TWI551105B - System for managing certificate and method thereof - Google Patents

Description

System and method for managing credentials

A credential management system and method thereof, in particular, a system and method for managing credentials through a proxy server and a gateway.

An electronic voucher, also known as a digital voucher, is an identity recognition mechanism for computer systems. The electronic voucher is a signature signed by the identity certification authority on the digital ID card. This behavior indicates that the identity certification authority has determined that the user has a digital identity card. An electronic voucher is a file or group of computer files that record the identity of the owner and a set of public keys. The owner of the electronic voucher can authenticate himself to the computer system to access or use a particular computer service.

In the early days, due to the lack of network security, the computer software execution environment is relatively simple. The system built with the browser and the web page has the advantages of easy use and no additional software installed on the client side. Therefore, Computer services that need to be accessed or used through electronic vouchers are mostly provided in the form of webpages attached to the security plug-in components, meaning that when the user accesses or uses these services, the voucher application is made to the remote server through the browser. , extensions and inquiries and other related services.

However, due to the increasing importance of network security in recent years, browsers have become more and more demanding on the security requirements and checks of web pages and plug-in components operating on them. The restrictions have increased dramatically and the support has decreased. Complex, the new applications, extensions, inquiries and other related operations that have been successfully executed in the past have greatly increased the proportion of operational failures, which has caused problems for users.

In summary, it can be seen that in the prior art, there has been a long-standing problem that the browser may restrict the credential management operation, and therefore it is necessary to propose an improved technical means to solve this problem.

In view of the prior art, there is a problem that a browser may limit a credential management job, and the present invention discloses a system for managing credential and a method thereof, wherein:

The system for managing credentials disclosed in the present invention comprises at least: a network module connected to a proxy server, a proxy server connected to the gateway; and a login module for providing input identification information and for transmitting the network The module and the proxy server transmit the identification data to the gateway, so that the gateway performs the login operation and receives the login result returned by the gateway; the voucher processing module is used to locally log in when the login result indicates successful login. The local credential information of the local voucher corresponding to the identification data is read, and the local credential information is transmitted to the gateway through the network module and the proxy server; the status guiding module is configured to receive through the network module The gateway device forwards a status indication through the proxy server to the remote credential information of the remote credential corresponding to the local credential information and the identification data, and guides the operation of the credential management according to the status guide. software.

The method for managing voucher disclosed in the present invention comprises the steps of: connecting a gateway device and a proxy server; the voucher management software provides input identification data; and the voucher management software transmits the identification data to the gateway device through the proxy server to enable the gateway The login operation is performed; the gateway returns the login result to the voucher management software; when the login result indicates successful login, the voucher management software reads the local credential information of the local voucher stored at the local end, and transmits the local credential through the proxy server. Information to the gateway; the gateway reads the remote credential information of the remote credential corresponding to the identification data; the gateway generates a status guide according to the local credential information and the remote credential information, and transmits the status through the proxy server Directed to the voucher management software; the voucher management software guides the operation according to the status guide.

The system and method disclosed in the present invention are as above, and the difference between the prior art and the prior art is that the present invention provides user login through the credential management software executed at the local end, and obtains local credential information and remote credential information after the gateway device obtains The local credential information and the remote credential information generate status guidance to guide the user to operate the credential management software, thereby solving the problems existing in the prior art, and achieving the technical effect of performing credential management operations using the credential management software independently executed on the local end.

The features and embodiments of the present invention will be described in detail below with reference to the drawings and embodiments, which are sufficient to enable those skilled in the art to fully understand the technical means to which the present invention solves the technical problems, and The achievable effects of the present invention.

The invention allows the user to perform management operations on the voucher owned by the user through the voucher management software executed at the local end, for example, applying for a voucher, querying the status of the voucher on the local and the server, voucher renewal, changing the voucher password, and the like, However, the invention is not limited thereto. The invention can also automatically import credentials into the browser.

Hereinafter, the network architecture of the present invention will be described with reference to "FIG. 1". First, the user operates the local terminal 200, and the voucher management software 210 of the present invention is executed in the local terminal 200. The local terminal 200 is connected to the financial channel 100 through the network, and the financial channel 100 is also configured through the network and the voucher. The credential server 410 of the management center is connected. The financial channel 100 is provided with at least a proxy server (Proxy Server) 110, a credential registration server (RA) 130, a security server (Secure Server) 150, and a gateway 170.

