JP5471150B2 - Authentication system, authentication apparatus, control method thereof, and control program - Google Patents

Description

  The present invention relates to an authentication system, an authentication device, and a control method thereof, and a control program, and more particularly to an authentication system, an authentication device, and a control method and control for authenticating an electronic certificate issued online. Regarding the program.

  Conventionally, in order to ensure a safe communication environment, various technologies for authenticating a communication partner using a public key electronic certificate have been disclosed.

  For example, Patent Document 1 (Japanese Patent Application Laid-Open No. 2004-171274) discloses a technique for distributing authentication processing among a plurality of service devices in an authentication system. In this technology, when a certain service device uses a service provided by another service device, an authentication device that establishes a connection with the certain service device searches for an authentication device that performs authentication on behalf of the other service device. Then, an access request to the other service device is transmitted to the authentication device obtained as a search result. In response to this, the authentication device obtained as the search result transmits an access request to the other service device when the certain service device has access authority to the other service device. Based on this, the other service device issues a token that defines a restriction such as an expiration date. The certain service device uses a service provided by the other service device using the token.

  Further, in Patent Document 2 (Japanese Translation of PCT International Publication No. 2009-510978), when a communication link is set between the host device and the client device, a known shared secret key or the like is used for the host device and the client device. There is disclosed a technique for causing a client device to authenticate a proxy device using a generated proxy key.

JP 2004-171274 A Special table 2009-510978 gazette

  By the way, when the certificate authority (authentication server device) has a hierarchical relationship, in order to verify an electronic certificate issued by a lower certificate authority, the upper certificate authority defined in the security policy is used. It is necessary to verify the electronic certificate in order from the certificate authority, verify the electronic certificate of the lower certificate authority, and verify the electronic certificate using the lower public key.

  With the conventional technology, if the certificate authority's hierarchical relationship or security policy is subsequently changed after issuing an electronic certificate, the electronic certificate of the communication partner can be verified until then by changing the security level. The device that had been used could not verify the digital certificate of the same communication partner.

  Specifically, for example, due to a change in the hierarchical relationship of the certificate authority or a change in the security policy, the security level of communication in the device increases, and the certification authority of the higher-ranking certificate authority that needs to be verified to verify the electronic certificate of the communication partner. If the number increases, the number of certificates that the device needs to store for verification of the digital certificate will increase, and it is assumed that the storage capacity of the device will be insufficient Because.

  As a result, the device cannot communicate with the communication partner, and when a new solution is introduced, the security level that must be met for the introduction of the solution cannot be satisfied, and the solution cannot be used. A situation was assumed.

  In the technology described in Patent Document 1, the service device (“Service Peer · 2” in Patent Document 1) is used instead of the other service device (“Service Peer · 1” in Patent Document 1). An authentication apparatus (“Authentication Peer / A” in Patent Document 1) to be authenticated determines whether or not a certain service device has an authority to access the other service device. Therefore, it does not verify the electronic certificate, and it is considered that the above situation cannot be solved.

  Further, the technique described in Patent Document 2 described above is the first that is generated in the host device in order for the client device to change its communication partner to the proxy device from the state where the connection with the host device is established. And the second proxy key generated in the client device are used to authenticate the proxy device. Therefore, it does not disclose a technique related to a device that verifies an electronic certificate in place of another device, and it is considered that the above situation cannot be avoided even if the technique described in Patent Document 2 is simply adopted. .

  In particular, when an online electronic certificate is issued, a situation where the security level is easily changed as described above is assumed, and it is considered that a countermeasure for the above situation is desired.

  The present invention has been conceived in view of such circumstances, and its purpose is to use the electronic certificate in a client device that needs to verify the electronic certificate in order to use a service provided by another device. An authentication system, an authentication device, a control method thereof, and a control program are provided that can provide the client device with the same effect as when the verification of the electronic certificate is successful when the verification of the certificate cannot be performed. That is.

An authentication system control method according to the present invention is an authentication system control method including a first client device, a second client device, and an authentication server device. A step of storing a first electronic certificate issued online by a server device; a step of acquiring a range of processing necessary for verifying the first electronic certificate; and processing of the acquired range by a first client device And a step of requesting the second client device to perform processing necessary for verifying the first electronic certificate, and the first client device requests the processing. And the step of performing the range that cannot be executed for the second client device when it is determined that the acquired range includes a range that cannot be executed by the first client device. A step in which the second client device executes a process requested by the first client device, and a result of the process requested by the first client device is transmitted to the first client device. And the step of requesting processing in a range that cannot be executed is further included in the step of requesting processing in a range that cannot be executed by the first client device. Including the transmission of the result and the transmission of information specifying whether or not the first electronic certificate can be verified by a plurality of devices. Information indicating that the verification of the first electronic certificate has failed as a result of the requested processing, the information indicating that the verification of the first electronic certificate has failed It is sent to the client device.

  In the authentication system control method according to the present invention, the authentication system includes a plurality of authentication server devices having a hierarchical structure, and the first electronic certificate is issued by any of the plurality of authentication server devices, The step of acquiring the range by the first client device includes the step of acquiring the range of the authentication server device that requires verification of the electronic certificate for verification of the first electronic certificate. The step of determining whether or not the processing of the acquired range can be executed is performed by the electronic certificate issued by a higher-order authentication server device than the electronic certificate that can be verified by the first client device. Including the step of determining whether or not the first client device includes the step of executing a process within a range that can be executed by the first client device can be verified in the electronic certificate that needs to be verified. The step of transmitting a result of executing a process within a range that can be executed by the first client device includes a step of transmitting a verification result of the electronic certificate within a range that can be verified; The step of requesting processing by the first client device is a step of requesting verification of an electronic certificate issued by a higher-order authentication server device than an electronic certificate that can be verified among electronic certificates that require verification. including.

