Communication apparatus and authentication apparatus

A communication apparatus with a memory (418) holding CA information A(301a) including (i) a CA certificate A(106a) indicating that an AP server certificate A(402a) (that indicates the validity of an application server (401)) is valid and (ii) a URL B(302b) indicating the URL of a download server B(406b) where CA information B(301b) including the next valid CA certificate B(106b) is stored. The communication apparatus also having a server authentication unit (416) verifying the AP server certificate A(402a) using the CA certificate A(106a), and having a CA information update unit (417) obtaining the CA information B(301b) from the download server B(406b) indicated by the URL B(302b), wherein, when the CA certificate A(106a) becomes revoked, the server authentication unit (416) authenticates the application server (401) using the CA certificate B(106b) included in the CA information B(301b) obtained by the CA information update unit (417).

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to a communication apparatus and the like as a client that receives a service from a server after checking the validity of such server, and particularly to a communication apparatus and the like for verifying a server certificate issued by a certificate authority.

2. Description of the Related Art

In recent years there has been rapid proliferation as well as an expanding use of the Internet, and there are a variety of services utilizing the Internet such as E-mail and Internet shopping. Behind this trend, however, there are problems of tapping and tampering of data such as individual information that is carried over the Internet. In order to prevent attacks from malicious third parties, a variety of security techniques have been conceived and employed. Such security techniques include cryptography for preventing data contents from being leaked, even when such data is tapped while being transmitted, and authentication for checking whether data has not been tampered in the course of transmission.

A technology known as SSL (Secure Sockets Layer) is a security technique that utilizes cryptography and authentication and that is often employed on the Internet. SSL, which is disclosed in U.S. Pat. No. 5,657,390, for example, is a technology for providing a communication that ensures that (1) a server is authenticated, (2) data is not leaked in the course of communication, and (3) the contents of data that the client is to receive has not been tampered in the course of communication.

Referring toFIGS. 1 and 2, a description is given of an overview of an SSL communication method.

FIG. 1is a diagram illustrating how key information and certificates are prepared in SSL. This drawing shows a server103and a client102that carry out a secret communication, and a certificate authority101that issues a server certificate indicating the validity of the server103.

A CA public key104is a public key corresponding to the private key of the certificate authority101. A CA private key105is the private key of the certificate authority101. A CA certificate106is a certificate indicating that a server certificate issued by the certificate authority101is valid. A server public key107is a public key corresponding to the private key of the server103. A server private key108is the private key of the server103. A server certificate109is a certificate indicating the validity of the server103. And a signature110is a signature created by the certificate authority101on the server certificate109.

FIG. 2is a diagram showing an SSL communication protocol. InFIG. 2, a communication common key201is a common key to be used in a secret communication.

The certificate authority101previously generates a key pair consisting of the CA public key104and the CA private key105, and generates, at the same time, a CA certificate106that describes the CA public key104and information concerning the certificate authority101.

Before starting the operation, the server103first generates a key pair consisting of the server public key107and the server private key108. Then, the server103sends, to the certificate authority101, the server public key107and information concerning the server103, so as to request for the issue of a server certificate109.

Using the CA private key105, the certificate authority101creates a signature110from information received from the server103and other necessary information, and issues, for the server103, a server certificate109that is the result of putting together the information from the server103, the other necessary information, and the signature110.

The server103stores the received server certificate109.

Meanwhile, the client102previously obtains the CA certificate106from the certificate authority101, and stores it.

The following describes how the client102and the server103actually carry out a secret communication.

When getting connected to the server103, the client102negotiates with the server103which encryption specification to use in the secret communication.

Next, the server103sends the server certificate109to the client102.

Then, the client102verifies if the server certificate109is valid or not using the CA public key104which the client102stores in itself. When the server certificate109is valid, i.e., the signature110included in such server certificate109is one created by use of the CA private key105, it is possible for the client102to verify the validity of the server certificate109using the CA public key104.

After verifying that the server certificate109is valid, the client102randomly generates information about common key generation on the client side (hereinafter referred to as “client-side common key generation information), and sends the generated information to the server103.

Meanwhile, the server103randomly generates information about common key generation on the server side (hereinafter referred to as “server-side common key generation information), and sends the generated information to the client102.

Then, the server103and the client102generate a communication common key201using the above server-side common key generation information and client-side common key generation information.

Through the above operation, it becomes possible for the client102and the server103to share the communication common key201.

From then on, by using the communication common key201to encrypt and decrypt data to be transmitted, it becomes possible for the client102and the server103to carry out a secret communication.

Note that the X.509 certificate format defied by the ITU-T (International Telecommunication Union-Telecommunication Standardization Sector) is often employed as the format of a CA certificate106and a server certificate109.

According to the X.509 certificate format, a server certificate109needs to describe the validity period. This is because the security of a private key depends on the fact that it takes sufficiently long time to calculate the private key from the public key and communication data, meaning that there is a higher possibility that the private key will be exposed if the same key continues to be used for a longer period of time.

Similarly, a CA certificate106is also required to describe the validity period, which is longer than that of a server certificate109in general.

