Information processing apparatus, method for setting certificate issuance request, and program

Abstract

To prevent an error in user settings in requesting issuance of an electronic certificate to improve convenience for a user, in an environment in which a plurality of certificate issuance request protocols are available.SOLUTION: An information processing apparatus comprises: requesting means that requests a certificate issuance server to issue an electronic certificate by using any one of a plurality of protocols; receiving means that receives selection of any one of the plurality of protocols and selection of any one of a plurality of uses of the electronic certificate, which are made by a user; and notification means that performs notification related to the combination of the protocol according to the selection received by the receiving means and the use according to the selection.SELECTED DRAWING: Figure 14

Description

[Technical Field]

[0001] The present disclosure relates to setting up a digital certificate issuance request protocol. [Background technology]

[0002] Secure network identification and authentication is realized through public key infrastructure (PKI) technology using digital certificates. For example, when an information processing device acts as a client, the information processing device can verify the legitimacy of the server by obtaining a server public key certificate from the server and a certification authority certificate from the certification authority that issued the server public key certificate. Communication protocols that use digital certificates include, for example, SSL (Secure Sockets Layer), TLS (Transport Layer Security), IEEE802.1X, and IPSec (Security Architecture for Internet Protocol).

[0003] Furthermore, when an information processing device requests a certification authority to issue a digital certificate (hereinafter referred to as a certificate), the request can be made without user operation by using a predetermined certificate issuance request protocol. Patent Document 1 discloses a multifunction peripheral that uses SCEP (Simple Certificate Enrollment Protocol) as the certificate issuance request protocol.

[0004] There are various types of certificate issuance request protocols (hereafter referred to as protocols), each with different functions and characteristics. Therefore, different protocols are used depending on the purpose of the certificate and the required security level. For example, ACME (Automatic Certificate Management Environment) is used to obtain a certificate for TLS, and EST (Enrollment over Secure Transport) is used to obtain a certificate for IEEE802.1X. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2023-078380 Summary of the Invention [Problem to be solved by the invention]

[0006] In this way, in an environment where multiple protocols (for example, SCEP / EST / ACME) are available, specific functions can be realized and the required level of security can be obtained by selecting the appropriate protocol depending on the purpose. However, if the protocol and the purpose for which the certificate is used do not match, the functions and security level that should be available may not be obtained.

[0007] The present disclosure aims to prevent users from making incorrect settings when requesting the issuance of a digital certificate in an environment where multiple certificate signing request protocols are available, thereby improving user convenience. [Means for solving the problem]

[0008] The information processing device disclosed herein includes a request means for requesting a certificate issuing server to issue an electronic certificate using one of a plurality of protocols, a reception means for receiving a user's selection of one of the plurality of protocols and a selection of one of a plurality of uses for the electronic certificate, and a notification means for notifying the user of the combination of the protocol and the use related to the selection received by the reception means. [Effects of the Invention]

[0009] The present disclosure makes it possible to prevent users from making incorrect settings when requesting the issuance of a digital certificate in an environment where multiple certificate signing request protocols are available, thereby improving user convenience. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a diagram illustrating a configuration of a system including a multifunction peripheral according to an embodiment of the present disclosure. [Figure 2] FIG. 2 is a diagram illustrating a hardware configuration of a multifunction peripheral. [Figure 3] FIG. 2 is a diagram illustrating a software configuration of the multifunction peripheral. [Figure 4] 10 is a table showing the priority and availability of combinations of certificate uses and certificate request protocols. [Figure 5] FIG. 2 is a diagram illustrating the hardware configuration of a PC. [Figure 6] FIG. 2 is a diagram illustrating the software configuration of a PC. [Figure 7] FIG. 10 is a diagram illustrating a functional configuration related to a certificate issuance request. [Figure 8] This is a sequence diagram of the connection settings to the certification authority / registration authority and the certificate issuance request process. [Figure 9] FIG. 10 is a diagram illustrating an example of a connection setting screen. [Figure 10] 10 is an example of a setting screen for a SCEP certificate issuance request. [Figure 11] 10 is an example of a setting screen for requesting issuance of an EST certificate. [Figure 12] 10 is an example of a settings screen for an ACME certificate issuance request. [Figure 13] 10 is a flowchart showing the flow of a certificate issuance request setting process. [Figure 14] 10 is an example of a notification regarding a combination of a certificate issuing request protocol and a use. [Figure 15] 10 is an example of a setting screen for setting protocol priority for certificate usage. [Figure 16] 10 is a flowchart showing the flow of a setting process for a certificate issuance request in the second embodiment. [Figure 17] 13 is a flowchart showing the flow of a setting process for a certificate issuance request in the third embodiment. [Figure 18]13 is a flowchart showing the flow of a setting process for a certificate issuance request in the fourth embodiment. [Figure 19] 10 is an example of a screen for setting a SCEP certificate issuance request with UI components masked. [Figure 20] 10 is an example of an EST certificate issuance request setting screen with UI components masked. [Figure 21] 10 is an example of an ACME certificate issuance request settings screen with UI widgets masked. [Figure 22] 10 is a flowchart illustrating display control based on the priority of a combination of a protocol and a purpose. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. Note that the following embodiments do not limit the scope of the claims, and not all combinations of features described in the embodiments are necessarily essential to the solutions of the present disclosure. Note that the use of electronic certificates according to the embodiments and an information processing device that manages the electronic certificates will be described using a multifunction peripheral (digital multifunction device / MFP / Multi Function Peripheral) as an example. However, the scope of application of the present disclosure is not limited to multifunction devices, and includes image forming devices and various information processing devices that can use electronic certificates.

