JP2019208096A - Network management device and network system - Google Patents

Abstract

To provide a network management device and a network system that can reduce the burden on a network administrator or the like.SOLUTION: A certificate distribution unit 16a in a network management device expands a first file that is a p12 file received from a certificate authority CA and in which a client certificate is archived into a client certificate by using the initial password received from the certificate authority CA (step S205). Further, in response to a client certificate acquisition request from a user terminal 20, the certificate distribution unit 16a causes a user 21 to input an arbitrary password, and archives the client certificate after the expansion in the step S205 in the second file to be the p12 file with the arbitrary password, and then transmits the second file to the user terminal 20 (steps S210 and S211).SELECTED DRAWING: Figure 2

Description

  The present invention relates to a network management apparatus and a network system, for example, a network management apparatus and a network system having a client certificate distribution function.

  The certificate issuing device disclosed in Patent Literature 1 transmits a password input screen to the terminal device in response to a certificate acquisition request from the terminal device. After password authentication, the certificate file in the PKCS # 12 format is transmitted to the terminal device. Send. The password is notified to the user of the terminal device in advance online or offline (such as mail).

JP 2006-67515 A

  For example, when user authentication or computer authentication is performed using a client certificate in a network system of a company or the like, a client certificate needs to be installed in advance on a user terminal used by each user. Therefore, normally, a network administrator or the like applies to a certificate authority for issuance of a client certificate, and each PKCS # 12 format file (referred to as a p12 file in the specification) that includes the client certificate issued by the certificate authority. Distribute to users (user terminals). Each user installs the client certificate included in the p12 file in his user terminal.

  The p12 file is a file having a format defined by the “PKCS # 12 Personal Information Exchange Syntax Standard” standard. The standard defines a format for storing (archiving) a private key and a public key certificate (for example, a client certificate) related to the private key as one file. The client certificate and the like are distributed in a state archived in a p12 file by a password. When the distributed p12 file is expanded into a client certificate and installed on the user terminal, a password for archiving is required. For this reason, in addition to the work of distributing the p12 file to each user, the network administrator or the like, as shown in Patent Document 1, notifies the password of the p12 file in advance by e-mail or written document. Need to do. As a result, the burden on the network administrator becomes heavy.

  The present invention has been made in view of such circumstances, and one of its purposes is to provide a network management apparatus and a network system that can reduce the burden on a network administrator or the like.

  The above and other objects and novel features of the present invention will be apparent from the description of this specification and the accompanying drawings.

  Of the inventions disclosed in the present application, the outline of a typical embodiment will be briefly described as follows.

  The network management device according to the present embodiment executes the first and second processes. In the first process, the network management apparatus expands the first file, which is the p12 file received from the certificate authority and in which the client certificate is archived, into the client certificate with the initial password received from the certificate authority. In the second process, the network management apparatus causes the user of the user terminal to input an arbitrary password in response to a client certificate acquisition request from the user terminal, and obtains the expanded client certificate obtained by the first process. Is archived in a second file to be a p12 file with the arbitrary password and then transmitted to the user terminal.

  Of the inventions disclosed in the present application, the effects obtained by the representative embodiments will be briefly described, and the burden on the network administrator or the like can be reduced.

In the network system by Embodiment 1 of this invention, it is a figure which shows the schematic structural example of the principal part, and the schematic operation example at the time of network authentication. It is a sequence diagram which shows an example of the processing content relevant to the certificate delivery part in FIG. It is the schematic which shows the structural example of the principal part of the certificate delivery part in FIG. It is the schematic which shows the structural example of the principal part of the network authentication part in FIG. FIG. 6 is a schematic diagram illustrating a configuration example of a main part of a certificate delivery unit in FIG. 1 in a network management device according to a second embodiment of the present invention. FIG. 6 is a sequence diagram illustrating an example of processing contents related to the certificate delivery unit of FIG. 5.

  In the following embodiment, when it is necessary for the sake of convenience, the description will be divided into a plurality of sections or embodiments. However, unless otherwise specified, they are not irrelevant, and one is the other. Some or all of the modifications, details, supplementary explanations, and the like are related. Further, in the following embodiments, when referring to the number of elements (including the number, numerical value, quantity, range, etc.), especially when clearly indicated and when clearly limited to a specific number in principle, etc. Except, it is not limited to the specific number, and may be more or less than the specific number.

