JP2008042381A - Network system and network management device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To manage the expiration time of the digital certificate of communication equipment connected to a network for which authentication is needed and to present an appropriate updating procedure corresponding to conditions at the time to a user at the time when updating is needed. <P>SOLUTION: The network management device 1 manages a quarantine network 9 to which a printer 2 or the like holding a digital certificate 21 is connected. The management device 1 includes an authentication processing part 11 for acquiring the digital certificate 21 from the printer 2 and performs authentication and a guidance processing part 15 for outputting guidance corresponding to an authenticated result. The guidance output part 15 outputs the different guidance in the case that the authentication is a success and the remaining number of days before the expiration time of the digital certificate 21 is the prescribed number of days or less and in the case that the authentication is not a success. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to the expiration date management of a digital certificate of a communication device connected to a so-called quarantine network, and more particularly to the expiration date management of a digital certificate of a communication device that does not have a built-in clock function.

2. Description of the Related Art Conventionally, when performing communication through a computer network, a digital certificate is used for authentication as to whether or not a communication partner is an individual. Usually, this digital certificate has an expiration date. Therefore, it is preferable to update the digital certificate to a new one before the expiration date arrives. Therefore, a technique is known that warns the user when the number of remaining days until the expiration date decreases (for example, Patent Documents 1 and 2).
JP 2003-273855 A JP 2005-269558 A

  By the way, in a network system referred to as a so-called quarantine network that requires authentication for communication by connecting to a network, the certificate must be valid when logging into the network. Therefore, it is preferable to renew the digital certificate before the expiration date expires. However, in a device that does not have an RTC (Real Time Clock) for knowing the current time, the expiration date of the digital certificate has expired. However, it happens that he / she is not aware and cannot log in to the quarantine network.

  As described above, in the case of the quarantine network, there are cases where the device itself can be connected to the network and when the digital certificate needs to be updated. In other words, if it is possible to connect to the network, the digital certificate can be updated via the network, but if it cannot be connected, it must be updated standalone.

  Therefore, an object of the present invention is to manage the expiration date of a digital certificate of a communication device connected to a network that requires authentication, and to perform an appropriate renewal procedure according to the situation at the time when renewal is necessary. Is to provide technology for presenting.

  A network system according to an embodiment of the present invention includes a management device that manages a network and a communication device that communicates with the network, and only a communication device authenticated by the management device can be connected to the network. The communication device includes a storage unit that has a predetermined expiration date and stores authentication information for receiving authentication by the management device. Further, the management device includes an authentication unit that acquires the authentication information from the communication device and performs authentication processing of the communication device, and a guidance unit that outputs a guidance according to an authentication result by the authentication unit. . The guidance means is different depending on whether the authentication by the authentication information is successful and the remaining number of days until the expiration date of the authentication information is equal to or less than a predetermined number of days and the authentication by the authentication information is unsuccessful. Output guidance.

  Thereby, when the expiration date of the authentication information is about to expire and when the expiration date has already expired, the update guidance for the authentication information corresponding to each can be presented to the user.

  In a preferred embodiment, the guidance when the authentication is successful and the remaining number of days until the expiration date of the authentication information is equal to or less than a predetermined number of days is guidance that teaches a procedure for updating the authentication information via the network It may be.

  In a preferred embodiment, the guidance when the authentication is unsuccessful may be guidance that teaches a procedure for updating the authentication information without going through the network.

  In a preferred embodiment, the network may be a network according to IEEE 802.1X.

  In a preferred embodiment, the network may be a network related to wireless communication.

  A network management device according to another embodiment of the present invention is a device for managing a network, and connects only an authenticated communication device to the network. Then, an authentication unit that acquires authentication information having a predetermined expiration date from the communication device, performs authentication processing of the communication device, and a guidance unit that outputs guidance according to an authentication result by the authentication unit, Prepare. The guidance means provides different guidance depending on whether authentication by the authentication information is successful and the number of remaining days until the expiration date of the authentication information is equal to or less than a predetermined number of days and when authentication by the authentication information is unsuccessful. Output.

  A management device according to still another embodiment of the present invention is a management device connected to a network to which only a communication device authenticated by an authentication server can be connected, and when the communication device is connected to the network, An acquisition unit that acquires the latest authentication information from the communication device, and a guidance unit that outputs a guidance according to the authentication information, the guidance unit, when the communication device is not connected to the network, Based on the authentication information acquired at the last connection with the communication device, it is determined whether the validity period of the authentication information has expired, and if it has expired, a first guidance corresponding to the determination is output. If the communication device is connected to the network, whether the remaining days until the expiration date of the authentication information is equal to or less than a predetermined number of days Determining, when more than a predetermined number of days outputs a second guidance corresponding to the determination, and outputs the first guidance and the second guidance in a different manner.

