JP4648100B2 - PKI environment setting method, client server system, and computer program - Google Patents

Description

  The present invention relates to a method for automatically setting a PKI environment on a client side in a client server system using a public key infrastructure (PKI), and a client server for automatically setting a PKI environment on a client side. The present invention relates to a system and a computer program stored in a client.

  A public key infrastructure is used to prevent mutual authentication between the server and the client and the tampering of the electronic document flowing between the server and the client when performing electronic transactions in a client server system using the Internet ( For example, Patent Document 1).

  In a client-server system using PKI, the server and the client each issue a public key certificate issued by a third party's certification authority (Certification Authority) in order to prove the validity of the public key possessed by each. Possess. Actually, since the server to which the client connects differs for each application used by the user, the client needs a public key certificate for each server to be connected.

  For this reason, in Patent Document 2, a public key that can be issued by the certificate authority in various forms according to the client's application so that the public key certificate required by the client can be easily obtained. A certificate issuing method and a certificate authority are disclosed.

However, from the client side, every time the public key certificate to be used is changed, the PKI environment set on the client side (for example, settings related to the public key certificate policy and settings related to the repository) must be changed. It was very inconvenient. In addition, the setting described above also has a problem that the user needs specialized knowledge about PKI.
Japanese Patent Laid-Open No. 11-3033 JP 2001-305956 A

  In view of the above-described problems, the present invention reduces the burden on the user by automatically setting the PKI environment in accordance with the server to which the client is connected in the client server system using PKI. It is an object of the present invention to provide a client server system that can perform a method, a method of setting a PKI environment, and a computer program stored in a client.

A first invention for solving the above-described problem is a method in which the client automatically sets a PKI environment in a client server system using a public key infrastructure (PKI), and (a) A step in which the client accesses a server connected by a network; (b) an electronic envelope in which a setting file in which attribute information including at least PKI environment setting contents and file identification information and version information is described is embedded; (C) The client opens the electronic envelope transmitted from the server, and the client acquires the setting file from the electronic envelope, (d) Before the client is identified by the attribute information obtained from the electronic envelope (E1) In the step (d), when the client stores the setting file specified by the attribute information obtained from the electronic envelope, When the PKI environment is set using the setting file stored in the client and (e2) the setting file specified by the attribute information is not stored in the step (d), the client The setting file is displayed, and processing for editing the setting file or obtaining consent for the user operating the client is executed. When the consent is obtained, the setting file is displayed and one of the setting files is displayed. When a part of the setting file is edited, the setting file after editing is set to the setting. If a part of the file is not edited, a PKI environment is set by using the setting file before editing and then storing the setting file used for setting the PKI environment. It is a setting method.

  According to the first invention, the electronic envelope in which the setting file is embedded is transmitted from the server to the client, and the client performs PKI environment setting according to the setting file, whereby the server to which the client connects Accordingly, the environment setting of PKI can be automatically performed.

Further, according to the first invention, the client checks whether the setting file specified by the attribute information received from the server is stored, and branches the process depending on whether the setting file is stored. When the setting file is not stored, a process for causing the user to edit the setting file is executed, and the edited setting file is stored, whereby one of the contents of the setting file transmitted from the server is stored. When editing and using a copy, each time the setting file is transmitted from the server, there is no need to edit a part of the contents of the setting file.

Furthermore, the second invention is a client-server system using a public key infrastructure (PKI) and comprising a client and a server connected via a network, wherein the server is accessed via the network. Means for transmitting to the client an electronic envelope in which a setting file in which attribute information including at least PKI environment setting content and file identification information and version information is described is embedded; An information storage unit that stores the electronic envelope received from the electronic envelope, and confirms whether the setting file specified by the attribute information obtained from the electronic envelope is stored, and stores the setting file specified by the attribute information The PKI is stored using the configuration file stored in the client. When the environment is set and the setting file specified by the attribute information is not stored, the client displays the setting file and consents to the user operating the client to edit the setting file. If the consent is obtained, the setting file is displayed, and a process for causing the user to edit a part of the setting file is executed. When a part of the setting file is edited, An electronic device that stores the setting file used for PKI environment setting after setting the PKI environment using the setting file before editing when the setting file after editing is not partially edited A client-server system comprising envelope processing means.

Furthermore, a third invention is a computer program for causing a computer to function as an electronic envelope processing means provided in a client constituting the client server system described in the second invention.

  According to the present invention described above, in a client-server system using PKI, the client can reduce the burden on the user by automatically setting items related to PKI according to the server to which the client is connected. A server system, method, and computer program stored in a client can be provided.