  In addition, according to the control method of the authentication system according to the present invention, the second client device uses the first electronic certificate based on the verification result by the first client device and the verification result by the second client device. And a step of determining whether the verification of the first electronic certificate is successful, and a step of transmitting the result of the determination of whether the verification of the first electronic certificate is successful to the first client device.

  Further, in the control method of the authentication system according to the present invention, the second client device sends the determination result to the first client device by applying the electronic signature of the second client device.

  In the authentication system control method according to the present invention, the first client device applies the electronic signature of the first client device to the verification result of the electronic certificate that can be verified, and transmits the result to the second client device. .

  In the authentication system control method according to the present invention, the first electronic certificate includes a description of the hierarchy of the authentication server device required for the verification of the first electronic certificate. The client device acquires the range of the authentication server device based on the description of the first electronic certificate hierarchy.

  In the authentication system control method according to the present invention, the first client device and the second client device communicate using a common electronic certificate.

  In the authentication system control method according to the present invention, the first electronic certificate includes a description of information for specifying a device that requests processing necessary for the verification of the first electronic certificate. The client device determines a device that requests processing necessary for verification of the first electronic certificate based on the description of the information specifying the device in the first electronic certificate.

An authentication device control method according to the present invention is a method of controlling an authentication device, executed by a computer of the authentication device, the step of storing an electronic certificate issued online by an authentication server device, and an electronic certificate Acquiring a range of processing required for verification of the authentication, determining whether the authentication device can execute the processing of the acquired range, and processing required for verifying the electronic certificate for other devices And a step of receiving a result of processing executed in response to the request from the other device from the other device, and the step of requesting the processing cannot be executed by the authentication device within the acquired range. If it is determined that includes a range, look including the step of requesting the processing range that can not be performed with respect to another device, and performs processing in a range that can be performed within a range obtained scan The step of requesting processing in a range that cannot be executed includes transmission of a result of processing in the range that can be executed and transmission of information that specifies whether or not the electronic certificate can be verified by a plurality of devices. If the information for identifying the electronic certificate indicates that the electronic certificate cannot be verified by a plurality of devices, the electronic certificate is obtained as a result of processing executed in response to the request from the other device. Receives information indicating that verification failed .

An authentication system control program according to the present invention is an authentication system control program including a first client device, a second client device, and an authentication server device. acquiring and storing an electronic certificate issued online by the server device, the range of processing required for verification of the electronic certificate, whether the processing range obtained first client device can perform And the step of requesting the second client device to perform processing necessary for verification of the electronic certificate, and the step of requesting the processing by the first client device are the acquired range. Is determined to include a range that cannot be executed by the first client device, a range that cannot be executed by the second client device. Including a step of requesting management, a step of executing processing necessary for verifying the electronic certificate requested from the first client device to the second client device, and a processing requested from the first client device. Transmitting the result to the first client device, causing the first client device to further execute a process within the range that can be executed within the acquired range, and requesting a process within the range that cannot be performed. step includes the transmission of a result of the processing of a range that can be performed, and a transmission of information specifying whether the verification by a plurality of devices of the electronic certificate, information specifying whether the by a plurality of devices of an electronic certificate to to indicate that the verification is impossible is the second client apparatus, to the first client device, an electronic certificate as a result of the requested processing To transmit the information indicating that it has failed to testify.

The control program of the authentication device according to the present invention is a control program that can be executed by the computer of the authentication device, and the control program stores the electronic certificate issued online by the authentication server device in the computer; Steps for acquiring a processing range necessary for verification of an electronic certificate, steps for determining whether or not the authentication device can execute processing of the acquired range, and verifying an electronic certificate for other devices The step of requesting the necessary processing and the step of receiving the result of the processing executed in response to the request from the other device from the other device are executed, and the step of requesting the processing is authenticated by the acquired range. If it is determined that includes an execution can not range of the device, it viewed including the step of requesting the processing range that can not be performed with respect to another apparatus, the acquired The step of executing the process of the range that can be executed in the enclosure is further executed, and the step of requesting the process of the range that cannot be executed includes the transmission of the result of the process of the executable range and the verification of the electronic certificate by a plurality of devices. In response to a request from another device, the other device responds to the request when the information specifying the propriety indicates that verification by a plurality of devices is not possible. As a result of the processing executed in this manner, information indicating that the verification of the electronic certificate has failed is received .

An authentication system according to the present invention includes a first client device, a second client device, and an authentication server device, and the first client device stores an electronic certificate issued online by the authentication server device. a storage unit which, for the second client device, and a request unit for requesting the processing required for verification of the electronic certificate, the request unit, the range of processing required for verification of the electronic certificate When the first client device determines whether or not the first client device can execute the processing of the acquired range and the acquired range includes a range that cannot be executed by the first client device, the second client device The second client device requests a process in a range that cannot be executed, and the second client device executes a process necessary for verifying the electronic certificate received from the request unit, and a process executed by the verification unit Look including a transmission unit which transmits the result to the first client device, the first client device, further comprising an execution unit for executing the processing in the range that can be performed within the range obtained, the scope of which can not be performed The processing request includes transmission of processing results within a range that can be executed and transmission of information specifying whether or not the electronic certificate can be verified by a plurality of devices. When it is indicated that verification by a plurality of devices of the electronic certificate is impossible, information indicating that the verification of the electronic certificate has failed is transmitted to the first client device as a result of the requested processing .

An authentication device according to the present invention is an authentication device connected to another device and an authentication server device via a network, and a storage unit for storing an electronic certificate issued online by the authentication server device, and another device A request unit for requesting processing necessary for verification of the electronic certificate, and a receiving unit for receiving the result of processing executed in response to the request in the other device from the other device. Obtains a processing range necessary for verification of the electronic certificate, determines whether the authentication device can execute the processing of the acquired range, and determines that the acquired range includes a range that cannot be executed by the authentication device. In such a case, the apparatus further includes an execution unit for requesting processing in a range that cannot be executed to another device, and executing processing in a range that can be executed in the acquired range. Execution Including transmission of results of processing within a possible range and transmission of information specifying whether or not the electronic certificate can be verified by a plurality of devices. In the case of indicating that the certificate cannot be verified, information indicating that the verification of the electronic certificate has failed is received from another device as a result of the processing executed in response to the request in the other device .