The proxy server 110 is connected to the local terminal 200 and the gateway 170.

The credential registration server 130 is connected to the gateway 170 and the credential server 410, and is responsible for storing the credential of the user and the credential information of the credential. In the present invention, the credential and credential information stored by the credential registration server 130 are respectively called It is "Remote Credentials" and "Remote Credential Information".

The voucher registration server 130 is also responsible for providing various services related to the voucher through the credential server 410, for example, application, renewal, update, cancellation, inquiry, download, registration, etc. of the voucher, but the invention is not limited thereto. .

In addition, the credential registration server 130 also provides a login interface for performing login operations using the identification data of the user provided by the gateway 170 and transmitting the login result back to the gateway 170. In some embodiments, the user's identification data includes an account password, and the voucher registration server 130 may check whether the account number in the identification data exists, and compare the password corresponding to the account number in the identification data with the identification data. If the password is the same, if the account number in the identification data exists and the password corresponding to the account number in the identification data is the same as the password in the identification data, the voucher registration server 130 generates a login result indicating that the login is successful, and if the account in the identification data is identified, If the password corresponding to the account number in the identification data does not exist, or the password in the identification data is different, the voucher registration server 130 generates a login result indicating that the login failed.

The security server 150 is connected to the gateway 170 and is responsible for providing security control mechanisms related to the voucher, for example, performing signature, verification, and encryption and decryption operations, but the security server 150 does not operate. Limited to the above.

The gateway 170 is connected to the proxy server 110, the credential registration server 130, and the security server 150, and is responsible for storing version information of the credential management software 210.

The gateway 170 is also responsible for controlling the user's login behavior. After receiving the identification data of the user transmitted by the credential management software 210 of the local terminal 200, the gateway 170 performs a login operation through the login interface provided by the credential registration server 130, and registers the credential with the proxy server 110. The login result returned by the device 130 is replied to the credential management software 210. The login result of the gateway 170 to the credential management software 210 may indicate that the login is successful, and may also indicate that the login fails.

The gateway 170 is also responsible for generating state guidelines. The gateway 170 receives the credential information transmitted by the credential management software 210 of the local terminal 200 through the proxy server 110. In the present invention, the local terminal 200 also stores credentials and credential information, which are referred to as "local credential" and "local credential information" respectively, and the local credential stored by the local end 200 and the remote end stored by the credential registration server 130. The voucher will correspond to the identification data of the same user.

After receiving the local credential information, the gateway 170 obtains the remote credential information corresponding to the identification information of the same user by the credential registration server 130, and generates the status according to the local credential information and the remote credential information. Guidelines. For example, the gateway 170 can determine whether the local credential information is the same as the remote credential information. If not, the gateway 170 can then determine whether the credential management software 210 of the local end 200 has not succeeded in issuing a request to update the local credential. The updated credentials are stored to the local end 200, and if so, the status indication generated by the gateway 170 can include a message prompting the user to download the updated credentials. If no, that is, the reason that the local credential information is different from the remote credential information is that the updated credential is not stored in the local end 200, the status guide generated by the gateway 170 usually includes a message prompting the user to contact the manager. However, the invention is not limited thereto. In this way, the user can operate the credential management software 210 to update the local credential or simultaneously update the local credential and the remote credential according to the status generated by the gateway 170 when the local credential information is different from the remote credential information, so that the local credential information is The same as the remote credential information.

If the local credential information is the same as the remote credential information, the gateway 170 may further determine whether the local credential information indicates whether the difference between the expiration time of the local credential and the current time is lower than a predetermined value, that is, whether the local credential is about to expire, If no, that is, the local certificate has not expired, the status guidance generated by the gateway 170 may include providing a certificate password change operation, providing a local credential information inquiry, providing a remote credential information inquiry, and the like, and if the local credential is about to arrive In the meantime, the status guide generated by the gateway 170 includes a message for providing a voucher rollover operation in addition to the message included in the status guide that the local voucher has not expired.

In addition, the gateway 170 may transmit the received signature to the security server 150 after receiving the signature of the local certificate required to be renewed transmitted by the certificate management software 210 of the local terminal 200 through the proxy server 110. The verification is performed and the verification result returned by the security server 150 is received. If the verification result indicates that the signature has passed the verification, the gateway 170 may extend the time limit of the voucher through the voucher registration server 130 to complete the voucher renewal operation. If the verification result indicates that the signature has not passed the verification, the gateway 170 will not continue the voucher extension operation.

