JP2010141490A - Electronic certificate management device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an electronic certificate management device capable of readily acquiring the required electronic certificate from among a plurality of electronic certificates belonging to the same user. <P>SOLUTION: A user operates a client device, to acquire a URL indicating a place for the electronic certificate belonging to oneself from the electronic certificate; searches a server device corresponding to the URL (S301, S302), and acquires the electronic certificate matching the conditions (the expiration date, encryption strength, or the like) from among the plurality of electronic certificates stored in the storage section of the server device (S303, S203), thus easily transferring to the electronic certificate having the expiration date even if the expiration date of the electronic certificate under use has expired. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an electronic certificate management apparatus.

  In a network system, for example, a digital signature is used so that a sender can confirm whether a sender of a document or the like sent through the Internet is correct. An electronic certificate is also used for confirmation (authentication) of whether or not a business partner can be trusted.

In addition, it will be common for corporations, individuals, etc. to hold multiple electronic certificates in the future so that they can be used properly according to the purpose of use, etc. A program for selecting a necessary electronic certificate from among certificates has been proposed (see, for example, Patent Document 1).
JP 2007-67836 A

  An object of the present invention is to provide an electronic certificate management apparatus that can easily obtain a necessary electronic certificate from among a plurality of electronic certificates belonging to the same user.

  In order to achieve the above object, one aspect of the present invention provides the following electronic certificate management apparatus.

[1] An electronic certificate management apparatus comprising an acquisition unit that acquires information on a storage location of an electronic certificate belonging to the same user from an electronic certificate in which the storage location information is recorded.

[2] Storage means for storing for each user an electronic certificate in which information on the location of an electronic certificate belonging to the same user is recorded, and acquisition means for acquiring information on the location from the electronic certificate An electronic certificate management device.

[3] The electronic certificate according to [1] or [2], further including search means for searching for the electronic certificate that matches a condition based on the information on the storage location acquired by the acquisition means. Management device.

[4] The electronic certificate management apparatus according to [1], wherein the search unit includes at least one of an expiration date, importance, an electronic certificate validity, and a certificate authority as the condition.

[5] The electronic certificate management according to [2], further comprising permission means for permitting the search means to search the electronic certificate stored in the storage means based on an access right possessed by a user. apparatus.

  According to the first and second aspects of the invention, a necessary electronic certificate can be easily obtained from a plurality of electronic certificates belonging to the same user.

  According to the third and fourth aspects of the invention, it is possible to search for an electronic certificate that matches the purpose of use.

  According to invention of Claim 5, it can suppress that the information of an electronic certificate leaks to the third party.

[First Embodiment]
FIG. 1 is a diagram illustrating an example of a configuration of a network system according to a first embodiment to which an electronic management device of the present invention is applied.

The network system 100 includes a server device 1, a plurality of client devices 2, 3 _{−1 to} 3 _-N connected to the server device 1 via a network 30 such as a local area network and _the Internet, and _the Internet 40. And a computer 4 of a certificate authority (CA) 5 that is connected to the server apparatus 1 and the client apparatus 2 and issues an electronic certificate (hereinafter simply referred to as “certificate”) in response to a request from them. Configured.

  The server device 1 is a computer provided in a company, an office, or the like, or a multi-functional peripheral device (MFP) having functions of a printer, a copier, a scanner, and a facsimile. The server device 1 also includes a control unit having a CPU and the like and a storage unit such as a ROM, RAM, and HDD that stores data such as a CPU program and a certificate. The storage unit of the server apparatus 1 is a place (repository) of a plurality of certificates 10 to 13 registered for the user by the computer 4 of the certificate authority 5. Here, the certificates 10 to 13 have different personalities such that the certificates 10 and 11 are equivalent to three sentences, the certificate 12 is equivalent to a bank seal, and the certificate 13 is equivalent to a real seal. In addition, the certificates 10 to 13 can be classified according to the above uses, for example, by a certificate authority, an expiration date, whether or not there is a guarantee of a national institution, and the like.