  The client device (first client device or authentication device) is a case where the (first) electronic certificate cannot be verified due to a lack of storage or processing capacity due to a change in the security level of communication in the authentication system. Even if it exists, it is possible to request verification of the (first) electronic certificate from another client device and obtain the verification result.

  As a result, a user who uses the client device can use communication and solutions obtained by performing verification of an electronic certificate that requires higher verification capability than the verification capability of the electronic certificate of the client device itself. Is possible. As a result, the client device can obtain the effect of the verification of the electronic certificate without requiring the change of the verification capability of the electronic certificate even when the security level is changed in the authentication system.

It is a figure which shows typically the structure of 1st Embodiment of the authentication system of this invention. It is a figure which shows typically the structure of the network contained in the authentication system of FIG. It is a figure which shows typically the hardware constitutions of the client apparatus of FIG. It is a figure which shows typically the hardware constitutions of the authentication server apparatus of FIG. It is a figure which shows typically the functional block of the client apparatus of FIG. It is a figure which shows typically the functional block of the authentication server apparatus of FIG. It is a figure which shows typically the structure of the electronic certificate utilized in the authentication system of FIG. It is a figure which shows typically the structure of 2nd Embodiment of the authentication system of this invention.

  Hereinafter, an embodiment of an authentication system according to the present invention will be described with reference to the drawings. In the drawings, the same components are denoted by the same reference numerals, and detailed description of common features will not be repeated.

[First Embodiment]
FIG. 1 is a diagram schematically illustrating the configuration of the first embodiment of the authentication system.

  The authentication system of the present embodiment includes a plurality of authentication server devices 7A to 7C having a hierarchical structure and a plurality of client devices 2A to 2C.

  In the following description, the authentication server device is appropriately referred to as CA (Certificate Authority), and the client device is appropriately referred to as MFP (Multi Function Peripheral) or PC (Personal Computer). Specifically, the client device 2A is appropriately referred to as MFP (1), the client device 2B is referred to as MFP (2), and the client device 2C is referred to as PC (1).

  In this authentication system, the authentication server devices 7A to 7C have a hierarchical structure. The authentication server device 7B is a higher-order authentication server device than the authentication server device 7A. The authentication server device 7C is a higher-order authentication server device of the authentication server device 7B, and is the highest-order authentication server device (root CA) of the authentication system of the present embodiment. Hereinafter, the authentication server device 7A is appropriately referred to as “CA (2)”, the authentication server device 7B is referred to as “CA (1)”, and the authentication server device 7C is referred to as “root CA”.

  In the present embodiment, the client apparatuses 2A to 2C are issued electronic certificates online from the authentication server apparatus 7A.

  In FIG. 1, “MFP (1) certificate” is an electronic certificate of MFP (1) issued by the authentication server device 7A. The “MFP (2) certificate” is an electronic certificate of the client device 2B issued by the authentication server device 7A. The “PC (1) certificate” is an electronic certificate of the client device 2C issued by the authentication server device 7A.

  The “CA (2) certificate” is an electronic certificate of the authentication server device 7A and includes the public key of the authentication server device 7A and the electronic signature of the authentication server device 7B.

  The “CA (1) certificate” is an electronic certificate of the authentication server device 7B, and includes the public key of the authentication server device 7B and the electronic signature of the authentication server device 7C.

  The “Root certificate” is an electronic certificate of the authentication server device 7C and includes a public key of the authentication server device 7C and an electronic signature of the authentication server device 7C. In the present embodiment, the “Root certificate” is a root certificate.

  The client apparatus 2A stores “MFP (1) certificate” and “CA (2) certificate”. When the client apparatus 2A receives the “MFP (2) certificate” from the client apparatus 2B, the client apparatus 2A uses the public key of the authentication server apparatus 7B (CA (1)) included in the “CA (2) certificate”. Attempts to verify the digital certificate.

(Network configuration)
FIG. 2 is a diagram schematically illustrating a configuration of a network including client devices 2A to 2C (hereinafter, referred to as “network 6” as appropriate).

  The network includes a plurality of client devices 2 (the client devices 2A to 2C are collectively referred to as “client devices 2” as appropriate). Each client device 2 includes a monitor 21 and is connected to a hub 4 through a network cable 3. A terminal or an authentication server device (such as an authentication server device 7 </ b> A) connected to another network (not shown) via the hub 4 and the router 5. ).

(Hardware configuration of client device)
FIG. 3 is a diagram schematically illustrating a hardware configuration of the PC (1) configuring the client device 2.

  Referring to FIG. 3, the client device 2 includes a CPU (Central Processing Unit) 250 that controls the operation of the client device 2 as a whole, a RAM (Random Access Memory) 254 that functions as a work area for the CPU 250, programs and data. ROM (Read Only Memory) 256 for storing information, an input device 260 such as a keyboard for inputting information to the client device 2, another client device 2, an authentication server device, and a communication device for communicating with the monitor 21 262, a hard disk device (HDD) 264 having a hard disk for storing programs and files, and a media drive 252 that accesses a recording medium 252A such as a CD-ROM (Compact Disk Read Only Memory) that can be attached to and detached from the client device 2. It has. In other words, the client device 2 accepts input of information input to the input device 260, communicates with other terminals and networks via the communication device 262, and transmits information processed in the client device 2 to the monitor 21. Display.

  The client device 2 performs the calculation and processing of data by reading and executing the program stored in the HDD 264 or the recording medium 252A, thereby issuing a request for issuing an electronic certificate, verifying the electronic certificate, and others. It functions as a client device that transmits information for requesting verification of an electronic certificate to the device.