The gateway 170 may also, after receiving the request for the voucher application transmitted by the voucher management software 210 of the local terminal 200 through the proxy server 110, apply for a voucher through the voucher registration server 130 to complete the voucher application operation. The gateway 170 may further receive the request for the certificate password change transmitted by the voucher management software 210 through the proxy server 110, and then change the password of the voucher through the voucher registration server 130 to complete the password change operation.

Moreover, in some embodiments, the local end 200 and the gateway 170 may be directly connected rather than necessarily connected through the proxy server 110, that is, in the present invention, the proxy server 110 is not necessary. At this time, the data can be directly transmitted between the local terminal 200 and the gateway 170 without passing through the proxy server 110.

Next, the system architecture of the system for managing credentials according to the present invention will be described with reference to the system architecture of the present invention. As shown in FIG. 2, the system of the present invention is applied to the voucher management software 210, which mainly includes a network module 211, a login module 212, a voucher processing module 213, a status guiding module 215, and an attachable The software update module 217 and the document import module 219.

The network module 211 is connected to the proxy server 110. In the present invention, the network module 211 transmits the data to the proxy server 110, and the proxy server 110 receives the data. Even the data transmitted between the network module 211 and the gateway 170 is transmitted through. The proxy server 110 forwards.

The login module 212 is responsible for providing the input identification data, and is responsible for transmitting the input identification data to the gateway 170 through the network module 111, causing the gateway 170 to perform the login operation through the voucher registration server 130, and the login mode. The group 212 is also responsible for receiving the login results returned by the gateway 170 via the network module 211.

The voucher processing module 213 is responsible for reading, by the storage medium 240 of the local terminal 200, the local voucher of the local voucher corresponding to the identification data provided by the login module 212 when the login result received by the login module 212 indicates successful login. News.

The voucher processing module 213 is also responsible for transmitting the local credential information to the gateway 170 through the network module 211 when the login result received by the login module 212 indicates successful login, so that the gateway 170 can be based on the local credential information. Status guidance with remote credential information.

The voucher processing module 213 can perform a voucher application operation through the network module 211 and the proxy server 110 to the gateway 170 when the local voucher cannot be read.

The voucher processing module 213 can also provide a password for entering a local credential and open the local credential using the entered password.

The status guiding module 215 is responsible for receiving the status indication returned by the gateway through the network module 211, and guiding the operation of the credential management software according to the status. For example, when the status guide includes a message prompting the user to download the updated credential, the status directing module 215 can guide the user to perform the credential download operation in the credential management software 210, thereby updating the local credential; when the status guide includes When the user is prompted to contact the manager's message, the status guiding module 215 can guide the user to contact the administrator to update the local credential and the remote credential; and when the status guide includes providing the credential password change operation, providing the local credential information query, The status guiding module 215 can guide the user to perform the credential password change, the local credential information or the remote credential information query, and the voucher renewing operation in the credential management software 210 when the remote credential information inquiry, the credential extension operation, and the like are provided.

The software update module 217 can obtain the version information of the credential management software 210 stored in the gateway 170 through the network module 211 and the proxy server 110. In the present invention, the version information stored by the gateway 170 is the latest version information of the voucher management software 210.

The software update module 217 can also read the version information of the credential management software 210 currently executing on the local end 200, and compare whether the latest version information obtained by the gateway 170 is the same as the current version information read out, and if so, The software update module 217 will not perform the software update job. When the latest version information is different from the current version information, the software update module 217 can connect to the proxy server 110 or the gateway 170 via the network module 211 to download the latest version of the credential management software 210, and perform software update. The job is to update the credential management software 210 executed at the local end 200 to the latest version.

The voucher import module 219 can detect the browser 230 installed in the local end 200, and the local credential stored in the local end 200 can be added, renewed, updated, replaced, etc., but not limited to the above. When the local credential is changed, the changed local credential is imported into the corresponding browser 230. In general, the voucher import module 219 can import the corresponding local credentials into the browser 230 through the application programming interface (API) provided by the browser 230, so as to provide the browser 230 with the updated local. certificate.

The voucher import module 219 can detect the browser 230 installed in the local end 200 when the voucher management software 210 is executed, and can also detect the browser installed in the local end 200 when the local credential changes. 230, the present invention is not particularly limited.