Meanwhile, when the validity period of a CA certificate expires, or when the CA private key is exposed due to some cause, it is necessary to immediately generate a new key pair and to issue/obtain a new CA certificate.

For example, in the case where (1) there are a sufficient number of certificate authorities which are available at the same time, (2) a client has a sufficient computer resource such as a PC (Personal Computer), and (3) such client can therefore posses all or a required number of CA certificates of the certificate authorities, it is possible for a server to use a server certificate that was issued by another certificate authority other than a revoked certificate authority. In this case, the client verifies such server certificate by using, one after another, the CA certificates which it possesses. When the client can verify the validity of the server certificate by using any one of such CA certificates, it is possible for the client to verify that such server is an authenticated server.

Meanwhile, when a certificate authority is newly established, the user of a client apparatus can obtain a CA certificate of such certificate authority from the certificate authority itself or from a reliable server, and then installs the obtained CA certificate in its client apparatus.

Also, there are apparatuses and methods for automatically renewing a server certificate when the validity period of the server certificate is close to expiring and when the server certificate gets revoked. Such techniques are disclosed, for example, in Japanese Laid-Open Patent publication No. 2001-197054 and Japanese Laid-Open Patent publication No. 2002-215826.

With the above existing techniques, however, if a client apparatus is a home appliance, for example, that is not equipped with a sufficient amount of resources including a memory, there is a problem that it is difficult for such client apparatus to possess many CA certificates at the same time and to be equipped with a program or a circuit for authenticating a server by use of plural CA certificates.

Furthermore, if a client apparatus does not have a clock (calendar/timer) or any means for setting the clock to the correct time, it is difficult for such client apparatus to check the validity period of a CA certificate, which causes the problem that such client apparatus cannot renew the CA certificate automatically even when the end of the validity period is approaching.

The present invention has been conceived in view of the above problems, and it is an object of the present invention to provide a communication apparatus, an authentication apparatus, and the like which make it possible to verify the validity of a server, with a CA certificate being renewed in a safe and secure manner, even when the communication apparatus is equipped only with a small amount of resources.

BRIEF SUMMARY OF THE INVENTION

In order to achieve the above object, the communication apparatus according to the present invention is a communication apparatus for verifying validity of a server that is connected to said communication apparatus via a communication network, comprising: a first storage unit operable to hold first CA information that includes a first CA certificate and a next address for update, the first CA certificate indicating that a server certificate that indicates the validity of the server is valid, and the next address for update indicating a location, on the communication network, of a download server on which second CA information is placed, said second CA information including a second CA certificate to be a next valid CA certificate in a case where said first CA certificate becomes revoked; an authentication unit operable to authenticate the server by verifying the server certificate using the first CA certificate; and a CA information update unit operable to obtain the second CA information from the download server indicated by the next address for update, wherein when the first CA certificate becomes revoked, the authentication unit thereafter authenticates the server using the second CA certificate included in the second CA information obtained by the CA information update unit. Accordingly, since it becomes possible to obtain the second CA certificate which is the next valid CA certificate by making an access to the download server indicated by the next address for update included in the first CA information, it is no longer necessary for the communication apparatus to pre-store a plurality of CA certificates. Thus, even if the communication apparatus is a home appliance and the like with a small amount of resources such as memory, it becomes possible for the communication apparatus to verify the validity of the server, with the CA certificate being renewed.

Here, the CA information update unit may try to connect to the download server periodically, and obtain the second CA information from the download server when said connection succeeds. Accordingly, since it becomes possible for the communication apparatus to obtain the second CA certificate which is the next valid CA certificate by setting up the download server before a certain period of times before the end of the validity period of the first CA certificate, it is no longer necessary to manage the validity period using a calendar, a timer, or the like, meaning that such communication apparatus is required to be equipped with only a small amount of resources.

Moreover, the CA information update unit may try to connect to the download server when the authentication unit has failed to authenticate the server using the first CA certificate, and obtain the second CA information from the download server when said connection succeeds. Accordingly, even in the case where the first CA certificate gets revoked before its validity period, it becomes possible for the communication apparatus to obtain, from the download server, the second CA certificate which is the next valid CA certificate, immediately after such revocation.

Moreover, the authentication unit may try to authenticate the server using the second CA certificate included in the second CA information obtained by the CA information update unit, and when said authentication succeeds, thereafter authenticate the server using the second CA certificate instead of the first CA certificate. Accordingly, it becomes possible to switch the CA certificate from the first CA certificate to the second CA certificate as soon as such second CA certificate becomes valid, as a result of which the communication apparatus is not required to manage the validity periods of the first and second CA certificates.