(Hardware configuration of authentication server device)
FIG. 4 is a diagram schematically illustrating a hardware configuration of a computer constituting the authentication server device 7.

  Referring to FIG. 4, the authentication server device 7 includes a CPU 750 that controls the operation of the authentication server device 7 as a whole, a RAM 754 that functions as a work area for the CPU 750, a ROM 756 that stores programs and data, and the authentication server device 7. An input device 760 such as a keyboard for inputting information to the communication device, a communication device 762 for communicating with other terminals (devices) such as the client device 2 and the authentication server device 7, and a hard disk for storing programs and files. A HDD 764 and a recording medium 752A such as a CD-ROM that can be attached to and detached from the main body of the authentication server device 7 and a media drive 752 for accessing the recording medium 752 are provided. That is, the authentication server device 7 accepts input of information input to the input device 760 and communicates with other terminals and networks via the communication device 762.

  The authentication server device 7 performs various types of information processing described in the present embodiment by calculating and processing data by reading and executing the program stored in the HDD 764 or the recording medium 752A. Functions as a server device.

(Functional configuration of client device)
FIG. 5 schematically shows functional blocks of the client device 2.

  Referring to FIG. 5, data transmitted to client device 2 via hub 4 (see FIG. 2) is received by data receiving unit 202.

  The data receiving unit 202 determines whether or not the received data (packet) is data destined for the own device. If the data receiving unit 202 determines that the data is addressed to the own device, the data receiving unit 202 sends the data to the data analyzing unit 203.

  The data analysis unit 203 extracts data from the received packet, and if the processing instruction is included in the extracted data, the data analysis unit 203 is one of the certificate processing unit 204, the continuation verification unit 205, and the other processing unit 207. To process.

  The certificate processing unit 204 requests the authentication server device 7A to issue an electronic certificate, verifies the electronic certificate transmitted from the communication partner, and checks the security policy necessary for the verification.

  The security policy is used to specify the CA hierarchy required for verifying the transmitted electronic certificate, that is, which authentication server device of the authentication server devices 7A to 7C needs to be verified. Contains information (hierarchical information).

  When verifying the transmitted electronic certificate, the certificate processing unit 204 checks the security policy to obtain hierarchical information regarding the verification of the electronic certificate, and all the information specified by the hierarchical information It is determined whether or not the electronic certificate of the authentication server device can be verified by itself.

  If it is determined that all are possible, the certificate processing unit 204 verifies the electronic certificate and transmits the verification result to the transmission source of the electronic certificate. On the other hand, if the certificate processing unit 204 determines that the electronic certificate of all the authentication server devices specified by the hierarchy information cannot be verified by itself, the certificate processing unit 204 causes another device to request continuous verification. .

  The continuation verification unit 205 searches for another device for which continuation verification is requested based on the transmitted description in the electronic certificate. Then, information for requesting continuous verification of the electronic certificate is transmitted to “another device” obtained as a search result.

  The continuous verification is the remaining CA digital certificates when the client apparatus 2 verifies some of the CA digital certificates in all the CAs required for verification of the received digital certificate. It means to execute the verification.

  On the other hand, when the client apparatus 2 receives information requesting continuous verification from another device, the client apparatus 2 executes verification of the electronic certificate according to the information, and returns the verification result to the transmission source of the request information.

  The data holding unit 206 stores various information including an electronic certificate and security policy data. The hierarchical information described above may be stored in the data holding unit 206 as a part of the security policy data, may be included in the electronic certificate, or data separately from the electronic certificate and the security policy data. It may be stored in the holding unit 206.

  Further, the hierarchy information may be included in the security policy of the application that is the purpose of verifying the electronic certificate in the client device 2. In this case, when the client device 2 requires authentication of the other client device 2 for execution of the application, and verification of the electronic certificate of the other client device 2 is required for the authentication, the client device 2 Hierarchical information is acquired from the security policy of the application, and based on the acquired hierarchical information, it is recognized which electronic certificate up to which CA should be verified.

  In the client apparatus 2, processing other than the verification of the electronic certificate and the request for verifying the electronic certificate to another device is performed by the other processing unit 207.

The data transmission unit 212 is for transmitting information to other devices.
Data to be transmitted to another device is formed into a network packet by the data creation unit 211 and transmitted to the transmission destination determined as described above by the data transmission unit 212.

(Functional configuration of authentication server device)
FIG. 6 schematically illustrates functional blocks of the authentication server device 7 (hereinafter, the authentication server devices 7A to 7C are collectively referred to as “authentication server device 7” as appropriate).

  Referring to FIG. 6, data receiving section 702 determines whether or not a packet flowing on network 6 is a packet destined for the own apparatus. Part 703.

  The data analysis unit 703 extracts data from the received packet, and if the extracted data includes a processing instruction, any of the certificate issuing unit 704, the certificate management unit 705, and the other processing unit 707 is included. Let's process.

  The certificate issuing unit 704 issues an electronic certificate online to the client device 2. The issuance of the electronic certificate is performed, for example, in response to the authentication server device 7 receiving information requesting the issuance of the electronic certificate from the client device 2.

  A certificate management unit 705 manages electronic certificate revocation and CRL (Certificate Revocation List). The management of the CRL includes a process of updating the CRL to the latest one at regular intervals.

  In the authentication server device 7, processes other than the above-described issuance of electronic certificates and management of electronic certificates are performed by the other processing unit 707.

The data transmission unit 712 is for transmitting information.
Data to be transmitted to another device is formed into a network packet by the data creation unit 711 and transmitted to an appropriately set transmission source by the data transmission unit 712.

The data holding unit 706 stores data including issuance records of electronic certificates and CRLs.
(Verification of electronic certificate on client device)
Hereinafter, verification of the electronic certificate of the client apparatus 2A for authentication of the client apparatus 2A in the client apparatus 2B will be described.