The client devices 2, 3 _{-1 to} 3- _N include a control unit having a CPU and the like, a storage unit 20 such as a ROM, RAM, and HDD for storing data such as a CPU program and a certificate, a keyboard, a mouse, and the like. An input unit (not shown) and a display unit (not shown) such as a liquid crystal display are provided. Communication with the server apparatus 1 is possible by user operation using these client apparatuses 2, 3 _{-1 to} 3- _N , and files, data, and the like are acquired from the server apparatus 1, and files and data are acquired. It can be sent to the server device 1.

For example, the client device 2 is assumed to store the certificate 10 in the storage unit 20. In this certificate 10, a URL (Uniform Resource Locator) is recorded as information on the location (server device 1) of the certificates 10 to 13 belonging to the user A. The URL is also recorded in each of the certificates 11-13. Similarly to the client device 2, the client devices _{3-1 to} 3 _-N may have a certificate with a URL. The placement location information may be other information such as a file path.

The CPUs of the client apparatuses 2, _{3-1 to} 3 _-N operate according to the program of the CPU, thereby acquiring the storage location information from the electronic certificate and the storage location information acquired by the acquisition device. Based on this, it functions as a search means for searching for an electronic certificate that matches a condition specified by the user.

  The certificate authority 5 is a company that issues an electronic certificate, including an issuer, an expiration date, a name, the applicant's public key, and a digital signature of the certificate authority 5 by a computer 4 according to an application from an individual, an organization, a company, The certificates 10 to 13 are issued in response to the certificate registration application from the client device 2.

FIG. 2 is a diagram showing a condition setting table used for certificate search. The condition setting table 6 is provided in the server device 1, and as shown in FIG. 2, conditions and certificate numbers are registered for each user (A, B,...). The conditions include a certificate authority, encryption strength (high, medium, low), expiration date (date). Items such as the validity of an electronic certificate (not shown) may be included as conditions. The condition setting table 6 may be provided in the client devices 2, 3 _{−1 to} 3 _-N individually instead of the server device 1 or together with the server device 1.

(Network system operation)
FIG. 3 is a flowchart showing processing in the network system of FIG. Hereinafter, a case where the user A of the client apparatus 2 acquires a necessary certificate will be described.

  First, the user A browses by operating the client device 2 and displaying the certificate 10 held by the client device 2 on the display unit (S301). When the certificate 10 does not satisfy the use condition such as expiration, the user A acquires the URL 10a from the certificate 10 by the CPU as the acquisition unit of the client device 2 (S302). This URL 10a indicates the place where the certificates 10 to 13 belonging to the user A are placed.

  Next, the user A operates the client device 2 to set conditions for searching for a certificate to be acquired (S303). This setting is appropriately selected by operating the mouse and keyboard according to the purpose of use, etc. according to the expiration date, the strength of the encryption, the issuer (certificate authority), and the like. For example, when a certificate to be used has expired and an alternative certificate is required, the expiration date, encryption strength, etc. are selected.

  Next, the user A is connected to the server device 1 of the URL 10a via the network 30 by the CPU as the search unit of the client device 2 (S304), and is stored in the storage unit of the server device 1 corresponding to the URL 10a. A certificate that matches the condition set in step S303 is searched from among the certificates 10-13. Here, it is assumed that the certificate 13 matches the condition specified by the user A. Next, the user A downloads the retrieved certificate 13 from the server device 1 to the client device 2 (S305).

  In steps S304 and S305, the client device 2 searches for a certificate. However, the server device 1 may have a function as a search unit. In this case, the search unit of the server device 1 searches the condition setting table 6 for a certificate that matches the condition set by the user A. Further, certificate search means may be provided in both the server device 1 and the client device 2 so that the user A can select one.

  User A uses the acquired certificate 13 to execute, for example, transactions such as internet banking transfers and balance inquiries, authentication when using the in-house network from outside, email transmission with a certificate, etc. Can do.