[0012] First Embodiment FIG. 1 is a diagram illustrating the system configuration of an information processing system including a multifunction peripheral 100 according to a first embodiment of the present disclosure.

[0013] The multifunction peripheral 100, which has a printing function, can be connected to and communicate with other information processing devices via a network 110. The multifunction peripheral 100 can send and receive print data, scanned image data, device management information, and the like to and from other information processing devices via the network 110. The multifunction peripheral 100 has the function of performing multiple encrypted communications such as TLS, IPsec, and IEEE802.1X. The multifunction peripheral 100 holds a public key pair and an electronic certificate (hereinafter referred to as a certificate) used for these encryption processes.

[0014] The multifunction peripheral 100 has a web server function and exposes a web page type Remote UI (hereinafter referred to as RUI) function to the network 110. That is, the multifunction peripheral 100 provides various setting screens and operation screens via the RUI to the PC 103 connected via the network 110. For example, the multifunction peripheral 100 provides the PC 103 with an RUI including a setting screen for inputting information required to request the issuance of a certificate. The setting screen will be described later.

[0015] The multifunction device 100 is an example of an image forming device, and the image forming device is not limited to this, and may be a device having the functions of a facsimile machine, a printer, or a copier, or a device having a combination of these functions.

[0016] The certification authority / registration authority 102 has the functions of a certification authority (CA) that issues certificates and the functions of a registration authority (RA) that accepts certificate issuance requests and performs registration processing. In other words, the certification authority / registration authority 102 is a server device that has the functions of distributing CA certificates and issuing and registering certificates via the network 110. An information processing device such as the multifunction peripheral 100 uses a certificate issuance request protocol (hereinafter simply referred to as the protocol) to request the issuance of a certificate, and communicates with the certification authority / registration authority 102 via the network 110 to request and obtain the issuance of a certificate. In relation to the certification authority / registration authority 102, the multifunction peripheral 100 functions as a client.

[0017] When the certification authority / registration authority 102 receives a certificate issuance request from an information processing device such as the multifunction peripheral 100 or the PC 103 via the network 110, it issues and registers a certificate based on the issuance request and transmits the issued certificate as a response to the issuance request. While the present embodiment illustrates an example in which the functions of the certification authority and registration authority are implemented by the same server device, the certification authority and registration authority may also be implemented by different server devices. Furthermore, the present embodiment illustrates SCEP, ACME, and EST as examples of certificate issuance request protocols used between the multifunction peripheral 100 and the certification authority / registration authority 102. The certification authority / registration authority 102 may be configured as a single server device, or may be configured such that separate server devices corresponding to each protocol are provided, such as a SCEP server, an ACME server, and an EST server.

[0018] The PC 103 is a personal computer equipped with a web browser function. The web browser function allows the PC 103 to view and use HTML documents and websites published by information processing devices (such as the multifunction peripheral 100) connected to the network 110. A user of the PC 103 can configure the multifunction peripheral 100 by accessing the RUI of the multifunction peripheral 100 using the web browser function. For example, the user of the multifunction peripheral 100 uses the web browser installed on the PC 103 to connect to a web page published by the multifunction peripheral 100 for requesting and obtaining a certificate, and inputs the information required to request the certificate. Based on the information entered by the user, the multifunction peripheral 100 transmits a certificate issuance request to the certification authority / registration authority 102 using one of the protocols selected by the user from SCEP, ACME, and EST. After obtaining a certificate from the certification authority / registration authority 102, the multifunction peripheral 100 configures the multifunction peripheral 100 to use the obtained certificate according to the information entered by the user.

[0019] Next, the configuration of the multifunction peripheral 100 according to this embodiment will be described. 2 is a block diagram showing the hardware configuration of the multifunction peripheral 100 according to this embodiment. The CPU 201 executes the software programs of the multifunction peripheral 100 and controls the entire device. The ROM 202 is a read-only memory that stores the boot program and fixed parameters of the multifunction peripheral 100. The RAM 203 is a random access memory that is used to store programs and temporary data when the CPU 201 controls the multifunction peripheral 100. The HDD 204 is a hard disk drive that stores system software, applications, and various data.

[0020] The CPU 201 executes a boot program stored in the ROM 202, expands a program stored in the HDD 204 into the RAM 203, and executes the expanded program to control the operation of the multifunction peripheral 100. The network I / F control unit 205 controls the transmission and reception of data to and from the network 110. The scanner I / F control unit 206 controls the reading of documents by the scanner 211. The printer I / F control unit 207 controls printing processes by the printer 210. The panel control unit 208 controls a touch panel-type operation panel 212, and controls the display of various information and the input of instructions from the user. The bus 209 interconnects the CPU 201, ROM 202, RAM 203, HDD 204, network I / F control unit 205, scanner I / F control unit 206, printer I / F control unit 207, and panel control unit 208. Control signals from the CPU 201 and data signals between each device are transmitted and received via the bus 209.

[0021] 3 is a block diagram illustrating software modules included in the multifunction peripheral 100 according to this embodiment. The software modules shown in FIG. 3 are implemented by the CPU 201 executing a program loaded in the RAM 203.