  If the hierarchical information about the verification of the electronic certificate of the client apparatus 2A requires the verification of the electronic certificate of CA (2) (authentication server apparatus 7A), the client apparatus 2B is stored in its own device. The CA (2) (authentication server device 7A) public key is used to verify the electronic signature of CA (2) included in the electronic certificate of the client device 2A. If the verification is successful, the client device 2B assumes that the authentication of the client device 2A is successful, and the subsequent processing is executed.

  On the other hand, if it is necessary to verify the root certificate, which is the electronic certificate of the root CA (authentication server device 7C), in the hierarchical information for verifying the electronic certificate of the client device 2A, the client device 2B The electronic certificate of the client device 2A cannot be verified. In the client device 2B, the electronic certificate and root certificate of CA (1) are not stored (the public key of CA (1) and the public key of root CA are not stored), and CA (1) and This is because the electronic signature of the root CA cannot be verified.

  Hereinafter, in this specification, the client device 2B requires authentication of the client device 2A, and it is necessary to verify the root certificate in the hierarchical information for verifying the electronic certificate of the client device 2A. In this case, the processing executed in the client devices 2A to 2C will be described mainly with reference to FIG.

<Procedure [1. ]>
First, at the start of communication between the client device 2A and the client device 2B, each other's electronic certificate is transmitted to the communication partner by a shake hand. Thereby, the client apparatus 2B receives the electronic certificate (MFP (1) certificate) of the client apparatus 2A.

<Procedure [2. ]>
Next, the certificate processing unit 204 of the client device 2B uses the electronic signature of the CA (2) included in the MFP (1) certificate and the public key of the CA (2) included in the CA (2) certificate. And verify.

<Procedure [3. ]>
Next, the certificate processing unit 204 of the client apparatus 2B checks the security policy regarding the verification of the MFP (1) certificate. As described above, in the security policy, the verification of the certificate involves the procedure [2. In addition to the verification of the MFP (1) certificate executed in the above, verification of the CA (2) certificate, CA (1) certificate, and root certificate is required. When the certificate processing unit 204 recognizes this through the check, the certificate processing unit 204 determines a device for which continuous verification is requested. The continuous verification in this case is verification of a certificate necessary for verification of the MFP (1) certificate, and verification of a certificate other than verification of the MFP (1) certificate that can be performed by the client apparatus 2B. That is, verification of CA (2) certificate, CA (1) certificate, and root certificate.

  For example, as shown in FIG. 7, the information specifying the device that is requested to continue verification may be included in the MFP (1) certificate.

  Referring to FIG. 7, MFP (1) certificate 900 generally includes proxy information 901 and option information 902 in addition to information included in the certificate. The proxy information 901 includes information for specifying a device that can perform verification that satisfies the security level necessary for verification of the certificate. If the device required to verify the certificate cannot perform the verification required for the certificate verification, refer to the proxy information 901 and perform continuous verification for the certificate verification. Determine the device to request.

  The option information 902 includes information specific to a certificate issuer that is not described in a general certificate. The device that verifies the certificate can realize higher security than usual by referring to the option information 902 at the time of verification. The option information 902 includes, for example, a digital signature unique to the issuer, a serial code unique to the company to which the issuer belongs, and the type, model, and device of the device that has issued the certificate when the certificate is a device certificate. The version and year of manufacture are listed.

  The certificate processing unit 204 can identify a certificate that is necessary for verifying the MFP (1) certificate and cannot be verified by the MFP (2) by checking the hierarchical information (security policy). . Therefore, the certificate processing unit 204 can search the network 6 for a device that can verify a certificate that cannot be verified by itself. Based on the search result, the certificate processing unit 204 may specify the device that is the request destination for continuous verification.

  Further, in this embodiment, since it is determined that the certificate is valid, the content of the option information 902 may be required to be appropriate. That is, the check of the contents of the option information 902 may be included in the certificate verification. The range of information in the option information 902 that needs to be referred to when verifying the certificate may be described in the hierarchical information. The certificate processing unit 204 obtains a range necessary for verification by referring to the description in the hierarchical information, and the certificate is transferred to the MFP (2) depending on whether or not the information in the obtained range can be checked. ) Can specify whether the certificate cannot be verified.

  Then, the certificate processing unit 204 transmits a command for causing the continuation verification unit 205 to request the device identified as described above for continuation verification.

Here, it is assumed that the device specified as described above is the client apparatus 2C.
The information for requesting continuous verification includes, for example, information specifying the MFP (1) certificate and the extent to which verification of the upper layer CA certificate is necessary for verification of the MFP (1) certificate.

  It should be noted that the information that specifies how much higher-level CA certificate verification is necessary is acquired by performing the same processing as the above-described hierarchical information check in the device that has received a request for continuous verification. May be.

  At least in the present embodiment, the MFP (2) specifies the range of authentication servers that are required to verify the certificate for verifying the MFP (1) certificate by checking the hierarchy information. If the range includes an authentication server whose certificate cannot be verified by the MFP (2), it requests another device to continue verification.

  Here, the range for determining whether or not the request for continuous verification is necessary is not limited to the hierarchy of the authentication server. Whether the range of information that needs to be checked for verification of the MFP (1) certificate among the information included in the option information 902 includes information that cannot be checked by the MFP (2). If it is determined and included, another device may be requested to continue verification. That is, the range may be a check item in the option information 902.

  In the determination of the device by the certificate processing unit 204, a device connected to the network 6 (for example, a LAN (Local Area Network) to which the client apparatus 2B is connected) at that time may be preferentially selected. In addition, when the certificate processing unit 204 transmits request information for continuous verification to a device connected to the network 6, a device having the earliest response to the request information may be selected. Means that the device that received the request information determines whether the certificate required for continuous verification can be verified by itself, and if so, returns that fact to the sender of continuous verification To do.

  When the client apparatus 2B cannot connect to the device specified by the hierarchy information or when the above-described device cannot be determined, the certificate processing unit 204 determines that the authentication of the client apparatus 2A has failed (error state), and To the client device 2A.

