JP2015177453A - Authentication system, electronic apparatus, method for renewing certificate, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To simply register certificate data and to restore network communication even if the certificate data stored in an information apparatus has expired and a communication system is disconnected from a network in the communication system which joins the network on the basis of authentication based on the certificate data.SOLUTION: At a time of certificate renewing processing of an electronic apparatus such as an image forming device of which the certificate for IEEE 802.1x authentication has expired, an authentication system performs certificate proxy acquisition (subrogation acquisition) via direct connection by Wi-Fi Direct (R) with an apparatus with an effective certificate and returns to a network.

Description

  The present invention relates to an authentication system, an electronic device, a certificate renewal method, and a program, and more particularly to a technology that makes it easy to return to a network after an electronic certificate has expired.

  In recent years, the importance of security and personal authentication has increased, and there are many companies that have introduced IEEE 802.1x that can restrict the availability of LAN on a user basis. However, since this mechanism determines whether or not communication is possible by authentication using a digital certificate, once the certificate expires, it will be isolated from the network and cost will be required to restore communication again. It will take. As a countermeasure against this, an automatic certificate renewal technique using SCEP (Simple Certificate Enrollment Protocol) is known.

  However, in an information device such as a multifunction machine or a laser printer that is often turned off, even if automatic update using SCEP is available, if the power is cut off at the update timing, the update opportunity Will be missed. As a result, it has not been possible to prevent isolation from the network.

  Patent Document 1 describes a mechanism for automatically updating a certificate as a certificate revocation solution in a system between a POS terminal device installed in a store and a store server. This may be relevant in terms of certificate revocation countermeasures in IEEE 802.1x. However, the above-mentioned problem in the case of “missing the update timing with the power off and as a result, being isolated from the network” cannot be solved.

  The present invention has been made in view of the above-described problems in the prior art. In a communication system that participates in a network based on authentication based on certificate data, the certificate data stored in the information device is invalidated and disconnected from the network. It is an object of the present invention to enable certificate data to be registered easily and network communication to be recovered even if it is in a state of being changed.

  In order to achieve the above object, one aspect of the present invention is a server client system in which an authentication server and a plurality of electronic devices are connected via a first network, and is one of the plurality of electronic devices. A storage means for storing a certificate for the first electronic device to use the first network, a determination means for determining whether the certificate is revoked, and the certificate is revoked If it is determined, a certificate proxy renewal that issues a certificate proxy renewal request that represents the renewal of a new certificate to the second electronic device that is one of the plurality of electronic devices via the second network. And when the second electronic device receives the certificate proxy renewal request via the second network, the second electronic device connects the authentication server connected via the first network to the authentication server. First It characterized by having a certificate proxy update execution means for requesting issuance of the child devices.

  According to the present invention, in a communication system that participates in a network based on authentication based on certificate data, even if the certificate data stored in the information device expires and is disconnected from the network, the certificate data can be simplified. Network communication can be restored.

1 is a block diagram showing an overall system configuration of an embodiment. It is a block diagram which shows the hardware structural example of the electronic device of embodiment. FIG. 3 is a block diagram showing a functional configuration of MFP 11 on the STA side in the second network of FIG. 1. FIG. 3 is a block diagram showing a functional configuration of an MFP 12 on the AP side in the second network of FIG. 1. It is a flowchart figure which shows the flow of the certificate update process in embodiment. It is a sequence diagram (the 1) which shows the detailed flow of the certificate update process in embodiment. It is a sequence diagram (the 2) which shows the detailed flow of the certificate update process in embodiment. It is a figure which shows an example of the screen which instruct | indicates the certificate proxy update in embodiment. It is a figure which shows an example of the screen displayed when establishing the connection of the 2nd network in embodiment. It is a figure which shows an example of the screen displayed when establishing the connection of the 2nd network in embodiment. It is a figure which shows an example of the result display screen of the certificate update process in embodiment. It is a conceptual diagram at the time of seeing the certificate update process and return to a network in an embodiment from a user viewpoint. It is a conceptual diagram for demonstrating that the certificate update process and return to the network in the embodiment can be performed collectively by a plurality of devices.