  Further, in the following embodiments, the constituent elements (including element steps and the like) are not necessarily indispensable unless otherwise specified and apparently essential in principle. Needless to say. Similarly, in the following embodiments, when referring to the shapes, positional relationships, etc. of the components, etc., the shapes are substantially the same unless otherwise specified, or otherwise apparent in principle. And the like are included. The same applies to the above numerical values and ranges.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Note that components having the same function are denoted by the same reference symbols throughout the drawings for describing the embodiment, and the repetitive description thereof will be omitted.

(Embodiment 1)
<< Schematic configuration of network system >>
FIG. 1 is a diagram showing a schematic configuration example of main parts and a schematic operation example during network authentication in the network system according to the first embodiment of the present invention. The network system shown in FIG. 1 includes a certification authority CA, an L3 switch L3SW, L2 switches L2SW1 and L2SW2, a wireless LAN access point AP, a network management device 12, a business server 13, a directory server 14, and a user terminal. 20a, 20b. The L3 switch L3SW performs relay processing based on the layer 3 (L3) (that is, IP address) in addition to relay processing based on the layer 2 (L2) (that is, MAC address) of the OSI reference model. The L2 switches L2SW1 and L2SW2 perform relay processing based on layer 2 (L2) of the OSI reference model.

  In this example, the certificate authority CA and the directory server 14 are connected to the L3 switch L3SW via the IP network 10. The L2 switches L2SW1, L2SW2, the network management device 12, and the business server 13 are connected to the L3 switch L3SW via a communication line (for example, Ethernet (registered trademark) cable) 11. The user terminal 20a is used by the user 21a and is connected to the L2 switch L2SW1 via the communication line 11. The user terminal 20b is used by the user 21b and performs wireless communication with the wireless LAN access point AP. The wireless LAN access point AP is connected to the L2 switch L2SW2 via the communication line 11. In this example, client certificates 25a and 25b are installed in the user terminals 20a and 20b, respectively.

  The certificate authority CA issues various electronic certificates such as a client certificate and a server certificate. As is widely known, an electronic certificate includes information on a public key, information on its owner, information on an expiration date, and the like, and the certificate authority CA performs electronic signature on these various types of information. The directory server 14 provides a directory service using, for example, LDAP (Lightweight Directory Access Protocol) or the like, and is a server that manages various resources and information existing on the network. The business server 13 is, for example, a server that provides each user 21a, 21b with various information necessary for business.

  The network management device 12 is, for example, a server managed by the network administrator 22 and includes a network authentication unit 15 and a certificate distribution unit 16 that are implemented by program processing on the server. Here, the network authentication unit 15 and the certificate distribution unit 16 are mounted on the same server, but may be mounted on individual servers. Although the details will be described later, the certificate distribution unit 16 distributes the client certificate to the user terminals 20a and 20b (users 21a and 21b). The network authentication unit 15 has a function of an authentication server based on IEEE802.1X.

  In IEEE802.1X, a supplicant serving as software on the user terminals 20a and 20b, an authentication server (RADIUS server) corresponding to the network authentication unit 15, and a communication path between the supplicant and the authentication server are inserted. Network authentication of the user terminal or the user is performed using the authenticator as a component. In this case, an authentication protocol called EAP (Extensible Authentication Protocol) is used. The authenticator corresponds to an IEEE 802.1X compatible L2 switch (referred to as an authentication switch) or a wireless LAN access point. In the example of FIG. 1, the authenticator corresponds to the L2 switch L2SW1 and the wireless LAN access point AP.

  For example, in the initial state, the L2 switch L2SW1 limits the communication range of the user terminal 20a to the range up to the L2 switch L2SW1. In this state, the user terminal 20a (user 21a) makes an authentication request to the L2 switch L2SW1 (step S101). This authentication request is made using an EAPOL (EAP Over LAN) frame. The EAPOL frame can include account information (user ID, password, etc.) of the user 21a or a client certificate 25a.

  The L2 switch L2SW1 relays the authentication request from the user terminal 20a to the network authentication unit 15 via the L3 switch L3SW (step S102). At this time, the L2 switch L2SW1 converts the EAPOL frame into an EAP packet whose destination is the IP address of the network authentication unit 15. The network authentication unit 15 determines the success or failure of authentication in response to an authentication request from the user terminal 20a via the L2 switch L2SW1 and the L3 switch L3SW (step S103).

