JP2007028049A - Certificate management device, method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a certificate management device, method, and program capable of acquiring a certificate without the need for implementing troublesome processing. <P>SOLUTION: Upon the receipt of a letter of proxy from a PC 10, a certificate management server 30 requests a certificate agency 40 to authenticate the PC 10. When receiving the certificate that the PC 10 is authenticated by the certificate agency 40, the certificate management server 30 transmits the received certificate to a multifunction machine 20 requiring the certificate of the PC 10 being an authentication request source. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a certificate management apparatus, method, and program, and more particularly, to a certificate management apparatus, method, and program for managing authentication requests and certificate updates for a plurality of apparatuses.

  Conventionally, when registering a user certificate in a device such as a printer or multifunction device, each end user obtains a certificate from a certificate authority and registers the obtained certificate in the device as it is, or mail with a certificate is registered in the device. It was issued. However, in order for each person to obtain a certificate from a certificate authority, a cumbersome process is required, and depending on the end user, the certificate may not be obtained or the internal security will be perfected. I could not.

  Therefore, in Patent Document 1, the certificate authority guarantees the correspondence between the mail address of the electronic mail apparatus and the public key by issuing a public key certificate, and the public key of the own apparatus is newly registered or expired. A technique for efficiently transmitting a new public key to a communication partner when updated for a reason is described.

In the technique described in Patent Document 1, an end user himself / herself requests authentication to obtain a certificate, and registers the certificate in an electronic mail apparatus that is a device. On the other hand, when the certificate is revoked, the e-mail device notifies the registered user by e-mail that the certificate has been revoked.
JP 2002-208960 A

  However, with the technique described in Patent Document 1, when many users try to obtain a certificate, each user has to perform troublesome processing for obtaining the certificate, and some users cannot obtain the certificate. There was also.

  SUMMARY An advantage of some aspects of the invention is that it provides a certificate management apparatus, a method, and a program that can acquire a certificate without performing troublesome processing.

  The certificate management device according to the present invention includes an authentication request unit that requests an authentication request from a plurality of devices to a certificate authority at any time or every predetermined time, a reception unit that receives a certificate authenticated by the certificate authority, Transmitting means for transmitting the certificate received by the receiving means to a device that requires the certificate.

  The certificate management method according to the present invention requests an authentication request from a plurality of devices to a certificate authority at any time or every predetermined time, receives a certificate authenticated by the certificate authority, and receives the received certificate. To the device that needs the certificate.

  The certificate management program according to the present invention causes a computer to request an authentication request from a plurality of devices from the certificate authority at any time or every predetermined time, to receive a certificate authenticated by the certificate authority, and to receive the certificate The certificate is transmitted to a device that requires the certificate.

  The certificate authority publicly authenticates the device and issues a certificate at the time of authentication. The authentication request means requests the certificate authority for authentication requests from a plurality of devices at any time or every predetermined time. When the certificate authority authenticates and issues a certificate, the receiving unit receives the certificate. The transmission means transmits the received certificate to a device that requires the certificate.

  Therefore, according to the above invention, an authentication request from a plurality of devices is requested to a certificate authority at any time or every predetermined time, a certificate authenticated by the certificate authority is received, and the received certificate is By transmitting the certificate to a device that requires the certificate, it is possible to eliminate the burden of each device directly requesting authentication from the certificate authority, and to obtain the certificate without performing any troublesome processing.

  The certificate management device includes: an update time extraction unit that extracts an update time of a certificate received by the reception unit; and an apparatus that has requested the authentication before the update time extracted by the update information extraction unit or Notification means for notifying the device having the certificate of the update time may be further provided. Thereby, it is possible to notify the user of the certificate update time.

  The certificate management apparatus further includes an update time extraction unit that extracts an update time of the certificate received by the reception unit, and the authentication request unit is configured to update the update time extracted by the update information extraction unit. Before the certificate, the certificate authority may be requested to renew the certificate. As a result, the user can automatically update the certificate without performing any troublesome processing.

  The certificate management apparatus further includes an update time acquisition unit that acquires a time from when the certificate authority is requested to update the certificate to when the certificate is updated. The certificate authority may be requested to renew the certificate at least at a time earlier than the renewal time. As a result, it is possible to prevent the certificate from expiring during the renewal process and causing a certificate blank period to occur.

  Further, the authentication requesting unit may request authentication from the certificate authority every time there is an authentication request from one device or at predetermined time intervals.