  Hereinafter, embodiments of the present invention will be described. In each of the following embodiments, when a certificate update process for an image forming apparatus whose certificate for IEEE 802.1x authentication has expired is performed, direct connection by wireless peer-to-peer communication with a device whose certificate is still valid It has the feature of returning to the network by acquiring a certificate substitute (acquisition on the shoulder).

  By mounting a [certificate proxy acquisition] [certificate proxy acquisition request] mechanism disclosed in the following embodiment on a device capable of simultaneous operation of wired and wireless, the IEEE 802.1x certificate expires. A device that has been isolated from a wired network can obtain a proxy certificate (acquisition on the shoulder) and return to the network through direct wireless connection with a device that still has a valid certificate.

<Overall system configuration>
FIG. 1 shows the overall system configuration of this embodiment.
As shown in the figure, the overall system of the present embodiment authenticates a plurality of electronic devices such as MFPs (multifunction peripherals) 11, MFPs 12, personal computers, and routers, and whether these electronic devices can use resources of the first network. This is a system to which a RADIUS (Remote Authentication Dial In User Service) server 200 as an authentication server is connected. Hereinafter, when any one of the plurality of electronic devices is referred to without being distinguished from the others, it is referred to as “electronic device 10”. In this server client system, the electronic device 10 functions as a Radius client.

  In this embodiment, the physical layer of the first network is a wired LAN such as 100Base-T. The first network is assumed to be constructed using the IEEE 802.1x protocol. In FIG. 1, the certificates of all electronic devices 10 are valid. For example, an electronic certificate applying a public key encryption method is used for authentication.

  Also, as shown in the figure, some of the electronic devices 10 (MFPs 11, 12, and 13 in FIG. 1) construct a second network. The network interface device for the electronic device 10 to participate in the second network is different in this embodiment. The second network is preferably a wireless peer-to-peer communication network. More preferably, Wi-FiDirect (registered trademark) is preferable. Hereinafter, an embodiment in which the second network is constructed by Wi-FiDirect is disclosed.

<Configuration of Electronic Device 10>
FIG. 2 shows a hardware configuration example of the electronic device 10.
As illustrated, the electronic device 10 includes an arithmetic processing device, a primary storage device, a secondary storage device, and an input / output device that are generally included in a general-purpose electronic device. In the illustrated example, it is a display output device, and includes an operation panel 123 that also serves as an operation input device, and two network interfaces 121 and 122. The network interface 121 is a device capable of wired LAN connection that can be connected by IEEE802.1x. On the other hand, the network interface 122 is a wireless LAN device capable of Wi-FiDirect connection.

  The electronic device 10 also has storage means 14 for storing and storing an IEEE 802.1x electronic certificate. The storage means may be a dedicated certificate management area. The specific operation is considered to be an HDD or a NAND flash memory.

<Functional Configuration of Electronic Device 10>
The electronic device 10 is configured as an electronic device having the following functions or means by predetermined information processing by a predetermined program stored in the ROM or HDD of FIG.

  In Wi-FiDirect, an electronic device having an IEEE802.11x function performs direct peer-to-peer communication without going through a normal wireless access point. At that time, group owner negotiation is performed between the devices, and one of them becomes “access point (AP)” and the other becomes “client (STA (station))”. Not only one-to-one connection but also one-to-N connection is possible.

  Based on the above, when the MFPs 11, 12, and 13 construct the second network by Wi-FiDirect in the network configuration of FIG. 1, the functions of the MFP 11 and the MFP 12 when the MFP 11 becomes the STA and the MFP 12 becomes the AP. The configuration will be described with reference to FIGS.

