JP2005045307A - Electronic certificate providing system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an electronic certificate to peripheral equipment 20 without imposing a load on the peripheral equipment 20 by allowing a personal computer 30 to carry out an issue request and acquisition processing of the electronic certificate to an authentication station 10 on behalf of the peripheral equipment 20. <P>SOLUTION: A certificate acquisition section 31 acquires the electronic certificate from the authentication station 10 via a network, a conversion section 32 converts the form of the electronic certificate into a form adapted to the peripheral equipment 20 being the destination of the electronic certificate, a transfer section 34 carries out processing of transferring the electronic certificate whose form is converted adaptable to the peripheral equipment 20 being the destination of the electronic certificate, and the personal computer 30 carries out the acquisition processing of the electronic certificate from the authentication station 10 on behalf of the peripheral equipment 20. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an encryption technique, and more particularly, to a technique in which a personal computer performs processing for obtaining an electronic certificate issued from a certificate authority for encryption on behalf of a peripheral device.
[0002]
[Prior art]
Due to the development of the office environment, a personal computer used for business processing by a user and peripheral devices used by the personal computer such as a printer device, a facsimile device, a copy device, etc. are connected in a network format, for example, by a personal computer. The document data is transmitted to a printer device having high printing capability via a network, and the document is printed out.
[0003]
Such connection between the personal computer and the peripheral device is realized not only by a wired connection by a connection cable but also by a configuration by a wireless connection as shown in FIGS.
The system configuration shown in FIG. 4 is a system called a wireless LAN, in which a wireless base station device 2 connected to the backbone network 1 is installed at a required location such as in an office, and a personal computer (PC) 3 and peripheral devices Request from the personal computer (PC) 3 via the backbone network 1 by wirelessly connecting the printer device (PR) 4, facsimile device (FAX) 5, copy device (Copy) 6, etc. Accordingly, these peripheral devices 4 to 6 execute processing such as document printing.
[0004]
The system configuration shown in FIG. 5 is a peer-to-peer system configuration in which a personal computer (PC) 3 and peripheral devices such as a printer device (PR) 4 and a facsimile device (FAX) 5 are wirelessly connected on a one-to-one basis. These peripheral devices execute processing such as document transmission in response to a request from the personal computer (PC) 3.
As described above, even in a peripheral device, it has a wired or wireless data communication function, and not only receives data but also transmits data even in a peripheral device such as a printer device or a copy device. A configuration has also been developed. For example, if a printer device or a copy device transmits data such as paper and toner remaining amount to a management device, and the operation status of these peripheral devices is constantly grasped and managed by the management device, a high-quality maintenance service is provided. be able to.
[0005]
When such data communication is performed, it is necessary to consider security for communication data. For example, even the above paper and toner remaining data is private information about individuals and companies related to maintenance fees, so measures to prevent leakage to third parties and tampering due to access from third parties Is required.
As an effective method for this measure, there is an encryption technique authenticated by an electronic certificate, and various proposals relating to this have been made (see Patent Document 1).
[0006]
Due to the spread of electronic commerce, confidential data such as personal information flows on the Internet. Along with this, encryption technology is used to realize security against data eavesdropping, spoofing, and data tampering by third parties. ing.
SSL (Secure Sockets Layer) / TLS (Transport Layer Security) using an electronic certificate issued by a certificate authority (certificate authority) is known as a method for realizing security such as personal authentication, electronic signature, data encryption, and falsification prevention. It has been. In recent years, there is authentication security conforming to IEEE802.1X as security enhancement of a wireless network, and a method using SSL / TLS is adopted as the method.
[0007]
An outline of such an encryption method is as follows. For example, as shown in FIG. 6, the personal computer PC (A) 7 requests the certificate authority server 8 to issue an electronic certificate including a private key, and acquires it. The data is encrypted with the secret key and transmitted to the other personal computer PC (B) 9, and the personal computer PC (B) 9 decrypts the received data with the corresponding public key.