<Procedure [4. ]>
Next, the continuation verification unit 205 of the client apparatus 2B sends the procedure [2. ] And information for requesting continuous verification are transmitted.

  The client device 2B communicates with the client device 2C by a security method different from the security method connected to the client device 2A. Other security methods include, for example, encrypted communication using an electronic certificate (common key) shared by these client devices, SSL (Secure Socket Layer) communication using a completely different certificate, There is VPN (Virtual Private Network) communication. Further, the client apparatus 2B performs polling at regular intervals after transmitting the information to the client apparatus 2C.

  Here, the continuation verification unit 205 may apply the electronic signature of the client device 2B to the verification result transmitted to the client device 2C.

<Procedure [5. ]>
In the client apparatus 2C, the procedure [4. ] Is sent to the continuation verification unit 205 of the client apparatus 2C received from the client apparatus 2B.

  Note that the authentication system performs the procedure [4. ], The client device 2C uses the public key of the client device 2B to send the digital signature of the client device 2B to the verification result. The verification information may be sent to the continuous verification unit 205 on the condition that the verification is performed and the verification of the electronic signature is successful.

<Procedure [6. ]>
The continuation verification unit 205 of the client device 2C that has received the request for continuation verification performs continuation verification. Specifically, CA (2) certificate, CA (1) certificate, and root certificate are verified.

<Procedure [7. ]>
The continuation verification unit 205 of the client device 2C performs the procedure [6. ] Is transmitted to the client apparatus 2B.

  Here, the continuation verification unit 205 may apply the electronic signature of the client device 2C to the verification result transmitted to the client device 2B.

<Procedure [8. ]>
When the client apparatus 2B receives the verification result from the client apparatus 2C, the certificate processing unit 204 performs the procedure [2. ], The client apparatus 2A is successfully authenticated, that is, whether the electronic signatures of CA (2), CA (2) and root CA have been successfully verified.

  Note that the authentication system performs the procedure [7. ], The client apparatus 2B uses the public key of the client apparatus 2C to transmit the electronic signature of the client apparatus 2C. Verification is performed, and the verification result may be sent from the client device 2C to the certificate processing unit 204 on the condition that the verification of the electronic signature is successful.

<Procedure [9. ]>
The certificate processing unit 204 of the client apparatus 2B performs the procedure [8. ], That is, information indicating whether or not the client apparatus 2B can communicate with the client apparatus 2A is transmitted to the client apparatus 2A.

(Summary)
In the present embodiment described above, when the MFP (1) certificate (first electronic certificate) issued online by the CA (1) (authentication server device) is received from the MFP (1), the MFP (2) The (first client device, authentication device) requests the PC (1) (second client device) to perform a part of processing necessary for verification of the electronic certificate. The PC (1) executes the requested processing and transmits the result to the MFP (2).

  In this embodiment, the MFP (2) requests the PC (1) to perform processing only for processing that is necessary for verification of the MFP (1) certificate and cannot be performed by itself as continuous verification. The MFP (2), even if the processing that cannot be performed by itself is a part of the processing required for verifying the MFP (1) certificate, all processing required for verifying the certificate (CA (2) Electronic signature verification, CA (1) electronic signature verification, and root CA electronic signature verification) may be requested from the PC (1).

  The above procedure [7. ], The continuation verification unit 205 of the client device 2C performs the procedure [6. ] Is transmitted to the client apparatus 2B. The continuation verification unit 205 determines whether or not the client apparatus 2A can be authenticated based on the information transmitted from the client apparatus 2B, and the result is sent to the client apparatus 2B. You may send to. Specifically, in the present embodiment, part of the processing necessary for verifying the MFP (1) certificate is a procedure [2. ] On the client apparatus 2B, and the remaining processing is performed in the procedure [6. ] On the client device 2C. That is, the client apparatus 2C can obtain verification results of all certificates necessary for verification of the MFP (1) certificate. Accordingly, the continuation verification unit 205 determines the final success / failure of the verification of the MFP (1) certificate based on the verification results of all the certificates necessary for the verification of the MFP (1) certificate, and the MFP based on the success / failure. It may be determined whether or not the authentication of (1) is possible, and the result of the determination may be transmitted to the client device 2B. Thereby, the client apparatus 2B can further reduce the processing content required when authenticating the client apparatus 2A.

[Second Embodiment]
FIG. 8 is a diagram schematically illustrating the configuration of the second embodiment of the authentication system.

  Referring to FIG. 8, the authentication system includes four authentication server devices, authentication server devices 7A to 7D. In this authentication system, CA (2) (authentication server device 7A), CA (1) (authentication server device 7B), CA (0) (authentication server device 7D), and root CA (authentication server device 7C) are arranged in this order. Root CA (authentication server device 7C) functions as the highest certificate authority. That is, the hierarchy of certificate authorities is increased by one step compared to the authentication system of the first embodiment.

  In the present embodiment, verification of the certificate of CA (2), CA (1), CA (0) and root CA (electronic signature) is required for verification of the MFP (1) certificate. .

  Upon receiving the MFP (1) certificate (procedure [1.]), the MFP (2) verifies the CA (2) certificate to verify the MFP (1) certificate (procedure [2.]). Information and procedure for requesting PC (1) for requesting continuous verification [2. ] Is transmitted (procedure [3.] [4.]).

  In response to this, the PC (1) verifies the certificates (electronic signatures) of the CA (1), CA (0) and the root CA (procedure [5.] [6.]), and the result is the MFP ( 2) (procedure [7.]).

  The MFP (2) verifies the MFP (1) certificate based on the verification result of the MFP (2) and the verification result received from the PC (1) (procedure [8.]).

  Then, the procedure [8. ], That is, information indicating whether or not the client apparatus 2B can communicate with the client apparatus 2A is transmitted to the client apparatus 2A (procedure [9.]).