Furthermore, the communication apparatus with the above configuration may further comprise a second storage unit operable to hold the second CA information, and in said communication apparatus, the CA information update unit may store, into the second storage unit, the second CA information obtained from the download server, and when the first CA certificate becomes revoked, the authentication unit may thereafter authenticate the server using the second CA certificate included in the second CA information stored in the second storage unit. Furthermore, when the first CA certificate becomes revoked, the authentication unit may move the second CA information stored in the second storage unit into the first storage unit, and thereafter authenticate the server using the second CA certificate included in the second CA information stored in the first storage unit. By repeating the processing of holding CA certificates equivalent to only two generations, i.e., the currently valid CA certificate (first CA certificate) and the next valid CA certificate (second CA certificate) according to the above usage of memories, with the current CA certificate being renewed when necessary, it becomes no longer necessary for the communication apparatus to unnecessarily hold a larger number of CA certificates.

Moreover, the CA information update unit may obtain, from the download server, a download server certificate indicating validity of said download server, and obtain the second CA information after authenticating the validity of the download server based on said obtained download server certificate. Accordingly, since the communication apparatus obtains the second CA information after verifying the validity of the download server itself, it becomes possible to obtain the authentic second CA information in a secure manner.

Note that not only is it possible to embody the present invention as a communication apparatus (client apparatus) with the above configuration, but also as (i) a method for verifying the validity of a server that includes, as its steps, the processes performed by the communication apparatus, (ii) an authentication apparatus (certificate authority) for issuing server certificates and CA information to the communication apparatus, (iii) an authentication method that includes, as its steps, the processes performed by such authentication apparatus, (iv) a program that causes a computer to execute the steps included in the above methods, (v) a recording medium on which such program is stored, and (vi) a method for operating an authentication system that includes, as its steps, the procedure for operating the authentication apparatus and download server.

As described above, the present invention makes it possible for an apparatus with a small amount of resources to obtain and renew a CA certificate in a reliable manner, without needing to care about when the validity period of a CA certificate expires. Therefore, the present invention is extremely useful especially in an authentication system which includes, as a client apparatus, a home appliance and the like.

As further information about the technical background to this application, Japanese Laid-Open Patent application No. 2003-098596 filed on Apr. 1, 2003, is incorporated herein by reference.

DETAILED DESCRIPTION OF THE INVENTION

The following describes the embodiments of the present invention with reference to the drawings.

First Embodiment

Referring toFIGS. 3 and 4, a description is first given of the first embodiment of the present invention.

FIG. 3is a diagram showing the configuration of a communication system according to the present embodiment. This communication system is formed of a certificate authority A101a, a certificate authority B101b, an application server401, a client415, and a download server B406b, which are connected over a communication network such as the Internet. Here, the application server401shall first be authenticated by the certificate authority A101aand then by the certificate authority B101b, due to the approaching of the validity period and the like.

The application server401, which is a computer apparatus and the like for providing a service in a specific application system (e.g., providing the latest firmware to a DVD player of a specific manufacturer), possesses an AP server private key A404aand an AP server certificate A402a. The AP server private key A404ais the private key of this application server401. The AP server certificate A402a, which is a certificate indicating the validity of the application server401issued by the certificate authority A101a, includes an AP server public key A403athat is the public key corresponding to the AP server private key A404aand an AP signature A405athat is a signature created by the certificate authority A101aon such AP server certificate A402a.

The client415, which is a home appliance and the like that receives a service (e.g., downloads firmware) from the application server401after verifying the validity of such application server401, is comprised of a server authentication unit416, a memory418, a preparatory memory419, a CA information update unit417, and a DL public key414. The server authentication unit416is a processing unit for authenticating the application server401by verifying the AP server certificate A402areceived from such application server401. The memory418is a memory for holding, in the default state, CA information A301athat is certificate authority A101a-related information and that is used for verifying the AP server certificate A402a. The preparatory memory419is a memory for holding CA information B301bthat is certificate authority B101b-related information used to carry on with the verification processing on the application server401(stated another way, to verify the AP server certificate B indicating the validity of the application server401issued by the certificate authority B101b), in the case where the CA information A301astored in the memory418gets revoked, for example. The CA information update unit417is a processing unit for obtaining the next valid CA information (CA information B301b) from the download server B406band stores it into the preparatory memory419, when the CA information A301astored in the memory418gets revoked, for example. The DL public key414is the public key corresponding to a DL server private key B410bof the download server B406b.

The certificate authority A101a, which is a certificate authority that issues the AP server certificate A402aindicating the validity of the application server401and the CA information A301aused to verify the validity of such AP server certificate A402a, possesses a CA private key A105a, a DL private key413, and the CA information A301a. The CA private key A105ais the private key of this certificate authority A101a, whereas the DL private key413is the private key of the download server B406b. The CA information A301aincludes (1) the CA certificate A106aindicating the validity of a server certificate issued by the certificate authority A101a(here, the AP server certificate A402aand the DL server certificate B408b), (2) a URL B302bwhich is the URL of the download server B406bwhere the CA information B301b, which is the next valid CA information after this CA information A301a, will be stored, and (3) a CA signature A303awhich is a signature created on this CA information A301aby use of the DL private key413.