[0008]
[Patent Document 1]
Japanese Patent Laid-Open No. 2002-82907
[Problems to be solved by the invention]
The security system using the electronic certificate as described above is assumed to be a personal computer, and a peripheral device (Non-PC) such as a printer device tries to acquire an electronic certificate corresponding to this security method. Does not have a means for issuing an electronic certificate to a certificate authority or a means for obtaining it, and the certificate authority also has no means for providing such a peripheral device with a unique electronic certificate for each device. There is a problem. In addition, when the functional means is mounted on a peripheral device, the peripheral device specialized for each application is inferior in performance (memory capacity, processing speed, etc.) compared to a personal computer, so that the mounting is extremely difficult. There is a problem that the original functional performance is deteriorated.
[0010]
The present invention has been made in view of the above-described conventional circumstances, and the electronic certificate issuance request and acquisition processing to the certificate authority on behalf of the personal computer. The purpose is to provide a book.
It is another object of the present invention to ensure that a unique electronic certificate is provided for each peripheral device.
Further objects of the present invention will be apparent from the following description.
[0011]
[Means for Solving the Problems]
In the present invention, a personal computer performs processing for acquiring an electronic certificate from a certificate authority for a peripheral device. The personal computer acquires an electronic certificate from a certificate authority via a network. A certificate acquisition unit, a conversion unit that converts the acquired electronic certificate into a format suitable for the peripheral device of the provider, and a transfer unit that transfers the converted electronic certificate to the peripheral device of the provider .
[0012]
In the present invention, the personal computer further includes an identification information management unit that uniquely manages the peripheral device based on the identification information acquired from the peripheral device of the provision destination and provides each peripheral device with a unique electronic certificate. Have.
In the present invention, the personal computer further includes a backup unit that holds the provided electronic certificate in association with the peripheral device based on the identification information acquired from the peripheral device of the providing destination.
[0013]
In addition, the present invention is a computer program for realizing a personal computer that performs the proxy processing as described above, an electronic certificate acquisition function for acquiring an electronic certificate from a certificate authority via a network, and an acquired electronic certificate. A personal computer is realized with a conversion function for converting to a format suitable for the peripheral device of the providing destination and a transfer function for transferring the electronic certificate after the format conversion to the peripheral device of the providing destination.
Further, in the present invention, the computer program has an identification information management function that uniquely manages the peripheral device based on the identification information acquired from the peripheral device of the providing destination and provides each peripheral device with a unique electronic certificate. Realize on a computer.
[0014]
In addition, the present invention realizes an electronic certificate providing method in which a personal computer performs an electronic certificate acquisition process from a certificate authority for a peripheral device, and the personal computer acquires identification information from the peripheral device. Request the digital certificate from the CA to the CA, convert it to a format suitable for the peripheral device of the provider, identify it uniquely using the identification information, Transfer the converted digital certificate to the peripheral device.
[0015]
DETAILED DESCRIPTION OF THE INVENTION
The present invention will be specifically described based on an example.
FIG. 1 shows an electronic certificate providing system according to the present example. The electronic certificate providing system of the present example includes a certificate authority (server) 10 that can issue an electronic certificate and peripherals that use the electronic certificate for security. A personal computer (PC) that implements a program for executing a series of processing for providing a unique electronic certificate for each device to the peripheral device 20 from issuing and obtaining an electronic certificate to the certificate authority 10 with the device 20 ) 30 is interposed.
[0016]
Communication between the certificate authority 10 and the personal computer (PC) 30 is performed via a wired or wireless network, and a Web browser function having a function of acquiring an electronic certificate provided in the PC 30 An electronic certificate issuance request and provision are made between the certificate authority 10 and the PC 30 by the electronic mail communication function.
Communication between the PC 30 and the peripheral device 20 is performed by network communication using TFTP or peer-to-peer communication connected by a connection cable such as USB.
