Certificate generation method, certificate generation apparatus, information processing apparatus, and communication device

• US 9,438,583 B2
• Filed: 03/19/2014
• Issued: 09/06/2016
• Est. Priority Date: 04/11/2013
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Suzuki, Masato, Kotani, Seigo
• Primary Examiner(s): Gee, Jason K
• Application Number:
  US14/219,153
• Publication Number:
  US 20140310822A1
• Time in Patent Office: 902 Days
• Field of Search: 726/29
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/127 Trusted platform modules [TPM]
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A certificate generation method executed by a computer, includes receiving specific information and configuration information of a communication device collected by an information processing apparatus, the specific information and the configuration information being transmitted from the communication device provided with the information processing apparatus having tamper resistance; determining a communication address of the communication device based on the specific information if a combination of the received specific information and the received configuration information of the communication device is equivalent to information stored beforehand in a storage unit; generating an electronic certificate including a part of or all of the specific information and the configuration information, and the determined communication address; and transmitting the electronic certificate to the communication device.

Claims

1. A certificate generation method executed by a computer, the certificate generation method comprising:

verifying, when a certificate issuance request including an electronic signature is received from a communication device, the electronic signature by comparing a first value corresponding to the certificate issuance request with a second value obtained by decoding the electronic signature;

receiving a specific information item and a configuration information item of the communication device from the communication device, the specific information item and the configuration information item being collected by a tamper-resistant information processing apparatus provided in the communication device;

obtaining a communication address of the communication device from a first storage unit of the computer, the first storage unit storing communication addresses associated with specific information items beforehand, based on the received specific information item, when a combination of the received specific information item and the received configuration information item of the communication device is equivalent to a combination of a specific information item and a configuration information item of the communication device stored beforehand in a second storage unit of the computer;

generating an electronic certificate including a part or all of the received specific information item and the received configuration information item, and the obtained communication address; and

transmitting the electronic certificate to the communication device,

wherein the electronic certificate transmitted to the communication device includes the communication address which is not received from the communication device.

2. The certificate generation method according to claim 1,

wherein the obtaining includes obtaining the communication address when the electronic signature is valid.

3. The certificate generation method according to claim 1, wherein the received specific information item of the communication device is one of a MAC address of the communication device and an electronic certificate of the communication device.

4. The certificate generation method according to claim 1, wherein the received configuration information item of the communication device is one of an ID of hardware included in or connected to the communication device, a version of software installed in the communication device, and a hash value of the software installed in the communication device.

5. The certificate generation method according to claim 1, wherein a public key stored in the computer is used when verifying the electronic signature, and the public key corresponds to a private key of the information processing apparatus.

6. A certificate generation apparatus comprising:

a memory; and

a processor coupled to the memory, wherein the processor executes a process including;

verifying, when a certificate issuance request including an electronic signature is received from a communication device, the electronic signature by comparing a first value corresponding to the certificate issuance request with a second value obtained by decoding the electronic signature;

receiving a specific information item and a configuration information item of the communication device from the communication device, the specific information item and the configuration information item being collected by a tamper-resistant information processing apparatus provided in the communication device;

obtaining a communication address of the communication device from a first storage unit of the memory, the first storage unit storing communication addresses associated with specific information items beforehand, based on the received specific information item, when a combination of the received specific information item and the received configuration information item of the communication device is equivalent to a combination of a specific information item and a configuration information item of the communication device stored beforehand in a second storage unit of the memory;

generating an electronic certificate including a part or all of the received specific information item and the received configuration information item, and the obtained communication address; and

transmitting the electronic certificate to the communication device,

wherein the electronic certificate transmitted to the communication device includes the communication address which is not received from the communication device.

7. The certificate generation apparatus according to claim 6, wherein the received specific information item of the communication device is one of a MAC address of the communication device and an electronic certificate of the communication device.

8. The certificate generation apparatus according to claim 6, wherein the received configuration information item of the communication device is one of an ID of hardware included in or connected to the communication device, a version of software installed in the communication device, and a hash value of the software installed in the communication device.

9. The certificate generation apparatus according to claim 6, wherein a public key stored in the memory is used when verifying the electronic signature, and the public key corresponds to a private key of the information processing apparatus.