JP5569201B2 - Image processing apparatus, electronic certificate setting method, and electronic certificate setting program - Google Patents

Description

  The present invention relates to an image processing apparatus in which an electronic certificate is set, an electronic certificate setting method executed in the image processing apparatus, and an electronic certificate setting program.

  In recent years, a multifunction peripheral as an example of an image processing apparatus has various functions. A multifunction peripheral needs to communicate with many external servers in order to realize various functions. Some communication performed between the MFP and the external server encrypts communication contents for security reasons. For example, authentication of an electronic certificate is used in encryption communication such as SSL (Secure Socket Layer).

  For example, when mutual authentication using an electronic certificate is required with an external server, the conventional multifunction peripheral needs to set an electronic certificate for each external server (for each function). This increases the burden on the administrator. For example, there has been a conventional multi-function device that communicates with a client device in which all the electronic certificates that are held can be sent to the client device so that the validity can be verified (see, for example, Patent Document 1).

  When communicating with a client device, the MFP described in Patent Document 1 that can verify the validity by sending all the electronic certificates that it holds does not need to set an electronic certificate for each function. The burden on the person is reduced. Even if the client device described in Patent Document 1 cannot verify the validity of a part of the electronic certificate received from the multifunction device, if the electronic certificate that can be verified is more than the threshold, the client device It describes that encrypted communication is performed by trusting the received electronic certificate.

  However, the multi-function device described in Patent Document 1 has a problem that an original protocol is required between the multi-function device and the client device in order to send all the electronic certificates held by the multi-function device to the client device. In order to eliminate the need for a unique protocol, the multi-function peripheral needs to send an electronic certificate associated with a function to the client device instead of sending all the electronic certificates held by the multifunction device to the client device.

  After all, in the conventional multi-function peripheral, an electronic certificate must be linked and set for each external server (for each function), which is a heavy burden on the administrator.

  SUMMARY An advantage of some aspects of the invention is that it provides an image processing apparatus, an electronic certificate setting method, and an electronic certificate setting program capable of easily setting an electronic certificate.

In order to solve the above-described problem, the present invention is an image processing apparatus in which an electronic certificate is set, and an analysis unit that analyzes an application of the electronic certificate from an electronic certificate requested to be set, and the electronic certificate The first management means for managing the electronic certificate and the identifier of the electronic certificate in a table, the storage means for storing the electronic certificate data, and the client means for communicating with the server, A second management unit that reads from the table an identifier of the electronic certificate corresponding to the usage of the electronic certificate that is the same as the usage of the client unit; and an electronic device that corresponds to the identifier of the electronic certificate read from the storage unit Client means for performing cryptographic communication with the server using certificate data.

  In addition, what applied the component, expression, or arbitrary combination of the component of this invention to a method, an apparatus, a system, a computer program, a recording medium, a data structure, etc. is also effective as an aspect of this invention.

  According to the present invention, it is possible to provide an image processing apparatus, an electronic certificate setting method, and an electronic certificate setting program capable of easily setting an electronic certificate.

It is a block diagram of an example of the system of a present Example. 1 is a hardware configuration diagram of an example of a multifunction machine according to an embodiment. 1 is a block diagram of an example of a multifunction machine. It is a data structure figure of an example of the electronic certificate of a present Example. It is a block diagram of an example of the table currently recorded on the table recording part. It is a block diagram of the other example of the table currently recorded on the table recording part. FIG. 10 is a sequence diagram illustrating an example of a processing procedure when an electronic certificate is introduced in a multifunction peripheral. FIG. 10 is a sequence diagram of another example illustrating a processing procedure when an electronic certificate is introduced in a multifunction peripheral. FIG. 10 is a sequence diagram of another example illustrating a processing procedure when an electronic certificate is introduced in a multifunction peripheral. FIG. 10 is a sequence diagram illustrating an example of a processing procedure during communication using an electronic certificate in a multifunction peripheral.

  Next, the best mode for carrying out the present invention will be described based on the following embodiments with reference to the drawings. In this embodiment, an example of a multifunction peripheral (MFP) will be described. However, any image processing apparatus or device that sets an electronic certificate may be used.