[0017]
Although the certificate authority 10 itself is publicly known, the PC 30 has a unique function for executing the proxy processing according to the present example.
That is, the PC 30 includes a certificate acquisition unit 31, a conversion unit 32, an identification code management unit 33, a transfer unit 34, a viewer unit 35, and a backup unit 36.
[0018]
The certificate acquisition unit 31 is a functional unit that requests and acquires an electronic certificate from the certificate authority 10 via the network using the Web browser function described above, and the conversion unit 32 provides the electronic certificate acquired from the certificate authority 10 This is a functional means for converting into a format suitable for the previous peripheral device 20.
The identification code management unit 33 uniquely manages the peripheral device 10 based on the identification code acquired from the peripheral device 20 of the provision destination, and provides a unique electronic certificate to each peripheral device even when there are a plurality of peripheral devices. Is a functional means for realizing For example, when an electronic certificate is provided to a dedicated peripheral device for a certain PC 30, uniqueness can be ensured even if the identification code management unit 33 is omitted.
[0019]
The transfer unit 34 is a functional unit that transfers the above-converted electronic certificate to the peripheral device 20 that is the destination, and the viewer unit 35 displays the contents of the electronic certificate acquired for confirmation by the operator operating the PC 30. The backup unit 36 is a functional unit that holds the electronic certificate provided to each peripheral device 20 in association with the identification code for backup.
Note that the viewer unit 35 and the backup unit 36 are not essential functions for the proxy providing process of certificate provision, which is the main object of the present invention, and can be omitted.
[0020]
Next, a proxy providing process (that is, an electronic certificate providing process for peripheral devices) according to this example will be described with reference to FIGS.
First, the peripheral device 20 to be provided with the electronic certificate is connected to the PC 30, and the peripheral device 20 transmits the unique identification code of the own device, whereby the PC 30 obtains the identification code of the peripheral device 20. (Step S1). The peripheral device 20 creates an identification code 21 from its own MAC address and device serial number and holds it in the device, and provides it to the PC 30.
[0021]
The PC 30 registers and manages the obtained identification code in the identification code management unit 33 in order to prevent a plurality of electronic certificates from being provided, and connects to the certificate authority 10 to request the issuance of an electronic certificate (step). S2).
As shown in FIG. 3A, the electronic certificate issuance request includes the requesting user ID and the user address, and describes the address of the requesting PC 30 as the user address. Here, in this example, the identification code acquired from the peripheral device 20 of the providing destination is reflected in the user ID, and the electronic certificate acquired at the time of acquisition of the electronic certificate and the peripheral device 20 of the providing destination are unique. Correspondence can be managed.
[0022]
When an electronic certificate is transmitted from the certificate authority 10 to the PC 30 in response to the request (step S30), the received and acquired electronic certificate is converted into a format suitable for the peripheral device 20 to be provided. (Step S4).
As shown in FIG. 3B, the electronic certificate includes a secret key used for encryption together with the certification matter.
The electronic certificate provided from the certificate authority 10 is generally a certificate format (PFX) used in the Windows OS (Windows is a trademark of Microsoft Corporation in the United States), so that it can be used in the OS of the peripheral device 20. Since it is necessary to rewrite (PEM, DER), the conversion unit 32 performs this conversion.
[0023]
Next, as shown in FIG. 3C, the backup unit 36 saves and manages the electronic certificate whose format has been converted in association with the identification code of the peripheral device 20 that is the provision destination (step S5), and the transfer unit 34 formats The converted electronic certificate is transmitted to the peripheral device 20 that is the provision destination, and the process is terminated (step S6).
Therefore, the peripheral device 20 can acquire the electronic certificate and perform the encryption process using the private key. Since the peripheral device 20 does not perform any processing with the certificate authority 10, it is possible to acquire an electronic certificate without any special capacity burden related to acquisition of the electronic certificate.
