Authentication System, CE Device, Mobile Terminal, Key Certificate Issuing Station, And Key Certificate Acquisition Method
Provided is an authentication system for improving user-friendliness. An IC card ( 100 ) of the authentication system ( 10 ) includes: a key/certificate storage unit ( 120 ) connected to a terminal device ( 200 ) and capable of storing a key pair and a temporary certificate or a permanent certificate while correlating them; a CE temporary public key certificate acquisition unit ( 170 ); and a CE public key/certificate acquisition control unit ( 150 ) connected to a CE device ( 300 ). When the key/certificate storage unit ( 120 ) has a key pair not correlated either to a temporary certificate or a permanent certificate, the CE temporary public key certificate acquisition unit ( 170 ) acquires a temporary certificate corresponding to the key pair from a public key certificate issuing station ( 400 ) by using the mobile terminal ( 200 ) and causes the key/certificate storage unit ( 120 ) to store it. When the key/certificate storage unit ( 120 ) has a key pair correlated a temporary certificate but not to a permanent certificate, the CE public key/certificate acquisition control unit ( 150 ) acquires a permanent certificate from the public key certificate issuing station ( 400 ) by using the temporary certificate via the CE device ( 300 ) and causes the key/certificate storage unit ( 120 ) to store it.
1 . An authentication system having a mobile terminal, a CE device, an IC card that is connectable to the mobile terminal and the CE device, and a key certificate issuing station that issues a temporary certificate and permanent certificate for a key pair composed of a public key and private key used by the CE device,
wherein the IC card comprises:
a storage section that is capable of storing the key pair and the temporary certificate or the permanent certificate in mutually associated form;
a first key certificate acquisition section that acquires a temporary certificate corresponding to the key pair from the key certificate issuing station using the mobile terminal and stores this in the storage section when the first key certificate acquisition section is connected to the mobile terminal and the key pair that is not associated with either the temporary certificate or the permanent certificate exists in the storage section; and
a second key certificate acquisition section that acquires the permanent certificate from the key certificate issuing station using the temporary certificate via the CE device and stores this in the storage section when the second key certificate acquisition section is connected to the CE device and the key pair that is associated with the temporary certificate but is not associated with the permanent certificate exists in the storage section.
2 . The authentication system according to claim 1 , wherein:
when the first key certificate acquisition section is connected to the mobile terminal and the key pair that is not associated with either the temporary certificate or the permanent certificate exists in the storage section, the first key certificate acquisition section sends a temporary certificate issuance request corresponding to the key pair to the mobile terminal; and
the mobile terminal comprises a third key certificate acquisition section that, on reception of the temporary certificate issuance request, acquires the temporary certificate from the key certificate issuing station via a secure channel using a terminal key pair and terminal key certificate of that apparatus, and sends that temporary certificate to the IC card.
3 . The authentication system according to claim 1 , wherein:
when the second key certificate acquisition section is connected to the CE device and the key pair that is associated with the temporary certificate but is not associated with the permanent certificate exists in the storage section, the second key certificate acquisition section sends a permanent certificate issuance request including the key pair and the temporary certificate to the CE device; and
the CE device 300 comprises a fourth key certificate acquisition section that, on reception of the permanent certificate issuance request, acquires the permanent certificate from the key certificate issuing station via a secure channel using the temporary certificate, and sends that permanent certificate to the IC card.
4 . The authentication system according to claim 2 , wherein:
the third key certificate acquisition section, on reception of the temporary certificate issuance request, transmits the temporary certificate issuance request to the key certificate issuing station via a secure channel using a terminal key pair and terminal key certificate of that apparatus; and
the key certificate issuing station comprises:
an issuing station storage section that is capable of storing the temporary certificate or the permanent certificate and the terminal key certificate in mutually associated form; and
a temporary certificate issuance control section that, on reception of the temporary certificate issuance request, issues the temporary certificate and transmits that temporary certificate to the third key certificate acquisition section, and also stores the issued temporary certificate and the terminal key certificate of the mobile terminal that is a transmission source of the temporary certificate issuance request in the issuing station storage section in mutually associated form.