  FIG. 1 is a configuration diagram of an example of a system according to the present embodiment. In the system of FIG. 1, a multi-function device 1 as a client and a plurality of servers 2 are connected via a network 3 such as a LAN or the Internet so that data communication is possible. In FIG. 1, three servers 2A to 2C are shown.

  The multifunction device 1 is a device that uses the functions provided by the server 2 in accordance with the application. The server 2 is a device that provides the multifunction device 1 with a function according to the application. Communication performed between the MFP 1 and the server 2 encrypts communication contents for security. When mutual authentication using an electronic certificate is required between the multifunction device 1 and the server 2, the multifunction device 1 needs to set the electronic certificate in association with each server 2 or each function.

  Therefore, in this embodiment, when the electronic certificate is introduced, the server 1 automatically determines and sets the electronic certificate to which the MFP 1 is set as described later. In this embodiment, the electronic certificate can be automatically linked and set for each server 2 or for each function, so that the burden on the administrator can be reduced.

  FIG. 2 is a hardware configuration diagram of an example of the multifunction machine according to the present embodiment. The multifunction machine 1 includes a controller 601, an operation panel 602, a facsimile control unit (FCU) 603, an image pickup unit 604, and a printing unit 605.

  The controller 601 includes a CPU 611, ASIC 612, NB 621, SB 622, MEM-P 631, MEM-C 632, HDD (Hard Disk Drive) 633, memory card slot 634, NIC (Network Interface Controller) 641, USB device 642, IEEE 1394 device 643, Centronics device 644.

  The CPU 611 is an IC for various information processing. The ASIC 612 is an IC for various image processing. The NB 621 is a north bridge of the controller 601. The SB 622 is a south bridge of the controller 601. The MEM-P 631 is a system memory of the multifunction device 1. The MEM-C 632 is a local memory of the multifunction machine 1. The HDD 633 is storage of the multifunction device 1. The memory card slot 634 is a slot for setting a memory card 635.

  The NIC 641 is a controller for network communication using a MAC address. The USB device 642 is a device for providing a USB standard connection terminal. The IEEE 1394 device 643 is a device for providing a connection terminal of the IEEE 1394 standard. The Centronics device 644 is a device for providing connection terminals of Centronics specifications. The operation panel 602 is hardware (operation unit) for an operator to input to the multifunction device 1 and hardware (display unit) for an operator to obtain an output from the multifunction device 1.

  The electronic certificate setting program of this embodiment is at least a part of various programs that control the multifunction device 1. The memory card 635 is an example of a recording medium on which various programs for controlling the multifunction device 1 are recorded. The recording medium on which various programs for controlling the multifunction device 1 are recorded is not limited to the memory card 635, but various types of recording media such as a semiconductor memory for electrically recording information such as a ROM and a flash memory. Can be used.

  Various programs for controlling the multifunction device 1 are read from the memory card 635 when the multifunction device 1 is activated, for example, and stored in the MEM-P 631. The CPU 611 realizes various processes as described later according to various programs for controlling the multifunction machine 1 stored in the MEM-P 631.

  FIG. 3 is a block diagram of an example of a multifunction machine. As shown in FIG. 3, the multifunction device 1 includes an operation unit 10, a certificate introduction unit 12, a certificate analysis unit 14, a certificate management unit 16, a client function unit 18, a server management unit 20, And a table recording unit 22.

  The operation unit 10 receives a request from an administrator and outputs a result to the administrator. If the request received from the operation unit 10 or the Web is a certificate introduction request, the certificate introduction unit 12 requests the certificate management unit 16 to add a certificate. Further, the certificate introduction unit 12 receives a response to the certificate addition request from the certificate management unit 16, and transmits the response to the operation unit 10 or the Web as a result.

  Upon receiving the analysis request from the certificate management unit 14, the certificate analysis unit 14 analyzes the usage of the electronic certificate as described later. The certificate analysis unit 14 transmits the analysis result to the certificate management unit 16 as a response to the analysis request.