The certificate authority B101b, which is a certificate authority that issues the CA information B301bto be the next valid CA information after the CA information A301aissued by the certificate authority A101a, possesses a CA private key B105b, the DL private key413, and the CA information B301b. The CA private key B105bis the private key of this certificate authority B101b. The CA information B301bincludes (1) the CA certificate B106bindicating the validity of a server certificate issued by the certificate authority B101b(here, the AP server certificate B402band the like), (2) a URL C302cwhich is the URL of the download server C where CA information C, which is the next valid CA information after this CA information B301b, will be stored, and (3) a CA signature B303bwhich is a signature created on this CA information B301bby use of the DL private key413.

The download server B406b, which is a server apparatus from which the client415downloads the next valid CA information, possesses the CA information B301b, the DL server certificate B408band the DL server private key B410b. The CA information B301bis the next valid CA information after the CA information A301a(the CA information B301bis sent from the certificate authority B101b). The DL server private key B410bis the private key of this download server B406b. The DL server certificate B408b, which is a server certificate issued by the certificate authority B101b, indicates the validity of the download server B406b. Such DL server certificate B408bincludes a DL server public key B409bwhich is the public key corresponding to the DL server private key B410b, and a DL signature B412bwhich is created by the certificate authority B101bon this DL server certificate B408b.

FIG. 4is a diagram showing a more detailed data structure of the CA information A301aand CA information B301billustrated inFIG. 3. The CA information301includes: a CA certificate106indicating that a server certificate is valid; a CA certificate length116which is information indicating the length of such CA certificate106; a URL302of a download server on which the next valid CA information after the CA information301will be stored; URL length information312indicating the length of the URL302; and a CA signature303for the above four pieces of information (here, a signature created by the DL private key413). Note that the CA certificate106includes the public key of the certificate authority (CA public key) to be used for verifying the validity of a server certificate issued by the certificate authority.

The use of the CA information301with the above structure makes it possible for the client415to verify the validity of the application server401. In other words, by using the CA certificate106included in the obtained CA information301after verifying the validity of the CA information301itself though the verification of the CA signature303on such CA information301by use of the DL public key414, the client415can verify the validity of the server certificate received from the application server401, and by making an access to the URL302included in such CA information301, the client415can obtain CA information which will be valid after the CA information301.

The following describes a server authentication operation (processing for verifying the validity of the application server401) to be carried out by the client415.

First, the application server401generates an AP server private key A404aand an AP server public key A403athat make up a key pair for an SSL communication. Then, the application server401sends, to the certificate authority A101a, the AP server public key A403aand other necessary information, so as to request for the issue of a server certificate.

The certificate authority A101apre-stores a key pair consisting of the CA private key A105aand the CA public key A. Upon receipt of the request from the application server401for the issue of a server certificate, the certificate authority A101aissues an AP server certificate A402athat includes a signature which it has created with the CA private key A105b, and sends such server certificate A402ato the application server401.

Furthermore, after generating a CA certificate A106awhich is a server certificate including the CA public key A, the certificate authority A101agenerates CA information A301athat includes such CA certificate A106a. A URL B302bto be added to such CA information A301ais the URL of the download server B406b.

The client415stores in its internal memory418the CA information A301ain the default state, with nothing being stored in its preparatory memory419.

When the client415is to carry out an SSL communication with the application server401, the server authentication unit416obtains the AP server certificate A402afrom the application server401, and performs verification on the obtained AP server certificate A402ausing the CA public key A contained in the CA certificate A106astored in the memory418.

If such AP server certificate A402ais verified as valid, it becomes possible for the client415and the application server401to carry out an SSL communication, as in the case of the existing techniques.

Next, a description is given of the operation performed by the client415when updating CA information.

When the validity period of the CA certificate A106ais close to expiring, it becomes necessary for the client415to be able to obtain a new CA certificate before the expiration date. In order to enable the client415to do so, the system operator, before the validity period expires, first sets up a new certificate authority B101bpossessing a key pair consisting of the CA private key B105band the CA public key B, and such new certificate authority B101bgenerates a new CA certificate B106bthat includes the CA public key B. At this point of time, however, the certificate authority B101bdoes not issue any AP server certificates to the application server401. Even if the certificate authority B101bdid issue an AP server certificate, the application server401will not use the AP server certificate obtained from the certificate authority B101bfor server authentication to be performed in a communication with the client415.

The certificate authority B101bgenerates new CA information B301bfrom the CA certificate B106bit has generated. The URL C302c, to be described in the CA information B301b, shall be the URL of the download server C from which new CA information will be downloaded next time, and the CA signature B303bto be described in the CA information B301bshall be created in an equivalent manner in which the CA signature A303awas created.

Next, the system operator sets up a download server B406bat the location (a website on the network, and the like) specified by the URL B302b, so that the CA information B301bcan be downloaded from it. When this is done, the download server B406bgenerates a key pair consisting of the DL server public key B409band the DL server private key B410b, and sends the DL server public key B409band necessary information to the certificate authority A101a, so as to obtain a DL server certificate B408bfrom the certificate authority A101a, as a server certificate.

Meanwhile, the CA information update unit417of the client415tries to connect to the download server specified by the URL B302bthat is described in the CA information A301astored in the memory418at certain time intervals, e.g., once every month.

