Certification apparatus and method

[0002] 1. Field of the Invention

[0003] The present invention relates to certification technique whereby certification is performed in an organization such as an enterprise.

[0004] 2. Description of the Related Art

[0005] In the case of using a public cryptography method, assurance of correspondence between a public key and the person himself is required. This assurance is called “certification”. As a mechanism for providing this certification, there is Certification Authority (hereinafter, called also “CA”). The CA is a fair third party system for assuring a correspondence relation between the public key and the person himself, and this is being popularly used for certification. In this method, the CA issues, as a certificate, electronic data electronically signed using the private key of CA on information indicating correspondence between a certification target (natural individual or legal person) and its public key. A third party, who places its confidence in the CA, confirms the contents (signature) of the certificate using the public key of CA, whereby the third party accepts that the correspondence relation between the public keys of an individual and an individual is legitimate.

[0006] If the conventional CA is used within an enterprise, the following problems will occur:

[0007] (1) A fair third party is required as a manager of CA. If such a management job is entrusted to an external third party organization, the essence of the internal security system would be held by the third party.

[0008] (2) Even if an attempt is made to provide a fair third party within the company, an employee within the company will become the individual concerned (an individual to be certified). The enterprise side also desires to prevent a specific manager from holding the essence of the security system, and the manager does not desire to manage important information either (he is very likely to be suspected if a problem such as divulgation arises).

[0009] (3) Within an enterprise, since activities are performed in units of groups, which are an aggregate of individuals or groups such as a department or a section, it is desirable to establish a right such as reference right for information in units of groups. Accordingly, it becomes necessary to correctly assure the individual or group, which is an element of the group, but the conventional CA does not have such ability.

[0010] (4) In the CA, the fair third party identifies by some method that a person to be certified is the person himself, but since generally the CA's manager is not acquainted with the person to be certified, there is no method for the identification except some method left to the CA's decision among methods such as correspondence to mail address, non-duplication of the name, and backing using a public certificate. Since there are diversified methods in this manner, variations occur in the degree of reliability of the identification. Even if we may rely on the public certificate, we are powerless against false papers for it. Within the enterprise, an employee's identification card may be the public certificate, but it costs for an applicant to meet the manager with his employee's identification card.

[0011] The present applicant has proposed a cryptography technique in units of groups (Japanese Published Unexamined Patent Application No. 11-015373). This technique enables information control in units of groups to the public key cryptography technique, that is, decoding and electronic signature. In order to perform the information control in units of groups, it is necessary to maintain the legitimacy of a member of the group. This is because if an illegitimate member can be added, the illegitimate member could use the rights given to the group. For this reason, in the Japanese Published Unexamined Patent Application No. 11-015373, there was provided ability to legitimately change the group members. However, no certification ability is included in the Japanese Published Unexamined Patent Application No. 11-015373. More specifically, there is not included ability to assure the correspondence relation between an individual and the public key, and the correspondence relation between a group and the public key.

[0012] Even in a general CA, there exists a system in which a plurality of CAs form a hierarchical structure. Concretely, a higher level CA places its electronic signature on information indicating the correspondence relation between its lower level CA and its public key. Thus, if the public key for the higher level CA is known, the information indicating the public key for the lower level CA electronically signed is confirmed, whereby the public key for the lower level CA can be also correctly known. In this system, however, although the hierarchical structure is formed, a fair third party is still required. Also, since the CA is service, it is difficult to bring the group into correspondence with the CA, and the group cannot be controlled. Further, the basis for the certification remains the same as before, and the degree of reliability varies.

[0013] The present invention has been achieved in consideration of the above-described state of affairs, and is aimed to provide a certification technique suitable for performing a certification in an organization such as an enterprise.

[0014] Hereinafter, the description will be made of the present invention. The present invention enables the certification of an individual and an organization using a hierarchy of the organization. A responsible person of each group ought to certainly know other groups and individuals directly belonging to the group, and performs the certification on the basis thereof. This has the following effects:

[0015] (1) The certification can be performed without necessitating the existence of any fair third party.

[0016] (2) Uniform and fair certification can be performed on the basis of acquaintance with the members which the responsible person of the group has.

[0017] (3) The group can be handled.

[0018] (4) The certification can be performed by the in-house alone.

[0019] More specifically, according to the present invention, in order to achieve the above-described object, a certification apparatus for performing certification for an individual and a group in an organization constructed by hierarchically arranging a group having at least one of an individual and a group as a constituent member, is provided with: a confirmation process unit for confirming the certification target on the basis of communication between a responsible person of a group and a certification target belonging to the group; and a certificate generating unit for generating a certificate for the certification target by placing the signature on signature-target information including a public key for the certification target and specifying information on the certification target by a private key used by the responsible person of the group.

[0020] In this structure, a certification scheme is hierarchically constructed with the responsible person of the group as a nucleus, and therefore, the effects of (1) to (4) described above can be achieved.

[0021] In this structure, a unit for keeping the certificate may be further provided. Of course, the certificate may be sent to the user. Also, the signature-target information may further include specifying information on the group.

[0022] Also, a certificate having a group as a certification target may further include specifying information on each of members of the group, and signature information comprising the specifying information signed by the private key of the responsible person of the group.

[0023] Also, the certificate having a group as a certification target may further include a shared public key of members of the group encrypted by respective public keys of members of the group; a shared public key of members of the group; and signature information comprising at least the members' shared private key encrypted, signed by the private key of the responsible person of the group.

[0024] Also, a private key used by the responsible person of the group encrypted by a public key corresponding to a private key used by a responsible person of a group in a higher level hierarchy of the group may be further included in the certificate. In this case, the private key used by the responsible person of the group may be set independently of an individual private key of the responsible person, the private key used by the responsible person of the group encrypted by the individual public key of the responsible person of the group may be included in the certificate.