  At this time, when authenticating with account information, the network authentication unit 15 verifies the authenticity based on, for example, an authentication table in which valid account information is registered in advance. On the other hand, when authenticating with the client certificate 25a, the network authentication unit 15 verifies the authenticity based on, for example, an electronic signature or an expiration date of the client certificate 25a. The network authentication unit 15 may verify the authenticity based on, for example, the identity of a client certificate registered in advance and the received client certificate 25a. In the verification of authenticity, the network authentication unit 15 is not limited to registration information such as an authentication table held therein, and may use registration information acquired from the directory server 14 through communication with the directory server 14. Good.

  The network authentication unit 15 determines the success or failure of the authentication based on the verification result of authenticity, and transmits the authentication result including the determination result of the authentication success or failure to the L2 switch L2SW1 (step S104). The L2 switch L2SW1 controls the communication range of the user terminal 20a according to the authentication result from the network authentication unit 15. For example, when the L2 switch L2SW1 receives an authentication failure result from the network authentication unit 15, the L2 switch L2SW1 controls not to relay the frame from the user terminal 20a. In addition, when the L2 switch L2SW1 receives the authentication result of the authentication success from the network authentication unit 15, for example, the L2 switch L2SW1 communicates with the business server 13 or the like by information such as the assigned VLAN included in the authentication result (ie, the authentication VLAN function) Control to establish a communication path. The wireless LAN access point AP also performs the same processing as that for the L2 switch L2SW1 for the user terminal 20b (user 21b).

  Here, as described above, when performing network authentication using the client certificates 25a and 25b, the client certificates 25a and 25b need to be installed in the user terminals 20a and 20b in advance. Therefore, a certificate distribution unit 16 that distributes a client certificate to a user terminal (user) is provided. In detail, the client certificate is divided into a user certificate that proves the authenticity of the user and a computer certificate that proves the authenticity of the user terminal.

《Details of Certificate Distribution Department》
FIG. 2 is a sequence diagram showing an example of processing contents related to the certificate delivery unit in FIG. In FIG. 2, first, the network administrator 22 makes an application for issuing a client certificate of the user 21 or the user terminal 20 to the certificate authority CA in response to a request from the user 21 (step S201). The certificate authority CA issues a client certificate in response to the issuance application, and archives the issued client certificate in a p12 file (first file) with an initial password determined by the certificate authority CA, etc. together with a secret key, etc. (Step S202). Subsequently, the certificate authority CA sends the p12 file and the initial password to the management terminal 22 (step S203).

  Next, the network administrator 22 certifies the p12 file (first file) and the initial password received from the certificate authority CA by associating them with the account information (user account or computer account) of the user 21 or the user terminal 20. Upload to the document distribution unit 16a (step S204). Specifically, the network administrator 22 registers these correspondences in a management table provided in the certificate delivery unit 16a, for example. The certificate distribution unit 16a corresponds to the certificate distribution unit 16 illustrated in FIG.

  Subsequently, the certificate distribution unit 16a expands the p12 file (first file) in which the client certificate is archived into the client certificate with the initial password based on the correspondence relationship registered in step S204 (step S204). S205). Next, the certificate distribution unit 16a manages the client certificate after the expansion in association with the account information corresponding to the p12 file before the expansion, and further manages the client certificate in a state where it can be archived in the p12 file with an arbitrary password. (Step S206). As a specific example, for example, the management table holds the correspondence between the account information and the expanded client certificate in addition to the correspondence between the p12 file (first file), the initial password, and the account information. .

  Thereafter, the user 21 uses the user terminal 20 to log in to the certificate distribution unit 16a with predetermined account information (user account or computer account), and transmits a client certificate acquisition request to the certificate distribution unit 16a (Step S21). S207). In response to this, the certificate delivery unit 16a displays a password input screen on the user terminal 20 (step S208), and causes the user 21 of the user terminal 20 to input an arbitrary password (step S209).

  Next, based on the correspondence (management table) in step S206, the certificate distribution unit 16a determines the expanded client certificate corresponding to the account information in step S207 as an archive target. Then, the certificate distribution unit 16a archives the target expanded client certificate in the p12 file (second file) with the arbitrary password input in step S209 (step S210). Thereafter, the certificate delivery unit 16a transmits the p12 file to the user terminal 20 (step S211). The user 21 of the user terminal 20 expands the p12 file into a client certificate with the arbitrary password input in step S209 and installs it in the user terminal 20 (step S212).