When the download server B406bis not in operation, the CA information update unit417fails to connect to the download server B406b, in which case it judges that there is no need for updating the current CA information. From then on, the CA information update unit417tries to connect to the download server B406bonce every month, for example, as above.

When the download server B406bis in operation, on the other hand, the CA information update unit417succeeds in getting connected to the download server B406b, in which case it first obtains the DL server certificate B408band then performs verification on it using the CA public key A (which is included in the CA certificate A106a) stored in the memory418.

After verifying the validity of the DL server certificate B408b, the CA information update unit417then obtains the CA information B301bfrom the download server B406b. The CA information update unit417performs verification on the CA signature B303bincluded in the obtained CA information B301b, by using the DL public key414, and stores such CA signature B303binto the preparatory memory419when the validity of the CA information B301bhas been verified.

Next, a description is given of the operation performed by the application server401and the client415when the validity period of the CA certificate A106aexpires.

The application server401generates a new key pair consisting of the AP server public key and the AP server private key before the validity period of the CA certificate A106aexpires or upon termination of such validity period, and obtains a new AP server certificate B from the certificate authority B101b. When the validity period of the CA certificate A106aexpires, the application server401destroys the old AP server certificate A402a, and sends the AP server certificate B as a server certificate, when needing to carry out an SSL communication from then on.

As described above, when the validity period of the CA certificate A106aexpires, the server authentication unit416of the client415receives a new AP server certificate B in order to communicate with the application server401. However, verification on the AP server certificate B fails if the CA public key A included in the CA certificate A106astored in the memory418is used. In such case, the server authentication unit416performs verification on the AP server certificate B by use of the CA public key B included in the CA information B301bstored in the preparatory memory419. When the validity of the AP server certificate B has been verified, the client415continues to carry out the SSL communication with the application server401.

When this is done, the server authentication unit416moves the CA information B301bstored in the preparatory memory419into the memory418, and subsequently empties the preparatory memory419. From then on, the server authentication unit416uses the CA information B301bstored in the memory418to perform authentication in a communication with the application server401.

When nothing is stored in the preparatory memory419, on the other hand, the server authentication unit416indicates the CA information update unit417to obtain new CA information. Upon receipt of such indication, the CA information update unit417obtains new CA information B301bfrom the download server B406bin the same manner as described above. After obtaining the new CA information B301b, the server authentication unit416performs authentication on the application server401by use of such CA information B301b.

From then on, the client415can automatically obtain a new CA certificate by carrying out the operation in the similar manner as above when the validity period of a CA certificate is close to expiring, and can automatically perform authentication by use of a new CA certificate when the validity period of a CA certificate expires.

As described above, according to the present embodiment, the certificate authority A101apreviously sends, to the client415, the URL of the download server B406bthat is a website from which a CA certificate will be downloaded next time, together with a new CA certificate. When the validity period of the CA certificate is close to expiring, the system operator sets up the certificate authority B101bthat will issue a new CA certificate, and brings the download server B406binto operation at the same time. Meanwhile, the client415periodically tries to make an access to the URL of the download server B406b, downloads a new CA certificate from it and stores such new CA certificate into the preparatory memory419, when succeeding in making an access to the download server B406b. Then, when becoming unable to verify the validity of the server certificate of the application server401in a communication by use of the current CA certificate, the client415uses the new CA certificate stored in the preparatory memory419to perform authentication on the application server401. When the validity of the application server401has been verified, the client415deletes the original CA certificate, so as to use the new CA certificate to verify a server certificate from then on.

Accordingly, since it becomes possible for the client415to renew the CA certificate simply by holding the next valid CA certificate, there is no need for the client415to hold many CA certificates all the time or to be equipped with a program or a circuit for authenticating a server by use of plural CA certificates. What is more, since it is possible for the client415to start communicating with another application server after obtaining a new CA certificate by periodically accessing the download server B406b, there is no need for such client415to check the validity period of the current CA certificate by use of a clock. Thus, even if the client415is a home appliance and the like which is not equipped with a sufficient amount of recourses, it becomes possible for the client415to obtain and renew a CA certificate in a reliable manner, without needing to care about when the validity period of a CA certificate expires.

Note that, in the present embodiment, the CA information update unit417tries to connect to the download server specified by the URL that is described in the CA information stored in the memory418once every month, but the present invention is not limited to a one month interval and therefore a longer or shorter interval is also applicable. Moreover, such an interval may be uniform or there may be variations in intervals to some extent. To put it briefly, any interval may be applicable to the present invention as long as an attempt can be made at least once without fail from when a download server starts operating to when the validity period of the current CA certificate expires.

Moreover, in the present embodiment, the application server401generates a new key pair consisting of the AP server public key and the AP server private key upon expiration of the validity period of a CA certificate, but the application server401may generate a new key pair consisting of the AP server public key and the AP server private key even before the validity period of a CA certificate expires, so as to obtain a new AP server certificate. Since the new AP server certificate includes an AP signature created by the same CA private key in such case too, it is possible for the client415to verify the new AP server certificate using the CA public key which it stores.