[0022] The network driver 301 controls the network I / F control unit 205 connected to the network 110 to transmit and receive data to and from the outside via the network 110 .

[0023] The network control unit 302 controls communication below the transport layer in a network communication protocol such as TCP / IP, and transmits and receives data.

[0024] The communication control unit 303 is a module for controlling multiple communication protocols supported by the multifunction peripheral 100. In the process of obtaining a certificate according to the Certificate Issuance Request Protocol in this embodiment, the communication control unit 303 controls the generation and analysis of requests and response data for HTTP (Hyper Text Transfer Protocol) and SOAP (Simple Object Access Protocol) protocol communication, as well as data transmission and reception. The communication control unit 303 also executes communication with the certification authority / registration authority 102 and the PC 103. The communication control unit 303 also executes encrypted communication including TLS, IPsec, IEEE802.1X, and the like supported by the multifunction peripheral 100.

[0025] TLS is a protocol used primarily between transport layer protocols and application layers to perform secure communications. For example, when combined with HTTP, it realizes a secure communications protocol called HTTPS. Note that TLS does not depend on a specific application layer protocol and is used in combination with various protocols. In this embodiment, TLS refers to HTTPS unless otherwise specified.

[0026] IPsec is a protocol that protects communications by authenticating and encrypting IP packets at the network layer.

[0027] IEEE802.1X is an authentication standard used when connecting to a LAN at the data link layer, and is a quarantine network technology that prevents devices other than those authorized to connect from connecting to the LAN.

[0028] Web page control unit 304 is a module that generates HTML data for displaying, for example, a certificate issuance request and an RUI (Web page) for obtaining the certificate, and controls communication. Web page control unit 304 executes processing in response to a Web page display request and a certificate issuance request and an instruction to obtain the certificate, sent from network driver 301 via communication control unit 303. Web page control unit 304 transmits HTML data of a default Web page stored in RAM 203 or HDD 204, or HTML data generated in accordance with the contents of the display request, as a response to a request from Web browser 604.

[0029] The key pair and certificate acquisition control unit 305 is a module for executing certificate acquisition processing based on instructions from the web page control unit 304. The key pair and certificate acquisition control unit 305 stores setting values related to the certificate issuance request processing and controls communication of the certificate issuance request protocol. The key pair and certificate acquisition control unit 305 also generates and analyzes encrypted data required for communication such as PKCS#7 and PKCS#10, and stores acquired certificates and sets their uses. The setting values and information handled by the key pair and certificate acquisition control unit 305 are stored in certificate acquisition information 321.

[0030] The certificate acquisition information 321 is a database that stores data used for processing by the key pair and certificate acquisition control unit 305. The information in the certificate acquisition information 321 is stored, for example, in the HDD 204. The certificate acquisition information 321 includes a first table 401 in which the priority order (priority) of combinations of certificate uses and certificate signing request protocols is set, and a second table 402 in which the availability of combinations of certificate uses and certificate signing request protocols is set.

[0031] Fig. 4(a) shows an example of a first table 401 indicating the priority order (priority) of combinations of certificate uses and certificate request protocols. Fig. 4(b) shows an example of a second table 402 indicating whether combinations of certificate uses and certificate request protocols are available.

[0032] The rows of the first table 401 shown in FIG. 4(a) indicate the certificate signing request protocols supported by the multifunction peripheral 100, and the columns indicate the certificate uses (encrypted communication protocols) supported by the multifunction peripheral 100. The values in the first table 401 indicate that the smaller the numerical value, the higher the priority. That is, for the use "TLS," the priority is defined as ACME, EST, and SCEP in descending order. Furthermore, for the uses "IEEE802.1X" and "IPSec," the priority is defined as EST and SCEP in descending order. The priority is preferably determined based on the functionality and security level of the certificate signing request protocol.

[0033] ACME's specifications allow the server (certification authority / registration authority 102) to verify whether the certificate is issued to a match with the client (the source of the certificate issuance request, such as the multifunction device 100) after issuing the certificate. Certificates issued using ACME are intended to be used with TLS, and are not intended for use with IEEE802.1X or IPSec. The ACME specifications are published as RFC8555.

[0034] EST does not allow the server (certification authority / registration authority 102) to verify whether the certificate is issued to the client (the requester of the certificate, such as the multifunction device 100) after issuing the certificate. EST also assumes that TLS is used for communication between the server and client. There are no particular restrictions on the use of certificates issued using EST, and they can be used with TLS, IEEE802.1X, IPSec, etc. The EST specification is published as RFC7030.

[0035] With SCEP, the server (certification authority / registration authority 102) cannot verify whether the certificate is issued to the client (the requester of the certificate, such as the multifunction device 100) after issuing the certificate. Furthermore, SCEP does not require the use of TLS for communication between the server and client. There are no particular restrictions on the use of certificates issued using SCEP, and they can be used with TLS, IEEE802.1X, IPSec, etc. The SCEP specification is published as RFC8894.

[0036] Considering the characteristics of each protocol, the order of security when using TLS is ACME, EST, and SCEP. The reason for this order is that ACME allows the server to verify that the certificate recipient matches the client after issuing the certificate, but SCEP and EST cannot, and EST has stronger security than SCEP.

