Digital certificate management system, digital certificate management apparatus, digital certificate management method, update procedure determination method and program

• US 20060036850A1
• Filed: 10/25/2005
• Published: 02/16/2006
• Est. Priority Date: 06/25/2003
• Status: Active Grant

• Current Assignee: Tomoaki Enokida
• Original Assignee: Tomoaki Enokida
• Inventors: Enokida, Tomoaki
• Granted Patent: US 7,489,783 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

In a digital certificate management system, a client/server system is connected to a digital certificate management apparatus capable of communicating with clients and servers. Mutual authentication is performed between the clients and the servers by using digital certificates and communications are performed over a communication channel established based on mutual authentication. The digital certificate management apparatus includes a certification key update part updating a server certification key used for mutual authentication and stored in each of the clients that become communication parties of one of the servers. The certification key updating part includes a key obtaining part, a certificate obtaining part, and first and second transmission parts. The second transmission part performs an operation of transmitting the new server certificate to each of the servers after there are responses, indicating that the new server certification key is received, from all of the clients that become communication parties of the server.

Claims

1. An update procedure determination method that, in a client/server system constructed by nodes (one or more clients and one or more servers) that perform communications with each other over a communication channel established based on mutual authentication using digital certificates, determines an update procedure for updating, by a digital certificate management apparatus capable of communicating with each of the nodes, a key that is a certification key for verifying a digital certificate used for the mutual authentication by each of the nodes constructing the client/server system, and stored in each of the nodes that become communication parties of the node,

wherein the digital certificate management apparatus determines the update procedure such that the update procedure includes a step of transmitting a new certification key for updating and/or a new certificate to each of the nodes that are target nodes and performing mutual authentication using a certification key to be updated based on information of each of the nodes, the information including a communication party of the node, whether the node functions as a client or a server with respect to the communication party, and a certification key used when performing the mutual authentication with the communication party,

wherein, when determining the update procedure, a step of creating an order to perform the step of transmitting the new certification key for updating and/or the new certificate on each of the nodes that are the target nodes is performed, and

wherein, in the step of creating the order, one of the nodes that are the target nodes is first added to the order, each node that is added to the order is then sequentially taken as a node of notice, and when there is a node that is a communication party performing mutual authentication using the certification key to be updated with the node of notice and is not added to the order, it is determined for each communication party whether the node of notice functions as a client or a server when communicating with the communication party, and when the node of notice functions as the client, the communication party is added to the order such that the communication party is later than the node of notice, and when the node of notice functions as the server, the communication party is added to the order such that the communication party is earlier than the node of notice.