Next, an operational system and method of the present invention will be described with reference to an embodiment, and reference is made to the flowchart of the method for managing credentials provided by the present invention in "FIG. 3A". In the present embodiment, it is assumed that the financial channel 100 is a securities company, but the invention is not limited thereto.

After the proxy server 110, the credential registration server 130, the security server 150, and the gateway 170 are set up by the securities company, the gateway 170 and the proxy server 110, the credential registration server 130, and the security server 150 Connected (step 301).

After the user operates the local terminal 200, the voucher management software 210 of the present invention is downloaded by the securities company, and after being executed by the local end 200, the voucher management software 210 can display the operation interface on the local end 200 and wait for the user to input and recognize. data. In this embodiment, it is assumed that the login module 212 of the credential management module 210 can provide the user with input identification data such as an account password in the operation interface (step 310).

After the login module 212 of the voucher management software 210 provides the user input identification data (step 310), the login module 212 can transmit the identification data input by the user to the gateway through the network module 211 and the proxy server 110. The device 170 (step 320). In this embodiment, it is assumed that the login module 212 transmits the identification data input by the user to the proxy server 110 through the network module 211, and the proxy server 110 transfers the identification data to the gateway 170.

After the gateway 170 receives the identification data transmitted by the voucher management software 210, the gateway 170 can perform the login operation on the received identification data through the connected voucher registration server 130, and will complete the login operation. The generated login result is passed back to the credential management software 210 (step 330). In the present embodiment, it is assumed that the gateway 170 will also transmit the login result to the voucher management software 210 via the proxy server 110.

After the login module 212 of the voucher management software 210 receives the login result returned by the gateway 170 through the network module 211 of the voucher management software 210, if the login result indicates that the identification data input by the user can be successfully registered, The voucher processing module 213 of the voucher management software 210 can read the voucher information (local credential information) of the local voucher corresponding to the identification data input by the user into the storage medium 240 of the local end 200, and through the network mode. The group 211 and the proxy server 110 transmit the read local credential information to the gateway 170 (step 350). In this embodiment, as shown in the flow of "FIG. 3B", after the network module 211 of the credential management software 210 receives the login result returned by the gateway 170 (step 330), the credential management The login module 212 of the software 210 can determine whether the login result received by the network module 211 indicates successful login (step 352). If not, the credential management software 210 can provide the user-operated credential management operation to remain closed. The login module 212 will again provide the user input identification data (step 310).

If the login module 212 of the credential management software 210 determines that the login result received by the network module 211 of the credential management software 210 indicates successful login, the credential processing module 213 of the credential management software 210 can then determine the storage of the local end 200. Whether there is a local credential in the media 240 (step 361), if so, the credential processing module 213 can read the credential information (local credential information) of the local credential (step 356), and can pass through the network module 211 and the proxy server. 110 transmits the local credentials to the gateway (step 358).

If the local credential is not stored in the storage medium 240 of the local end 200, that is, the local credential is not stored in the local end 200, the status guiding module 215 of the credential management software 210 can open the credential application in the credential management operation ( At this time, the voucher management software 210 also closes other functions in the voucher management job, thereby guiding the user to perform the voucher application operation. After the user selects the voucher management job for the voucher application, the voucher processing module 213 of the voucher management software 210 will be able to provide the user application voucher (step 365). In this embodiment, it is assumed that the voucher processing module 213 can provide a password for the user to input the voucher, and transmit the password input by the user to the gateway device through the network module 211 of the voucher management software 210 and the proxy server 110. 170, by which the gateway 170 is provided to complete the voucher application operation through the voucher registration server 130.

The gateway 170 may transmit the requested certificate to the proxy server 110 after completing the voucher application operation. The proxy server 110 can store the received credentials and transmit the received credentials to the credential management software 210, so that the credential processing module 213 of the credential management software 210 can receive the network module 211 of the credential management software 210. The gateway 170 passes the credentials returned by the proxy server 110. After receiving the voucher, the voucher processing module 213 can store the received voucher into the storage medium 240 of the local terminal 200 (step 367), so that the stored voucher becomes a local credential, and then the voucher processing module The group 213 can communicate the local credentials to the gateway 170 via the network module 211 and the proxy server 110 (step 358).