[0037] When the use is IEEE802.1X or IPSec, the order of security is EST, followed by SCEP. The reason for this order is that, in addition to the reason for TLS, IEEE802.1X and IPSec are not assumed to be used in ACME. The reason why the values for IEEE802.1X and IPSec in the "ACME" row in the first table 401 are "-" (no priority) is because, in this embodiment, ACME does not support IEEE802.1X or IPSec as certificate uses.

[0038] The priority of each protocol for each application may be set and stored in advance as shown in this embodiment, or may be set by the user of the multifunction peripheral 100 using a setting screen (RUI). Setting of priority by the user will be described later.

[0039] The rows of the second table 402 in FIG. 4(b) indicate the certificate issuance request protocols (request methods) supported by the multifunction peripheral 100, and the columns indicate the certificate uses (communication protocols) supported by the multifunction peripheral 100. In the example of FIG. 4(b), it is assumed that the user has configured connection settings for SCEP, EST, and ACME on the connection setting screen (FIG. 9) described below. Furthermore, use is set as "enabled" for all combinations except for some combinations. Specifically, for ACME, when the use is IEEE802.1X and when the use is IPSec, "(use) is not allowed" is set. This is because the ACME specifications do not assume IEEE802.1X and IPSec as certificate uses. Even if a combination is usable according to the specifications, protocols for which the user has not configured connection settings are not usable by the multifunction peripheral 100. The usability of each protocol is stored in the second table 402 in FIG. 4(b).

[0040] Returning to the explanation of Figure 3. The key and certificate information 322 is a database that stores key pairs and certificates and CA certificates used by the multifunction device 100. The key and certificate information 322 may initially hold CA certificates as trustworthy, or may allow the user of the multifunction device 100 to add and store key pairs and certificates and CA certificates later.

[0041] The encryption processing unit 306 is a module for executing various cryptographic processes such as data encryption and decryption, digital signature generation and verification, hash value generation, etc. The encryption processing unit 306 executes each cryptographic process required in the certificate issuance request process.

[0042] The key pair and certificate management unit 307 is a module that manages public key pairs and certificates held by the multifunction peripheral 100. The key pair and certificate management unit 307 stores data on public key pairs and certificates together with various setting values in the RAM 203 or HDD 204. Although not shown in the present embodiment, processes such as displaying details of public key pairs and certificates, generating and deleting them, etc. can also be executed in response to user instructions via the operation panel 212. The operation panel 212 and panel control unit 208 are controlled by a UI control unit 308.

[0043] In addition, in encrypted communication processing such as TLS, IPsec, and IEEE802.1X executed by the communication control unit 303, encryption processing is performed by the encryption processing unit 306, and the public key pair and certificate data to be used are obtained from the key pair and certificate management unit 307.

[0044] The print / read processor 310 is a module for executing functions such as printing by the printer 210 and reading of documents by the scanner 211.

[0045] The device control unit 311 is a module that generates control commands and control data for the multifunction peripheral 100 and controls the multifunction peripheral 100 in an integrated manner.

[0046] Next, the configuration of the PC 103 will be described. FIG. 5 is a block diagram showing the hardware configuration of the PC 103 according to this embodiment.

[0047] The CPU 501 executes the software program of the PC 103 and controls the entire device. The ROM 502 is a read-only memory that stores the boot program and fixed parameters of the PC 103. The RAM 503 is a random access memory that is used to store programs and temporary data when the CPU 501 controls the PC 103. The HDD 504 is a hard disk drive that stores system software, applications, and various data.

[0048] The CPU 501 executes a boot program stored in the ROM 502, expands a program stored in the HDD 504 into the RAM 503, and executes the expanded program to control the operation of the PC 103. The network I / F control unit 505 controls sending and receiving of data to and from the network 110. The UI control unit 506 controls input processing via the operation of the mouse 509 and keyboard 510. The display unit 507 controls the display 511 and controls the display of various information. The bus 508 interconnects the CPU 501, ROM 502, RAM 503, HDD 504, network I / F control unit 505, UI control unit 506, and display unit 507. Control signals from the CPU 501 and data signals between the various devices are transmitted and received via the bus 508.

[0049] 6 is a block diagram illustrating software modules included in the PC 103 according to this embodiment. The software modules shown in FIG. 6 are implemented by the CPU 501 executing a program loaded in the RAM 503.

[0050] The network driver 601 controls the network I / F control unit 505 connected to the network 110 to transmit and receive data to and from the outside via the network 110 .

[0051] A network control unit 602 controls communication below the transport layer in a network communication protocol such as TCP / IP, and transmits and receives data.

[0052] The communication control unit 603 is a module for controlling multiple communication protocols supported by the PC 103. In this embodiment, the communication control unit 603 controls the generation and analysis of requests and response data for HTTP and SOAP protocol communication, as well as data transmission and reception, accesses the RUI of the multifunction peripheral 100, and performs settings for obtaining a certificate.

[0053] The web browser 604 is an application for displaying and operating web pages published by the multifunction peripheral 100 .

[0054] A display control unit 607 controls the screen that the web browser 604 displays on the display 511. A UI control unit 606 controls inputs from a mouse 509 and a keyboard 510 for performing various operations on the web browser 604.

[0055] Next, the functional configuration of the multifunction device 100 for realizing the method for setting a certificate issuance request according to this embodiment will be described.