[Second Embodiment]
FIG. 4 is a diagram showing an example of the configuration of a network system according to the second embodiment to which the electronic certificate management apparatus of the present invention is applied.

  In the present embodiment, in the first embodiment, the server apparatus 1 holds the URLs 10a, 11a, 12a, and 13a of the certificates 10 to 13, and the certificate 10 is held in the issuing certificate authority 5. The certificates 11 to 13 are configured to be held in the issuing certificate authority 7, and the other configurations are the same as those in the first embodiment. The combination of the certificates 10 to 13 and the certificate authorities 5 and 7 is an example. For example, the certificates 10 to 13 may be collectively held in the certificate authority 5. Further, the place where the certificates 10 to 13 are placed is not limited to the certificate authorities 5 and 7 and may be another place.

  Next, the operation of the present embodiment will be described. For example, when the certificate 10 viewed by the user A with the client device 2 has expired, the user A acquires the URL 10 a from the certificate 10 by the CPU as the acquisition unit of the client device 2. In addition, the user A sets a certificate search condition in the same manner as described in the first embodiment. Next, the user A connects to the server 1 based on the URL 10a by the CPU as the search unit of the client device 2, searches the URLs 11a to 13a associated with the URL 10a, and places corresponding to the URLs 11a to 13a. The certificate that matches the above condition is retrieved from the certificates 11 to 13 in the certificate authority (Certification Authority 5, 7) and downloaded to the client device 2.

[Other embodiments]
In addition, this invention is not limited to said each embodiment, A various deformation | transformation is possible within the range which does not change the summary. For example, a configuration in which various access rights can be set for the certificates 10 to 13 is possible. This configuration can be achieved by using HTTP (Hyper Text Transfer Protocol Secure) as a communication protocol to the place where the certificates 10 to 13 are placed. For example, the server apparatus 1 where the certificate is placed has permission means for permitting a search for the electronic certificate stored in the storage unit within a range where access is permitted based on the access right. As an access right, for example, it is conceivable that only certificates belonging to itself can be searched.

FIG. 1 is a diagram showing an example of the configuration of a network system according to a first embodiment to which an electronic certificate management apparatus of the present invention is applied. FIG. 2 is a diagram showing a condition setting table used for certificate selection. FIG. 3 is a flowchart showing processing in the network system of FIG. FIG. 4 is a diagram showing an example of the configuration of a network system according to the second embodiment to which the electronic certificate management apparatus of the present invention is applied.

Explanation of symbols

DESCRIPTION OF _SYMBOLS 1 ... Server apparatus, 2 ... Client apparatus, 3 _{-1 to} 3- _N ... Client apparatus,
4 ... computer, 5 ... certificate authority, 6 ... condition setting table, 7 ... certificate authority, 10 ... certificate, 10a ... URL, 11, 12, 13 ... certificate, 11a ... URL, 12a ... URL, 13a ... URL, 20 ... storage unit, 30 ... network,
40 ... Internet, 100 ... Network system

Claims (5)

  An electronic certificate management apparatus comprising an acquisition means for acquiring information on a storage location of an electronic certificate belonging to the same user from an electronic certificate in which the information on the storage location of the electronic certificate is recorded. Storage means for storing, for each user, an electronic certificate in which information on the location of the electronic certificate belonging to the same user is recorded;
An electronic certificate management apparatus comprising: acquisition means for acquiring information on the storage location from the electronic certificate.   The electronic certificate management apparatus according to claim 1, further comprising a search unit that searches for the electronic certificate that matches a condition based on the information on the placement location acquired by the acquisition unit.   The electronic certificate management apparatus according to claim 1, wherein the search unit includes one or more of an expiration date, an importance level, an electronic certificate validity, and a certificate authority as the conditions.   The electronic certificate management apparatus according to claim 2, further comprising permission means for permitting the search means to search the electronic certificate stored in the storage means based on an access right possessed by a user.

Images