  The certificate management unit 16 stores the electronic certificate data in the HDD 633. The certificate management unit 16 requests the server management unit 20 to update or add a table to be described later according to the introduced electronic certificate. If there is a certificate request from the client function unit 18, the certificate management unit 16 receives the certificate ID of the electronic certificate corresponding to the usage from the server management unit 20 as described later. The certificate management unit 16 reads the received electronic certificate with the certificate ID and transmits it to the client function unit 18.

  The client function unit 18 performs cryptographic communication with the server 2 using the electronic certificate received from the certificate management unit 16 during communication with the server 2. The server management unit 20 updates or adds a table to be described later according to the introduced electronic certificate. Further, based on the use notified from the certificate management unit 16, the server management unit 20 reads a certificate ID corresponding to the use from a table described later and transmits the certificate ID to the certificate management unit 16. The table recording unit 22 records a table described later.

  FIG. 4 is a data structure diagram of an example of the electronic certificate of this embodiment. 4 has a pre-signature certificate 32, a signature algorithm 34, and a signature value 36. As shown in FIG. 4, the pre-signature certificate 32 has a version, serial number, algorithm identifier, issuer, validity period, subject, subject public key information, issuer unique identifier, subject unique identifier, and extension area 38. Have. The electronic certificate 30 of the present embodiment is characterized in that “use” is included in the extended area 38 as the purpose of use.

  The pre-signature certificate 32 represents basic information of the electronic certificate 30 and a public key. The signature algorithm 34 represents an algorithm when the issuer signs the electronic certificate 30. The signature value 36 is an issuer's digital signature.

  The version represents the version of the electronic certificate 30. The serial number represents a number for uniquely identifying the electronic certificate 30. The algorithm identifier is an algorithm used when the issuer signs the electronic certificate 30. The issuer represents the issuer (institution) that issued the electronic certificate 30. The validity period represents the validity period of the electronic certificate 30. The subject represents the owner of the electronic certificate 30. The subject public key information is information related to the subject's public key, and includes the algorithm name of the public key and the public key. The issuer unique identifier is used to identify the issuer when the issuer name is reused. The subject unique identifier is used to identify the subject when the subject name is reused. The extension area 38 is an extension area of the electronic certificate 30.

  In this embodiment, when the electronic certificate 30 is introduced into the multifunction device 1, the multifunction device 1 reads the usage from the extended area 38 of the electronic certificate 30, and the electronic certificate for which server 2 or function is determined from the usage. By automatically determining whether it is a certificate 30, the electronic certificate 30 can be automatically linked and set for each server 2 or for each function. It is assumed that the multifunction machine 1 has a table (not shown) that associates the server 2 or function with the application.

  FIG. 5 is a configuration diagram of an example of a table recorded in the table recording unit. The table shown in FIG. 5 includes certificate ID, usage, and server as data items. The table in FIG. 5 associates certificate IDs with uses, and associates uses with servers. The usage is associated with one or more servers. In the table of FIG. 5, the certificate ID can be acquired using the usage as a key.

  FIG. 6 is a configuration diagram of another example of a table recorded in the table recording unit. The table shown in FIG. 6 has certificate ID, server, and usage as data items. The table in FIG. 6 associates the certificate ID with the server and associates the server with the application. A server is associated with one or more uses. Since the multifunction machine 1 has a table for associating the server 2 and usage (not shown), the server 2 can be acquired using the usage as a key, and the certificate ID can be acquired using the server 2 as a key.

  The use represents various services provided by the server 2, for example. Various services include services remotely managed via the Internet, directory services, authentication services, and the like. The service remotely managed via the Internet is an automatic notification from the multifunction machine 1 as a client to the technical center as the server 2 via the Internet. The service remotely managed via the Internet is intended to prevent the failure of the multifunction device 1 by performing a periodic diagnosis of the multifunction device 1 and performing an appropriate inspection according to the state of the multifunction device 1. In addition, the remote management service via the Internet minimizes downtime of the multifunction device 1, such as automatic notification in the event of failure, status confirmation, quick customer engineer (CE) arrangement, and simplified repair request work. . Since various services in this embodiment are performed by encrypted communication, mutual authentication using an electronic certificate is required.