[0024]
【The invention's effect】
As described above, according to the present invention, the personal computer obtains the electronic certificate from the certificate authority, converts it into a format suitable for the peripheral device of the provider, and transfers it to the peripheral device. It is possible to provide an electronic certificate without imposing a burden on peripheral devices related to processing of issuing and obtaining an electronic certificate to a station. Therefore, it is possible to obtain an effect that the same security level as that of the personal computer can be realized in the peripheral device.
[Brief description of the drawings]
FIG. 1 is a diagram showing an electronic certificate providing system according to an embodiment of the present invention.
FIG. 2 is a diagram illustrating a certificate provision agency process according to an embodiment of the present invention.
FIG. 3 is a diagram illustrating a data configuration according to an embodiment of the present invention.
FIG. 4 is a diagram illustrating an example of a wireless LAN system.
FIG. 5 is a diagram illustrating a connection between a peripheral device and a PC.
FIG. 6 is a diagram illustrating a method for acquiring an electronic certificate.
[Explanation of symbols]
10: Certification authority, 20: Peripheral equipment,
21: Identification code, 30: Personal computer (PC),
31: Certificate acquisition unit, 32: Conversion unit,
33: Identification code management unit 34: Transfer unit
35: Viewer part, 36: Backup part,

Claims (8)

An electronic certificate providing system in which a personal computer performs an electronic certificate acquisition process from a certificate authority for a peripheral device,
Personal computer
An electronic certificate acquisition unit for acquiring an electronic certificate from a certificate authority via a network;
A conversion unit for converting the acquired electronic certificate into a format suitable for the peripheral device of the provider,
An electronic certificate providing system comprising: a transfer unit that transfers an electronic certificate whose format has been converted to a peripheral device to which the electronic certificate is provided. The electronic certificate providing system according to claim 1,
Personal computer
Providing an electronic certificate, further comprising an identification information management unit that uniquely manages the peripheral device based on the identification information acquired from the peripheral device of the providing destination and provides each peripheral device with a unique electronic certificate system. (Control uniqueness at the time of acquisition or transfer) A personal computer acting on behalf of a peripheral device for obtaining an electronic certificate from a certificate authority,
An electronic certificate acquisition unit for acquiring an electronic certificate from a certificate authority via a network;
A conversion unit for converting the acquired electronic certificate into a format suitable for the peripheral device of the provider,
A personal computer, comprising: a transfer unit that transfers the electronic certificate whose format has been converted to a peripheral device to which the digital certificate has been provided. The personal computer according to claim 3.
A personal computer, further comprising: an identification information management unit that uniquely manages the peripheral device based on the identification information acquired from the peripheral device of the providing destination, and provides each peripheral device with a unique electronic certificate. In the personal computer according to claim 3 or 4,
A personal computer, further comprising: a backup unit that holds the provided electronic certificate in association with the peripheral device based on the identification information acquired from the peripheral device of the providing destination. A computer program that causes a personal computer to perform an acquisition process of an electronic certificate from a certificate authority for a peripheral device,
An electronic certificate acquisition function for acquiring an electronic certificate from a certificate authority via a network;
A conversion function that converts the acquired electronic certificate into a format suitable for the peripheral device of the recipient,
A computer program for realizing, on a personal computer, a transfer function for transferring a digital certificate whose format has been converted to a peripheral device to which it is provided. The computer program according to claim 6,
The personal computer further realizes an identification information management function for uniquely managing the peripheral device based on the identification information acquired from the peripheral device of the providing destination and providing each peripheral device with a unique electronic certificate. Computer program. An electronic certificate providing method in which a personal computer performs an electronic certificate acquisition process from a certificate authority for a peripheral device,
The personal computer acquires the identification information from the peripheral device, requests and obtains an electronic certificate from the certificate authority over the network, and converts the acquired electronic certificate into a format suitable for the peripheral device of the provider. A method for providing an electronic certificate, comprising: transferring an electronic certificate that is uniquely identified by identification information and converted in format to a peripheral device to be provided.

Images