  The certificate management apparatus, method, and program according to the present invention request an authentication request from a plurality of apparatuses to a certificate authority at any time or every predetermined time, receive a certificate authenticated by the certificate authority, and receive the certificate By transmitting the received certificate to a device that requires the certificate, the burden of each device directly requesting authentication from the certificate authority can be saved, and the certificate can be acquired without performing any troublesome processing.

  Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a block diagram showing a configuration of an authentication management system according to an embodiment of the present invention. The authentication management system includes a plurality of so-called personal computers 10 (10A, 10B, 10C), a plurality of multifunction devices 20 (20A, 20B), and a certificate management server 30 that manages the certificates of each multifunction device 20. I have.

  The PC 10 is a terminal device used by a user, and has various application software. For example, the PC 10 transmits the data created by the application software to the multi-function device 20 in order to perform mail delivery, facsimile transmission, printout, and the like.

  The multi-function device 20 can execute functions such as printing, facsimile transmission / reception, scanning, copying, and mail transmission / reception, for example. The multi-function device 20 has a user certificate and a device certificate. The user certificate is for certifying a user (PC 10) who can access the multifunction device 20. The device certificate certifies the multifunction device 20 itself.

  For example, when the MFP 20A has only the user certificate of the PC 10A, it accepts only the access of the PC 10A and rejects the access of the PCs 10B to 10D. As a result, the multi-function device 20A can handle only the data of the PC 10A whose identity is proved and permitted by the multifunction device 20A. The user certificate and the device certificate are authenticated by the certificate authority 40. In the present embodiment, an example in which the certificate authority 40 issues a user certificate will be described.

  The certificate management server 30 receives an authentication request (certificate issuance request) from each PC 10 and collectively requests an authentication request from the certificate authority 40 to manage the update timing of the certificate issued by the certificate authority 40. To do.

  FIG. 2 is a block diagram showing the configuration of the certificate management server 30. The certificate management server 30 receives an authorization letter from the PC 10, transmits / receives a user certificate, etc., makes an authentication request with the transmission / reception unit 31 that transmits / receives other information, and extracts a certificate update time. The control part 32 which performs control for performing, and the memory | storage part 32 which memorize | stores the management tool which manages the certificate of each PC10 are provided.

  In the authentication management system configured as described above, the user certificate of the PC 10 is issued as follows. First, the PC 10 transmits a proxy to the certificate management server 30 in order to request the certificate management server 30 to issue a user certificate. For example, the PC 10 may access the certificate management server 30, open the proxy screen shown below, and input necessary information.

  FIG. 3 is a diagram showing a power of attorney screen 51. On the power of attorney screen 51, an electronic stamp 52 indicating that the PC 10 itself is delegated and user information indicating information of the PC 10 itself are input. Furthermore, information such as a desired start date and time of a certificate, an expiration date, a device that requires a user certificate (the multifunction device 20 in this embodiment), and the like are input to the power of attorney screen 51. Note that the identification information (ID) and password of the PC 10 may be used instead of the electronic stamp 52. In addition, the PC 10 may transmit information input to the power of attorney screen 51 to the certificate management server 30 by e-mail.

  Note that the certificate management server 30 may acquire user information of the PC 10 using a cookie. When there is a server that centrally manages information of each PC 10, the certificate management server 30 may acquire user information from the server.

  FIG. 4 is a flowchart showing an authentication request routine of the certificate management server 30. Upon receiving the proxy from the PC 10 (Step S1), the certificate management server 30 requests the certificate authority 40 to authenticate the PC 10 (Step S2).

  Note that the certificate management server 30 may request authentication from the certificate authority 40 every predetermined time instead of requesting the certificate authority 40 to perform authentication at any time. As a result, even when authentication requests from the PC 10 are concentrated in the same time zone, the certificate management server 30 can collectively perform authentication requests to the certificate authority 40.

  In addition, the certificate management server 30 makes an authentication request to the certificate authority 40 every predetermined time, and includes information indicating that the proxy is urgent (for example, the degree of urgency is high and the desired authentication deadline is near). If so, an authentication request may be made to the certificate authority 40 as needed. That is, the certificate management server 30 may normally request authentication every predetermined time, and may request authentication at any time in an emergency.

  Next, when the certificate management server 30 receives a certificate indicating that the PC 10 has been authenticated by the certificate authority 40 (step S3), the certificate management server 30 receives the certificate of the authentication requesting source PC 10 to the MFP 20 that requires the certificate. A certificate is transmitted (step S4).