  Note that in order for the user terminal 20 (user 21) to log in to the certificate distribution unit 16a in step S207, a communication path between the user terminal 20 and the certificate distribution unit 16a is established by network authentication. Need to be. As described in FIG. 1, for example, when the user 21a performs network authentication with a user account, or when network authentication is performed with the client certificate 25a in the user terminal 20a (for example, the expiration date of the client certificate 25a) At the time of update), the communication path is established. However, there are cases where such a method cannot be applied. In this case, for example, the network administrator 22 may perform setting so that the communication path is constructed when authentication fails using the authentication VLAN function.

  By providing the certificate distribution unit 16a as described above, it is possible to reduce the burden on the network administrator 22. That is, the network administrator 22 only needs to perform the operation of uploading the p12 file to the certificate distribution unit 16a in step S204, and does not need to perform the operation of distributing to the user terminal 20 (user 21). Further, the certificate delivery unit 16a allows the user 21 to decide an arbitrary password in step S209, so that the network administrator 22 can notify the user 21 of the initial password in step S203 as in Patent Document 1. No need to do it. In addition, by using a mechanism that allows the user 21 to determine an arbitrary password in this way, the password is less likely to be leaked than when the network administrator 22 notifies each user of the initial password, and security in the network system Can be improved.

  FIG. 3 is a schematic diagram illustrating a configuration example of a main part of the certificate distribution unit in FIG. The certificate distribution unit 16a illustrated in FIG. 3 includes a management table 30a, a development processing unit 31a, an archive processing unit 32, and a storage unit 33. The management table 30a and the storage unit 33 are mounted on a volatile memory or a nonvolatile memory. The expansion processing unit 31a and the archive processing unit 32 are implemented by, for example, program processing using a CPU. In the management table 30a, the correspondence between the account information, the initial password (PW), and the p12 file (its pointer) is registered by the process of step S204 in FIG. The p12 file 34 that is an entity is stored in the storage unit 33.

  In this example, a user account including a user ID and a password and a computer account including a computer name of the user terminal are registered as account information. However, in some cases, for example, only a user account may be used. As described in step S205 in FIG. 2, the expansion processing unit 31a uses the initial password corresponding to the p12 file (first file) 34 in the storage unit 33 for each registered entry in the management table 30a. This is expanded into a book 35 and stored in the storage unit 33.

  Further, as described in step S206 in FIG. 2, the expansion processing unit 31a manages the client certificate 35 after expansion in association with account information corresponding to the p12 file (first file) 34 before expansion. To do. In this example, the expansion processing unit 31a registers a pointer to the expanded client certificate 35 in the corresponding registration entry in the management table 30a. In addition, when such expansion processing is completed, the expansion processing unit 31a may delete the processed p12 file 34 and the initial password corresponding thereto from the storage unit 33 and the management table 30a.

  The archive processing unit 32 searches each registered entry in the management table 30a using the account information 40 in step S207 of FIG. 2 as a search key, and sets the expanded client certificate 35 registered in the hit entry as an archive target. Determine. Then, the archive processing unit 32 archives the target expanded client certificate 35 into the p12 file (second file) 43 with the arbitrary password (PW) 41 input in step S209 and then the request source. Send to user terminal.

<Details of Network Authentication Unit>
FIG. 4 is a schematic diagram illustrating a configuration example of a main part of the network authentication unit in FIG. The network authentication unit 15 illustrated in FIG. 4 includes an authentication table 45, a storage unit 46, and an authentication determination unit 47. The authentication table 45 and the storage unit 46 are implemented in a volatile memory or a nonvolatile memory. The authentication determination unit 47 is implemented by, for example, program processing using a CPU.

  Each information in the authentication table 45 may be registered in advance by the network administrator 22 or may be acquired by the network authentication unit 15 from the directory server 14 in cooperation with the directory server 14 in FIG. . Each registered entry in the authentication table 45 holds, for example, a correspondence relationship between account information for verification and a client certificate (its pointer) and an assigned VLAN. The verification client certificate as an entity is stored in the storage unit 46. The account information for verification includes a user account and a computer account.