  A client server system (Client Server System) that uses a public key infrastructure (hereinafter referred to as PKI) according to the present invention will be described in detail with reference to the drawings. FIG. 1 is a configuration diagram of a client server system according to the present invention. In the client server system shown in FIG. 1, the client 20 and the server 10 are connected via the network 30, and data communication is performed between the client 20 and the server 10, so that a certain transaction (for example, electronic application or electronic Commerce) is executed.

  In the client server system of FIG. 1, the PKI is used for mutual authentication between the client 20 and the server 10 and for encryption / decryption of data transmitted between the client 20 and the server 10. When the client 20 accesses the server 10, a setting file in which recommended values of information related to the PKI environment set on the client 20 side (for example, settings related to public key certificate policies, settings related to the repository, etc.) is written in an electronic envelope ( Embedded in the digital envelope) and transmitted from the server 10 to the client 20.

  The client 20 acquires the setting file by opening the electronic envelope transmitted from the server 10, and the client 20 automatically sets the PKI environment with reference to the acquired setting file. As described above, the PKI environment on the client 20 side is automatically changed according to the server 10 to be accessed, so that the trouble of manually setting the PKI environment by the user operating the client 20 is eliminated. Can do.

FIG. 2 is a block diagram of the client server system shown in FIG. In FIG. 2, the client server system of FIG. 1 is described as being configured by a two-tier client server system, but actually, the client server system of FIG. 1 may be a three-tier client server system. I do not care.

  As shown in FIG. 2, the server 10 includes a server application 11 that centrally performs processing such as electronic application and electronic commerce, and an electronic envelope 13 in which the setting file 14 corresponding to the server application 11 is embedded. And an electronic envelope server processing unit 12 having a function of transmitting the electronic envelope 13 to the client 20 accessing the server 10.

  The server application 11 provided in the server 10 is realized by a computer program that operates hardware resources (for example, a CPU and a memory) of the server 10, and the electronic envelope 13 in which the setting file 14 is embedded is a hard disk of the server 10 or the like. Are stored in the information storage device.

  The client 20 has a function of automatically setting a PKI environment according to a client application 21 that performs processing using an application of the server 10 and a setting file 14 embedded in the electronic envelope 13 transmitted from the server 10. Are added to the client application 21, and an information storage unit 23 for storing the setting file 14 is provided.

  The client application 21 provided in the client 20 is realized by a computer program (for example, a browser) that operates hardware resources (for example, a CPU and a memory) of the client 20, and the electronic envelope client processing unit 22 is an add-in of the client application 21. Realized in software. The information storage unit 23 is realized by a hard disk of the client 20 or an external storage device (CD-ROM).

  FIG. 3 is a diagram for explaining an example of the electronic envelope 13 stored in the server 10 and transmitted from the server 10 to the client 20. The electronic envelope 13 is data in which information called an envelope (envelope) is added to a structured document (for example, an XML document). The electronic envelope server processing unit 12 provided in the server 10 and the client 20 are provided. The electronic envelope client processing unit 22 has a function of generating / interpreting the electronic envelope 13.

  As shown in FIG. 3, the electronic envelope 13 includes a header portion 131 serving as an envelope of the electronic envelope 13 and a content embedded in the electronic envelope 13 and transmitted and described in a structured document (here, the setting file 14). ).

  The header portion 131 of the electronic envelope 13 stores information indicating the format of the electronic envelope 13 and information necessary for decrypting the content portion 132 when the content portion 132 is encrypted. The electronic envelope client processing unit 22 can open the electronic envelope 13, that is, take out the content portion 132 embedded in the electronic envelope 13 by analyzing the information described in the header portion 131 of the electronic envelope 13.

  Note that this patent does not depend on the specifications of the electronic envelope 13, and any electronic envelope 13 can be used as long as the client 20 and the server 10 are compatible.

  In addition, in the content portion 132 of the electronic envelope 13, a setting file 14 that is a main body of the content is stored in addition to the information 132 a indicating the format of the content embedded and transmitted in the electronic envelope 13.

  FIG. 4 is a diagram illustrating the setting file 14 embedded in the electronic envelope 13 described in FIG. As shown in FIG. 4, in the setting file 14, in addition to the attribute information 141 of the setting file 14 in which the identification information 141a of the setting file 14 and the version 141b of the setting file 14 are described, information on the environment setting of the PKI The information 142 regarding the confirmation of the public key certificate and the information 143 regarding the security policy are described in XML (eXtensible Markup Language).

  As the information 142 related to the confirmation of the public key certificate, information 142a related to trust anchors (Trust Anchors), information 142b related to the repository, information 142c related to the policy to be accepted, etc. are described. Is done. Further, as information 143 related to the security policy, information related to encryption key exchange is stored.

