, and the matching rule information "X.500" indicating this matching rule is sent, and this is the CA2B account. It is assumed that it is set in the collation rule information management table 12 in association with the name "CA-B".

【0053】

After such preprocessing, CA2A and CA2B send the public key certificate issued by each certificate authority to directory 1, and directory 1 stores this in the public key certificate storage unit 11. To do.

【0054】

Here, the public key certificate of user A who is going to use the business system 3 (referred to as public key certificate A01) is issued by CA2B, and the public key certificate is proved by the conversion method according to the verification rule "X.500". It is assumed that the information is stored in the public key certificate storage unit 11 in association with the owner name of the document A01, that is, the character string "A" which is the search label converted from the user name A. Since the search label obtained by the conversion by the conversion method according to the collation rule "X.500" is a character string, the search label is equal to the user name as a result. In addition, the public key certificate includes the owner name A as the Subject and the issuer name, that is, the DN of CA2 as the Issuer.

【0055】

Next, with reference to FIG. 1, the process until the search key of the public key certificate is sent to the directory 1 will be described.

【0056】

When the user of the user terminal 4 uses the business system 3, a signature document including the signature of the user A is transmitted from the user terminal 4 to the business system 3, and the user name A is changed. It is notified as the owner name of this user's public key certificate.

【0057】

Here, it is assumed that the owner name "12020041" (12: string type indicating UTF8String, 02: string length, 0041: string "A") of the public key certificate of user A is notified.

【0058】

The business system 3 transmits the owner name notified from the user terminal 4 to the directory 1 as a search key of the public key certificate in order to verify the signature of the signature document transmitted from the user terminal 4.

【0059】

FIG. 3 is a diagram showing the public key certificate search process of the directory 1. When the business system 3 notifies the directory 1 of the owner name of the public key certificate when the business system 3 requests a search for the public key certificate (step S3), the collation rule information extraction unit 14 notifies the collation rule information. Extract the collation rule information from the management table 12 (step S5). When the collation rule information extraction unit 14 has an account name (CA-A or CA-B) attached to the owner name notified from the search request source, the collation rule information extraction unit 14 corresponds to the collation rule information from the collation rule information management table 12. Extract ("RFC2459" or "X.500"). Therefore, in response to a search request made by specifying the certificate authority that issued the public key certificate with the account name, the process of searching for the public key certificate issued by another certificate authority is not performed, and as a result, the process is not performed. You can quickly search for the desired public key certificate. On the other hand, if the account name is not attached, all the collation rule information in the collation rule information management table 12 is extracted. Therefore, in the example, the collation rule information "RFC2459" and the collation rule information "X.500" are extracted.

【0060】

Next, the name conversion unit 15 converts the owner name notified from the business system 3 into a search key by a conversion method according to the collation rule indicated by the extracted collation rule information (step S7). More specifically, when the extracted collation rule information is "X.500", the string of the owner name notified from the business system 3 is converted into a character string. If the extracted collation rule information is "RFC2459" and the string type of the owner name notified from the business system 3 is PrintableString, the string of the owner name is converted into a character string. If the extracted collation rule information is "RFC2459" and the string type of the owner name notified from the business system 3 is other than PrintableString, the string of the owner name is converted to hexadecimal.

【0061】

In the example, since the string type of the owner name is other than PrintableString (12: indicates UTF8String), the owner name "12020041" is converted according to the collation rule "RFC2459 collation" indicated by the collation rule information "RFC2459". It is converted to the hexadecimal search key "12020041" by the method. Further, the string "12020041" of the owner name is converted into the character string search key "A" by the conversion method according to the collation rule "X.500 collation" indicated by the collation rule information "X.500".

【0062】

Next, the public key certificate search unit 16 searches the public key certificate storage unit 11 for the public key certificate using one of the search keys obtained in step S7 (step S9). In the example, the public key certificate is searched by collating one of the search keys "12020041" with the search label of the public key certificate storage unit 11. Since the same search label as the search key "12020041" does not exist in the public key certificate storage unit 11, the public key certificate is not searched here, but user A adopts the collation rule "RFC2459". If the public key is also registered in CA2A and the subsequent processing is performed, the public key certificate issued by CA2A will be searched.

【0063】

Next, the public key certificate spool unit 17 stores (spools) the public key certificate searched in step S9 in the storage area in the public key certificate spool unit 17 (step S11). In the example, the public key certificate could not be searched in step S9, but user A also registers the public key in CA2A that adopts the verification rule "RFC2459", and after that, it is issued by CA2A. When the public key certificate is searched, the public key certificate is spooled in the public key certificate spool unit 17.

【0064】

Next, the public key certificate search unit 16 determines whether or not the public key certificate has been searched using all of the search keys obtained in step S7, and if NO is determined here, the step Return to S9 and search for the public key certificate from the public key certificate storage 11 using one of the search keys used for the search.

【0065】

In the example, the public key certificate is searched by collating the other search key "A" with the search label of the public key certificate storage unit 11. Since the same search label as the search key "A" exists in the public key certificate storage unit 11, here, the public key certificate stored in association with the search label "A", that is, the public key certificate. A01 is searched. Then, the public key certificate spool unit 17 spools the searched public key certificate A01 to the storage area in the public key certificate spool unit 17.

【0066】

Then, in step S13, the public key certificate search unit 16 determines whether or not the public key certificate has been searched for all the search keys obtained in step S7. In the example, two search keys are used. Since the search for the public key certificate used has been completed, it is determined as YES and the control shifts to step S15.