[0056] Fig. 7 is a diagram showing a functional configuration for implementing the certificate issuance request setting method according to the present disclosure in multifunction peripheral 100. As shown in Fig. 7, multifunction peripheral 100 has a certificate issuance request unit 701, a selection unit 702, an information reception unit 703, a priority acquisition unit 704, a priority determination unit 705, a notification unit 706, etc. These functions are included in key pair / certificate acquisition control unit 305 shown in Fig. 3, and are implemented by CPU 201 executing a program corresponding to each function.

[0057] The certificate issuance request unit 701 is a function that requests the issuance of a certificate from the certification authority / registration authority 102. The certificate issuance request unit 701 requests the issuance of a certificate from the certification authority / registration authority 102, which is a certificate issuing server, using a certificate issuance request protocol (hereinafter referred to as a request method) selected by the user in the selection unit 702, and obtains the certificate. The certificate issuance request process will be described later.

[0058] The selection unit 702 accepts the user's selection of a certificate issuance request protocol. In this embodiment, any one of SCEP, EST, and ACME protocols can be selected, but the present invention is not limited to these and other protocols may be included. Also, it is not necessary to include all of these protocols, and the selection may be accepted from any two of the protocols.

[0059] The information accepting unit 703 accepts input of information necessary for a certificate issuance request. The information accepting unit 703 displays, for example, on the RUI, a certificate issuance request setting screen (hereinafter referred to as the setting screen) on which setting items according to the certificate issuance request protocol are provided. The information accepting unit 703 also accepts information input by the user via the RUI. The information necessary for a certificate issuance request includes the purpose of the certificate. The setting screen will be described in detail later (FIGS. 9 to 12).

[0060] The priority acquisition unit 704 acquires information indicating the priority for each combination of multiple certificate uses and multiple certificate request protocols. Specifically, as shown in the first table 401 in FIG. 4(a), the priority is set as a value indicating the level of priority for each combination of protocol and use, such as "1," "2," "3," .... The priority "1" is the highest priority, and the priority decreases in the order of "2," "3," .... No priority is set for combinations that cannot be used. Note that the priority does not necessarily need to be stored in the form of a table, and may be stored in any format that can be acquired by the CPU 201. Note that the priority acquisition unit 704 also acquires information (the second table 402 in FIG. 4(b)) indicating whether a combination of certificate use and protocol is usable or not.

[0061] The priority determination unit 705 determines whether the combination of the certificate purpose selected by the user and the selected protocol is usable and whether there is a combination with a higher priority. Depending on the result of this determination, it controls whether to execute a certificate issuance request to the certification authority / registration authority 102 or to notify the notification unit.

[0062] The notification unit 706 determines whether there is a combination of certificate use and protocol that is usable and has a higher priority than the combination selected by the user as determined by the priority determination unit 705. If it is determined that there is a combination that is usable and has a higher priority, the notification unit 706 notifies the user that there is a combination with a higher priority. The notification may be displayed on the screen via the RUI, or may be sent to the user by email or other notification method, for example.

[0063] If the priority determination unit 705 determines that the combination of certificate use and protocol selected by the user is not available or that there is no combination with a higher priority, the certificate issuance request unit 701 executes a certificate issuance request.

[0064] Next, a process flow for the multifunction peripheral 100 to request the issuance of a certificate in the information processing system of this embodiment will be described.

[0065] FIG. 8 is a sequence diagram illustrating the overall flow of processing including connection setup processing, certificate issuance request setting processing, and certificate issuance request processing.

[0066] S801 to S806 are connection setting processing, which indicate the procedure for setting information (connection setting information) required for the multifunction device 100 to connect to the certification authority / registration authority 102. The connection setting processing is performed by the time the multifunction device 100 makes a certificate issuance request to the certification authority / registration authority 102. In this embodiment, the connection setting processing is performed before the setting processing for the certificate issuance request.

[0067] Steps S807 to S811 are a setting process for a certificate issuance request, in which the MFP 100 inputs information required to make a certificate issuance request to the certification authority / registration authority 102 via the RUI (setting screen). Steps S812 to S815 are a certificate issuance request process, in which the MFP 100 makes a certificate issuance request to the certification authority / registration authority 102 and obtains the certificate.

[0068] First, the connection setup process will be described. In S801, the multifunction peripheral 100 receives a request to display a connection setting screen from the PC 103. For example, in order to perform connection settings with the certification authority / registration authority 102, the user of the multifunction peripheral 100 selects connection settings 912 from a menu list 910 provided in the RUI, thereby transmitting a request to display the connection setting screen to the multifunction peripheral 100.

[0069] In S802, in response to S801, the multifunction peripheral 100 generates HTML data for a connection setting screen 900 as shown in FIG. 9 using the Web page control unit 304, and displays it on the RUI.

[0070] In this embodiment, a user of the multifunction device 100 uses a web browser 604 installed on the PC 103 to connect to the RUI published by the multifunction device 100 and perform operations such as inputting instructions and information to the RUI.

[0071] Fig. 9 is a diagram showing an example of a connection setting screen 900. HTML data for the web page screen shown in Fig. 9 is generated by the web page control unit 304 in Fig. 3, and is displayed on the display 511 by the web browser 604 of the PC 103. In the following description, unless otherwise specified, the screen display in this embodiment follows a similar flow.