  The electronic envelope client processing unit 22 provided in the client 20 opens the electronic envelope 13 transmitted from the server 10 and then tags the structured document describing the setting file 14 embedded in the opened electronic envelope 13. , By referring to the contents described in the setting file 14, the PKI environment is set, and the process according to the set PKI environment (for example, confirmation of the reliability of the public key certificate that the server 10 has) Processing).

  In addition, the electronic envelope client processing unit 22 has a function of displaying and editing the setting file 14 and a function of storing the setting file 14 in the information storage unit 23.

  The function of displaying / editing the setting file 14 is realized by a text editor or a dedicated program that can set the items of the setting file 14, and the electronic envelope client processing unit 22 has a function of editing the setting file 14 by the client. The contents of the setting file 14 transmitted from the server 10 must be changed due to circumstances on the 20 side (for example, when a path storing information necessary for setting a PKI environment is changed). Because there is a case.

  In addition, as described above, the electronic envelope client processing unit 22 stores the setting file 14 in the information storage unit 23 in some cases where the setting file 14 is edited on the client 20 side. It is for memorizing. Since the electronic envelope client processing unit 22 has a function of storing the setting file 14 in the information storage unit 23, it is not necessary to edit the setting file 14 every time the setting file 14 is transmitted from the server 10.

  When the electronic envelope client processing unit 22 receives the setting file 14 from the server 10 in order to use the setting file 14 stored in the information storage unit 23, the electronic envelope client processing unit 22 refers to the attribute information of the setting file 14 and is transmitted from the server 10. It is checked whether the setting file 14 indicated by the attribute information of the setting file 14 is stored in the information storage unit 23. If the information is stored in the information storage unit 23, the setting file 14 stored in the information storage unit 23 is used. If not, the setting file 14 transmitted from the server 10 is edited. And use it.

  FIG. 5 is a diagram for explaining the information stored in the information storage unit 23. FIG. 5A shows the structure of information stored in the information storage unit 23. The information storage unit 23 is used by the client 20 in association with the management file 24 by the electronic envelope client processing unit 22. The setting file 14 is stored.

  FIG. 5B is a diagram showing an example of the management file 24 in the information storage unit 23. In the management file, record information 241 of each setting file 14 stored in the information storage unit 23 is stored. The record information 241 stores the number 241a of the setting file 14, the URI 241b of the server 10 that transmitted the setting file 14, the name 241c of the client application that uses the setting file 14, and the like. The electronic envelope client processing unit 22 refers to the management file 24 to set the setting file indicated by the attribute information of the setting file 14 transmitted from the server 10 from among the setting files 14 stored in the information storage unit 23. 14 is searched to see if it is stored.

  From here, the operation of the client server system described with reference to FIGS. 1 and 2 will be described, and a method for automatically setting the PKI environment will also be described. FIG. 6 is a flowchart showing the operation of the client server system.

The first step S 10 is a step in which the client application 21 stored in the client 20 is activated and accesses the server 10. In this step, when the icon of the client application 21 displayed on the display of the client 20 is clicked, the client application 21 is activated and accesses the server 10 via the network.

  In the next step S11, the server 10 transmits to the client 20 the electronic envelope 13 in which the setting file 14 is embedded. The electronic envelope server processing unit 12 of the server 10 analyzes the access log to the server 10 and transmits the electronic envelope 13 in which the latest setting file 14 is embedded to the accessed client 20.

  In this step, the electronic envelope server processing unit 12 of the server 10 may encrypt the setting file 14 embedded in the electronic envelope 13 when transmitting the electronic envelope 13 to the client 20. When the setting file 14 is encrypted, information for decrypting the setting file 14 is described in the envelope of the electronic envelope 13.

  In addition, preferably, the electronic envelope server processing unit 12 provides a function for generating the electronic envelope 13 or information indicating that the setting file 14 has been updated when the setting file 14 is updated by means such as mail. It is desirable to have a function of transmitting to the client 20. By notifying the client 20 that the setting file 14 has been updated, the user operating the client 20 can know that the setting file 14 has been updated before the client application 21 is activated.

  In the next step S12, the client 20 opens the electronic envelope 13 transmitted from the server 10 and takes out the setting file 14. The electronic envelope client processing unit 22 of the client 20 opens the electronic envelope 13 according to a predetermined procedure (for example, decrypts the content portion of the electronic envelope 13), and analyzes the tag of the electronic envelope 13 received from the server 10. The setting file 14 is taken out.

  In the next step S13, the client 20 is included in the setting file 14, and attribute information (for example, the figure of the setting file 14 and the identification information of the setting file 14 (for example, the name of the setting file 14) is described. 4 is a step for confirming that the setting file 14 indicated by the attribute information 141) is not stored.