  Hereinafter, a network system according to an embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 is a configuration diagram of a network system according to the present embodiment.

  The system includes a network management apparatus (hereinafter simply referred to as a management apparatus) 1 serving as an authentication server, a printer 2 serving as a supplicant via a hub and an access point (not illustrated), and a scanner 3, and functions of the printer and the scanner. A device that performs communication via a network, such as a digital multifunction peripheral (hereinafter simply referred to as a multifunction peripheral) 4, is connected via a network 9. The network 9 is connected to an authentication information issuing server 6 having a CA station that issues a digital certificate for authentication.

  The network system according to the present embodiment is a network system called a so-called quarantine network that requires authentication in order to connect to the network 9 and perform communication. That is, a supplicant (a communication device such as the printer 2, the scanner 3, and the multifunction device 4) can log in to the network 9 and perform communication only when authenticated by the management device 1 via the authentication device. It becomes like this. Note that the network 9 may be either a wired network or a wireless communication network.

  The authentication apparatus will be described in detail. It can be said that the apparatus performs “relay of authentication between the authentication server and the supplicant” and “access control from the supplicant to the network”. In other words, whether the network access from the supplicant is possible or not is determined by the management device based on the result of the authentication procedure between the management device and the supplicant. The control of the actual network access from the supplicant after the authentication procedure is controlled by the authentication device. Is going.

  The printer 2, the scanner 3, and the multifunction device 4 each hold in advance digital certificates 21, 31, 41 as authentication information necessary for receiving authentication by the management apparatus 1. Each digital certificate 21, 31, 41 needs to be installed in advance by some method such as connecting directly to the authentication information issuing server 6.

  Each digital certificate 21, 31, 41 has an expiration date. When the expiration date has passed, the digital certificate becomes invalid, and it is not possible to log in to the network 9 with the invalid digital certificate. Therefore, each digital certificate 21, 31, 41 needs to be updated within the expiration date. In the present embodiment, the printer 2, the scanner 3, and the multifunction device 4 do not have an RTC (Real Time Clock) for knowing the current time, and therefore cannot manage the expiration date of their digital certificate. Therefore, as will be described later, the management apparatus 1 manages the expiration dates of the digital certificates of these communication apparatuses.

  The management apparatus 1 is configured by, for example, a general-purpose computer system, and each component or function in the management apparatus 1 described below is realized by executing a computer program, for example.

  The management device 1 includes an authentication processing unit 11 that authenticates a communication device connected to the network 9, a certificate management information storage unit 13 that stores digital certificate management information, and a guidance that outputs guidance on digital certificate update. A processing unit 15 and an RTC 17 indicating the current time are provided.

  The authentication processing unit 11 authenticates communication devices such as the printer 2, the scanner 3, and the multifunction device 4. Hereinafter, the printer 2 will be described as an example of a representative communication device. For example, the authentication processing unit 11 acquires the digital certificate 21 from the printer 2 and authenticates the printer 2. The authentication processing unit 11 confirms the contents of the digital certificate 21, acquires the current date and time from the RTC 17, and confirms whether the expiration date of the digital certificate 21 has elapsed. If the authentication is successful, the authentication processing unit 11 permits the printer 2 to access the network. On the other hand, if the authentication is not successful, the printer 2 refuses to access the network.

  When the printer 2 is newly physically connected to the network 9 or when the printer 2 is turned on, the authentication processing unit 11 acquires a digital certificate 21 from the printer 2 together with a login request. Then, the above authentication is performed. In addition to that, the authentication processing unit 11 may perform the authentication process at any regular or irregular timing.

  The authentication processing unit 11 stores the management information of the authenticated digital certificate 21 in the certificate management information storage unit 13. If the management information of the digital certificate 21 is already stored, it is overwritten.

  The certificate management information storage unit 13 is connected to the network 9 and stores management information related to the digital certificate held by the authenticated communication device. For example, an example of management information stored in the certificate management information storage unit 13 is shown in FIG.

  As illustrated in FIG. 2, the management information of the digital certificate stores a device ID 131 that is identification information of the communication device and a digital certificate expiration date 132.