[0072] 9 accepts input of information for the multifunction peripheral 100 to connect to the certification authority / registration authority 102. The host name of the server on which the certificate issuance service provided by the certification authority / registration authority 102 operates is input into input fields 901, 903, and 905 provided in area 920 of the connection setting screen 900. The connection destination port number is input into input fields 902, 904, and 906. An OK button 907 is operated to complete the input. The multifunction peripheral 100 connects to the certification authority / registration authority 102 based on the information set and saved on the connection setting screen 900.

[0073] In S803, the PC 103 displays the connection setting screen 900. The PC 103 accepts information input by the user.

[0074] In step S804 , when the OK button 907 on the connection setting screen 900 is operated, the PC 103 transmits a setting instruction request to the multifunction peripheral 100 .

[0075] In S805, the multifunction peripheral 100 executes a connection setting process. The key pair and certificate acquisition control unit 305 of the multifunction peripheral 100 acquires the setting values of the host name (certificate issuing server name) and port number included in the connection setting and saves them in the RAM 203 or HDD 204. The key pair and certificate acquisition control unit 305 of the multifunction peripheral 100 also determines that a protocol corresponding to a certificate issuing server for which a connection setting has been made by the user is available, and determines that a protocol corresponding to a certificate issuing server for which a connection setting has not been made is unavailable. The key pair and certificate acquisition control unit 305 saves the availability of each protocol based on this connection setting in the second table 402 of FIG. 4(b). Note that the second table 402 of FIG. 4(b) is assumed to contain pre-set information regarding whether each communication protocol (application) used by the multifunction peripheral 100 is available or unavailable in terms of its specifications for each certificate issuing request protocol (request method) installed in the multifunction peripheral 100.

[0076] In S806, the multifunction peripheral 100 generates a screen showing the connection setting results and displays it on the PC 103 as a response.

[0077] Next, the certificate issuance request setting process will be described. In S807, the multifunction peripheral 100 receives a display request for a certificate issuing request setting screen (hereinafter referred to as the setting screen) sent from the browser of the PC 103. To request the issuance of a desired certificate, the user of the multifunction peripheral 100 selects a desired certificate issuing request protocol (request method) from a menu list 910 of the RUI displayed on the PC 103. The menu list 910 displays a plurality of selectable certificate issuing request protocols (request methods) supported by the multifunction peripheral 100.

[0078] In this embodiment, a menu list 910 displays a plurality of protocols supported by the multifunction peripheral 100 as a SCEP certificate issuance request 913, an EST certificate issuance request 914, and an ACME certificate issuance request 915. When the user selects one of the protocols, the PC 103 transmits to the multifunction peripheral 100 a request to display a setting screen for the certificate issuance request corresponding to the protocol selected by the user.

[0079] In S808, the multifunction peripheral 100 generates HTML data for one of the setting screens 1000, 1100, and 1200 shown in FIGS. 10 to 12 in response to S807, and displays the HTML data on the RUI.

[0080] In S809, the PC 103 displays a certificate signing request setting screen corresponding to the protocol selected by the user. The PC 103 also accepts information input by the user onto the certificate signing request setting screens 1000, 1100, and 1200. The certificate signing request setting screens 1000, 1100, and 1200 will be described later.

[0081] In step S810, when the OK button on the certificate issuance request setting screen is operated, the PC 103 transmits a certificate issuance request to the multifunction peripheral 100.

[0082] In S811, when the multifunction peripheral 100 receives a certificate issuance request from the PC 103, it executes a certificate issuance request setting process based on the information entered on the certificate issuance request setting screens 1000, 1100, and 1200. The certificate issuance request setting process is a process for generating certificate issuance request data based on the information entered on the certificate issuance request setting screens 1000, 1100, and 1200 in S809. In this setting process, the multifunction peripheral 100 determines the priority of the combination of the protocol selected from multiple protocols and the certificate usage ([Key Usage]) set on the setting screens 1000, 1100, and 1200. If there is a protocol with a higher priority than the currently set usage, the multifunction peripheral 100 notifies the user. The certificate issuance request setting process will be described in detail later.

[0083] In S812, the multifunction peripheral 100 transmits the certificate issuance request data generated in S811 to the corresponding server, the certification authority / registration authority 102, based on the information set in S805.

[0084] In S813, the multifunction peripheral 100 receives a response to the certificate issuance request sent from the certification authority / registration authority 102.

[0085] In S814, the multifunction device 100 analyzes the response to the certificate issuance request received in S813 (performing signature verification according to the settings, obtaining the certificate included in the response, setting the obtained certificate for the specified purpose, etc.), and then generates a screen showing the results of the certificate issuance request. If the certificate is successfully issued and obtained, the certificate data is saved in the multifunction device 100 by the processing of S814.

[0086] In S815 , the multifunction peripheral 100 generates a screen indicating whether the issuance and acquisition of the certificate was successful or unsuccessful, and transmits the screen to the PC 103 .

[0087] 10 to 12 are examples of setting screens 1000, 1100, and 1200 for a certificate issuance request displayed by the web browser 604 of the PC 103. Based on the setting values entered on these setting screens 1000, 1100, and 1200, the multifunction device 100 makes a request for the issuance of a certificate to the certification authority / registration authority 102. The multifunction device 100 also receives the certificate issued by the certification authority / registration authority 102 and registers it in the multifunction device 100.

