JP2008071318A - Certificate management apparatus, certificate management method and certificate management program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a certificate management apparatus, a certificate management method and a certificate management program which can precisely and efficiently manage a certificate necessary for authentication for receiving service provision. <P>SOLUTION: The certificate management apparatus 1 for managing the certificate necessary for authentication for receiving service provision from a service providing apparatus comprises a service management means 102 for managing service to be provided and a certificate management means 104 for managing the certificate necessary for the authentication for receiving service provision on the basis of a certificate table means 107 for managing correspondence between a held certificate and service to be provided by the certificate. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a certificate management apparatus, a certificate management method, and a certificate management program, and more particularly, a certificate for managing a certificate necessary for authentication for receiving a service from a service providing apparatus that provides a predetermined service. The present invention relates to a management apparatus, a certificate management method, and a certificate management program.

  2. Description of the Related Art Conventionally, a client / server system in which a plurality of computers are communicably connected via a network, at least one server (service providing apparatus), and the rest as clients is often configured.

  In such a client / server system, various requests are made from the client to the server, the server performs processing according to the request, and then makes a response based on the processing result. In a client / server system, for example, when a client receives provision of a service from a server, the client needs to perform authentication, which is a work for verifying the validity.

For example, a certificate is used for authentication. For example, the client obtains a certificate before receiving a service from the server, authenticates using the certificate, and then receives the service from the server. Patent Document 1 describes an example of a client / server system that performs authentication.
JP 2004-320727 A

  However, the certificate generally varies depending on the service to be provided. Therefore, a client that receives a plurality of services from a plurality of servers needs to hold a large number of certificates. A conventional client has a problem that when a user wants to receive a certain service, the certificate used for authentication for receiving the service is not known unless the user connects to the server.

  In addition, clients often have certificates held by each application, and when viewed from the whole client, there is a problem that a plurality of the same certificates are held. Furthermore, there is a problem that it is difficult for a client to determine which service can be provided with which certificate.

  The present invention has been made in view of the above points. A certificate management apparatus, a certificate management method, and a certificate capable of clearly and efficiently managing a certificate necessary for authentication for receiving service provision. The purpose is to provide a management program.

  In order to solve the above-described problem, the present invention provides a certificate management apparatus that manages a certificate required for authentication for receiving a service provided from a service providing apparatus, the service receiving the service provided from the service providing apparatus. Authentication for receiving the provision of the service based on the service management means to be managed and the certificate table means for managing the correspondence between the certificate held and the service that can be provided by the certificate Certificate management means for managing the necessary certificate.

  In addition, what applied the component, expression, or arbitrary combination of the component of this invention to a method, an apparatus, a system, a computer program, a recording medium, a data structure, etc. is also effective as an aspect of this invention.

  According to the present invention, it is possible to provide a certificate management apparatus, a certificate management method, and a certificate management program that can clearly and efficiently manage a certificate necessary for authentication for receiving service provision.

  Next, the best mode for carrying out the present invention will be described based on the following embodiments with reference to the drawings. In this embodiment, a multifunction peripheral (MFP) will be described as an example of a certificate management apparatus, but any apparatus or device that manages certificates may be used. Note that the multifunction peripheral is an example of an image processing apparatus.

  FIG. 1 is a configuration diagram of an example of a system including a multifunction machine according to the present invention. The system in FIG. 1 has a configuration in which a multifunction machine 1, an image processing server 2, and a user management server 3 are connected via a network 4 such as a LAN. The image processing server 2 and the user management server 3 are examples of service providing apparatuses. When receiving a service provision from the image processing server 2 or the user management server 3, the multifunction device 1 performs authentication using a certificate.

  As will be described later, the multi function device 1 manages certificates in correspondence with services provided from the image processing server 2 or the user management server 3. Therefore, the MFP 1 can easily specify a certificate corresponding to a service provided from the image processing server 2 or the user management server 3.

  After the authentication, the multi-function device 1 makes a service request to the image processing server 2 or the user management server 3 to receive service. The correspondence between the service and the certificate may be one-to-one, one-to-many, many-to-one, or many-to-many.

  FIG. 2 is a configuration diagram of an example of a multifunction peripheral. The multi-function device 1 shown in FIG. 1 includes various hardware and various software (programs). As hardware of the multifunction device 1, there are a hard disk drive (HDD) 28, an SDRAM (Synchronous DRAM) 29, and other hardware not shown.

  There are various applications and various platforms as the software of the multifunction device 1. These programs are executed in parallel on a process basis by an OS (Operating System) such as UNIX (registered trademark).