[0025] Also, on generating the certificate, a confirming unit of the group using the certification target based on the communication between the responsible person of the group and the certification target belonging to the group may be further provided for the certification apparatus.

[0026] Also, the signature-target information may include information having classification of the signature target described therein. The classification means, for example, difference between temporary registration and genuine registration, presence or absence of certification ability and the like. For example, a friendship group and a task force can be designated to have no authentication ability.

[0027] Also, along with communication between the responsible person of the group and the certification target belonging to the group, it may be possible for the certification target belonging to the group to receive specifying information on the group and the private key for the group for signing by the private key of the certification target itself.

[0028] Also, along with the communication between the responsible person of the group and the certification target belonging to the group, it may be possible for the certification target belonging to the group to receive specifying information on the group and the private key for the group for signing by the private key of the certification target itself, and to allow the certification target to be kept in such a manner as to be made available.

[0029] Also, it goes without saying that the present invention is implementable both as a mode of the method and as a mode of the computer program. Also, in place of the confirmation process of the certification target based on communication between the responsible person of the group and the certification target belonging to the group or a responsible person of the certification target, it is possible to use the existing credit scheme (diversion and the like of a confirmation document and the like which have already been used), and to omit the confirmation process.

[0030] FIG. 1 is a block diagram showing a system configuration of an embodiment according to the present invention;

[0031] FIG. 2 is an explanatory view showing a group hierarchy in the above-described embodiment;

[0032] FIG. 3 is an explanatory view showing data for certification in the group hierarchy of FIG. 2;

[0033] FIG. 4 is a view in which a member of the group explains a case of the group in the embodiment;

[0034] FIG. 5 is an explanatory view showing data for certification used in FIG. 4;

[0035] FIG. 6 is an explanatory view showing data for certification in the embodiment;

[0036] FIG. 7 is an explanatory view showing data for certification for a group in the embodiment;

[0037] FIG. 8 is an explanatory view showing data for certification including specifying information on an immediately above group;

[0038] FIG. 9 is an explanatory view showing data for certification further including information on a group member;

[0039] FIG. 10 is an explanatory view showing data for certification including a group lock;

[0040] FIG. 11 is an explanatory view showing data for certification including a group lock and a group member public key;

[0041] FIG. 12 is an explanatory view showing data for certification in which the group responsible person can be indirectly designated;

[0042] FIG. 13 is an explanatory view showing data for certification in which a private key of the group responsible person can be acquired by the responsible person of the immediately above group;

[0043] FIG. 14 is an explanatory view showing data for certification, on the basis of which a group responsible person can be changed on a level of a group responsible person;

[0044] FIG. 15 is an explanatory view showing the structure of data for a non-certification group;

[0045] FIG. 16 is an explanatory view showing a concrete example of an individual certificate;

[0046] FIG. 17 is an explanatory view showing a concrete example of a group certificate;

[0047] FIG. 18 is a flow-chart for explaining an operation of installing certification service of an embodiment in a server;

[0048] FIG. 19 is a flow-chart for explaining a registration operation of a service name;

[0049] FIG. 20 is a flow-chart for explaining a registration operation for a manager;

[0050] FIG. 21 is a flow-chart for explaining a preparation operation for a service key pair;

[0051] FIG. 22 is a flow-chart for explaining a registration operation for an initial group responsible person;

[0052] FIG. 23 is a flow-chart for explaining an individual temporary registration operation;

[0053] FIG. 24 is a flow-chart for explaining a server public key acquisition operation;

[0054] FIG. 25 is a flow-chart for explaining an initial group creation operation;

[0055] FIG. 26 is a flow-chart for explaining a manager identifying operation;

[0056] FIG. 27 is a flow-chart for explaining an operation of identifying the person himself by a manager;

[0057] FIG. 28 is a flow-chart for explaining an operation of identifying the person himself by a user;

[0058] FIG. 29 is a flow-chart for explaining an operation of preparing a member candidate list;

[0059] FIG. 30 is a flow-chart for explaining an operation of identifying an operator;

[0060] FIG. 31 is a flow-chart for explaining an operation of designating a new member;

[0061] FIGS. 32A-32C are flow-charts for explaining an operation of authorizing a candidate list;

[0062] FIG. 33 is a flow-chart for explaining an operation of authorizing a group;

[0063] FIG. 34 is a flow-chart for explaining an operation of deleting a certificate; and

[0064] FIG. 35 is a flow-chart for explaining an operation of confirming a certificate.

[0065] Hereinafter, the detailed description will be made of the present invention.

[0066] (1) Certification of Member

[0067] First the basic function is for a group G (properly speaking, a responsible person G_Rof the group G) to certify its member M_i. To certify is to place an electronic signature on information indicating correspondence relation between specifying information M_iIof a member M_iand a public key M_iP. A private key used for the electronic signature is a manager's individual private key G_RSor an exclusive private key G_Swhich the group has.

[0068] To enable certification means that a confirmation process for certification as well as a certification process must be enabled. To this end, it is necessary to know a public key G_Pof the group G and a public key G_RPof a group manager G_R, which are the reference. If these are known, it becomes possible to certify a direct and indirect member M_allof the group G. It can function properly even with this data.

[0069] (2) Authorization of Group under Direct Control

[0070] In the case of “certification of a member” alone, it will not function if the manager public key G_RPof the group or the public key G_Pof the group is not known. Therefore, we consider imparting the following function in order to authorize the member.