FIG. 3 shows a functional configuration of the MFP 11 on the STA side in the second network.
An external I / F (wireless) 101 performs communication processing with the outside via wireless. In the present embodiment, communication based on Wi-FiDirect is assumed. The network management unit 102 is a central function that performs certificate update processing in the present embodiment. The network management unit 102 determines whether the certificate stored in the storage unit 14 has been revoked. If the certificate has been revoked, the network management unit 102 issues an instruction to the panel management unit 108 to notify the user to that effect. In addition, based on the certificate proxy update notification from the operation panel 13, it creates data for proxy update request through the 802.1x certificate update processing unit 104, and requests the external MFP device.

  The network management unit 102 performs connection processing with an external MFP device by Wi-FiDirect as the communication means. Therefore, in Wi-FiDirect connection, the MFP 11 becomes a station (STA). In the Wi-FiDirect connection process, the network management unit 102 acquires communication partner candidates using Device Discovery, displays a list on the operation panel 13, and causes the user to select the list. Also give instructions.

  Upon receiving the certificate proxy update request, the 802.1x certificate update processing unit 104 creates data necessary for the certificate update process. The content of the certificate update process is a certificate update request by SCEP. At this time, the [certificate request] data is requested from the security management unit 105 and created.

  The security management unit 105 creates a public key encryption private key and a certificate request according to the certificate request creation request. The security management unit 105 uses the encryption / decryption unit 107 to create a private key and a public key, and uses the certificate creation unit 106 to create a certificate request.

  The certificate registration unit 103 and the certificate storage unit 103a cause the storage unit 14 to store the certificate information finally acquired by the network management unit 102.

  In the Wi-FiDirect connection process, the panel management unit 108 and the panel display unit 109 obtain communication partner candidates using Device Discovery, display a list on the screen, and prompt the user to select the list. Also do.

FIG. 4 shows a functional configuration of the MFP 12 on the AP side in the second network.
The external I / F (wireless) 111 performs communication processing with the outside via wireless. In the present embodiment, communication based on Wi-FiDirect is assumed. On the other hand, the external I / F (wired 802.1x) 112 performs communication / certificate update packet transmission / reception with the Radisus server 20 using the IEEE802.1x protocol. The communication protocol in the update process is SCEP.

  The network management unit 113 is a central function that performs certificate update processing according to the present embodiment. When a certificate proxy update request from the STA is acquired via Wi-FiDirect wireless communication, an analysis request is made to the 802.1x certificate update processing unit 114. If there is no problem in the result, an external I / F ( A certificate renewal request is made to the Radius server 20 connected to the destination through (wired 802.1x) 112 (a certificate renewal request for SCEP is made).

  In the Wi-FiDirect connection process, since the device is an AP (access point), the network management unit 113 acquires a communication partner candidate by using Device Discovery, displays a list on the screen, and selects a STA to be connected to the user. Also, a list display instruction is given to the operation panel 13.

  In the Wi-FiDirect connection process, the panel management unit 115 and the panel display unit 116 obtain communication partner candidates using Device Discovery, display a list on the screen, and allow the user to select the list. Display instructions are also given.

  As apparent from the above description, the network management unit 102 functions as a determination unit and a certificate proxy update request unit. The 802.1x certificate update processing unit 114 functions as a certificate proxy update execution unit.

  The network management unit 102 in FIG. 3 and the network management unit 113 in FIG. 4 are essentially different only in the functions provided when the same network management unit is on the STA side and on the AP side. The same thing. The same is true for the 802.1x certificate update processing unit 104 and the 802.1x certificate update processing unit 114. When one electronic device 10 has the function of the network management unit 102 in FIG. 3 and the function of the network management unit 113 in FIG. 4, its own certificate is revoked because it is in a power-off state at the update timing. Can request the other electronic device 10 to update the certificate via Wi-FiDirect, and when the certificate of the other electronic device 10 is revoked, the side that executes the proxy update itself This has the effect of facilitating recovery to network communication with a simple configuration.