5 . The authentication system according to claim 3 , wherein:
the fourth key certificate acquisition section receives the permanent certificate issuance request, and transmits that permanent certificate issuance request to the key certificate issuing station via a secure channel using the temporary certificate; and
the key certificate issuing station comprises:
an issuing station storage section that is capable of storing the temporary certificate or the permanent certificate and the terminal key certificate in mutually associated form; and
a permanent certificate issuance control section that searches the issuing station storage section in response to the permanent certificate issuance request, and when the temporary certificate included in the permanent certificate issuance request is stored in the issuing station storage section, issues the permanent certificate and transmits this to the fourth key certificate acquisition section, and also stores that permanent certificate and identification information of the CE device that is a transmission source of the permanent certificate issuance request in the information storage section.
6 . The authentication system according to claim 1 , wherein:
the key certificate issuing station comprises:
a storage section that stores destination information relating to the mobile terminal; and
a confirmation section that, before the permanent certificate is issued and transmitted to the CE device, transmits an issuance permission confirmation notification to the mobile terminal using the destination information.
7 . An IC card comprising:
a storage section that is capable of storing a key pair and a temporary certificate or permanent certificate in mutually associated form;
a first key certificate acquisition section that acquires a temporary certificate corresponding to the key pair from a key certificate issuing station using the mobile terminal and stores this in the storage section when the first key certificate acquisition section is connected to a mobile terminal and the key pair that is not associated with either the temporary certificate or the permanent certificate exists in the storage section; and
a second key certificate acquisition section that acquires the permanent certificate from the key certificate issuing station using the temporary certificate via the CE device and stores this in the storage section when the second key certificate acquisition section is connected to the CE device and the key pair that is associated with the temporary certificate but is not associated with the permanent certificate exists in the storage section.
8 . A CE device comprising a key certificate acquisition section that is connected to the IC card according to claim 7 , receives a permanent certificate issuance request from the second key certificate acquisition section of that IC card, transmits that permanent certificate issuance request to the key certificate issuing station via a secure channel using a temporary certificate, receives the permanent certificate issued by the key certificate issuing station in response to that permanent certificate issuance request, and sends that permanent certificate to the IC card.
9 . A mobile terminal comprising a key certificate acquisition section that is connected to the IC card according to claim 7 , and, on reception of a temporary certificate issuance request from the first key certificate acquisition section of that IC card, transmits the temporary certificate issuance request to the key certificate issuing station via a secure channel using a terminal key pair and terminal key certificate of that apparatus, receives the temporary certificate issued by the key certificate issuing station in response to that temporary certificate issuance request, and sends that temporary certificate to the IC card.
10 . A key certificate issuing station that performs communication with the CE device according to claim 8 , the key certificate issuing station comprising:
an issuing station storage section that is capable of storing a temporary certificate or permanent certificate and a terminal key certificate in mutually associated form; and
a permanent certificate issuance control section that searches the issuing station storage section in response to a permanent certificate issuance request from a key certificate acquisition section of the CE device, and when the temporary certificate included in the permanent certificate issuance request is stored in the issuing station storage section, issues the permanent certificate and transmits this to the key certificate acquisition section of the CE device, and also stores that permanent certificate and identification information of the CE device that is a transmission source of the permanent certificate issuance request in the issuing station storage section.
11 . A key certificate issuing station that performs communication with the mobile terminal according to claim 9 , the key certificate issuing station comprising:
an issuing station storage section that is capable of storing a temporary certificate or permanent certificate and a terminal key certificate in mutually associated form; and
a temporary certificate issuance control section that issues the temporary certificate in response to a temporary certificate issuance request from a key certificate acquisition section of the CE device and transmits that temporary certificate to the key certificate acquisition section of the CE device, and also stores the issued temporary certificate and the terminal key certificate of the mobile terminal that is a transmission source of the temporary certificate issuance request in the issuing station storage section in mutually associated form.
12 . A key certificate acquisition method that acquires a permanent certificate of a key used by a CE device, the key certificate acquisition method comprising:
a step of connecting an IC card and a mobile terminal, and the IC card, when the key that is not associated with either the permanent certificate or the temporary certificate exists in a storage section of the IC card, acquiring a temporary certificate corresponding to the key from the key certificate issuing station using the mobile terminal; and
a step of connecting the IC card and the CE device, and the IC card acquiring the permanent certificate from the key certificate issuing station using the temporary certificate via the CE device.