[0071] When a certain member M_iis certified by the group G, it is imposed as the basic function to authorize in the reversed direction. Hence, it is assumed that a certain member M_ican trust the manager public key G_RPor the group public key G_Pof the group G, to which the member himself belongs. By reflexively applying it, the member M_allcan trust a management social circle key or the group public key of the group G, to which the member M_allindirectly belongs. Together with the function, which “certification of member” has, it is possible to know the public key of the group or individual, which is a member even indirectly, of the group G which regards the member himself as a member even indirectly.

[0072] (3) Correspondence to Change in Organization

[0073] Further, we consider imparting a function relating to a change in an organization. This is because since a change in an organization occurs within an enterprise, an ability to follow it is necessary. There are 1) a mechanism in which new member candidates are arranged in advance and are authorized once at a certain point of time, 2) a mechanism in which new member candidates are automatically authorized at a designated time, 3) a mechanism in which members are designated by any other than the group responsible person and they are authorized by the responsible person, 4) a mechanism in which if identification of the person himself has been finished, the identification of the person himself is omitted, and 5) a mechanism in which if authorization has already been given by the higher level group, the confirmation by them is omitted.

[0074] Also, it is also made possible to hold an additional post and implement a task of an individual.

[0075] Hereinafter, the concrete description will be made of the present invention.

[0076] In the following description, the following terms will be used.

[0077] (1) System Configuration

[0078] FIG. 1 shows the system configuration of the present embodiment, and this system supervises the certification in an enterprise, of course, the organization of the enterprise may be divided to perform the certification in units of the division, and may be separated for each level of security for certification. In FIG. 1, a server 100 and a plurality of clients 200 are connected via a network 300. The network 300 connects all the systems of the enterprises, and is constructed by connecting LAN or LAN segments by WAN. Since the server 100 and the clients 200 have ordinary resources of computer system, and are the same in structure as the ordinary ones, the description will be omitted. The server 100 has a closed secondary memory 101 and a public secondary memory 102. The client 200 has a closed secondary memory 201. Information in the closed secondary memory 101 and 201 cannot be directly referred to from others. Information in the public secondary memory 102 can be freely referred to from others, but cannot be changed by others.

[0079] The closed secondary memory 101 in the server 100 holds a manager pass phrase, a server private key, a new member designation list, and the like. The public secondary memory 102 in the server 100 holds a server name, an all certificate list, an all temporary registrant list and the like. The closed secondary memory 201 in the client 200 holds an individual pass phrase, an individual private key, a server public key, an authorized group list and the like.

[0080] (2) Certification based on Group Hierarchy

[0081] By a private key G_ORSof a responsible person G_ORof a group G₀, a pair of specifying information M_iIand a public key M_iPof a member M_i(0<i<=n, 0<=n) of the group will be signed. If, however, the member is a group (=G_i), a pair of specifying information G_iIof a group G_iand a public key G_iRPof its responsible person G_iRwill be signed. Thus, if you know the public key of the responsible person G_0Rof the group G₀, you will be able to know the public key of its direct member M_i. If the member M_iis the group G_i, you will be able to know a responsible person public key G_iRPof the group G_i. By reflexively applying this process, it is possible to also know the public key of an indirect member of the group G₀.

[0082] FIG. 2 shows relation between a group, a manager and members in the case of an one-hierarchy. In FIG. 2, the group G₁is composed of members M_i, and its responsible person G_1Rrepresents the group. A pair of specifying information M_iIand a public key M_iPof a member M_iwill be signed by the private key G_1RSof the responsible person G_1R.

[0083] FIG. 2 shows data necessary in the case of one hierarchy (a rectangle in bold strokes indicates data). G_1RPabove at the right is a manager public key of a group G₁, which serves as a reference. In order to know the public key of each member using this method, it is a precondition to know this G_1RPin some way. As regards where this information exists, nothing has been specified on this level, but it may be opened to the public by, for example, the service. The three rectangles vertically arranged on the lower side show 1) public information of a member, 2) a public key of the member and 3) a signature block of signature by a private key of the group responsible person from above. The signature block is thus shaded in light color, and the signature range is indicated by a brace and an arrow. Where this information is held can be changed in various ways. A process, in which it is held in, for example, the service, and is specified by looking for M_iIto return the corresponding M_iPis assumed to be provided by the service, and it is used in that process. The rectangles in bold strokes at the lowest stage are a private key for each member, and these are controlled by each member.

[0084] FIG. 4 shows relation between a group, a manager and members when the group is nested if the member is a group. In this case, necessary data is the substantially same as in the case of the one hierarchy. It is when the member is a group that caution should be required, and data corresponding to G2 of FIG. 4 is as shown in FIG. 5.

[0085] (3) Identification of the person himself by acquaintance or the like

[0086] When the responsible person G_0Rof the group G₀identifies a member, the responsible person G_0Rutilizes a fact that he is personally acquainted with the member M_i. Concretely, several methods are considered.

[0087] First, the member M_itemporarily registers. The registration is performed when the member M_iinstructs to a temporary registration sub-system in the client 200 to temporarily register. Specifying information M_iIof his own is inputted into the client 200 (the specifying information M_iImay be inputted by any arbitrary person, and when inputted by another person, the person himself only selects the information thus inputted). The temporary registration sub-system generates, in the client 200, a pair of the private key M_iSand the public key M_iP, and registers a pair of the public key M_iPand specifying information M_iIin the server 100. This pair registered is in a state in which the designation by an individual who is merely likely to be the member M_ihas been registered as it is, and there is no assurance of the legitimacy of the pair. For this reason, it is called “temporary registration”.