<Certificate update process flow>
With reference to FIG. 5, the flow of the certificate update process executed by the electronic device 10 having the functional configurations of FIGS. 3 and 4 will be described. The “Radius client whose certificate has expired” in FIG. 5 is the MFP 11 in the above-described example. On the other hand, the “Radius client whose certificate has not expired” is the MFP 12 in the above-described example. The MFP 12 performs proxy update on the Radius server 20.

  First, the network management unit 102 of the MFP 11 determines whether or not a certificate used for network connection according to its own IEEE 802.1x protocol has expired (S101). If it has expired, a connection of wireless peer-to-peer communication is established between the MFP 11 and the MFP 12 (S102, S103). In the present embodiment, direct connection is made using Wi-FiDirect. The connection may be established before confirmation of certificate revocation. Further, automatic connection or manual connection by a user may be used. In FIG. 5, a connection is automatically made when a certificate revocation is determined (in the example described later with reference to FIGS. 6 and 7, manual connection is used).

  The processing of S102 and S103 will be further described. In this embodiment, a pass code (PIN code in Wi-FiDirect) associated with the former is stored in advance in an HDD or the like in another electronic device 10 that permits connection to a certain electronic device 10. In the example of FIG. 5, the pass code of the MFP 12 is stored in advance in the electronic device 10 (for example, the MFP 11 or the MFP 13) that the user or administrator permits the connection to the MFP 12. When the AP is determined to be the MFP 12 by the group owner negotiation in Wi-FiDirect, the MFP 12 establishes a connection with the electronic device 10 that has requested permission for connection together with its own passcode, and communication with other devices is not performed. Reject. In this way, when the certificate used in the first network has expired, the connection to the second network is automatically started, so that it does not take time. Further, communication with an unknown device can be rejected, and security is improved.

  Next, the network management unit 102 issues a certificate to the other electronic device 10 with which peer-to-peer communication has been established and which can be connected via the first network (in this case, the MFP 12). A proxy update request is issued (S104). The MFP 12 receives this (S105).

  Next, the network management unit 113 of the MFP 12 requests the Radius server 20 to issue a certificate (S106). The Radius server 20 receives this (S107). In response to this, the Radius server 20 issues a certificate (S108), and the received MFP 12 (S109) transmits the certificate to the MFP 11 as a response to the proxy update request (S110). The MFP 11 receives this (S111).

  Next, the certificate registration unit 103 stores the certificate in the update / certificate storage unit 103a based on the response to the received proxy update request (S112). In this way, in this embodiment, an image forming apparatus whose certificate for IEEE 802.1x authentication has expired is certificated by direct connection by wireless peer-to-peer communication with a device whose certificate is still valid. By performing proxy acquisition (acquisition of shoulder), it is possible to return to the network.

<Detailed flow of certificate renewal process>
The flow of the certificate update process will be described in more detail with reference to the sequence diagrams of FIGS. FIG. 6 shows the STA side sequence. FIG. 7 shows an AP side sequence. 5 differs from the example described with reference to FIG. 5 in that the communication connection of the second network is manually started and the execution of certificate proxy update is manually started by the user.

In FIG. 6 (STA side), the following five processes are mainly performed.
1. 1. Establish communication using Wi-FiDirect 2. Communication partner (AP) selection 3. Create certificate proxy update request information 4. Send certificate proxy update request Receive certificate proxy update response → store

In FIG. 7 (AP side), the following six processes are mainly performed.
1. 1. Establish communication using Wi-FiDirect 2. Communication partner (STA) selection 3. Receiving certificate proxy update request Certificate update processing via wired 802.1x to Radius server (using SCEP)
5. 5. Receive certificate from Radius server Send certificate proxy update response to STA

  As shown in FIG. 6, first, the user instructs the MFP 11 to perform certificate proxy update using the panel display unit 109. At that time, the panel display unit 108 displays a screen for instructing certificate proxy update as shown in FIG. The instruction is notified to the network management unit 102, and under the control of the network management unit 102, the external interface (wireless) 101, which is a wireless LAN interface, tries to find a nearby device.