  As applications, there are a user management application 11, a scanner application 12, a printer application 13, an image processing application 14, an operation application (user interface) 15, a mail application 16, and an encryption application 17.

  As a platform, there are various services, various handlers, and a driver group 27. The service includes authentication control service 18, scanner control service 19, printer control service 20, filter control service 21, network control service 22, encryption control service 23, user management service 24, certificate management service 25, system control (execution unit) ) Service 26 exists. As handlers, there are a scanner handler 30 and a plotter handler 31.

  The MFP 1 includes a user management application 11, a scanner application 12, a printer application 13, an image processing application 14, an operation application 15, a mail application 16, an encryption application 17, an authentication control service 18, a scanner control service 19, a printer control service 20, A filter control service 21, a network control service 22, an encryption control service 23, a user management service 24, a certificate management service 25, a system control service 26, and a driver group 27 are connected via an API (Application Program Interface) 32. .

  The MFP 1 includes an authentication control service 18, a scanner control service 19, a printer control service 20, a filter control service 21, a network control service 22, an encryption control service 23, a user management service 24, a certificate management service 25, and system control. A service 26, SDRAM 29, scanner handler 30, and plotter handler 31 are connected via a PCI 33.

  The user management application 11, scanner application 12, printer application 13, image processing application 14, operation application 15, mail application 16, and encryption application 17 use the platform via the API 32 and perform processing represented by their names. .

  The authentication control service 18 performs control related to authentication processing and billing processing. The scanner control service 19 provides a scanner API. The printer control service 20 provides a printer API. The filter management service 21 performs management related to filters (functions).

  The network control service 22 mediates network communication. The encryption control service 23 performs control related to encryption processing. The user management service 24 performs control related to management of user information. The certificate management service 25 manages certificates. The system control service 26 performs control related to system management.

  The multifunction device 1 of the present invention is characterized by having a filter management service 21 and a certificate management service 25. In the present invention, the phrase “filter” is used in terms of functional units. The user can create a desired process by combining filters.

  The multi-function device 1 as described above can be configured to have processing blocks as shown in FIGS. FIG. 3 is a configuration diagram of an embodiment showing processing blocks of the multifunction machine. The MFP 1 shown in FIG. 3 includes a user operation unit 101, a filter management unit 102, a filter processing unit 103, a certificate management unit 104, and a user authentication unit 105. The filter management unit 102 includes a filter combination unit 111 and a filter list creation unit 112. 3 is connected to a processing execution unit 106, a certificate table 107, a certificate storage unit 108, and a user management unit 109 via a network 4.

  FIG. 4 is a configuration diagram of another embodiment showing the processing blocks of the multifunction peripheral. 4 is obtained by adding a processing execution unit 106, a certificate table 107, a certificate storage unit 108, and a user management unit 109 to the configuration of the multifunction device 1 in FIG. That is, the multi-function device 1a in FIG. 4 includes the processing execution unit 106, the certificate table 107, the certificate storage unit 108, and the user management unit 109 that are connected via the network 4 in the multi-function device 1 in FIG.

  FIG. 5 is a configuration diagram of another embodiment showing processing blocks included in the multifunction peripheral. The MFP 1b in FIG. 5 is obtained by adding a certificate table 107 to the configuration of the MFP 1 in FIG. That is, the MFP 1a in FIG. 5 has a configuration including the certificate table 107 connected via the network 4 in the MFP 1 in FIG.

  FIG. 6 is a configuration diagram of another embodiment showing processing blocks of the multi-function peripheral. A multifunction device 1c in FIG. 6 is obtained by adding a certificate table 107 and a certificate storage unit 108 to the configuration of the multifunction device 1 in FIG. That is, the MFP 1c shown in FIG. 6 has a configuration including the certificate table 107 and the certificate storage unit 108 that are connected via the network 4 in the MFP 1 shown in FIG.

  Unless otherwise specified, the operation processing of each embodiment shown below is executed and processed by a CPU using a main memory such as a RAM as a work area according to a program stored in a ROM or HDD.

  Next, the operation of the processing blocks shown in FIGS. 3 to 6 will be described in detail using sequence diagrams. Here, the multifunction device 1 shown in FIG. 3 will be described as an example. A user who wants to create a desired process by combining the filters and want the multifunction device 1 to log in logs into the multifunction device 1.

  FIG. 7 is a sequence diagram illustrating an example of login processing by the multifunction machine. FIG. 8 is an example of a screen image displayed on the user operation unit of the multifunction machine. First, in step S <b> 1, the user inputs a user name and password on a login screen 200 displayed on the user operation unit 101 such as an operation panel, and presses a “login” button 201. The user operation unit 101 transmits the input user name and password to the user authentication unit 105 and makes a login request.