Continuing back to the "FIG. 3A", after the gateway 170 receives the local credential information transmitted by the credential management software 210 of the local terminal 200 through the proxy server 110, the gateway 170 can obtain the same through the credential registration server 130. The received local credential information corresponds to the remote credential information of the same user identification data, and generates status guidance according to the local credential information and the remote credential information, and transmits the generated status guide to the credential management through the proxy server 110. Software 210 (step 370). In this embodiment, if the gateway 170 determines that the local credential information is different from the remote credential information, the gateway 170 can determine whether the local credential is in the update request according to the local credential information, the remote credential information, or even other related information. After being transmitted, it is not successfully stored in the storage medium 240 of the local terminal 200. If so, the status indication generated by the gateway 170 may include a message prompting to download the local certificate, and if the local credential information and the remote credential information are not The same reason is not that the updated local credentials are not properly stored in the storage medium 240, and the status guide generated by the gateway 170 will contain a message prompting the contact manager.

If the gateway 170 determines that the local credential information is the same as the remote credential information, the gateway 170 can further determine whether the local credential is about to expire, that is, whether the difference between the expiration time of the local credential and the current time is lower than or not. The predetermined value, for example, is less than one month. If not, that is, the local credentials have not yet expired, the status guidance generated by the gateway 170 may include providing functions other than the voucher application and voucher extension in the voucher management job, such as voucher inquiry, password change, and the like. To provide users with credential management.

And if the local credential is about to expire, that is, the difference between the expiration time of the local credential and the current time is lower than the predetermined value, the status guidance generated by the gateway 170 may include providing a voucher management job in addition to the voucher application. Other functions, that is, voucher renewal, voucher inquiry, password change, etc.

After the status guiding module 215 of the credential management software 210 receives the status guidance transmitted by the gateway 170 through the network module 211, the status guiding module 215 can guide the user to operate the credential management software according to the received status guide. 210 (step 380).

In this embodiment, if the status guide includes a message prompting the user to download the updated credential, the status directing module 215 can guide the user to perform the credential download operation in the credential management software 210, so that the user operates Afterwards, the network module 211 can download the remote credential to the gateway 170, and store the downloaded remote credential into the storage medium 240 of the local end 200 to become a local credential, thereby completing the update of the local credential. If the status guide includes a message prompting the user to contact the administrator, the status guide module 215 can guide the user to contact the administrator by telephone, email or instant messaging, thereby updating the local credential and the remote credential, that is, simultaneously replacing Local credentials and remote credentials.

When the status guide includes a message providing a voucher browsing job, a voucher password change job, a voucher rollover job, etc., the status guiding module 215 can guide the user to open the voucher, the voucher password change, and the voucher rollover operation in the voucher management software 210. . When the user performs the operation of opening the voucher, the voucher processing module 213 can provide the password for the user to input the local voucher, thereby opening the voucher; when the user performs the operation of changing the voucher password, the voucher processing module 213 can provide the user input. The password of the local credential is transmitted to the gateway 170 through the network module 211 and the proxy server 110 through the network module 211 and the proxy server 110, thereby providing the gateway 170 to complete the credential password change operation through the credential registration server 130.

When the user performs the voucher extension operation with the guidance of the state guidance module 215, the voucher processing module 213 can provide the user with a password for inputting the local certificate to be extended, and the password input by the user is transmitted through the network. The module 211 and the proxy server 110 are transmitted to the gateway 170 to provide the gateway 170 to complete the voucher renewal operation through the security server 150 and the voucher registration server 130. Thereafter, the gateway 170 can pass the extended expiration date to the proxy server 110. The proxy server 110 may update the voucher information (remote voucher information) of the voucher (remote voucher) of the extension period according to the received deadline, and transmit the received expiration date to the voucher management software 210. The voucher processing module 213 of the voucher management software 210 can receive the extended expiration date returned by the gateway 170 through the proxy server 110 through the network module 211 of the voucher management software 210. After receiving the extended expiration date, the voucher processing module 213 can update the local credential information according to the expiration period, and can read the remote credential information of the remote credential stored by the proxy server 110 through the network module 211, and simultaneously The status directing module 215 will disable the function of the voucher extension in the voucher management software 210. Thus, in the voucher management software 210, the credential management functions other than the voucher application and the voucher extension remain open.