  Then, as shown in FIG. 7, the network management unit 113 issues an instruction to display a confirmation screen on the panel management unit 115, and the panel management unit 115 controls the panel display unit 116 to display the confirmation screen. With this Device Discovery, a panel screen as shown in FIG. 9 is displayed on the MFP 11 side, and a panel screen as shown in FIG. 10 is displayed on the MFP 12 side.

  The group owner negotiation is well known and will not be described. Here, an example in which the MFP 12 acts as an access point (AP) will be described. The user selects a STA that allows connection, and the selection result is transmitted to the MFP 11. A Wi-FiDirect connection is established.

  Next, the network management unit 102 instructs the 802.1x certificate update processing unit 104 to create a proxy update request, and the 802.1x certificate update processing unit 104 receives the certificate and sends a certificate to the security management unit 105. An instruction to create a request is given (FIG. 6). The security management unit 105 instructs the encryption / decryption unit 107 to create a secret key and a public key, and instructs the certificate creation unit 106 to create a certificate request. The security management unit 105 returns the certificate request data thus obtained to the 802.1x certificate update processing unit 104. The 802.1x certificate update processing unit 104 creates proxy update request information based on the certificate request data and returns it to the network management unit 102. The network management unit 102 transmits / issues the created proxy update request to the MFP 12 via Wi-FiDirect.

  Upon receiving the proxy update request information, the network management unit 113 on the AP side instructs the 802.1x certificate update processing unit 114 to execute proxy update (FIG. 7). The 802.1x certificate update processing unit 114 transmits a certificate update request to the Radius server 20 based on the SCEP protocol. Further, the certificate update result sent from the Radius server 20 is received. SCEP communication is performed via the wired 802.1x external interface 112. A proxy update response based on the certificate update result is transmitted to the MFP 11 serving as the STA via Wi-FiDirect.

  Upon receiving the proxy update response, the network management unit 102 instructs the 802.1x certificate update processing unit 104 to analyze the proxy update response (FIG. 6). The 802.1x certificate update processing unit 104 returns the analysis result to the network management unit 102, and the network management unit 102 instructs the certificate registration unit 103 to store the certificate updated based on the proxy update response. The certificate is stored in the certificate storage unit 103a (storage unit 14). On the other hand, the network management unit 102 instructs the panel management unit 108 and the panel display unit 109 to notify the user of the update result. An example of the panel screen at that time is shown in FIG.

  FIG. 12 is a conceptual diagram showing the flow of the certificate proxy acquisition process described with reference to FIGS. 6 and 7. This is a diagram showing what happens from the viewpoint of the user user as a result of the sequence flow operation. The case where the certificate is prepared by yourself is shown. The user creates a request and issues a certificate issued from the Radius server 20 to the SD card (registered trademark) by a predetermined method, and applies it to the MFP 11. In this manner, proxy certificate acquisition by Wi-FiDirect and Radius (IEEE 802.1x) authentication network recovery are realized.

  In the present embodiment, since a one-to-many wireless network can be constructed, as shown in FIG. 13, it is possible to update certificates of a plurality of devices at once. FIG. 13 is a diagram illustrating that a plurality of devices can make an update request and update a certificate because a plurality of Wi-FiDirect can be connected to one AP.

  In the future, printer / MFP devices may simultaneously support Wi-FiDirect communication with mobile terminals such as smart pads and smartphones in addition to wired connections for in-house infrastructure. The above-described embodiment provides a new certificate update mechanism based on the environment. When wireless peer-to-peer communication such as Wi-FiDirect is used as in this embodiment, it is not necessary to change the physical network layout, so it is simple and convenient, and has a low burden on the user and the administrator. There is an effect.