  If there is a login request, the user authentication unit 105 proceeds to step S2 and makes a certificate selection request to the certificate management unit 104. The certificate management unit 104 proceeds to steps S3 and S4, and selects a certificate associated with the user who is the target of the login request from the certificate table 107 as shown in FIG.

  FIG. 9 is a configuration diagram showing an example of a certificate table. The certificate table in FIG. 9 correlates the services that can be used in the multifunction device 1, the server that provides the services, the certificate required for authentication to receive the services, and the user information that represents the users who can use the services. It is a table. For example, when the user who is the target of the login request is “user1”, the certificate management unit 104 selects the certificate “CERT1”.

  In step S5, the certificate management unit 104 notifies the user authentication unit 105 of the selected certificate. The user authentication unit 105 proceeds to steps S6 and S7, and acquires a certificate associated with the user who is the target of the login request from the certificate storage unit 108.

  In step S8, the user authentication unit 105 makes a service request to the user management unit 109. The user management unit 109 manages the elements shown in FIG. 10 for each filter. FIG. 10 is an image diagram showing an example of filter elements.

  FIG. 10 shows service names, function type information (input, processing, output, etc.), certificate unnecessary information, billing information, user information (user identification information, general, etc.) as examples of filter elements. The user information here is information for selecting a user who can use the filter.

  The user management unit 109 selects a service that can be used by the user who is the target of the login request, based on the user information included in the filter element. In step S 9, the user management unit 109 notifies the user authentication unit 105 of the selected service.

  In step S10, the user authentication unit 105 performs user authentication using the received user name and password, a certificate associated with the acquired login request target user, and the login request target user. Based on the service that can be used, it is determined whether the login is OK or NG, and the determination result is notified to the user operation unit 101.

  If the login is OK, the multifunction device 1 performs the filter list display process shown in FIG. FIG. 11 is a sequence diagram illustrating an example of the filter list display process. Steps S21 and S22 show steps S1 to S10 in FIG.

  If the login is OK, the user operation unit 101 proceeds to step S23, and makes a filter list display request to the filter list creation unit 112. In step S24, the filter list creation unit 112 makes a certificate selection request to the certificate management unit 104. The certificate management unit 104 proceeds to steps S25 and S26, and selects a certificate associated with the user who is the target of the login request from the certificate table 107 shown in FIG. In step S27, the certificate management unit 104 notifies the filter list creation unit 112 of the selected certificate.

  The filter list creation unit 112 proceeds to steps S28 and S29, and acquires a certificate associated with the user who is the target of the login request from the certificate storage unit 108. In step S30, the filter list creation unit 112 determines the login request based on the service available to the user who is the target of the login request notified during the login process and the certificate stored in the certificate storage unit 108. Select a filter available to the target user.

  In step S 30, the filter list creation unit 112 creates the filter list screen 210 shown in FIG. 8 and displays it on the user operation unit 101. The filter list screen 210 is displayed so that the user can select an available filter. For example, the filter list screen 210 grays out a filter that cannot be used by the user and visually distinguishes it from a filter that can be used by the user. Note that as another filter list screen, a filter that cannot be used by the user may not be displayed. Further, the annotation 211 may be displayed on a filter that can be used for billing (300 yen / case, 100 yen / time, etc.).

  In the filter list screen 210 of FIG. 8, the filters are displayed as “input”, “process”, and “output” based on the above-described function type information as filter elements. For example, the filter list screen 210 displays “input” as a filter “scan”, “network”, “processing” as a filter “image processing”, and “output” as a filter “printout”.

  In the filter list screen 210, the filter “signature” is grayed out and cannot be selected. Further, the filter “accumulate” is annotated 211 and can be selected by charging. The filter list screen 210 in FIG. 8 represents an example in which the filter “scan” is selected as “input”, the filter “image processing” is selected as “processing”, and the filter is not selected as “output”. .

  When the user selects a filter from the filter list screen 210 and presses an “execution button” 212, the multi-function device 1 executes processing as shown in FIG. FIG. 12 is a sequence diagram illustrating an example of processing execution.

  When the user presses the “execute button” 212, the multifunction peripheral 1 proceeds to step S 41 and notifies the filter combination unit 111 of the combination of filters selected from the filter list screen 210. In step S42, the filter combination unit 111 requests the filter processing unit 103 to execute the filter combined by the user. In step S43, the filter processing unit 103 requests the processing execution unit 106 to perform processing on the filter combined by the user.