[0088] The responsible person G_0Rselects the member M_iof the group G₀from among temporarily-registered individuals. Since, however, whether or not the member M_itemporarily registered is the person himself is obscure, the responsible person confirms the specifying information M_iIby directly meeting the member M_ihimself, or by telephone or the like. If the member and other temporary registrants do not overlap in the specifying information, the person himself can recognize that the specifying information is correct. This is because the responsible person G_0Ris acquainted with the member M_iand the specifying information designated by the member M_ihimself does not exist elsewhere (in the case of a method in which the specifying information M_iIis inputted by another person, it is confirmed whether or not temporary registration has been performed by selecting the specifying information M_iI. Since temporary registration can be performed only once for the same specifying information M_iI, M_icannot be temporarily registered if any other than M_ihas temporarily registered.) For this reason, it is confirmed that the public key M_iPdesignated together with the specifying information M_iIis correct, and assurance can be provided.

[0089] Temporary registration is performed as in the case of the first method. In the first method, the responsible person G_0Rmay neglect the confirmation. For this reason, the responsible person G_0Rimparts information on appropriate character string and the like to information corresponding to a candidate M_ifor the member after the temporary registration, or the service automatically imparts so that the responsible person notifies the member M_iof the information orally or by a method such as telephone. The member M_inotifies the service of the information notified. Plural methods can be considered as a way of notifying, but a method of placing an electronic signature by the private key M_iSto notify the service for verifying the signature prevents any illegitimacy or neglected confirmation.

[0090] Temporary registration is performed as in the case of the first method. At that time, the member G_iRPinputs also a mail address M_iAof his own. Then, the service generates information such as random character strings to its mail address M_iA, and the service likewise encrypts by the public key M_iPto send it to a mail address M_iAdesignated by mail. The individual decodes the information received by mail by the private key M_iSto notify the service. If the information received coincides, the service assures of the correspondence with the mail address. This process is finished to terminate the temporary registration.

[0091] In accordance with the mail address M_iAas well as the specifying information M_iIthe responsible person G_0Rjudges a candidate M_ifor the temporarily-registered member for legitimacy.

[0092] Of course, this method cannot be used if the responsible person G_0Rknows the mail address of the member M_iand cannot trust the correspondence relation between the mail address and the member.

[0093] (4) Authorization of an individual who has been already a member of another group

[0094] When authorizing an individual who has already been a member of another group, it is also possible in practical use to omit the identification of the person himself by believing that the identification of the person himself performed previously might have been sufficiently performed. To be exact, if a group, to which an individual, who is going to become a member, currently belongs, is known and identification of the person himself in the group is sufficient, the identification of the person himself can be omitted.

[0095] If the manager G_1Rof a group G₁, which is going to be authorized, knows the public key G_0RPof the manager G_0Rof the group G₀and an individual P to be authorized is a direct or indirect member of the group G₀, the correspondence relation between the public key P_Pand the specifying information P_Iof the individual P has already been assured to G_1R. Therefore, the identification of the person himself can be omitted.

[0096] In a case where the individual P has already been a member of another group, the identification of the person himself will be omitted after the system confirms the omission of the identification of the person himself at the responsible person G_1R, or automatically.

[0097] (5) Issue of Individual Certificate

[0098] In order to assure of the correspondence relation between the public key P_Pand the specifying information P_Iof the individual P even offline (without using any service provided by the server 100), there is, as an individual certificate P_C, issued pair information of the public key P_Pand the specifying information P_I, which has been electronically signed by the private key of the responsible person G_1Rof the group G₁, to which the individual P (=M_i) directly belongs.

[0099] In order to make the most of the individual certificate P_C, however, the public key G_1RPof the responsible person G_1Rof the group G₁must be known. If the G_1RPis known, the correspondence relation between P_Pand P_Ican be confirmed by confirming the electronic signature from only the individual certificate P_Ceven offline (without accessing the service).

[0100] By opening such data (shown also in FIG. 3) as shown in FIG. 6 to the public, the member public key is acquired or confirmed offline.

[0101] (6) Issue of Group Certificate

[0102] A certificate G_Cfor a group is issued. This certificate enables the ability of the group to be utilized even offline. Concretely, there is, as a group certificate G_1C(FIG. 7), issued pair information of the specifying information G_1Iand the public key G_1RPof the responsible person G_1Rof the group, which has been electronically signed by the responsible person private key G_0RSof the immediately above group G₀.

[0103] In order to confirm the correspondence relation between the public key P_Pand the specifying information P_Iof an individual P using a group certificate, it is necessary to know the responsible person public key G_nRPof the group G_nhaving the individual P as one of its direct members. If the G_nRPis not yet known, the G_nRPcan be confirmed on the assumption that the G_n−1RPwould be known through the use of a certificate of the group G_nand the responsible person public key G_n−1RPof the immediately above group G_n−1of G_n. In this way, G_iRP(0<=i<=n) is confirmed in order, such a process is advanced up to i=0, which is already known, and G_nRPis confirmed on the basis of G_0RP, which is already known, and further the correspondence relation between P_Pand P_Iis confirmed. (This process includes a process for confirming the correspondence relation between the responsible person public key G_nRPand the specifying information G_nIof the group G_n).

[0104] By opening such information as shown in FIG. 7 to the public although also shown in FIG. 5, it is made possible to acquire or confirm the responsible person public key of a group offline. Here, G₁designates the group concerned, and G₀designates the immediately above group.

[0105] (7) Inclusion of Immediately Above Group Information in Certificate

[0106] As regards the immediately above group G₀of a member M₁, the responsible person G_0Rof the immediately above group G₀can know. This is because G_0Relectronically signs on information concerning M_i, that is, assures of the legitimacy of the information. More specifically, there does not exist any immediately below member which is not designated by the responsible person G_0Rof the immediately above group G₀. For this reason, it is easy to include information specifying the immediately above group of M_iin a certificate M_Cof a member M_i. Also, in order to confirm the contents of a certain certificate M_C, it must be confirmed that the certificate M_Chas been electronically signed by the responsible person G_0Rof the immediately above group G₀of the member M. Therefore, on viewing the certificate M_C, it is convenient to obtain the group G₀corresponding to the private key G_0RP, by which the certificate M_Chas been electronically signed, from the certificate M_C. Also, there is no risk due to inclusion of the specifying information of the immediately above group.

