CERTIFICATE AUTHORITY OPERATION APPARATUS AND METHOD

• US 20160034693A1
• Filed: 06/15/2015
• Published: 02/04/2016
• Est. Priority Date: 07/30/2014
• Status: Abandoned Application

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Takeuchi, Takashi
• Application Number:
  US14/738,986
• Publication Number:
  US 20160034693A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

A certificate authority operation apparatus includes a storage unit that retains a plurality of private keys that correspond to a plurality of cryptosystems with different generations, respectively, encryption strength of each of the plurality of cryptosystems being different according with the generations, and a processor which executes a process. The process includes, when acquiring an issuance instruction, performing a control so as to issue a public key certificate by utilizing a first private key that corresponds to a cryptosystem of a generation whose encryption strength is highest.

Claims

1. A certificate authority operation apparatus comprising:

a storage unit that retains a plurality of private keys that correspond to a plurality of cryptosystems with different generations, respectively, encryption strength of each of the plurality of cryptosystems being different according with the generations; and

a processor which executes a process including;

when acquiring an issuance instruction, performing a control so as to issue a public key certificate by utilizing a first private key that corresponds to a cryptosystem of a generation whose encryption strength is highest.

2. The certificate authority operation apparatus according to claim 1, wherein

the performing performs a control so as to issue the public key certificate by utilizing the first private key that corresponds to a cryptosystem of a latest generation among the cryptosystems of the plurality of generations and so as not to issue a public key certificate by utilizing a second private key that is different from the first private key.

3. The certificate authority operation apparatus according to claim 1, the process further including:

issuing, by utilizing a private key from among the plurality of private keys, a revocation list that includes revocation information on a public key certificate that has been issued by utilizing the private key, and

stopping the issuance of a revocation list of the public key certificate that has been issued by utilizing the private key when acquiring an issuance stop request for the revocation information.

4. The certificate authority operation apparatus according to claim 1, wherein

a revocation list that has been generated by utilizing the cryptosystem of the generation whose encryption strength is highest includes revocation information on a public key certificate that has been issued by utilizing a cryptosystem of a generation that is different from the generation whose encryption strength is highest.

5. The certificate authority operation apparatus according to claim 1, wherein

the storage unit stores generation information that is obtained by associating information that indicates a generation of the cryptosystem with a public key certificate that has been generated by utilizing a cryptosystem of a generation that is indicated by the information that indicates the generation, and

the process further includes:

when a certificate authority certificate that is a public key certificate for ensuring legitimacy of the certificate authority operation apparatus has been revoked, revoking a certificate authority certificate that has been generated by utilizing a cryptosystem whose encryption strength is weaker than a cryptosystem that has been used for generating the revoked certificate authority certificate according to the generation information.

6. The certificate authority operation apparatus according to claim 1, wherein

the storage unit stores information that indicates each strength of the plurality of private keys, and

the process further includes:

when the first private key is generated, in a case in which a strength of the first private key is higher than strengths of any of private keys that are different from the first private key, performing a control so as to generate the first private key.

7. The certificate authority operation apparatus according to claim 3, wherein

the storage unit stores output destination information that indicates each output destination of the plurality of revocation lists, and

the process further includes:

when receiving a setting request that includes a first output destination that indicates an output destination of a first revocation list that is a revocation list among the plurality of revocation lists, setting as the first output destination the output destination of the first revocation list in a case in which the first output destination that is included in the received setting request is different from an output destination that is indicated by the output destination information of a revocation list whose generation is different from that of the first revocation list.

8. A non-transitory computer-readable recording medium having stored therein a certificate authority operating program that causes a computer to execute a process comprising:

when acquiring an issuance instruction, performing a control so as to issue a public key certificate by utilizing a private key that corresponds to a cryptosystem of a generation whose encryption strength is highest among a plurality of private keys that correspond to a plurality of cryptosystems with different generations, respectively, encryption strengths of each of the plurality of cryptosystems being different according with the generations.

9. A certificate authority operation method comprising:

when acquiring an issuance instruction, performing a control, by using a computer, so as to issue a public key certificate by utilizing a private key that corresponds to a cryptosystem of a generation whose encryption strength is highest among a plurality of private keys that correspond to a plurality of cryptosystems with different generations, respectively, encryption strengths of each of the plurality of cryptosystems being different according with the generations.