Furthermore, the CA information301shown inFIG. 4may include other information not illustrated in the drawing.

Also, the CA information update unit417stores downloaded new CA information into the preparatory memory419when the validity of such new CA information has been verified, but the CA information update unit417does not have to store the CA signature303at this time. This makes it possible to reduce the memory amount of the preparatory memory419. Similarly, the CA information A301ais stored in the memory418in the default state, but the CA signature A303adoes not have to be stored there.

Furthermore, in the present embodiment, the server authentication unit416empties the preparatory memory419after moving the CA information B301bstored in the preparatory memory419into the memory418. Instead of this, however, the server authentication unit416may switch the roles of the memory418and the preparatory memory419after emptying the memory418, and from then on, switch the roles of the memory418and the preparatory memory419every time CA information is updated.

Second Embodiment

Next, referring toFIGS. 5-9, a description is given of example operations of the certificate authorities and download server according to the first embodiment, as the second embodiment of the present invention.

FIG. 5is a flowchart showing an example operation of the certificate authorities and download server.

FIG. 6is a flowchart showing how the termination of the download server is determined.

FIG. 7is a diagram showing an example operational flow of the certificate authorities, client, download servers, and application server at the normal case.

FIG. 8is a diagram showing an example operational flow of the certificate authorities, client, download servers, and application server in the case where the CA certificate A gets revoked before the end of the validity period and where the next download server is not in operation yet when such CA certificate A gets revoked.

FIG. 9is a diagram showing an example operational flow of the certificate authorities, client, download servers, and application server in the case where the CA certificate A gets revoked before the end of the validity period and where the next download server is already in operation when such CA certificate A gets revoked.

In the present embodiment, the validity period of the CA certificate A106ashall be 20 years, and a new certificate authority B101band a new download server B406bshall start operating five years before the validity period of the CA certificate A106aexpires.

Furthermore, a download server shall stop operating at the time when the validity period of the previous CA certificate expires. For example, the download server B406bwill stop operating upon expiration of the validity period specified in the CA certificate A106a, i.e., 20 years after the certificate authority A101astarts operating.

First, referring to the flowcharts shown inFIGS. 5 and 6, the example operations of the certificate authorities and download server are described. These drawings illustrate the steps carried out by the system operator that manages the certificate authorities and the download server.

AsFIG. 5shows, when the operation starts (Step501), the system operator first brings the certificate authority A101ainto operation (Step502).

The system operator checks if the CA certificate A106agets revoked before its validity period ends (Step503), and goes on to Step504if the CA certificate A106ais not revoked.

When the CA certificate A106ais not revoked (No in Step503), the system operator checks if it is five years before the validity period of the CA certificate A106aexpires (Step504), and returns to Step503if it is not yet five years before the end of the validity period, whereas it goes on to Step505if it is five years before the end of the validity period.

When it is five years before the end of the validity period (Yes in Step504), the system operator brings the certificate authority B101binto provisional operation (Step505), and also brings the download server B406binto operation (Step506). Note that, at this point of time, the certificate authority B101bholds a key pair consisting of the CA public key B and the CA private key B105bwhich it has generated, but a server certificate to be sent from the application server401to the client415is still the AP server certificate A402a.

Subsequently, the system operator checks if the CA certificate A106agets revoked before the end of the validity period (Step507), and goes on to Step509if the CA certificate A106ais revoked, whereas it goes on to Step508if the CA certificate A106ais not revoked.

When the CA certificate A106ais not revoked (No in Step507), the system operator checks if the validity period of the CA certificate A106ais expired or not (Step508), and returns to Step507if the validity period is not expired, whereas it goes on to Step509if the validity period is expired.

When the validity period is expired (Yes in Step508), the system operator terminates the operation of the certificate authority A101a, and brings the certificate authority B101binto full operation (Step510). Note that at this point of time, a server certificate sent from the application server401to the client415is an AP server certificate B on which a signature is created with the CA private key B105b.

Meanwhile, if the CA certificate A106agets revoked before the end of its validity period (Yes in Step503), the system operator terminates the operation of the certificate authority A101a(Step509), after bringing the download server B406binto operation (Step511).

Note that after starting the full operation of the certificate authority B101b(Step510), the system operator repeatedly execute the above steps by performing the processing which has been performed on the certificate authority A and CA certificate A, respectively on the certificate authority B and CA certificate B, and by performing the processing which has been performed on the certificate authority B, CA certificate B, and download server B, respectively on the next valid certificate authority C, CA certificate C, and download server C (Steps503˜510).

Meanwhile, the flowchart inFIG. 6illustrates the processing for determining whether to terminate the operation of the currently operating download server.

When the download server starts operating (Step601), the system operator checks the permitted operation period of such download server (Step602). If such permitted operation period is not expired, the system operator returns to Step602to wait for such permitted operation period to expire, whereas if the permitted operation period is already expired, the system operator goes on to Step603. Note that an example permitted operation period of the download server starts five years before the end of the validity period of the currently valid CA certificate and ends on the date of expiration of such validity period.

