Hitachi, Ltd.

Shingo Hane

Takahiro Fujishiro

Yoko Hashimoto

Masahiko Furuya

Akane Sato

Tadashi Kaji

Yoko Kumagai

Masami Uzawa

Hitoshi Shimonosono

Masami Ogawa

Hiromi Nagano

A validation server using HSM, which reduces required process time from receiving a validation request to responding with a validation result, and comprises a first software cryptographic moduleand a second software cryptographic moduleon a validation serverwhose HSM is coupled with an I/F part. According to the validation server, load states of HSM, the first software cryptographic moduleand the second software cryptographic moduleare monitored by a cryptographic module monitor unit, and when cryptographic calculations in a validation process of certificates are conducted, the cryptographic calculations are executed by using the least loaded cryptographic module selected at a cryptographic module selector unit

Validation server, validation method, and program

In response to a validation request that includes second information identifying the certificate authority, key information of the certificate authority at issuance of the public key certificate, and information identifying the public key certificate, if the second information identifying the certificate authority included in the validation request corresponds to the first information identifying the certificate authority included in the authority certificate, and the information identifying the public key certificate included in the validation request does not exist in the revocation information, the validation server creates a validation result indicating that the public key certificate corresponding to the information identifying the public key certificate included in the validation request is valid.

Method of validation public key certificate and validation server

A validation authority for certificates searches for and verifies paths and certificate revocation lists periodically, and classifies the paths into valid paths and invalid paths in accordance with the results of the validations, so as to register the paths in databases beforehand. Besides, in a case where a request for authenticating the validity of a certificate has been received from an end entity, the validation authority judges the validity of the public key certificate by checking in which of the valid-path database and the invalid-path database a path corresponding to the request is registered. On the other hand, in a case where the path corresponding to the validity authentication request is not registered in either of the databases, the validity of the public key certificate is authenticated by performing path search and validation anew.

Method, product and apparatus for accelerating public-key certificate validation

A certificate validation method for causing a certificate validation server to receive a certificate validation request from a given terminal device, build a certification path of from a first certificate authority (CA) to a second CA, perform validation of the certification path, and send a validation result to the terminal which issued the certificate validation request is disclosed. The validation server detects either a key update of any given CA or a compromise of the given CA, acquires a certificate of relevant CA and first certificate status information and second certificate status information, stores the acquired information in a storage unit or, alternatively, updates the information stored in the storage based on the acquired information, and performs the building of a certification path and validation of the certification path by use of the information of the storage unit.

Certificate validation method and certificate validation server and storage medium

Method and apparatus for accelerating public-key certificate validation

In response to a sign request including a digital document from a document-creating device, a digital-signed-document exchange supporting servercanonicalizes the digital document, calculates a digest value thereof, and returns the digest value to the document creating device. When the document-creating device transmits a digital sign created by encrypting the digest value to the digital-signed-digital document exchange-supporting server, the servercreates a digital-signed document from the digital sign and the digital document, and returns the document to the document-creating device. On the other hand, in response to a validation request including a digital-signed-digital document and a public key from a sign validating device, the servercompares a value resulting from the decryption of the digital sign with the public key and a digest value of the digital document canonicalized and returns the result to the sign validating device.

Digital-signed digital document exchange supporting method and information processor

If a CRL is cached for an increased speed of a certificate validation process, when a certification authority issues a CRL in an urgent situation, the accuracy of the certificate validation result cannot be secured because the cached CRL is not the latest one. This problem is solved as follows. When it issues a CRL, the certification authority sends a CRL issuance notification to certificate validation servers. The certificate validation servers that received the CRL issuance notification cache the latest CRL. Thus, the accuracy of the certificate validation result can be secured.

Growing community of inventors

Tokyo, Japan

Shingo Hane