  The process execution part 106 performs the process concerning a filter. Note that when the processing execution unit 106 requests the server to perform processing (service) to be filtered, authentication is performed using a certificate corresponding to the service. Then, after authentication, the process execution unit 106 makes a service request to the server and receives a service.

  The processing result applied to the filter combined by the user is transmitted from the process execution unit 106 to the user operation unit 101 via the filter processing unit 103 and the filter combination unit 111 in steps S44 to S46. When receiving the processing result, the user operation unit 101 displays an end screen 220.

  As described above, the multifunction device 1 can execute a desired process created by a user combining filters. In the MFP 1 according to the first embodiment, the filter list screen 210 can be created so that a filter that can be selected based on a held certificate can be selected.

  Further, the operation of the processing blocks shown in FIGS. 3 to 6 will be described in detail using sequence diagrams. Here, the multifunction device 1 shown in FIG. 3 will be described as an example. A user who wants to create a desired process by combining the filters and want the multifunction device 1 to log in logs into the multifunction device 1.

  If the login is OK, the multifunction device 1 displays the filter list and executes the process as shown in FIG. FIG. 13 is a sequence diagram showing an example of filter list display / process execution. Steps S61 and S62 show steps S1 to S10 in FIG.

  If the login is OK, the user operation unit 101 proceeds to step S63, and the user operation unit 101 makes a filter acquisition request to the filter management unit 102. In step S64, the filter management unit 102 notifies the user operation unit 101 of the filter. The user operation unit 101 displays a filter list screen using the notified filter.

  When the user selects a filter from the filter list screen and presses the “execute button”, the multifunction device 1 proceeds to step S65 and requests the filter processing unit 103 to execute the filter selected from the filter list screen.

  In step S 66, the filter processing unit 103 makes a certificate selection request to the certificate management unit 104. In step S67 or S68, the certificate management unit 104 selects a filter certificate selected by the user from the certificate table 107. In step S69, the certificate management unit 104 notifies the filter processing unit 103 of the selected certificate.

  In step S70 and S71, the filter processing unit 103 acquires the certificate of the filter selected by the user from the certificate storage unit 108. In step S72, the filter processing unit 103 requests the process execution unit 106 to perform processing on the filter selected from the filter list screen by the user.

  The process execution part 106 performs the process concerning a filter. Note that when the processing execution unit 106 requests the server to perform processing (service) to be filtered, authentication is performed using a certificate corresponding to the service. Then, after authentication, the process execution unit 106 makes a service request to the server and receives a service.

  Then, the processing result applied to the filter combined by the user is transmitted from the process execution unit 106 to the user operation unit 101 via the filter processing unit 103 in steps S73 to S74. Upon receiving the “OK” processing result indicating success, the user operation unit 101 displays an end screen 220. Further, when the user operation unit 101 receives the processing result of “NG” indicating failure, the user operation unit 101 displays an error screen 230.

As described above, the multifunction device 1 can execute a desired process created by a user combining filters. In the MFP 1 according to the second embodiment, after the user selects a filter from the filter list screen, it is possible to determine whether the filter can be selected based on the held certificate, and to perform processing on the filter.
(Summary)
According to the multifunction machine 1 of the first and second embodiments, the certificate used for authentication for receiving the provision of the service is clarified by managing the certificate by the certificate management unit 104 and the certificate table 107. Become. Further, according to the MFP 1 of the first and second embodiments, the certificate management is performed by the certificate management unit 104 and the certificate table 107, so that the same certificate is not held redundantly, Can be managed efficiently.

  The present invention is not limited to the specifically disclosed embodiments, and various modifications and changes can be made without departing from the scope of the claims.

It is a block diagram of an example of the system containing the multifunctional device by this invention. 1 is a configuration diagram of an example of a multifunction machine. FIG. 2 is a configuration diagram of an embodiment illustrating processing blocks included in a multifunction peripheral. It is a block diagram of the other Example showing the processing block which a multifunctional machine has. It is a block diagram of the other Example showing the processing block which a multifunctional machine has. It is a block diagram of the other Example showing the processing block which a multifunctional machine has. FIG. 11 is a sequence diagram illustrating an example of login processing by a multifunction machine. 6 is an example of a screen image displayed on a user operation unit of the multifunction peripheral. It is a block diagram which shows an example of a certificate table. It is an image figure showing an example of the element of a filter. It is a sequence diagram which shows an example of a filter list display process. It is a sequence diagram which shows an example of process execution. It is a sequence diagram which shows an example of filter list display and process execution.