[0107] FIG. 8 shows this construction. As compared with the construction of FIG. 7, the specifying information G_0Iof the immediately above group G₀is added.

[0108] Also, even in the case of holding information of a format, which is not a certificate, that is, the format of FIG. 5 in the service, this format as shown in FIG. 6 becomes effective. Hereinafter, the format of certificate will be described, and it will become effective even in the in-service holding format.

[0109] (8) Enumeration of Members using Group Certificate

[0110] To follow members M_ifrom the group G₁is effective because all members can be enumerated from the group. Since information indicating the immediately above group G₁is included in the certificate M_Cfor each member M_i, it is possible to enumerate the member M_iby retrieving all certificates M_iC, in which the person himself is likely to be a member, and moreover, if information on the immediately below member is included in the certificate of the group G₁in advance, it becomes possible to easily enumerate them.

[0111] The member M_iis designated by right of the responsible person G_1Rof the group G₁concerned, and only the responsible person G_1Rof the group G₁concerned must be able to change the member. To the end, the member information must have been electronically signed by the private key G_1RPof the responsible person G_1Rof the group G₁concerned. Also, the electronic signature of the responsible person G_0Rof the immediately above group G₀of the group G₁concerned must not be required. This is because no change will be possible to make without any permission by the responsible person G_0Rof the immediately above group G₀if such electronic signature is required.

[0112] In order to make this possible, member list information (for example, set of specifying information M_iIof each member M_i) is imparted to the certificate of the group G₁, only a pair of the responsible person public key G_1RPand the group specifying information G_1Iis electronically signed by the responsible person G_0Rof the immediately above group G₀, and the member list information is electronically signed by the responsible person G_1Rof the group concerned. Other portions may be covered with the signature of the responsible person G_1Rof the group concerned (for example, the entire certificate is electronically signed by G_1R).

[0113] In FIG. 9, a list of public information M_iIof the members is added as a member list.

[0114] (9) Division into Groups

[0115] By including a group lock proposed in Japanese Published Unexamined Patent Application No. 11-015373 in a group certificate, it is made possible to utilize the group certificate as the group lock. Concretely, a pair of the public key G_MPand the private key G_MSis allocated to each group G. This private key G_MScan be utilized only by a member M_iof the group. For this reason, they will be called the member public key G_MPand the member private key G_MSrespectively. Since the member private key G_MScan be utilized only by the member M_i, only the member M_iutilizes it for encipherment which can be decoded, and the like.

[0116] A member list in the group certificate is made into a shape conforming to the proposal in the Japanese Published Unexamined Patent Application No. 11-015373, that is, a list obtained by encrypting the member private key GMS by the individual public key M_iP(or the member public key of the group which is a member) of each member M_ito placing ciphers thus obtained side by side in a number corresponding to the number of the members. Since this is, of course, a member list, the whole is signed by the responsible person private key G_1RS. This construction is shown in FIG. 9.

[0117] In the member list of FIG. 10, M_iP(G_1MS) is regarded as an element. This notation of X_P(Y) indicates Y encrypted by the public key X_Pof X.

[0118] (10) Addition of Member Public Key to Group

[0119] Since it is used during encrypting to the group G₁, it is effective to be able to specify the member public key G_1MPfrom the group certificate G_1Coffline. To the end, G_1MPis added to the group certificate G_1C.

[0120] Concretely, it is necessary to prevent the member public key G_1MPfrom being changed by the third party. This is because a secret (information which can be decoded only by the members) within the limits of the members of the group G₁is to leak to others. For this reason, the member public key G_1MPis arranged within an electronic signature range by the group responsible person G_1Ror an electronic signature range by the immediately above group responsible person G_0R.

[0121] FIG. 11A shows the inclusion of the member public key G_1MPwithin the electronic signature range of the immediately above group responsible person G_0R. FIG. 11B shows the inclusion of the member public key G_1MPwithin the electronic signature range of the responsible person G_1Rof the group concerned.

[0122] (11) Indirect Designation of Responsible Person

[0123] To sign the certificate M_Cby an individual private key of the responsible person G_1RSof the immediately above group may not be preferable because it may be affected by movement or the like of the responsible person of the group G₁. Also, there may be some cases where it is desirable to designate two or more responsible persons G_Rof the group. For these reasons, there is provided a mechanism for indirectly designating responsible persons.

[0124] First, a pair of the public key G_1Pand the private key G_1Sis allocated to the group G₁. This private key G_1Scan be utilized only by the responsible person of the group G₁. This private key is called “group private key G_1S”. The group private keys G_1Sencrypted by the individual key G_1RiPof each responsible person, as in the case of the member list, using the member private key G_MSare placed side by side to form a responsible person list. Thus, what has been performed by the private key of the group responsible person so far is performed by this group private key. More specifically, 1) an electronic signature for a certificate M_Ccorresponding to an individual or a group which is a direct member, and 2) an electronic signature for a member list of the group G₁concerned will be performed by this group private key G_1S. Also, the responsible person list is assumed to be within the electronic signature range (electronically signed by the group private key G_0Sof the immediately above group G₀) by the immediately above group G₀, and to be designated by right of the responsible person G_0Rof the immediately above group G₀.