  The guidance processing unit 15 outputs guidance according to the processing result of the authentication processing in the authentication processing unit 11. For example, when authentication of the printer 2 is unsuccessful in the authentication processing unit 11, the guidance processing unit 15 notifies the user to that effect and also prompts the printer 2 to acquire a new digital certificate ( New certificate acquisition guidance) is output. In this case, since the authentication is unsuccessful, the printer 2 cannot access the network 9. Therefore, the new certificate acquisition guidance indicates a procedure for acquiring a new digital certificate without the printer 2 passing through the network 9 (for example, directly connected to the authentication information issuing server 6).

  Even if the authentication processing unit 11 succeeds in authentication, if the remaining number of days until the expiration date of the digital certificate 21 is equal to or less than the predetermined number of days, the guidance processing unit 15 informs the user to that effect. Along with the notification, a guidance (certificate renewal guidance) for prompting renewal of the digital certificate is output. In this case, since the printer 2 can access the network 9, the certificate update guidance indicates a procedure for accessing the authentication information issuing server 6 via the network 9 and updating the digital certificate.

  Any guidance may be output to a display device included in the management device 1 or may be output to a display device included in each communication device (all display devices are not illustrated).

  FIG. 3 shows a processing procedure for the printer 2 to log in to the network.

  First, the authentication processing unit 11 receives a login request from the printer 2 (S11), and performs authentication processing based on the digital certificate 21 included in the login request (S12).

  If the authentication is unsuccessful, the guidance processing unit 15 outputs a new certificate acquisition guidance (S17). At the same time, the authentication processing unit 11 does not permit the printer 2 to log in to the network (S18).

  On the other hand, when the authentication in step S12 is successful, the authentication processing unit 11 checks the remaining number of days until the expiration date of the digital certificate 21 (S13). When the remaining number of days is equal to or less than the predetermined number of days (S13: Yes), the guidance processing unit 15 outputs a certificate update guidance (S14). On the other hand, when the number of remaining days is greater than the predetermined number of days (S13: No), step S14 is skipped.

  At the same time, the authentication processing unit 11 permits the printer 2 to log in to the network (S15). Further, the authentication processing unit 11 stores the management information of the digital certificate 21 in the certificate management information storage unit 13 (S16).

  Thereby, the expiration date of the digital certificate of the communication device not having the RTC can be managed by the network management device. That is, when the expiration date of the digital certificate has already passed, and when the number of remaining days until the expiration date is small, it can be notified to the user. In addition, when the expiration date of a digital certificate has already passed, and when the number of remaining days until the expiration date is small, appropriate procedures for obtaining a new digital certificate may be indicated in the guidance. it can.

  FIG. 4 shows a processing procedure for the management apparatus 1 to check the expiration date of the digital certificate of the printer 2 regularly or irregularly. This confirmation processing may be performed, for example, when the number of remaining days until the expiration date 132 stored in the certificate management information storage unit 13 is equal to or less than a predetermined number of days.

  First, the authentication processing unit 11 acquires the digital certificate 21 from the printer 2 (S21), and updates the management information of the digital certificate 21 in the certificate management information storage unit 13 (S22).

  Next, the authentication processing unit 11 confirms the number of remaining days until the expiration date of the digital certificate 21 (S23). When the remaining number of days is equal to or less than the predetermined number of days (S23: Yes), the guidance processing unit 15 outputs a certificate update guidance (S24). On the other hand, when the number of remaining days is greater than the predetermined number of days (S23: No), step S24 is skipped.

  Thereby, even when the communication device continues to connect to the network for a long time, the management device can manage the expiration date of the digital certificate of the communication device.

  The above-described embodiments of the present invention are examples for explaining the present invention, and are not intended to limit the scope of the present invention only to those embodiments. Those skilled in the art can implement the present invention in various other modes without departing from the gist of the present invention.

  For example, the network management apparatus and the authentication information issuing server described above can be realized together by a single computer machine, or can be realized separately for each computer machine. The management device that manages the expiration date of authentication information is, for example, one or more other computers such as personal computers in the same subnet that do not have a network management function or an authentication function (all in the same subnet that can instruct communication devices to perform processing) For example, when the communication device is a printer, all computers on which a printer driver is installed may be used, and the communication device may be authenticated by a server having an authentication function. In that case, when authentication by the server of the communication device is successful and the communication device is connected to the network, the management device acquires the latest authentication information, and performs the processing after S21 in FIG. When the validity period of the authentication information is valid, the validity period is equal to or less than a predetermined number of days ”, and when the communication device is not connected to the network, the figure is based on the latest authentication information of the management device acquired last time. The determination after S23 of 4 may be performed. In that case, instead of (A), which is the determination in S23 of FIG. 4, only “(B) whether the authentication information has expired” may be determined.