  As described with reference to FIG. 1, the authentication determination unit 47 receives an authentication request 48 including account information or a client certificate, determines whether the account information or the client certificate has been authenticated based on the authentication table 45, and performs authentication. The result 49 is transmitted. For example, when the authentication determination unit 47 receives an authentication request 48 including a user account whose user ID and password are “ID [1]” and “PW [1]”, the user account is verified in the registration entry [1]. Therefore, it is determined that the authentication is successful. The authentication determination unit 47 then transmits the authentication success determination result and the assigned VLAN “VNx” registered in the registration entry [1] as the authentication result 49.

  On the other hand, for example, when the authentication determination unit 47 receives an authentication request 48 including the client certificate [1], the authentication determination unit 47 verifies the authenticity based on the electronic signature and the expiration date of the client certificate [1]. In addition, the authentication determination unit 47 indicates in the authentication table 45 the correspondence between the user ID or computer account described in the client certificate [1] or received together with the client certificate [1] and the client certificate [1]. The authenticity is verified by determining whether or not it is registered.

  Further, in some cases, the authentication determination unit 47 determines the identity between the received client certificate [1] and the verification client certificate [1] registered in the storage unit 46, thereby authenticating the authenticity. To verify. As a result, when the client certificate [1] is authentic, the authentication determination unit 47 determines that the authentication is successful, and as the authentication result 49, the authentication success determination result and the assignment registered in the registration entry [1]. The VLAN “VNx” is transmitted.

  Here, the account information included in the authentication table 45 of FIG. 4 is information that is a determination target of authentication success or failure in network authentication. On the other hand, the account information included in the management table 30a in FIG. 3 is information that is a target for determining whether or not to log in to the certificate distribution unit 16a. Therefore, these account information does not necessarily have to be the same. However, as shown in FIG. 1, in particular, when the network authentication unit 15 and the certificate distribution unit 16 are provided in the same server, the efficiency of various resources can be improved by making both account information the same. Can be achieved.

  Specifically, if both account information is the same, the correspondence between the account information and the client certificate can be shared in the authentication table 45 in FIG. 4 and the management table 30a in FIG. It is possible to combine tables into one. Further, the network authentication unit 15 in FIG. 4 generates the correspondence between the account information and the client certificate generated by the certificate distribution unit 16a in FIG. 3 and the actual data of the client certificate (the expanded client in FIG. 3). It is possible to perform network authentication (for example, determination of the identity of a client certificate) using the certificate 35).

<< Main effects of the first embodiment >>
As described above, by using the network system and the network management apparatus according to the first embodiment, typically, the burden on the network administrator or the like can be reduced. In addition, security in the network system can be improved.

(Embodiment 2)
<Details of certificate distribution section (variation)>
FIG. 5 is a schematic diagram illustrating a configuration example of a main part of the certificate delivery unit in FIG. 1 in the network management device according to the second embodiment of the present invention. FIG. 6 is a sequence diagram showing an example of processing contents related to the certificate delivery unit of FIG. When the distribution of the client certificate is completed, the certificate distribution unit may not have to leave the expanded client certificate (reference numeral 35 in FIG. 3) in the storage unit 33. Here, an example of such a case will be described.

  The certificate delivery unit 16b shown in FIG. 5 corresponds to the certificate delivery unit 16 in FIG. 1, and differs from the configuration example in FIG. 3 in the following points. First, the storage unit 33 does not hold the expanded client certificate (reference numeral 35 in FIG. 3), and accordingly, the management table 30b does not hold the correspondence between the account information and the expanded client certificate. . Accordingly, the expansion processing unit 31b transmits the expanded client certificate to the archive processing unit 32 as it is, instead of storing it in the storage unit 33.

  In the sequence shown in FIG. 6, the processing order of steps S205 to S210 in FIG. 2 is changed compared to the sequence shown in FIG. 2, and the processing of step S206 is deleted. In step S204 in FIG. 6, the network administrator 22 uploads the p12 file (first file) and the initial password to the certificate distribution unit 16b in association with the account information, as in FIG. Unlike the case of FIG. 2, the certificate delivery unit 16b waits for login from the user terminal 20 (user 21) in this state.

  In this state, when a login request from the user terminal 20 (user 21) and a client certificate acquisition request occur (step S207), the certificate distribution unit 16b requests the user 21 for a password, as in FIG. To input an arbitrary password (steps S208 and S209). Thereafter, the certificate distribution unit 16b expands the p12 file (first file) corresponding to the account information with the initial password (step S205), and then continues the expanded client certificate with the arbitrary password to the p12 file. Archive to (second file) (step S210). The certificate distribution unit 16b transmits the p12 file to the user terminal 20 (step S211). Note that the certificate distribution unit 16b may reduce the registered entries including the p12 file 34 in the storage unit 33 after completing the process of step S211.