[0125] FIG. 12 shows an example of the structure of the group certificate G_1Cin which this extension has been performed. The group public key G_1Pis included in the group certificate G_1Chere. Generally, in order to easily acquire the group public key even offline, it is advantageous but not indispensable to include the group public key in the group certificate.

[0126] (12) Addition of Responsible Person Private key to Group

[0127] On indirectly designating a responsible person, the group private key G_1Smust be encrypted by the individual public key G_1RiPof the responsible person. To the end, there is required a method for the responsible person G_0Riof the immediately above group G₀to know the group private key G_1Sof the group G₁. Of course, he knew it when he designated at the beginning, but since it is risky to leave the memory to the individual, and the responsible person G_0Riof the immediately above group G₀is also likely to be changed, it is preferable to remember by relating it to the group certificate G_1Cof the group G₁.

[0128] To the end, the group private key G_1Sof the group G₁concerned encrypted by the responsible person public key G_0Pof the immediately above group G₀is included in the group certificate G_1Cof the group G₁in advance.

[0129] FIG. 13 shows an example of the structure of the group certificate.

[0130] (13) Change of Responsible Person by Responsible Person

[0131] A responsible person list provided for indirectly designating the responsible person G_1Riof the group G₁is transferred from the electronic signature range by the group private key G_0Sof the immediately above group G₀to the electronic signature range by the group private key G_1Sof the group G₁concerned, whereby the responsible person G_1Riof the group G₁concerned can change the responsible person G_1Ri.

[0132] Even if the immediately above has actually the power to appoint the responsible person, such practical use may be more flexible, and there are usually no risks.

[0133] FIG. 14 shows an example of the structure of a group certificate corresponding thereto.

[0134] (14) Drafting and Package Authorization for Member Candidate

[0135] Such an individual as the responsible person G_1Riof the group G₁may have no skill and time for performing diversified management by directly interacting with the system. To the end, on changing the member, it is arranged that another person Px can designate a candidate for the new member and that the responsible person G_1Riof the group has only to authorize by confirming the contents.

[0136] At that time, there will be required a contrivance for preventing a candidate for the new member from leaking to any other than the group responsible person G_1Riand the drafter Px, a scheme in which the group responsible person G_1Riis notified of a fact of drafting a new member candidate, and the like.

[0137] (15) Group having no Signature Ability

[0138] In the case of constituting a group representing a task force, a recreation group or the like, there may be desired to constitute such a group that designation and the like of a member M_iare made free so that, for example, the manager G_1Rican freely designate a member, further everyone can freely become a member, and each member M_ican freely withdraw although the approval of the manager G_1Riis required when becoming a member. Such a special group will be called “non-certification group” because it cannot have any certification ability. Also, any groups other than the non-certification group will be specially called “certification group”.

[0139] The non-certification group has no ability to certify a member although it can designate the member. This is because it designates a member in accordance with a free and unique policy. To the end, an individual, whom the non-certification group has as a member, must have already been certified by the certification group. This is because there is no method whereby the public key of an individual not certified is trusted. However, it is possible for a non-certification group to have another non-certification group as a member.

[0140] In order to realize a non-certification group, information indicating the classification of the group is included in the group information (such as group certificate) The information indicating the classification of this group is included in the signature range of the immediately above group G₀. If “non-certification group” is recognized from the classification, it is arranged that the member cannot be certified, and if there should be a certificate certified by the non-certification group, the certification will not be accepted.

[0141] FIG. 15 shows an example of the structure of a group certificate G_1Ccorresponding thereto.

[0142] (16) Authorization of Immediately Above Group

[0143] Until now, if the public key of a certain group is known, it has been possible to know the public key of its direct or indirect member. Thus, in case where a higher level group is formed, when the public key of the group is changed, the user individually must take an action to “know the public key of a reference group”. Also, for the method to “know the public key of a reference group”, other appropriate methods should be determined, but there are often present security holes with the methods.

[0144] When a group G_nis going to certify an individual or a group as a member, the member (individual or group) M_ito be certified will be imposed to authorize G_nconversely. By doing so, each member M_iis capable of knowing the legitimacy of the group G_nwhich authorized the person himself, and is also capable of knowing the public key G_nPof G_n. Similarly, the group G_nis capable of knowing the public key G_n-1Pof the immediately above group G_n-1. In this way, the public key G_0Pof the highest level group G₀can be reflexively known.

[0145] As the concrete method, there are conceivable the following several methods by the group responsible person, similar to the identification of the person himself of a member. In any case, if the immediately above group is authorized, there can be adopted such a method as to indicate its authorization by placing the electronic signature of its own on the group certificate (or information on the interior of the service corresponding thereto) of the immediately above group.

[0146] Near a point of time (before, after or at the same time) whereat the manager G_nRof the group G_nauthorizes the member Hi as a member, the group manager G_nRnotifies the member M_iof authorization as a member, and the specifying information G_nIof the group orally or by a method of telephone or the like. Since the member M_iis personally acquainted with the group manager G_nR, the member M_ican recognize that it is certainly information from G_nR. The member M_ielectronically signs the group certificate G_nC. As regards an actual operation of the member M_i, the client system recognizes the request for authorization, and displays the specifying information G_nIof the group G_n, inquiring whether or not the member M_irecognizes. When answering that it is determined, the client system will electronically sign the group certificate G_nC. Such a method can be also adopted.

[0147] (17) Omission of Immediately Above Group's Authorization

[0148] When becoming a member of a group, whose public key is known directly or indirectly, the authorization to the group is omitted.

[0149] (18) Restriction to Same Group Hierarchy

[0150] When there exists already a group hierarchy, whose public key a certain individual knows directly or indirectly, the authorization of groups which do not belong to the group hierarchy is rejected. This prevents belonging to an illegitimate group hierarchy.