[0088] 10 shows an example of a settings screen 1000 for making a certificate issuance request using the SCEP method. This settings screen 1000 is displayed when SCEP certificate issuance request 913 is selected from menu list 910. An input field 1020 on the settings screen 1000 includes multiple items for inputting information required for a SCEP certificate issuance request. Specifically, these items include [Name], [Key Length], issuer information ([Country], [Prefecture], [City / Town / Village], [Organization], [Organizational Unit], [Common Name], etc.), [Challenge Password], and [Key Usage]. An OK button 1022 is a button that is operated when completing input into input field 1020 and starting a certificate issuance request.

[0089] [Key length] is an item for setting the key length of the key pair to be generated. [Challenge password] is a password that is sent together with the certificate issuance request to the certification authority / registration authority 102. [Key usage] is an item for setting the usage of the issued certificate.

[0090] The purpose in [Key Usage] refers to the communication function for which the certificate is used. In this embodiment, communication protocols for encrypted communication such as TLS, IPSEC, and IEEE802.1X can be selected. Furthermore, the multifunction peripheral 100 of this embodiment can have certificates for multiple certificate signing request protocols, and usage settings are made for each of the multiple certificates (i.e., certificate signing request protocols). For example, the certificate used when the multifunction peripheral 100 provides a server service that performs TLS communication as a web server may use a different protocol than the certificate used by the multifunction peripheral 100 for client communication using IEEE802.1X. In such cases, usage settings are accepted for each certificate (protocol).

[0091] Additionally, "No use" can be selected as the "Key use." "No use" is assumed to be set later. If "No use" is selected, the user must complete the use setting before actually using the certificate.

[0092] 11 shows an example of a settings screen 1100 for requesting the issuance of an EST certificate. The settings screen 1100 is displayed when EST certificate issuance request 914 is selected from menu list 910. The setting screen 1100 for the EST method differs from the setting screen 1000 for the SCEP method in that the EST method does not require the setting of a [challenge password]. The other setting items are the same as those for the SCEP method.

[0093] 12 shows an example of a settings screen 1200 for requesting the issuance of an ACME certificate. The settings screen 1200 is displayed when ACME certificate issuance request 915 is selected from menu list 910. The setting screen 1200 for the ACME method differs from the setting screen 1200 for the SCEP method in that the ACME method does not require the setting of a [Challenge Password]. Also, the ACME method only has TLS and no use as options for [Key Usage] 1221, and IPSEC and IEEE802.1X are not selectable. The other setting items are the same as those for the SCEP method.

[0094] Next, the certificate issuance request setting process executed by the CPU 201 of the multifunction peripheral 100 in S811 described above will be described with reference to Fig. 13. The process shown in this flowchart is written in a program stored in the ROM 202 or HDD 204. The program is called by the CPU 201, loaded into the RAM 203, and executed by the CPU 201 of the multifunction peripheral 100. When a certificate issuance request for a protocol selected by the user is received from the PC 103 (S810), the CPU 201 of the multifunction peripheral 100 starts this process. In the following description, the symbol "S" means a step.

[0095] In step S1301, the CPU 201 of the multifunction peripheral 100 receives information entered into the setting screen of the protocol selected by the user from the PC 103 via the RUI. The CPU 201 acquires the information entered into the input field of the setting screen.

[0096] In S1303, the CPU 201 acquires information about the screen of the protocol from which the certificate issuance request was received, among SCEP, EST, and ACME, and then proceeds to S1303. In this embodiment, the following description will be given taking as an example a case where the user selects SCEP.

[0097] In S1303, the CPU 201 acquires the value of [Key Usage] specified by the user, and then proceeds to S1304.

[0098] In S1304, CPU 201 switches the subsequent processing depending on the value of [Key Usage] acquired in S1303. If "No Usage" is selected as [Key Usage], proceed to S1310. If an option other than "No Usage" is selected as [Key Usage], proceed to S1305.

[0099] In S1305, CPU 201 checks whether there are any other protocols that can be used for the value of [Key Usage] acquired in S1303. If there are any other protocols that can be used, the process proceeds to S1306, and if there are no other methods that can be used, the process proceeds to S1310.

[0100] In the determination of S1305, CPU 201 refers to second table 402 shown in Fig. 4(b). CPU 201 checks whether there is a row (protocol) set to "OK" other than the protocol acquired in S1302 in the column of the value of [Key Usage] acquired in S1303 in second table 402. If there is, it is determined that there is another usable protocol, and if there is no other usable protocol, it is determined that there is no other usable protocol.

[0101] In this embodiment, an example will be described in which TLS is specified in [Key Usage]. In the second table 402, in addition to SCEP, ACME and EST are set as "OK" in the TLS column, so the CPU 201 determines that there are other protocols that can be used.

[0102] In S1306, the CPU 201 determines whether any available protocols found in the determination of S1305 have a higher priority than the selected protocol acquired in S1302. If any available protocols exist, the process proceeds to S1307; if no available protocols exist, the process proceeds to S1310.

[0103] In the determination of S1306, CPU 201 refers to first table 401 shown in FIG. 4(a). CPU 201 checks whether any of the values set in the row of the available protocol found in S1305 in the first table 401 in the column of the [Key Usage] value acquired in S1303 is smaller than the value in the row of the currently selected protocol. If any is present, it is determined that there is a protocol with a higher priority than the currently selected protocol, and the process proceeds to S1307. If there is no protocol with a lower value than the currently selected protocol, it is determined that there is no method with a higher priority than the currently selected protocol, and the process proceeds to S1310.