  The client 20 confirms the identification information and version included in the attribute information of the setting file 14 transmitted from the server 10, and when the setting file 14 having the same identification information and version is stored in the information storage unit 23. The process proceeds to step S14a, and if the setting file 14 having the same identification information and version is not stored in the information storage unit 23, the process proceeds to step S14b.

  In step S14a, the client 20 sets a PKI environment using the setting file 14 stored in the information storage unit 23 and having the same identification information / version as the setting file 14 transmitted from the server 10, and the process proceeds to step S19. .

  In step S <b> 14 b, the client 20 selects the setting file 14 used for the PKI environment as the setting file 14 transmitted from the server 10. In step S15 to be executed next, the client 20 confirms whether or not it is necessary to change the contents of the setting file 14 transmitted from the server 10. In this step S15, the client server 10 displays the contents of the setting file 14 on the display, and may set the PKI environment with the contents of the setting file 14 transmitted from the server 10, or operates the client 20. Get consent from the user.

  In step S15, when the setting file 14 is not required to be changed, the process proceeds to step S17, and when the setting file 14 is required to be changed (for example, information necessary for setting the PKI environment is stored). In the case where the existing path is changed), the setting file 14 transmitted from the server 10 is edited in step S16. As described above, since there are cases where the setting file 14 transmitted from the server 10 cannot be used as it is, the electronic envelope client processing unit 22 provided in the client 20 has a function (for example, an editor) that can edit the setting file 14. It is preferable to provide.

  In step S17, the client 20 sets the PKI environment using the setting file 14 extracted from the electronic envelope 13 in step S12 or the setting file 14 edited in step S16. In step S18 to be executed next, the setting file 14 used for environment setting of PKI in step S17 is stored. In step S <b> 18, the electronic envelope client processing unit 22 of the client 20 stores the setting file 14 used for PKI environment setting in the information storage unit 23.

  In step S19 to be executed next, processing of the client server system using the PKI is started in accordance with the PKI environment set in step S17 or step S14a.

The figure explaining the client server system which concerns on this invention. The block diagram of the client server system of FIG. The figure explaining an electronic envelope. The figure explaining the setting file embedded in the electronic envelope. The figure explaining the information memorize | stored in an information storage part. The figure explaining the operation | movement procedure of a client server system.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Server 11 Server application 12 Electronic envelope server processing part 13 Electronic envelope 14 Setting file 20 Client 21 Client application 22 Electronic envelope client processing part 23 Information storage part 30 Network

Claims (3)

In a client server system using a public key infrastructure (PKI), the client automatically sets a PKI environment,
(A) a step in which the client accesses a server connected via a network;
(B) a step in which the server transmits an electronic envelope in which a setting file in which attribute information including at least PKI environment setting contents and file identification information and version information is embedded is transmitted to the client;
(C) the client opens the electronic envelope transmitted from the server, and the client acquires the setting file from the electronic envelope;
(D) confirming whether the client stores the setting file specified by the attribute information obtained from the electronic envelope;
(E1) In the step (d), when the client stores the setting file specified by the attribute information obtained from the electronic envelope, the setting file stored in the client is used. Set the PKI environment,
(E2) In the step (d), when the setting file specified by the attribute information is not stored, the client displays the setting file and sends the setting file to a user who operates the client. Edit or execute a process for obtaining consent. When the consent is obtained, execute a process for causing the user to edit a part of the setting file. If a part of the setting file is edited, Storing the setting file used for setting the PKI environment after setting the PKI environment using the setting file before editing if the setting file is not partially edited;
A PKI environment setting method characterized by comprising: A client / server system using a public key infrastructure (PKI) and a client and a server connected via a network,
The server transmits an electronic envelope in which a setting file in which attribute information including at least PKI environment setting contents and file identification information and version information is described is embedded to the client accessed via the network. With means,
The client confirms whether an information storage unit that stores the electronic envelope received from the server and the setting file specified by the attribute information obtained from the electronic envelope are stored, and is specified by the attribute information. The setting file stored in the client is used to set a PKI environment, and if the setting file specified by the attribute information is not stored, the client Displays the setting file and executes a process of using the setting file as it is or obtaining an agreement for the user operating the client, and when the agreement is obtained, a part of the setting file is transferred to the user. run the process of editing, the setting file of the edited if some of the configuration file has been edited, a part of the configuration file After setting the PKI environment if not the edited using the configuration file before editing, and a digital envelope processing means for storing the configuration file that uses the PKI preferences,
A client-server system.   A computer program for causing a computer to function as electronic envelope processing means provided in a client constituting the client server system according to claim 2.

Images