  As described above, when the certificate management server 30 receives the authorization letter indicating the authentication request from the PC 10, the certificate management server 30 requests the certificate authority 40 to authenticate the PC 10 at predetermined time intervals or at any time. As a result, the PC 10, that is, the user can issue the user certificate to the certificate authority 40 only by sending predetermined information to the certificate management server 30 without performing troublesome work for authentication processing.

  The present invention is not limited to the above-described embodiment, and can be applied to the following cases.

  For example, when the certificate management server 30 receives a certificate issued by the certificate authority 40 (step S3), the certificate management server 30 extracts update time information indicating the next update time from the certificate, and writes this in the management tool. The renewal time of each certificate may be managed by For example, the certificate management server 30 may notify the PC 10 or the MFP 20 having the user information that has requested authentication that the update time is coming before the update time indicated by the update time information.

  Further, the certificate management server 30 may make a certificate update request to the certificate authority 40 before the update time indicated by the update time information. In this case, the certificate management server 30 may acquire the issue time from the certificate update request to the issue. The issuance time may be inquired from the certificate authority 40 by the certificate management server 30 or may be a time obtained from the average value of the latest certificate issuance times. Then, the certificate management server 30 may make a certificate update request to the certificate authority 40 at least at a time that is earlier than the issue time from the update time. As a result, it is possible to prevent the certificate from being expired during the certificate renewal process and the lime lag (blank period) of the certificate from occurring.

  Note that the present invention is not limited to the above-described embodiment, and it is needless to say that the present invention can also be applied to a design modified within the scope of the claims. In the above-described embodiment, the multi-function device 20 is taken as an example of a device that requires a user certificate. However, a printer, a facsimile machine, a computer, or the like may be used.

It is a block diagram which shows the structure of the authentication management system which concerns on embodiment of this invention. It is a block diagram which shows the structure of a certificate management server. It is a figure which shows a power of attorney screen. It is a flowchart which shows the authentication request routine of a certificate management server.

Explanation of symbols

10, 10A, 10B, 10C PC
20, 20A, 20B MFP 30 Certificate management server 31 Transmission / reception unit 32 Control unit 33 Storage unit 40 Certificate authority

Claims (11)

An authentication request means for requesting an authentication request from a plurality of devices to a certificate authority at any time or at predetermined time intervals;
Receiving means for receiving a certificate authenticated by the certificate authority;
Transmitting means for transmitting the certificate received by the receiving means to a device that requires the certificate;
Certificate management device with Update time extraction means for extracting the update time of the certificate received by the receiving means;
The information processing apparatus according to claim 1, further comprising notification means for notifying the update requesting apparatus or the apparatus having the certificate of the update time before the update time extracted by the update information extracting means. The certificate management device described. Update time extraction means for extracting the update time of the certificate received by the receiving means;
The certificate management apparatus according to claim 1, wherein the authentication request unit requests the certificate authority to update the certificate before the update time extracted by the update information extraction unit. Further comprising update time acquisition means for acquiring a time from when the certificate authority is requested to update the certificate until it is updated;
The certificate management apparatus according to claim 3, wherein the authentication request unit requests the certificate authority to renew the certificate at least at a time before the renewal time by the renewal time. The certificate management according to any one of claims 1 to 4, wherein the authentication requesting unit requests authentication from the certificate authority every time there is an authentication request from one device or every predetermined time. apparatus. Request authentication requests from multiple devices to the certificate authority at any time or at predetermined intervals,
Receiving a certificate authenticated by the certificate authority;
A certificate management method for transmitting the received certificate to a device that requires the certificate. Extract the renewal time of the received certificate,
The certificate management method according to claim 6, wherein the update time is notified to the authentication requesting device or the device having the certificate before the extracted update time is reached. Extract the renewal time of the received certificate,
The certificate management method according to claim 6, wherein the certificate authority is requested to update the certificate before the extracted renewal time is reached. Obtain the time from requesting the certificate authority to renew the certificate until it is renewed,
The certificate management method according to claim 8, wherein the certificate authority is requested to update the certificate at a time that is at least the acquired time from the update time. The certificate management according to any one of claims 6 to 9, wherein in the authentication request, the authentication authority is requested for authentication every time there is an authentication request from one device or every predetermined time. Method. On the computer,
An authentication request from a plurality of devices is requested to a certificate authority at any time or every predetermined time, a certificate authenticated by the certificate authority is received, and the received certificate is sent to a device that requires the certificate. Certificate management program to be sent.

Images