When the permitted operation period is expired (Yes in Step602), the system operator terminates the operation of the download server (Step603). For example, the system operator terminates the operation of the download server after the expiration of the validity period of the CA certificate which was valid until just a minute ago.

From then onward, the system operator repeats the above steps, so as to start and terminate the operation of a certificate authority and a download server.

As described above, according to the present embodiment, it is possible for the client415to renew the current CA certificate simply by holding the next valid CA certificate not only when the CA certificate gets revoked after the end of the validity period, but also when the CA certificate gets revoked before the end of its validity period, as in the case of the first embodiment. Accordingly, there is no need for the client415to hold many CA certificates all the time or to be equipped with a program or a circuit for authenticating a server by use of plural CA certificates. What is more, since it is possible for the client415to start communicating with another application server after obtaining a new CA certificate by periodically accessing the next valid download server, there is no need for such client415to check the validity period of the current CA certificate by use of a clock. Thus, even when the client415is a home appliance and the like which is not equipped with a sufficient amount of recourses, it becomes possible for the client415to obtain and renew a CA certificate in a reliable manner, without needing to care about when the validity period of a CA certificate expires.

Note that inFIG. 5, the order of Steps505and506may be reverse, or these steps may be carried out concurrently. Similarly, the order of Steps509and510may be reverse, or these steps may be carried out concurrently.

Next, a description is given of the operational flow of the client, download servers, and application server in the case where the certificate authorities and download server are operated according to the flowcharts shown inFIGS. 5 and 6. Here, a description is given respectively of the normal case (a CA certificate gets revoked due to the expiration of the validity period) and of the case where a CA certificate gets revoked before the end of the validity period due to some reason. Moreover, the operational flow for the case where a CA certificate gets revoked before the end of the validity period due to some reason, is further described for two cases: the next download server is already in operation at the point of time when a CA certificate gets revoked; and the next download server is not in operation yet at the point of time when a CA certificate gets revoked.

FIG. 7is an operational flow of the client, download servers, and application server at the normal case.

In the client415in the default state, the CA information A301ais stored in the memory418, whereas nothing is stored in the preparatory memory419.

Since it is possible to verify the AP server certificate A sent from the application server401by use of the CA public key A when it is within the validity period of the CA certificate A106a, the client415can verify the validity of the application server401by use of the CA information A301awhich it holds.

Moreover, the client415periodically tries to get connected to the download server B406bspecified by the URL B302b, but such connection inevitably fails, since it is after five years before the end of the validity period of the CA certificate A106athat the download server B406bstarts operating.

At the point of time when the remaining validity period of the CA certificate A106abecomes five years, the system operator sets up a new certificate authority B101band generates a new CA certificate B106band CA information B301b. At the same time, the system operator brings into operation the download server B406bfrom which the CA information B301bis downloadable.

When the download server B406bis brought into operation, it becomes possible for the client415to get connected to such downloads server B406b, and therefore to obtain the CA information B301b. After verifying the validity of the CA information B301b, the client415stores such CA information B301binto the preparatory memory419.

In order to connect to the download server B406bperiodically, the client415is connected to the download server B406bso as to obtain CA information B301beven after it obtained the CA information B301b, as long as it is before the end of the validity period of the CA certificate A106a. In this case, the obtained CA information B301bmay not have to be stored into the preparatory memory419if the CA information stored in the preparatory memory419and such obtained CA information B301bare the same, or the obtained CA information B301bmay be always written over the CA information stored in the preparatory memory419if such obtained CA information B301bis valid.

Meanwhile, when the validity period of the CA certificate A106aexpires, the application server401starts using, as a server certificate, the AP server certificate B which is to be verified by use of a new CA certificate B106b. After this, the AP server certificate B serves as a server certificate to be obtained by the client415to start an SSL communication with the application server401, but the client415cannot verify such AP server certificate B by use of the current CA certificate A106a.

In response to this failure, the client415performs verification on the AP server certificate B using the CA certificate B106bincluded in the CA information B301bstored in the preparatory memory419. After verifying the validity of the AP server certificate B, the client415resumes the SSL communication, and at the same time, moves the CA information B301bstored in the preparatory memory419into the memory418, so as to delete the information stored in the preparatory memory419.

From then on, the client415performs server authentication by use of the CA certificate B106b, and starts trying to connect to the download server C specified by the URL C302cthat is included in the CA information B301b.

In this case, the operation of the download server B406bis terminated upon expiration of the CA certificate A106a.

By continuing the similar operation as above, the client415can authenticate the application server401and renew a CA certificate, even when a certificate authority is replaced with a new certificate authority and a CA certificate is renewed.

Meanwhile, in the case where it becomes impossible to assure the security of the CA private key A105asuch as when the CA private key A105ahas been decrypted, it is necessary to immediately revoke the CA certificate A106aand to bring a new certificate authority B101binto operation at the same time, so as to issue a new CA certificate B106b. Also, the application server401is required to ask the new certificate authority B101bto issue a new AP server certificate B, so as to use it for server authentication.