  FIG. 7 is a sequence diagram illustrating an example of a processing procedure when an electronic certificate is introduced in the multifunction peripheral. For example, the administrator makes a request for introduction of an electronic certificate from the operation panel 602 of the multifunction machine 1. In addition, the administrator makes a request for introduction of an electronic certificate from the Web of a user terminal connected to the multi-function device 1 via the network 3 so that data communication is possible.

  The operation unit 10 of the multifunction device 1 receives an electronic certificate introduction request from the operation panel 602 by the administrator. In step S1, the certificate introduction unit 12 receives a certificate introduction request from the operation unit 10 or the Web. In step S2, the certificate introduction unit 12 requests the certificate management unit 16 to add a certificate.

  In step S3, the certificate management unit 16 requests the certificate analysis unit 14 to analyze the electronic certificate corresponding to the certificate addition request. In step S4, the certificate analysis unit 14 analyzes the purpose of the electronic certificate by referring to the purpose of use of the extended area of the electronic certificate corresponding to the certificate addition request. In step S5, the certificate analysis unit 14 responds to the certificate management unit 16 with the use of the analyzed electronic certificate as an analysis result. Here, an example in which the electronic certificate has one application will be described.

  In step S 6, the certificate management unit 16 stores the electronic certificate data requested for introduction in the HDD 633 in association with the certificate ID. In step S7, the certificate management unit 16 requests the server management unit 20 to update or add to the table shown in FIG. 5 or 6 according to the electronic certificate requested to be introduced. The table update or addition request includes the certificate ID of the electronic certificate for which the introduction request has been made, the usage, and server information associated with the usage.

  In step S8, the server management unit 20 updates or adds the table shown in FIG. 5 or 6 recorded in the table recording unit 22 in response to a table update or addition request from the certificate management unit 16. Do.

  Further, the certificate management unit 16 proceeds to step S9, and sends a response to the certificate addition request in step S2 to the certificate introduction unit 12. In step S10, the certificate introduction unit 12 transmits a response to the certificate addition request received from the certificate management unit 16 to the operation unit 10 or the Web as a result.

  If the purpose of use of the extension area of the electronic certificate is empty, the multifunction device 1 performs processing as shown in FIG. FIG. 8 is a sequence diagram of another example showing a processing procedure when an electronic certificate is introduced in the multifunction machine.

  The processing of steps S21 to S24 is the same as that of steps S1 to S4 in FIG. If the purpose of use of the extension area of the electronic certificate is empty, the certificate analysis unit 14 responds to the certificate management unit 16 in step S25 that the usage of the electronic certificate cannot be analyzed. In step S26, the certificate management unit 16 notifies the certificate introduction unit 12 that the use of the electronic certificate cannot be analyzed.

  In step S27, the certificate introduction unit 12 transmits an error to the operation unit 10 or the Web in response to the analysis failure received from the certificate management unit 16. In step S <b> 28, the operation unit 10 displays a screen on the operation panel 602 by which the administrator as an example of the user selects the use of the electronic certificate. In addition, a user terminal connected to the multi-function device 1 via the network 3 so as to be able to perform data communication displays a screen on which the administrator selects the use of the electronic certificate on the Web.

  When the administrator selects the usage of the electronic certificate, the operation unit 10 proceeds to step S29, and transmits the usage of the electronic certificate selected by the administrator to the certificate introduction unit 12 as selection information. When the administrator selects the usage of the electronic certificate, the user terminal proceeds to step S29, and transmits the usage of the electronic certificate selected by the administrator to the certificate introduction unit 12 as selection information.

  The certificate introduction unit 12 receives the usage of the electronic certificate selected by the administrator from the operation unit 10 or the Web of the user terminal as selection information. In step S30, the certificate introduction unit 12 transmits the usage of the electronic certificate selected by the administrator as information to the certificate management unit 16. Since the process after step S31 is the same as the process after step S6 of FIG. 7, description is abbreviate | omitted.

  If the usage purpose of the extension area of the electronic certificate includes a plurality of uses, the multifunction device 1 performs processing as shown in FIG. FIG. 9 is a sequence diagram of another example showing a processing procedure when an electronic certificate is introduced in the multifunction machine.