[0151] For example, in case where a group hierarchy is illegitimately formed in imitation of an actual group hierarchy and it is requested to become one group forming the illegitimate group hierarchy, if it has structure having a close imitation of the actual group hierarchy, there is a possibility that the individual cannot see through any illegitimacy but authorizes becoming a member. If he authorizes it and sends information, to which he can refer, to an legitimately-pretended illegitimate group or individual belonging to the illegitimate group hierarchy, the information will be stolen. The provision of a rejection rule shown here enables the risk to be eliminated.

[0152] Next, the description will be made of concrete processing of the certification mechanism. In this respect, since the individual concrete processing can be easily understood from the drawings, the detailed description will be omitted. In the following description, the individual certificate shown in FIG. 16 and the group certificate shown in FIG. 17 will be used. Also, the server 100 also holds the same information.

[0153] (1) Server Install (FIG. 18)

[0154] This process installs software for certification for further initializing. In the server 100, the server manager installs. As regards registration of a service name, registration of a manager, and preparation of a service key pair, the description will be made in FIGS. 19, 20 and 21 respectively.

[0155] (2) Registration of Service Name (FIG. 19)

[0156] Registration of a service name is called from the server install (FIG. 18). The service name is registered so as not to overlap other service names. The other service notifies the service name registration process of the service name in such a mode that security has been obtained by electronic signature, and is adapted to prompt re-input if the service name is overlapped. The service name is registered in the public secondary memory 102 in the server 100.

[0157] (3) Registration of Manager (FIG. 20)

[0158] Registration of a manager is also called from the server install (FIG. 18). This process is to register the pass phrase of the manager with the closed secondary memory 101 in the server 100.

[0159] (4) Preparation of Service Key Pair (FIG. 21)

[0160] Preparation of a service key pair is also called from the server install (FIG. 18). The service public key is registered in the public secondary memory 102 in the server 100, and the service private key is registered in the closed secondary memory 101 in the server 100.

[0161] (5) Registration of Initial Group Responsible Person (FIG. 22)

[0162] The initial group responsible person is registered by the initial group responsible person from the client 200 of his own. This processing is actually the same as the following individual registration.

[0163] (6) Individual Temporary Registration (FIG. 23)

[0164] This processing is performed by each individual from the client 200 of each person. The individual temporary registration is to store a pair of the individual specifying information and the public key (contents of registration) electronically signed by the individual private key in a temporary registrant list (public secondary memory 102 in the server 100). The contents of target registration are safely sent to the server 100 using the public key of the server 100. The process of the server 100 is to confirm the legitimacy of the electronic signature by the individual private key for registration. As regards acquisition of the server public key, the description will be made below.

[0165] (7) Acquisition of Server Public Key (FIG. 24)

[0166] An acquisition process of the server public key is called from the individual temporary registration (FIG. 23). In a case where the client 200 has the server public key in the closed secondary memory 201, it is used. Otherwise, the client 200 refers to other services and thereafter, acquires the server public key to hold it in the closed secondary memory 201.

[0167] In this respect, “loop start” and “loop end” in FIG. 24 represent a start and an end of the loop respectively.

[0168] Therefore, the processes interposed between the loop start and the loop end are repeated in a number of times of all other existing services.

[0169] Since the symbol of the loop end represents only the termination of the loop, the interior of the symbol is blank.

[0170] Further, the symbol of loop is likewise used also in other figures (FIGS. 19, 32 and 35).

[0171] (8) Creation of initial group (FIG. 25)

[0172] In this example, the manager creates an initial group in an arbitrary client 200 or the server. Of course, the group responsible person himself may individually create it. First, it is confirmed that it is the manager. For this, please see FIG. 26. The manager performs 1) input of group specifying information, 2) creation of the group public key and private key, 3) identification of the person himself of a candidate for the group responsible person, 4) creation of certificate data and the like to send the data for certification to the server 100 together with the manager pass phrase. The server 100 confirms the manager pass word (FIG. 26), and signs the data for certification and the responsible person information to register in the certificate list (public secondary memory 102).

[0173] (9) Identification that it is the Manager (FIG. 26)

[0174] The identification of the manager is called from the creation process of an initial group (FIG. 25). The manager is identified by, for example, a challenge and response technique. The server 100 creates character strings at random to send to the manager client 200. The manager client 200 hashes the character strings using the manager pass phrase to return the arithmetic result to the server 100. The server 100 performs a similar calculation, checks it against the arithmetic result sent from the manager, and if they coincide with each other, identifies that it is the manager.

[0175] (10) Identification of the Person Himself (By Manager) (FIG. 27)

[0176] The identification of the person himself for a candidate for the responsible person by the manager is called from the creation process of an initial group (FIG. 25). In order for the manager to perform the identification of the person himself, information (character string information) for identification of the person himself is sent from the manager client 200 to the server 100, and the manager notifies the target candidate for the responsible person of the character string information for identification of the person himself offline. The candidate for the responsible person electronically signs the character string information concerned by the private key of his own in the client 200 to send it to the server 100. In this respect, security is ensured by the server public key between the client servers. The server 100 confirms the electronic signature using the public key of the responsible person candidate, and further confirms the coincidence of the character string information to identify the person himself.

[0177] (11) Identification of the Person Himself (in general)

[0178] Generally, the identification of the person himself is a process of identifying a temporarily-registered individual as the person himself by any other than the manager. An identifier (group responsible person) performs in the client 200 of his own. The identifier inputs character string information for identification to the client 200, and sends to the target person offline. The target person electronically signs the character string information by the private key of his own in order to indicate his confirmation, and sends it to the client 200 of the identifier. In information transmission between identifier and target person, a cryptogram based on the identifier's public key is used. The identifier identifies the electronic signature of the information sent from the target person by the target person's public key, further checks both character string information, and if they coincide with each other, the identification of the person himself is successfully terminated.