<< Main effects of the second embodiment >>
As described above, using the network system and the network management apparatus of the second embodiment also provides the same effects as those of the first embodiment.

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiments. However, the present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the scope of the invention. For example, the above-described embodiment has been described in detail for easy understanding of the present invention, and is not necessarily limited to one having all the configurations described. In addition, part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. . Further, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment.

DESCRIPTION OF SYMBOLS 10 IP network 11 Communication line 12 Network management apparatus 13 Business server 14 Directory server 15 Network authentication part 16 Certificate distribution part 20 User terminal 21 User 22 Network administrator 25, 35 Client certificate 30 Management table 31 Deployment processing part 32 Archive processing Unit 33, 46 storage unit 34, 43 p12 file 40 account information 41 arbitrary password 45 authentication table 47 authentication determination unit 48 authentication request 49 authentication result AP wireless LAN access point CA certificate authority L2SW L2 switch L3SW L3 switch

Claims (8)

A first process of developing a first file received from the certificate authority in the PKCS # 12 format and archived with the client certificate into the client certificate with an initial password received from the certificate authority; ,
In response to the acquisition request of the client certificate from the user terminal, the user of the user terminal is input an arbitrary password, and the expanded client certificate obtained by the first process is input with the arbitrary password. A second process of archiving to a second file in PKCS # 12 format and transmitting to the user terminal;
Run the
Network management device. The network management device according to claim 1,
A management table that holds a correspondence relationship between account information of the user or the user terminal and the client certificate after the deployment;
In the second process, the account information is received from the user terminal, and based on the management table, the expanded client certificate corresponding to the account information is set as the archive target.
Network management device. The network management device according to claim 1,
A management table that holds a correspondence relationship between the first file, the initial password, and account information of the user or the user terminal;
In the first process, based on the management table, the first file is expanded to the client certificate with the initial password, and the expanded client certificate is the account corresponding to the first file. Linked to information and managed,
In the second process, the account information is received from the user terminal, and based on the management table, the expanded client certificate managed in association with the account information is set as the archive target.
Network management device. The network management device according to claim 2 or 3,
A certificate distribution unit that executes the first process and the second process;
A network authentication unit that determines success or failure of authentication in response to an authentication request based on IEEE802.1X from the user terminal;
With
The account information held in the management table is the same as the account information that is a determination target of authentication success or failure in the network authentication unit.
Network management device. A user terminal,
A network management device comprising: a network authentication unit that determines authentication success / failure in response to an authentication request based on IEEE802.1X from the user terminal; and a certificate distribution unit that distributes a client certificate to the user terminal;
It is inserted into a communication path between the user terminal and the network management device, relays the authentication request from the user terminal to the network authentication unit, and according to the authentication result from the network authentication unit, An authentication switch or wireless LAN access point for controlling the communication range;
A certificate authority issuing the client certificate;
A network system comprising:
The certificate distribution unit
A first file which is a PKCS # 12 format file received from the certificate authority and in which the client certificate is archived is expanded into the client certificate with an initial password received from the certificate authority. Processing,
In response to an acquisition request for the client certificate from the user terminal, the user of the user terminal is input an arbitrary password, and the expanded client certificate obtained by the first process is input with the arbitrary password. A second process of archiving to a second file in the PKCS # 12 format and transmitting to the user terminal;
Run the
Network system. The network system according to claim 5, wherein
The certificate distribution unit
A management table that holds a correspondence relationship between account information of the user or the user terminal and the client certificate after the deployment;
In the second process, the account information is received from the user terminal, and based on the management table, the expanded client certificate corresponding to the account information is set as the archive target.
Network system. The network system according to claim 5, wherein
The certificate distribution unit
A management table that holds a correspondence relationship between the first file, the initial password, and account information of the user or the user terminal;
In the first process, based on the management table, the first file is expanded to the client certificate with the initial password, and the expanded client certificate is the account corresponding to the first file. Linked to information and managed,
In the second process, the account information is received from the user terminal, and based on the management table, the expanded client certificate managed in association with the account information is set as the archive target.
Network system. The network system according to claim 6 or 7,
The account information held in the management table is the same as the account information that is a determination target of authentication success or failure in the network authentication unit.
Network system.

Images