10 Electronic device 11, 12 MFP
14 storage means 101 external interface (wireless)
DESCRIPTION OF SYMBOLS 102 Network management part 103 Certificate registration part 103a Certificate memory | storage part 104 802.1x certificate update process part 105 Security management part 106 Certificate preparation part 107 Encryption / decryption part 108 Panel management part 109 Panel display part 111 External interface (wireless)
112 External interface (Wired 802.1x)
113 Network Management Unit 114 802.1x Certificate Update Processing Unit 115 Panel Management Unit 116 Panel Display Unit

JP 2007-184769 A

Claims (10)

A server client system in which an authentication server and a plurality of electronic devices are connected via a first network,
A first electronic device that is one of the plurality of electronic devices,
Storage means for storing a certificate for using the first network;
Determining means for determining whether the certificate is revoked;
If it is determined that the certificate has been revoked, a certificate proxy acting as a proxy for renewing a new certificate to a second electronic device, which is one of the plurality of electronic devices, via a second network A certificate proxy update request means for issuing an update request,
The second electronic device is
When the certificate proxy update request is received via the second network, the certificate proxy requests the authentication server connected via the first network to issue a certificate of the first electronic device. An authentication system comprising update execution means. A server client system in which an authentication server and a plurality of electronic devices are connected via a first network,
Each of the plurality of electronic devices is
Storage means for storing a certificate for using the first network;
Determining means for determining whether the certificate is revoked;
If it is determined that the certificate has expired, a certificate proxy update request means for issuing a certificate proxy update request for proxying the update of a new certificate to another electronic device via the second network When,
When the certificate proxy renewal request is received from the other electronic device via the second network, the certificate of the other electronic device is issued to the authentication server connected via the first network. And a certificate proxy update execution means for requesting the authentication system.   The authentication system according to claim 1 or 2, wherein the second network is a network constructed by wireless peer-to-peer communication.   The certificate surrogate update execution means, when communication with the electronic device that has issued the certificate surrogate update request via the second network is performed together with a predetermined passcode, The authentication system according to any one of claims 1 to 3, wherein network communication is established, and proxy certificate update is automatically executed.   If the passcode associated with the certificate proxy update execution means is included in the communication from the electronic device that issued the certificate proxy update request, the certificate proxy update execution means The authentication system according to claim 4, wherein the authentication system is established.   The electronic device that has issued the certificate proxy update request updates the certificate stored in the storage unit based on the certificate received by the electronic device that has performed the proxy proxy update. The authentication system according to any one of claims 1 to 5. An electronic device connected to the authentication server via the first network,
Storage means for storing a certificate for using the first network;
Determining means for determining whether the certificate is revoked;
If it is determined that the certificate has expired, a certificate proxy update request means for issuing a certificate proxy update request for proxying the update of a new certificate to another electronic device via the second network When,
An electronic device comprising:   When the certificate proxy renewal request is received from the other electronic device via the second network, the certificate of the other electronic device is issued to the authentication server connected via the first network. The electronic device according to claim 7, further comprising a certificate proxy update execution means for requesting. A certificate updating method using a server client system in which an authentication server and a plurality of electronic devices are connected via a first network,
A first electronic device that is one of the plurality of electronic devices,
A determination step of determining whether a certificate for using the first network has expired;
If it is determined that the certificate has been revoked, a certificate proxy acting as a proxy for renewing a new certificate to a second electronic device, which is one of the plurality of electronic devices, via a second network A certificate surrogate renewal request step for issuing a renewal request; and
The second electronic device is
When the certificate proxy update request is received via the second network, the certificate proxy requests the authentication server connected via the first network to issue a certificate of the first electronic device. Update execution step;
A method for renewing a certificate, comprising: To an electronic device connected to the authentication server via the first network,
A storage process for storing a certificate for using the first network;
A determination process for determining whether the certificate is revoked;
If it is determined that the certificate has expired, a certificate proxy update request process for issuing a certificate proxy update request for proxying a new certificate update to another electronic device via the second network When,
A program for running

Images