  In this embodiment, even if there are four levels of certificate authorities in the authentication system, as in the first embodiment, the MFP (2) and the PC (1) share the MFP (1) certificate. Certificate can be verified.

[Third Embodiment]
In the first and second embodiments, when the PC (1) cannot verify the root CA certificate (electronic signature), the PC (1) requests another device to verify the root CA certificate. May be. That is, the continuous verification may be executed in a plurality of devices.

  Hereinafter, the verification mode of the MFP (1) certificate in the present embodiment will be described in more detail. In the first and second embodiments, when verifying the MFP (1) certificate, the MFP (2) performs a process (CA ( 2) Although continuous verification was requested to a device that can perform all of (certificate verification other than certificate verification), continuous verification was requested from a device that can execute at least a part of processing that cannot be performed by the device itself. Also good.

  In such a situation, the device requested to continue the verification is a process necessary for verifying the MFP (1) certificate, and after executing a part of the process that the MFP (2) cannot execute, The device is requested to perform the remaining processing necessary for verifying the MFP (1) certificate.

  Specifically, for example, in the first embodiment, verification of the MFP (1) certificate requires verification of the CA (2) certificate, verification of the CA (1) certificate, and verification of the root certificate. It is said. The MFP (2) verifies the CA (2) certificate and requests the PC (1) that can verify at least the CA (1) certificate to verify other certificates. The PC (1) verifies the CA (1) certificate and requests another device to perform the remaining processing (verification of the root certificate).

Further, the verification result of the root certificate is transmitted from another device to the PC (1).
The PC (1) transmits the received verification result of the root certificate and the verification result of the CA (1) certificate in itself to the MFP (2).

  Based on the root certificate verification result and the CA (1) certificate verification result received from the PC (1) and the CA (2) certificate verification result in the MFP (1), the MFP (2) ) Validate the certificate. Then, based on the verification result of the MFP (1) certificate, whether to communicate with the MFP (1) is determined, and the determination result is transmitted to the MFP (1).

  Note that the security policy (or hierarchy information) related to MFP (1) certificate verification may include information specifying whether or not continuous verification by a plurality of devices is possible, as realized in the present embodiment. . If continuous verification is not possible in the information, the MFP (2), as a request destination for continuous verification, is a verification other than the verification that can be executed by itself in the process for verifying the MFP (1) certificate. If a device that can execute all of the above processes cannot be obtained, the verification of the MFP (1) certificate has failed (an error has occurred), and a message to that effect is returned to the MFP (1).

  The embodiment disclosed this time should be considered as illustrative in all points and not restrictive. The scope of the present invention is defined by the terms of the claims, rather than the description above, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims.

  2, 2A to 2C client device, 3 network cable, 4 hub, 5 router, 7, 7A to 7D authentication server device, 250, 750 CPU, 252, 752 media drive, 252A, 752A storage medium, 202, 702 data receiving unit 203,703 Data analysis unit, 204 Certificate processing unit, 205 Continuation verification unit, 206 Data holding unit, 207 Other processing unit, 211,711 Data creation unit, 212,712 Data transmission unit, 704 Certificate issuance unit, 705 Certificate management unit, 706 data holding unit, 707 other processing unit, 900 certificate, 901 proxy information, 902 option information.

Claims (13)