  The processing in steps S41 to S44 is the same as that in steps S1 to S4 in FIG. When a plurality of uses are included in the purpose of use of the extension area of the electronic certificate, the certificate analysis unit 14 returns an analysis result indicating the plurality of uses of the electronic certificate to the certificate management unit 16 in step S45. In step S46, the certificate management unit 16 notifies the certificate introduction unit 12 of a plurality of uses of the electronic certificate.

  In step S47, the certificate introduction unit 12 transmits a plurality of uses of the electronic certificate received from the certificate management unit 16 to the operation unit 10 or the Web. In step S <b> 48, the operation unit 10 displays on the operation panel 602 a screen for selecting an application of the electronic certificate by an administrator as an example of a user. In addition, a user terminal connected to the multi-function device 1 via the network 3 so as to be able to perform data communication displays a screen on which the administrator selects the use of the electronic certificate on the Web.

  When the administrator selects the usage of the electronic certificate, the operation unit 10 proceeds to step S49, and transmits the usage of the electronic certificate selected by the administrator to the certificate introduction unit 12 as selection information. When the administrator selects the usage of the electronic certificate, the user terminal proceeds to step S49, and transmits the usage of the electronic certificate selected by the administrator to the certificate introduction unit 12 as selection information.

  The certificate introduction unit 12 receives the usage of the electronic certificate selected by the administrator from the operation unit 10 or the Web of the user terminal as selection information. In step S50, the certificate introduction unit 12 transmits the usage of the electronic certificate selected by the administrator as information to the certificate management unit 16. The processing after step S51 is the same as the processing after step S6 in FIG.

  FIG. 10 is a sequence diagram illustrating an example of a processing procedure during communication using an electronic certificate in the multifunction peripheral. In step S 61, the client function unit 18 of the MFP 1 that wants to communicate with the server 2 makes a certificate request to the certificate management unit 16.

  In step S62, the certificate management unit 16 confirms the usage of the client function unit 18 that has requested the certificate. Note that the certificate management unit 16 uses the function corresponding to the client function unit 18 or the function of the client function unit 18 and a table (not shown) that correlates the use, and uses of the client function unit 18 that has made a certificate request. Can be confirmed.

  In step S 63, the certificate management unit 16 requests the server management unit 20 for a certificate ID of an electronic certificate corresponding to the use of the client function unit 18. Here, an example using the table of FIG. 5 is shown. When the table of FIG. 6 is used, in step S63, the server management unit 20 is requested for a certificate ID of an electronic certificate corresponding to the use of the client function unit 18 and the server 2 with which the client function unit 18 communicates.

  In step S64, the server management unit 20 reads the certificate ID corresponding to the usage from the table of FIG. 5 based on the usage of the client function unit 18 received from the certificate management unit 16. When the table of FIG. 6 is used, the server management unit 20 uses the client function unit 18 received from the certificate management unit 16 and the server 2 with which the client function unit 18 communicates. The certificate ID corresponding to the server 2 with which the client function unit 18 communicates is read from the table of FIG. In step S65, the server management unit 20 transmits a certificate ID corresponding to the application to the certificate management unit 16.

  In step S 66, the certificate management unit 16 reads the received electronic certificate with the certificate ID from, for example, the HDD 633. In step S 67, the certificate management unit 16 transmits the received electronic certificate with the certificate ID to the client function unit 18. In step S68, the client function unit 18 performs cryptographic communication with the server 2 using the electronic certificate received from the certificate management unit 16 during communication with the corresponding server 2.

  The present invention is not limited to the specifically disclosed embodiments, and various modifications and changes can be made without departing from the scope of the claims. The analysis means described in the claims corresponds to the certificate analysis unit 14, the first management means corresponds to the certificate management unit 16, the storage means corresponds to the HDD 633, and the second management means corresponds to the server management. The client unit corresponds to the client function unit 18, and the selection unit corresponds to the certificate introduction unit 12.