In addition, the above embodiment may further be as shown in the flow of "3C", and the voucher importing module 219 of the voucher management software 210 may detect the browser installed at the local end 200 (step 391), and determine the detected Whether the detected browser supports the import of the voucher, and if not, the voucher import module 219 will not perform the voucher import operation. If the voucher import module 219 detects the browser support voucher import, when the voucher import module 219 detects the local voucher change, for example, the user newly applies for the local credential, and the user extends the local When the term of the voucher or the local voucher is replaced by the user, the voucher import module 219 can import the changed local credential into the browser through the detected application interface provided by the browser (step 395).

In addition, the above embodiment may also be implemented as shown in the flow of the "3D". After the voucher management software 210 is executed on the local end 200, the software update module 217 of the voucher management software 210 can access the network of the voucher management software 210. The module 211 and the proxy server 110 to the gateway 170 obtain the latest version information stored by the gateway 170 (step 307), and can read the current version information stored in the storage medium 240 of the local terminal 200. When the software update module 217 determines that the latest version information obtained is different from the current version information read, the latest version of the credential management software 210 can be downloaded through the network module 211 (step 309). In this embodiment, it is assumed that the software update module 217 downloads the latest version of the credential management software 210 through the network module 211 and the proxy server 110 to the gateway 170.

In this way, the user can perform the management operation on the voucher owned by the user after executing the voucher management software 210 proposed by the present invention at the local end 200.

In summary, it can be seen that the difference between the present invention and the prior art is that the voucher management software executed at the local end provides the user with the login, and transmits the local credential information to the gateway device, so that the gateway device obtains the local credential information and the far-reaching device. After the credential information is generated, the status information is generated according to the local credential information and the remote credential information, so as to guide the user to operate the credential management software, and the technical means can solve the problem that the browser existing in the prior art may restrict the credential management operation. The problem, in turn, achieves the technical effect of performing a credential management operation using the credential management software independently executed on the local end.

Furthermore, the method for managing credentials of the present invention can be implemented in hardware, software or a combination of hardware and software, or can be implemented in a centralized manner in a computer system or spread over several interconnected computer systems with different components. Decentralized implementation.

While the embodiments of the present invention have been described above, the above description is not intended to limit the scope of the invention. Any modification of the form and details of the practice of the present invention, which is a matter of ordinary skill in the art to which the present invention pertains, is a patent protection of the present invention. range. The scope of the invention is to be determined by the scope of the appended claims.

100‧‧‧Financial Access
110‧‧‧Proxy server
130‧‧‧Voucher registration server
150‧‧‧Security Server
170‧‧‧ gateway
200‧‧‧local
210‧‧‧Voucher management software
211‧‧‧Network Module
212‧‧‧ Login Module
213‧‧‧Voucher Processing Module
215‧‧‧Status Guidance Module
217‧‧‧Software update module
219‧‧‧Voucher Import Module
230‧‧‧ browser
240‧‧‧Storage media
410‧‧‧Voucher server step 301‧‧‧Connected gateway and proxy server Step 307‧‧‧Voucher management software obtains the latest version information stored in the gateway through the proxy server Step 309‧‧‧Voucher management software When the latest version information is different from the current version information, download the latest version of the voucher management software. Step 310‧‧‧Voucher management software provides input identification data Step 320‧‧‧Voucher management software transmits identification data to the gateway through the proxy server Step 330‧‧ ‧ The gateway performs the login operation and returns the login result to the voucher management software. Step 350‧‧‧ The login result indicates that the voucher management software reads the local credential information of the local voucher stored at the local end when the login is successful. And send the local credential information to the gateway through the proxy server. Step 352‧‧‧ Whether the login result indicates successful login Step 356‧‧‧Read local credential information Step 358‧‧‧Transfer local credential information Step 361‧‧ Local certificate Is there a step 365‧‧‧Provide the application for local credentials Step 367‧‧‧Store local credentials Step 370‧‧ ‧ The gateway reads the remote credential information of the remote credential corresponding to the identification data, generates a status guide according to the local credential information and the remote credential information, and transmits the status guide to the credential management software step through the proxy server 380‧‧‧Voucher management software provides guidance steps according to the status guide 391‧‧‧Voucher management software detection browser installed on the local side Step 395‧‧‧Voucher management software will change the local certificate when the local certificate is changed Import the corresponding browser

Figure 1 is a diagram of the network architecture proposed by the present invention. Figure 2 is a system architecture diagram of the management certificate proposed by the present invention. FIG. 3A is a flow chart of a method for managing credentials according to the present invention. Figure 3B is a flow chart of a detailed method of credential management proposed by the present invention. FIG. 3C is a flow chart of an additional method for importing a voucher submitted by the present invention into a browser. Figure 3D is a flow chart of an additional method of software update proposed by the present invention.