  In addition, when either of the conditions (A) and (B) is met, different types of update guidance may be presented to the user. Specifically, in the case of (A), the number of remaining days until the expiration date of the authentication information may be presented, and in the case of (B), information indicating that the expiration date of the authentication information has expired may be presented. In the case of (B), a communication device whose authentication information has expired cannot access the authentication information issuing server via the network. For example, it can be directly connected to the authentication information issuing server with a cable, a memory card, etc. Since it is necessary to update the authentication information by an update procedure other than the network, such as updating the authentication information via the storage medium, the update procedure other than the network is notified to the user. The user may be notified of the update procedure including the procedure in step (b).

  When the communication device is not connected to the network and it is determined whether or not the update guidance can be executed based on the latest authentication information of the management device acquired last time, although the authentication information of the communication device is actually updated, the power supply Since it is not included, there is a risk that the authentication information update guidance may be executed. Therefore, if (A) or (B) is determined based on the previous authentication information, first, a notification is given to the user to instruct the user to turn on the power of the communication device, and then the communication device is connected to the network after a predetermined time has elapsed or according to the user instruction. If the communication device is still not connected to the network as a result of the determination, either (A) or (B) or (A) or (B) is determined based on the previous authentication information. Both may be determined and the flow of FIG. 4 may be executed when connected to the network.

1 is a configuration diagram of a network system according to an embodiment of the present invention. An example of the management information memorize | stored in the certificate management information storage part is shown. It is a flowchart which shows the process sequence at the time of login. It is a flowchart which shows the procedure which confirms an expiration date regularly or irregularly.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Network management apparatus, 2 ... Printer, 6 ... Authentication information issuing server, 9 ... Quarantine network, 11 ... Authentication processing part, 13 ... Certificate management information storage part, 15 ... Guidance processing part, 21 ... Digital certificate.

Claims (7)

A network system comprising a management device for managing a network and a communication device for performing communication on the network, wherein only a communication device authenticated by the management device can be connected to the network,
The communication device includes a storage unit that has a predetermined expiration date and stores authentication information for receiving authentication by the management device;
The management device
Authentication means for obtaining the authentication information from the communication device and performing authentication processing of the communication device;
Guidance means for outputting guidance according to the authentication result by the authentication means,
The guidance means includes
A network system that outputs different guidance depending on whether authentication by the authentication information is successful and the remaining number of days until the expiration date of the authentication information is a predetermined number of days or less and when authentication by the authentication information is unsuccessful.   The guidance when the authentication is successful and the remaining number of days until the expiration date of the authentication information is equal to or less than a predetermined number of days is guidance that teaches a procedure for updating the authentication information via the network. The network system described.   The network system according to claim 1, wherein the guidance when the authentication is unsuccessful is a guidance that teaches a procedure for updating the authentication information without going through the network.   The network system according to claim 1, wherein the network is a network that conforms to IEEE 802.1X.   The network system according to claim 1, wherein the network is a network related to wireless communication. A network management device that manages a network and connects only authenticated communication devices to the network,
An authentication unit that acquires authentication information having a predetermined expiration date from the communication device and performs authentication processing of the communication device;
Guidance means for outputting guidance according to the authentication result by the authentication means,
The guidance means includes
Network management that outputs different guidance depending on whether authentication by the authentication information is successful and the remaining number of days until the expiration date of the authentication information is equal to or less than a predetermined number of days and when authentication by the authentication information is unsuccessful apparatus. A management device connected to a network to which only a communication device authenticated by an authentication server can be connected,
When the communication device is connected to the network, acquisition means for acquiring the latest authentication information from the communication device;
Guidance means for outputting guidance according to the authentication information,
If the communication device is not connected to the network, the guidance means determines whether the authentication information has expired based on the authentication information acquired when the communication device was last connected. If the communication apparatus is connected to the network, the remaining number of days until the expiration date of the authentication information is equal to or less than a predetermined number of days. A management apparatus that outputs a second guidance corresponding to the determination when the number of days is equal to or less than a predetermined number of days, and outputs the first guidance and the second guidance in different modes.

Images