1 MFP (MFP)
2, 2A to 2C server 3 network 10 operation unit 12 certificate introduction unit 14 certificate analysis unit 16 certificate management unit 18 client function unit 20 server management unit 22 table recording unit 30 electronic certificate 32 certificate before signature 34 signature algorithm 36 Signature Value 38 Extended Area 601 Controller 602 Operation Panel 603 Facsimile Control Unit (FCU)
604 Imaging unit 605 Printing unit 611 CPU
612 ASIC
621 NB
622 SB
631 MEM-P
632 MEM-C
633 HDD (Hard Disk Drive)
634 Memory card slot 635 Memory card 641 NIC (network interface controller)
642 USB device 643 IEEE 1394 device 644 Centronics device

JP 2007-274435 A

Claims (9)

An image processing apparatus to which an electronic certificate is set,
Analysis means for analyzing the use of the electronic certificate from the electronic certificate requested to be set;
First management means for associating and managing the use of the electronic certificate and the identifier of the electronic certificate in a table;
Storage means for storing the electronic certificate data in association with the identifier of the electronic certificate;
A second management unit that confirms the usage of the client unit that communicates with the server, and reads the identifier of the electronic certificate corresponding to the same usage of the electronic certificate as the usage of the client unit ;
An image processing apparatus comprising: client means for performing cryptographic communication with the server using data of an electronic certificate corresponding to an identifier of the electronic certificate read from the storage means.   The image according to claim 1, wherein the analysis unit refers to a use of the electronic certificate included in an extension area of the electronic certificate requested to be set, and analyzes the use of the electronic certificate. Processing equipment. The first management means manages the use of the electronic certificate, the identifier of the electronic certificate, and the server in a table in association with each other,
The second management means confirms the use of the client means that communicates with the server and the server that the client means communicates with, and the electronic certificate of the same use as the client means that communicates with the server . The image processing apparatus according to claim 2, wherein an identifier of the electronic certificate corresponding to the application and the server with which the client unit communicates is read from the table.   When the use of the electronic certificate cannot be analyzed by the analyzing means, a selection screen for selecting the use of the electronic certificate is presented to the user, and a selection means for causing the user to select the use of the electronic certificate is further provided. The image processing apparatus according to claim 3.   When the analysis unit analyzes a plurality of uses of the electronic certificate, the selection unit further presents a selection screen for selecting the use of the electronic certificate and allows the user to select the use of the electronic certificate. The image processing apparatus according to claim 3. An electronic certificate setting method executed by an image processing apparatus,
The image processing apparatus is
Analyzing the usage of the electronic certificate from the electronic certificate requested for setting;
Managing the use of the electronic certificate and the identifier of the electronic certificate in a table in association with each other;
Storing the electronic certificate data in association with the identifier of the electronic certificate;
Confirming the usage of the client means for communicating with the server, and reading from the table the identifier of the electronic certificate corresponding to the same usage of the electronic certificate as the usage of the client means ;
An electronic certificate setting method comprising: performing cryptographic communication with the server using data of an electronic certificate corresponding to the read identifier of the electronic certificate.   The step of analyzing the usage of the electronic certificate from the electronic certificate for which the setting request has been made refers to the usage of the electronic certificate included in an extension area of the electronic certificate for which the setting has been requested. 7. The electronic certificate setting method according to claim 6, wherein the usage of the certificate is analyzed. The image processing device
Analysis means for analyzing the use of the electronic certificate from the electronic certificate requested to be set;
First management means for associating and managing the use of the electronic certificate and the identifier of the electronic certificate in a table;
Storage means for storing the electronic certificate data in association with the identifier of the electronic certificate;
A second management unit that confirms the usage of the client unit that communicates with the server, and reads the identifier of the electronic certificate corresponding to the same usage of the electronic certificate as the usage of the client unit ;
An electronic certificate setting program for functioning as client means for performing cryptographic communication with the server using electronic certificate data corresponding to the identifier of the electronic certificate read from the storage means.   9. The electronic device according to claim 8, wherein the analyzing unit analyzes the usage of the electronic certificate by referring to the usage of the electronic certificate included in the extension area of the electronic certificate requested to be set. Certificate setting program.

Images