Step 301‧‧‧Connected gateway and proxy server

Step 310‧‧‧Voucher management software provides input identification data

Step 320‧‧‧Voucher management software transmits identification data to the gateway through the proxy server

Step 330‧‧‧The gateway performs the login operation and returns the login result to the voucher management software.

Step 350‧‧‧ The login result indicates that when the login is successful, the credential management software reads the local credential information of the local credential stored by the local end, and transmits the local credential information to the gateway through the proxy server.

Step 370‧‧ ‧ The gateway reads the remote credential information of the remote credential corresponding to the identification data, generates a status guide according to the local credential information and the remote credential information, and transmits the status guide to the credential management software through the proxy server

Step 380‧‧‧Voucher management software provides boot operations based on status guidelines

Claims (7)

A system for managing credentials is applied to a voucher management software. The system includes at least: a network module connected to a proxy server, the proxy server being connected to a gateway; and a login module for Providing an identification data for transmitting identification data to the gateway through the network module and the proxy server, causing the gateway to perform a login operation, and receiving a login result returned by the gateway a voucher processing module for reading a local credential information of one of the local voucher corresponding to the identification data at the local end when the login result indicates successful login, and through the network module and the proxy server Transmitting the local credential information to the gateway device; a state directing module for receiving, by the network module, the remote device one of the remote credential corresponding to the local credential information and the identification data After the voucher information, a status guide is sent back through the proxy server, and the voucher management software is guided according to the status guide; and a voucher import module is used to detect the browsing installed on the local end. And when the change in the local voucher, after the change of the local voucher corresponding import of the browser. The system for managing the voucher as described in claim 1, wherein the system further comprises a software update module for obtaining the latest version of the gateway stored by the network module and the proxy server. Information, and when the latest version information is different from the current version information of one of the credential management software, the latest version of the credential management software is downloaded through the network module. The system for managing the voucher as described in claim 1, wherein the status guiding module is further configured to apply for the local credential when the voucher processing module cannot read the local credential. The system for managing a voucher as described in claim 1, wherein the voucher processing module provides a password for inputting the local voucher, and transmits the password through the network module and the proxy server. To the gateway, the gateway is extended to the time limit of the local certificate; a password for inputting the local certificate is provided, and the local certificate is opened; and a password for changing the local certificate is provided, and the network module is The proxy server transmits the changed password to the gateway, so that the gateway changes the password of the local credential to the changed password. A system for managing credentials, the system comprising: at least one proxy server; a gateway connected to the proxy server; and a credential management software coupled to the proxy server for transmitting through the proxy server Inputting one of the identification data to the gateway device, causing the gateway device to perform a login operation to generate a login result, and for reading the login result to successfully log in, and reading, at the local end, one of the local data corresponding to the identification data One of the voucher local voucher information, the local voucher information is transmitted to the gateway through the proxy server and the remote voucher information of the remote voucher corresponding to the local voucher information and the identification data is received After returning a status guide, and guiding the operation of the credential management software according to the status guide, detecting the browser installed on the local end, and importing the changed local credential into the corresponding local credential change The browser. A method for managing credentials, the method comprising at least the steps of: connecting a gateway and a proxy server; a credential management software providing inputting an identification data; the credential management software transmitting the identification data to the gateway through the proxy server And causing the gateway to perform a login operation; the gateway returns a login result to the credential management software; When the login result indicates successful login, the credential management software reads one of the local credential information stored in the local end, and transmits the local credential information to the gateway through the proxy server; the gateway device Reading a remote credential information of one of the remote credential corresponding to the identification data; the gateway generates a status guide according to the local credential information and the remote credential information, and transmits the status guide to the proxy server to The voucher management software; the voucher management software guides the operation according to the state; and the voucher management software detects the browser installed at the local end, and when the local voucher is changed, the changed local voucher is correspondingly The browser. The method of managing a voucher as described in claim 6 wherein the method generates the status guide according to the local credential information and the remote credential information, and further comprises the gateway according to the local The voucher information determines whether the difference between the expiration time of the local voucher and the current time is lower than a predetermined value.