[0179] (12) Preparation of Member Candidate List (FIG. 29)

[0180] Preparation of a member candidate list is a process of temporarily designating, when there is an existing group, a member of the group, and an arbitrary individual (who may be the responsible person himself) performs at the client 200 by himself. A member candidate list prepared is sent to the group responsible person, who authorizes or rejects it (FIG. 32). In this process, there are performed 1) identification of an operator (FIG. 30), specifying the group and designation of a new member (FIG. 31), 2) sending information on the member candidate list to the server 100, and 3) sending the member candidate list to the target group responsible person by the server 100.

[0181] (13) Identification of Operator (FIG. 30)

[0182] This process is called from the preparation of the member candidate list. In order to perform this process, the information sent from the server 100 is electronically signed by the operator's private key at the operator client 200, and this is identified by the server 100. The information from the server 100 is character strings generated at random to avoid attack.

[0183] (14) Identification of New Member (FIG. 31)

[0184] This process is also called from the preparation of the member candidate list. The process differs depending upon whether the member candidate is an individual or a group.

[0185] (15) Authorization of Candidate List (FIG. 32)

[0186] On receipt of a member candidate list from the server, the group responsible person authorizes the candidate list. Concerning this process, since the flow becomes complicated, the description will be made with reference to the figures. This process is roughly as follows:

[0187] 1) Identification of Operator (S10)

[0188] This is the same process as in FIG. 30. The identification is performed by using the operator's electronic signature. This identification also confirms that the operator is the responsible person of the group concerned at the same time.

[0189] 2) Confirmation of Member Designation (S11, S12)

[0190] The group responsible person confirms group designation displayed, and after the confirmation, the process proceeds to the next step. Otherwise, it is made to be an error.

[0191] 3) Preparation to Prepare New Group Certificate (S13 to S16)

[0192] The member list is made empty, and the group member private key is restored to its original state. More specifically, the group private key (G_1S, D) is decoded, and G_1S(G_1MS) (inscribed as S in the figure) is decoded by the group private key decoded to obtain the group member private key (G_1MS, T).

[0193] 4) Process for Target included, as Member, in New Group as well as Conventional Group (S17 to S20)

[0194] The group member private key (G_1MS, T) is encrypted by the member public key. In this respect, the loop process including FIG. 32 is represented by interposing between a rectangle having broken-off right and left corners on the upper side (for example, S17) and a rectangle having broken-off right and left corners on the lower side (for example, S20).

[0195] 5) Process for Target included in New Group although not included in Conventional Group (S21 to S46)

[0196] In a case where the member is an individual, Steps S39 to S45 will be performed. If the individual member has already had a certificate, the certificate will be electronically signed by the responsible person's group private key G_1S(D) (the responsible person identifies the individual concerned to be a member of the group, S40). Thereafter, the member individual authorizes the group (see S43, FIG. 33). After authorized by the responsible person and the individual in this manner, the group member private key G_1MS(T) is encrypted by the member public key to be added to the list (S44 and S45). In a case where the individual member has no certificate, the member is identified as the person himself (S41) and a pair of the public key and the specifying information is electronically signed by the responsible person's group private key (S42). Thereafter, the process will be executed in the same manner as the case where he has already had the certificate (S43 to S45).

[0197] In a case where the member is a group, Steps S23 to S38 will be performed. In this case, since the immediately above group of the target group is changed (may be added), the certificate for the target group is changed to be registered in the server 100. In a case where the responsible person of the target group has a certificate, the group is certified directly by the responsible person of the target group (S25, FIG. 33). In a case where the responsible person of the target group has no certificate, the responsible person of the target group concerned is first identified as the person himself (S24).

[0198] Thereafter, of the information on the group certificate of the target group, the information and signature of the immediately above group are changed (S26 to S35), and further, the entire contents of the certificate are signed by using the group private key of the target group to be registered in the server 100 as a new certificate (S36 to S38).

[0199] 6) Process for Target not included in New Group although included in Conventional Group (S47 to S51)

[0200] The specifying information of such a member and a request (“deletion request information”) to delete this are coupled, and are signed by the group private key to be sent to the server 100. In response thereto, the server 100 deletes the old member (S50, FIG. 34).

[0201] 7) Structure of Certificate (S52 to S54)

[0202] As described above, a certificate, in which the member has been changed, is prepared to be registered in the server 100.

[0203] (16) Group Authorization (FIG. 33)

[0204] Group authorization is a process of authorizing a group from the member side on becoming a member of the group, and is called from the authorization (FIG. 32) of a candidate list.

[0205] (17) Deletion of Certificate (FIG. 34)

[0206] Deletion of a certificate is a process of deleting a certificate which has become invalid when the member of the group is changed and has ceased to be the member, and is called from the authorization (FIG. 32) of a candidate list.

[0207] (18) Confirmation of Certificate (FIG. 35)

[0208] Confirmation of a certificate is a process of confirming the correspondence relation between a group or an individual indicated by the specifying information and its public key by confirming a chain of signatures for a group certificate and an individual certificate, which are the original purposes of the Certification Authority, and a process of putting encipherment of information, confirmation of electronic signatures and the like into practice by an arbitrary individual, who must confirm the legitimacy of the public key, in the client of his own.

[0209] As described above, according to the present invention, certification is dispersedly performed with the responsible person of a group as the center within an organization such as an enterprise, and therefore, the certification can be performed uniformly and fairly without necessitating the existence of any fair third party, and a group such as a department and a section can be easily handled.