Explanation of symbols

1, 1a to 1c MFP 2 Image processing server 3 User management server 4 Network 101 User operation unit 102 Filter management unit 103 Filter processing unit 104 Certificate management unit 105 User authentication unit 106 Processing execution unit 107 Certificate table 108 Certificate storage Section 109 User management section 111 Filter combination section 112 Filter list creation section 200 Login screen 210 Filter list screen

Claims (19)

A certificate management device that manages a certificate required for authentication to receive service from a service providing device,
Service management means for managing the service received from the service providing device;
Manages the certificate necessary for authentication for receiving the service based on certificate table means for managing the correspondence between the certificate held and the service that can be provided by the certificate And a certificate management means.   The service management means uses the certificate management means to select the service that can be provided by the certificate held, create a service list screen for the selected service, and 2. The certificate management apparatus according to claim 1, further comprising service list creation means for displaying said service list screen on said interface means. The service management means includes a service combination means for combining one or more services selected by a user from the service list screen;
3. The certificate management apparatus according to claim 2, further comprising service processing means for executing processing related to the service using the certificate based on an execution request from the service combination means.   The service list creation means visually changes the service that can be provided by the held certificate to a service that cannot be provided by the held certificate, so that the service list is provided. The certificate management apparatus according to claim 2, wherein a screen is created.   The service list creation means creates the service list screen by visually changing the services that can be provided by charging among the services that cannot be provided by the held certificate. The certificate management apparatus according to claim 2, wherein: The service management unit creates a service list screen of the service, and displays a service list screen on an interface unit with a user;
Service combination means for combining one or more of the services selected by the user from the service list screen;
2. The certificate management according to claim 1, further comprising service processing means for executing processing related to the service using the certificate corresponding to the service based on an execution request from the service combination means. apparatus.   7. The certificate management apparatus according to claim 6, wherein the service processing means displays on the interface means a result indicating whether or not the process related to the service has been received.   The certificate table means manages the service, the service providing apparatus that provides the service, a certificate necessary for authentication for receiving service from the service providing apparatus, and a response of a user who receives the service The certificate management apparatus according to claim 1, wherein the certificate management apparatus is configured as described above.   The certificate management apparatus according to claim 1, wherein the certificate management apparatus is an image processing apparatus having a printing unit and an imaging unit. A certificate management method in a certificate management apparatus for managing a certificate necessary for authentication for receiving service provision from a service providing apparatus,
A service management step of managing the service received from the service providing device;
Manages the certificate necessary for authentication for receiving the service based on certificate table means for managing the correspondence between the certificate held and the service that can be provided by the certificate And a certificate management step.   The service management step uses the certificate management step to select the service that can be provided by the certificate held, create a service list screen for the selected service, and 11. The certificate management method according to claim 10, further comprising a service list creation step of displaying the service list screen on the interface means. The service management step includes a service combination step of combining one or more services selected by a user from the service list screen;
12. The certificate management method according to claim 11, further comprising a service processing step of executing processing related to the service using the certificate based on an execution request for the service combined in the service combination step. .   The service list creating step visually changes the service that can be provided by the held certificate to a service that cannot be provided by the held certificate, and the service list The certificate management method according to claim 11, wherein a screen is created.   The service list creation step creates the service list screen by visually changing the services that can be provided by billing among the services that cannot be provided by the held certificate. The certificate management method according to claim 11, wherein: The service management step includes creating a service list screen of the service and displaying the service list screen on an interface means with a user;
A service combination step of combining one or more services selected by a user from the service list screen;
11. The service processing step of executing a process related to the service using the certificate corresponding to the service based on an execution request for the service combined in the service combination step. Certificate management method.   16. The certificate management method according to claim 15, wherein in the service processing step, a result of whether or not the processing related to the service has been received is displayed on the interface unit.   The certificate table means manages the service, the service providing apparatus that provides the service, a certificate necessary for authentication for receiving service from the service providing apparatus, and a response of a user who receives the service The certificate management method according to any one of claims 10 to 16, wherein the certificate management method is performed.   The certificate management method according to claim 10, wherein the certificate management apparatus is an image processing apparatus having a printing unit and an imaging unit. A certificate management device that manages the certificates required for authentication to receive service provision from the service providing device.
Service management means for managing the service received from the service providing device;
Manages the certificate necessary for authentication for receiving the service based on certificate table means for managing the correspondence between the certificate held and the service that can be provided by the certificate Certificate management program for functioning as a certificate management means.

Images