An authentication system control method comprising a first client device, a second client device, and an authentication server device,
The first client device is
Storing a first electronic certificate issued online by the authentication server device;
Obtaining a range of processing necessary for verification of the first electronic certificate;
Determining whether the first client device can execute the processing of the acquired range;
Requesting the second client device to perform processing necessary for verifying the first electronic certificate,
The step of requesting the processing by the first client device cannot be executed with respect to the second client device when it is determined that the acquired range includes a range that cannot be executed by the first client device. Including the step of requesting processing of the range,
The second client device is
Executing a process requested by the first client device;
Transmitting the result of the processing requested from the first client device to the first client device,
The first client device further includes a step of executing a process in an executable range in the acquired range,
The step of requesting the processing in the unexecutable range includes transmission of a result of the processing in the executable range, and transmission of information specifying whether or not the first electronic certificate can be verified by a plurality of devices,
If the information specifying the availability indicates that the first electronic certificate cannot be verified by a plurality of devices, the second client device, as a result of the requested processing, A method for controlling an authentication system, wherein information indicating that the verification of one electronic certificate has failed is transmitted to the first client device. The authentication system includes a plurality of authentication server devices having a hierarchical structure,
The first electronic certificate is issued by any of the plurality of authentication server devices,
The step of the first client device acquiring the range includes acquiring a range of an authentication server device that requires verification of an electronic certificate for verification of the first electronic certificate;
The step of determining whether or not the first client device can execute the processing of the acquired range is such that the electronic certificate that needs to be verified is higher than the electronic certificate that can be verified by the first client device. Determining whether to include an electronic certificate issued by the authentication server device,
The step of executing the process of the executable range by the first client device includes the step of verifying the electronic certificate of the verifiable range in the electronic certificate that needs to be verified,
The step of transmitting the execution result of the process within the executable range by the first client device includes the step of transmitting the verification result of the electronic certificate within the verifiable range,
The step of requesting the processing by the first client device includes verifying an electronic certificate issued by an authentication server device higher than the electronic certificate that can be verified among the electronic certificates that require verification. The method for controlling an authentication system according to claim 1, further comprising the step of requesting: The second client device is
Determining whether the verification of the first electronic certificate is successful based on a verification result by the first client device and a verification result by the second client device;
The method for controlling the authentication system according to claim 2, further comprising a step of transmitting to the first client device a result of determination as to whether or not the verification of the first electronic certificate is successful.   The control method of the authentication system according to claim 3, wherein the second client device applies the electronic signature of the second client device and transmits the result of the determination to the first client device.   5. The authentication system according to claim 4, wherein the first client device adds an electronic signature of the first client device to a verification result of the electronic certificate that can be verified, and transmits the electronic signature to the second client device. Control method. The first electronic certificate includes a description of a hierarchy of authentication server devices required for verification of the first electronic certificate,
6. The authentication system control method according to claim 5, wherein the first client device acquires a range of the authentication server device based on a description of the hierarchy of the first electronic certificate.   The method for controlling an authentication system according to claim 1, wherein the first client device and the second client device communicate using a common electronic certificate. The first electronic certificate includes a description of information for specifying a device that requests processing necessary for verification of the first electronic certificate,
The first client device determines a device that requests processing necessary for verification of the first electronic certificate based on a description of information specifying the device in the first electronic certificate. The method for controlling an authentication system according to any one of claims 1 to 7. A method for controlling the authentication apparatus, executed by a computer of the authentication apparatus,
Storing an electronic certificate issued online by an authentication server device;
Obtaining a range of processing necessary for verification of the electronic certificate;
Determining whether the authentication device can execute the processing of the acquired range;
Requesting other devices to perform processing necessary for verification of the electronic certificate;
Receiving, from the other device, a result of processing executed in response to the request in the other device;
The step of requesting the process includes a step of requesting the other apparatus to perform a process in the non-executable range when it is determined that the acquired range includes an inexecutable range of the authentication apparatus,
A step of executing a process in a range that can be executed in the acquired range;
The step of requesting the processing of the inexecutable range includes transmission of a result of the processing of the executable range, and transmission of information specifying whether or not the electronic certificate can be verified by a plurality of devices,
When the information specifying the availability indicates that the electronic certificate cannot be verified by a plurality of devices, the result of processing executed in response to the request in the other device from the other device A method for controlling the authentication apparatus, wherein information indicating that the verification of the electronic certificate has failed is received. An authentication system control program comprising a first client device, a second client device, and an authentication server device,
In the first client device,
Storing an electronic certificate issued online by the authentication server device;
Obtaining a range of processing necessary for verification of the electronic certificate;
Determining whether the first client device can execute the processing of the acquired range;
Requesting the second client device to perform processing necessary for the verification of the electronic certificate,
The step of requesting the processing by the first client device cannot be executed with respect to the second client device when it is determined that the acquired range includes a range that cannot be executed by the first client device. Including the step of requesting processing of the range,
In the second client device,
Executing a process necessary for verifying the electronic certificate requested by the first client device;
Transmitting the result of the processing requested from the first client device to the first client device;
Causing the first client device to further execute a process of an executable range in the acquired range;
The step of requesting the processing of the inexecutable range includes transmission of a result of the processing of the executable range, and transmission of information specifying whether or not the electronic certificate can be verified by a plurality of devices,
If the information specifying the availability indicates that the electronic certificate cannot be verified by a plurality of devices, the second client device sends the requested processing to the first client device. As a result, an authentication system control program for transmitting information indicating that the verification of the electronic certificate has failed. A control program executable by the computer of the authentication device,
The control program is stored in the computer.
Storing an electronic certificate issued online by an authentication server device;
Obtaining a range of processing necessary for verification of the electronic certificate;
Determining whether the authentication device can execute the processing of the acquired range;
Requesting other devices to perform processing necessary for verification of the electronic certificate;
Receiving, from the other device, a result of processing executed in response to the request in the other device;
The step of requesting the process includes a step of requesting the other apparatus to perform a process in the non-executable range when it is determined that the acquired range includes an inexecutable range of the authentication apparatus,
A step of executing a process in a range that can be executed in the acquired range is further executed;
The step of requesting the processing of the inexecutable range includes transmission of a result of the processing of the executable range, and transmission of information specifying whether or not the electronic certificate can be verified by a plurality of devices,
When the information specifying the availability indicates that the electronic certificate cannot be verified by a plurality of devices, the result of processing executed in response to the request in the other device from the other device As a control program for an authentication apparatus for receiving information indicating that the verification of the electronic certificate has failed. A first client device, a second client device, and an authentication server device;
The first client device is:
A storage unit for storing an electronic certificate issued online by the authentication server device;
A request unit that requests the second client device to perform processing necessary for the verification of the electronic certificate,
The request section
Obtain the scope of processing required for verification of the electronic certificate,
Determining whether the first client device can execute the processing of the acquired range;
When it is determined that the acquired range includes a range that cannot be executed by the first client device, the second client device is requested to process the range that cannot be executed,
The second client device is
A verification unit that performs processing necessary for verification of the electronic certificate received from the request unit;
A transmission unit that transmits a result of the processing executed by the verification unit to the first client device,
The first client device further includes an execution unit for executing processing in a range that can be executed in the acquired range;
The request for the processing in the non-executable range includes transmission of the result of the processing in the executable range, and transmission of information for specifying whether or not the electronic certificate can be verified by a plurality of devices,
If the information specifying the availability indicates that the electronic certificate cannot be verified by a plurality of devices, the second client device, as a result of the requested processing, An authentication system that transmits information indicating that the verification has failed to the first client device. An authentication device connected to another device and an authentication server device via a network,
A storage unit for storing an electronic certificate issued online by the authentication server device;
A request unit that requests the other device to perform processing necessary for the verification of the electronic certificate;
A receiving unit that receives a result of a process executed in response to the request in the other device from the other device;
The request section
Obtain the scope of processing required for verification of the electronic certificate,
Determining whether the authentication device can execute the processing of the acquired range;
When it is determined that the acquired range includes a range that cannot be executed by the authentication device, the other device is requested to process the range that cannot be executed.
An execution unit for executing processing in a range that can be executed in the acquired range;
The request for the processing in the non-executable range includes transmission of the result of the processing in the executable range, and transmission of information for specifying whether or not the electronic certificate can be verified by a plurality of devices,
When the information specifying the availability indicates that the electronic certificate cannot be verified by a plurality of devices, the receiving unit executes the request from the other device in response to the request. An authentication device that receives information indicating that the verification of the electronic certificate has failed as a result of the processed processing.

Images