FIG. 8is a diagram showing the operational flow of the certificate authorities, client, download servers, and application server in the case where the current CA certificate gets revoked before the download server from which the next CA information should be downloaded starts operating.

Each of the processes to be performed before the revocation of the CA certificate A106ais the same as those shown inFIG. 7. Since the certificate authority B101bis not yet in operation at the point of time when the CA certificate A106agets revoked, the system operator immediately brings the new certificate authority B101binto operation and generates, at the same time, a new CA certificate B106band CA information B301b. At the same time, the system operator brings the download server B406binto operation so as to make the CA information B301bdownloadable.

In the case where the client415happens to succeed in connecting to the download server B406bbefore performing authentication on the application server401, after the CA certificate A106agets revoked, and succeeds in obtaining new CA information B301b, the client415is allowed to update the current CA information as in the case of the normal case.

When the client415performs authentication on the application server401before obtaining the CA information B301b, it fails to verify the AP server certificate B. In spite of this, however, the new CA information B301bis not stored in the preparatory memory419at that point of time. In such a case, the client415immediately tries to get connected to the download server B406b. Since the download server B406bis already in operation at that point of time, it is possible for the client415to obtain new CA information B301bfrom such download server B406b.

After the new CA information B301bis obtained, the same processes as those performed in the normal case are repeated. Note that, as shown inFIG. 8, however, the download server B406bcontinues to be in operation until the date which was supposed to be the end date of the validity period of the CA certificate A106a, even when such CA certificate A106agets revoked before the end of the validity period.

FIG. 9is a diagram showing the operational flow of the certificate authorities, client, download servers, and application server in the case where the current CA certificate gets revoked after the download server from which the next CA information should be downloaded is brought into operation.

Each of the processes to be performed before the revocation of the CA certificate A106ais the same as those shown inFIG. 7.

From the point of time when the CA certificate A106agets revoked, the application server401uses the new AP server certificate B issued by the new certificate authority B101bfor server authentication to be performed in a communication with the client415.

Moreover, since the certificate authority B101band the download server B406bare already in operation at the point of time when the CA certificate A106agets revoked, the client can obtain the CA information B301b. Thus, if the client415already stores in the preparatory memory419the CA information B301bwhich it obtained, the client415will be able to update the current CA information at the point of time when it fails to verify the AP server certificate B, as in the case shown inFIG. 7.

Furthermore, when failing to verify the AP server certificate B before obtaining new CA information B301b, the client415tries to get connected to the download server B406bat that timing, so as to obtain the new CA information B301b, and continues the processing for verifying the AP server certificate B, as in the case shown inFIG. 8.

From then on, the same processes as those to be performed in the normal case are repeated. Note that, as shown inFIG. 9, however, the download server B406bcontinues to be in operation until the date which was supposed to be the end date of the validity period of the CA certificate A106a, even when such CA certificate A106agets revoked before the end of the validity period.

By continuing the similar operation as above, the client415can authenticate the application server401and renew a CA certificate, even when a CA certificate gets revoked before the end of its validity date.

Note that it is described in the present embodiment that the validity period of a CA certificate is 20 years, and a new certificate authority and a new download server are brought into operation five years before the end of the validity period of the CA certificate. The present invention, however, is applicable to the case where the validity period of a CA certificate is other than 20 years and where it is not five years before the end of the validity period of the CA certificate that a new certificate authority and a new download server are brought into operation. Therefore, the validity period of all CA certificates may not have to be 20 years and may vary depending on CA certificate.

Furthermore, in the present embodiment, the preparatory memory419is emptied by moving the CA information B301bstored in the preparatory memory419into the memory418. Instead of this, the roles of the memory418and the preparatory memory419may be switched after the memory418is emptied, and from then on, the roles of the memory418and the preparatory memory419may be switched every time CA information is updated.

Moreover, in the present embodiment, there are plural certificates authorities, i.e., the certificate authority A101aand the certificate authority B101b, but it is also possible that a single certificate authority issues plural server certificates and CA information, as in the case of the system configuration shown inFIG. 10. InFIG. 10, one certificate authority120is equipped with two certificate issue units A120aand B120b. The certificate issue unit A120acorresponds to the certificate authority A101ashown inFIG. 3, whereas the certificate issue unit B120bcorresponds to the certificate authority B101bshown inFIG. 3. The same is applicable to the download server. More specifically, the certificate authorities and download server in the present embodiment may not be physical units, and therefore they may exist as functional units which are independent of whether they are implemented in the same computer apparatus or in different computer apparatuses, and the like.

Also, in the present embodiment, the system operator sets up and terminates the certificate authorities and download server, but the present invention is not limited to such a case where a series of processing is performed by human hands. Therefore, the certificate authorities and download server may be automatically set up or terminated by an administrative computer that operates according to a predetermined operation schedule.

The present invention is capable of being used as a client apparatus (communication apparatus) and the like that receives a service from a server after checking the validity of such server, and particularly as a home appliance and the like, such as an audio-video equipment, with a small amount of resources including memory.