【0067】

In step S15, the directory 1 sends the public key certificate spooled in the public key certificate spool unit 17 to the search request source. In the example, directory 1 sends the public key certificate A01 spooled in the public key certificate spool unit 17 to the business system 3.

【0068】

The business system 3 can verify the signature of the signature document sent from the user terminal 4 with this public key certificate A01, and trust the business system 3 by verifying the path of the public key certificate A01. When you reach the public key certificate, allow the user terminal 4 to use it. Therefore, by performing such processing, the business system 3 can be used from the user terminal 4.

【0069】

As described above, the directory 1 of the present embodiment is a public key certificate storage means (public) in which the public key certificate and the search label converted from the owner name of the public key certificate are stored in association with each other. It is a public key certificate search device that has a key certificate storage unit11) and searches for a public key certificate by collating the search label of the public key certificate storage means with the search key, and publishes it in response to a search request. The public key certificate is searched from the public key certificate storage means by executing the key certificate search method.

【0070】

This public key certificate search device (1) / public key certificate search method is when the public key is registered by the certificate authority with the owner name of the public key certificate given when searching for the public key certificate. And the name conversion that converts the owner name of the public key certificate after the registration into a search key by the conversion method according to the collation rule information indicating the collation rule used when the search label of the public key certificate is converted. Since the means (name conversion unit 15) / name conversion step (step S7) is provided, the public key certificate can be reliably searched in various collation rule environments used in PKI.

【0071】

The search referred to here may be grasped as a search from the public key certificate storage unit 11, or may be grasped as a technical idea including transmission of the public key certificate to the search request source. Good.

【0072】

In addition, the public key certificate search device (1) has a collation rule information storage means (verification rule information management table 12) for storing collation rule information transmitted from a certificate authority, and collation rule information when converting to a search key. It is equipped with a collation rule information extraction means (collation rule information extraction unit 14) that extracts collation rule information from the storage means (12), and the public key certificate search method stores the collation rule information transmitted from the certificate authority. Since the collation rule information extraction step (step S5) for extracting the collation rule information from the collation rule information storage means (12) is provided, the public key certificate can be reliably searched.

【0073】

Further, the public key certificate search device (1) has a collation rule information storage means (12) in which the collation rule information transmitted from the certificate authority and the account name indicating the certificate authority are stored in association with each other, and a search key. The public key certificate search method is equipped with a collation rule information extraction means (14) that extracts the collation rule information corresponding to the account name given together with the owner name from the collation rule information storage means (12). , The collation rule information transmitted from the certificate authority and the account name indicating the certificate authority are stored in association with each other in the collation rule information storage means (12) for storing the collation rule information transmitted from the certificate authority. Sometimes, when converting to a search key, a collation rule information extraction step (step S5) is provided to extract the collation rule information corresponding to the account name given together with the owner name from the collation rule information storage means (12). In response to a search request made by specifying the certificate authority that issued the public key certificate by the account name, the public key certificate search device performs the process of searching for the public key certificate issued by another certificate authority. As a result, the desired public key certificate can be searched quickly.

【0074】

Further, according to the public key certificate search device (1) / public key certificate search method, the collation rule information setting means (verification) that sets the collation rule information transmitted from the certificate authority to the collation rule information storage means (12). Since the rule information setting unit 13) / collation rule information setting stage (step S1) is provided, the transmitted collation rule information can be automatically set in the collation rule information storage means (12).

【0075】

In addition, according to the public key certificate search device (1) / public key certificate search method, the owner name of the public key certificate given at the time of searching the public key certificate can be used for each of the plurality of collation rule information. Since the public key certificate is searched for each of the search keys converted by the conversion method according to the conversion method, the public key certificate can be reliably searched, and a plurality of public key certificates can also be searched.

【0076】

In addition, according to the public key certificate search device (1) / public key certificate search method, the public key certificate spool that temporarily stores the public key certificate searched from the public key certificate storage means (11). Since the means (public key certificate spool unit 17) / public key certificate spool stage (step S11) is provided, there is no need for complicated processing of sending the searched public key certificate to the search request source of the public key certificate one by one. It becomes.

【0077】

Note that the computer program that causes the public key certificate search device to execute the above-mentioned processing can be recorded on a computer-readable recording medium such as a semiconductor memory, a magnetic disk, an optical disk, a magneto-optical disk, or a magnetic tape, or can be recorded on a computer-readable recording medium such as the Internet. It can be transmitted via a communication network and widely distributed.

【0078】

[Effect of the invention]

As described above, according to the present invention, the owner name given when searching the public key certificate is the owner name of the public key certificate when the public key is registered at the certificate authority and after the registration. Is converted to a search key by a conversion method according to the collation rule information indicating the collation rule used when converted to the search label of the public key certificate, so that it is published in various collation rule environments used in PKI. The key certificate can be searched reliably, and the convenience can be significantly improved.

[Simple explanation of drawings]

[Figure 1]

It is a figure which shows the structure of the public key certificate search apparatus which concerns on embodiment of this invention, and the network which was configured including this apparatus.

[Figure 2]

It is a figure which shows the preprocessing of a directory 1.

[Fig. 3]

It is a figure which shows the public key certificate search process of a directory 1.

[Fig. 4]

It is a figure for demonstrating the search method of the public key certificate in the conventional directory.

[Explanation of symbols]

1 Public key certificate search device (directory) 2A, 2B Certificate Authority (CA) 3 Business system 4 User terminal 11 Public key certificate storage 12 Matching rule information management table 13 Collation rule information setting unit 14 Collation rule information extraction unit 15 Name conversion unit 16 Public Key Certificate Search Department 17 Public key certificate spool A01 Public key certificate