[0104] In the above example, the value "3" of SCEP, which is the protocol currently selected in the column for use "TLS" in the first table 401, is compared with the values "1" and "2" of the available protocols (ACME and EST) found in S1305. Since "1" and "2" are smaller than "3," it is determined in S1306 that there is a method with a higher priority than the selected protocol.

[0105] In S1307, CPU 201 generates and displays a notification screen to be displayed on the RUI. Then, the process proceeds to S1308. An example of the notification screen is shown in FIG.

[0106] FIG. 14 is a diagram showing an example of a notification screen 1400. The notification screen 1400 displays a message 1401, an OK button 1402, and a Cancel button 1403. The message 1401 includes a notification regarding security strength. The message 1401 also includes content that asks the user whether they wish to switch to a recommended protocol. The recommended protocol is a protocol that has a higher priority than the currently set protocol for the currently selected application. Preferably, it is the protocol with the highest priority for the currently selected application. The OK button 1402 is operated when switching to the recommended protocol in accordance with the message. The Cancel button 1403 is operated when not following the message and continuing to use the currently selected protocol.

[0107] 14 includes a message 1401 asking "Do you want to switch to the more secure ACME?", which notifies users about the security level and recommends switching to a protocol with a higher priority. Note that the content of the message is not limited to this example and may be any content.

[0108] In S1308, if switching to a protocol with a higher priority is selected on the notification screen 1400, that is, if the OK button 1402 is operated, the CPU 201 proceeds to S1309. If using the current protocol as is is selected, that is, if the cancel button 1403 is operated, the CPU 201 proceeds to S1310.

[0109] In S1309, the CPU 201 displays on the RUI a setting screen for a certificate issuance request for a protocol with a high priority that is recommended for use on the notification screen 1400, and then returns to S1301. In the example of Fig. 14, since the use of ACME is recommended, the CPU 201 displays on the RUI the setting screen 1200 for making a certificate issuance request using the ACME method shown in Fig. 12.

[0110] The CPU 201 executes S1301 to S1309 for the changed Certificate Signing Request Protocol setting screen 1200. Note that when the application is TLS, ACME is an available protocol and has the highest priority, so the determination is NO in S1304 → YES in S1305 → NO in S1306, and the process proceeds to S1310.

[0111] In S1310, the CPU 201 executes the certificate issuance request process for the certification authority / registration authority 102 using the currently selected protocol, and then ends this flowchart. The process in Figure 13 enables the user to execute the certificate issuance request process using the certificate issuance request protocol that has the highest priority for the purpose of the certificate.

[0112] In the above example, an example of manual issuance in which the certificate issuance request process is executed after the user completes the settings on the certificate issuance request setting screen shown in Figures 10 to 12 has been shown, but the present disclosure is also applicable to the case of automatic issuance in which the certificate issuance request process is executed at a specified date and time.

[0113] In the case of automatic issuance, CPU 201 of multifunction peripheral 100 executes, for example, steps S1301 to S1309 in the same manner as in the example described above, and then accepts the date and time specification for the issuance request. If a date and time is specified, the specified date and time and the value set on the certificate issuance request setting screen are saved in certificate acquisition information 321. When the specified date and time arrives, CPU 201 executes the certificate issuance request process of S1310.

[0114] In the case of automatic issuance, the CPU 201 may execute the determination process shown in S1304 to S1306 before sending a certificate issuance request to the certification authority / registration authority 102 at the specified date and time. In this case, if there is a protocol with a higher priority than the selected protocol for the selected purpose, the recommended protocol is notified. However, if the notification is via an RUI as shown in FIG. 13, there is a possibility that the user will not be able to confirm the notification. For this reason, the CPU 201 may execute the notification of S1308 to the user using another communication means, such as email or a push notification to a registered device.

[0115] As described above, in an environment where multiple certificate signing request protocols are available, the multifunction peripheral 100 determines whether the certificate purpose selected on the setting screen for the selected certificate signing request protocol is appropriate and notifies the user if a higher priority combination is available. Therefore, even if a user unintentionally attempts to request a certificate using a combination with a low security level, the notification can prompt the user to change to a request protocol with a higher priority. Therefore, in an environment where multiple certificate signing request protocols are available, it is possible to prevent users from making incorrect settings when requesting the issuance of a digital certificate, improving user convenience. It is also possible to prevent a decrease in security due to a mismatch between the digital certificate purpose and the certificate signing request protocol being used.

[0116] In the above example, the priority is set and maintained as shown in Fig. 4(a), but it may also be set by the user. Setting of priority in the multifunction peripheral 100 will be described below with reference to Fig. 15.

[0117] Fig. 15 is a diagram showing an example of a settings screen 1500 for setting the priority of certificate signing request protocols for each certificate use. The settings screen 1500 in Fig. 15 is displayed when a "Protocol Priority" menu 1501 is selected from a menu list 1510 of the RUI. The priorities set on the settings screen 1500 are stored in the certificate acquisition information 321 in the format of the first table 401 shown in Fig. 4(a), for example.

[0118] Area 1520 of priority setting screen 1500 has input fields 1521 to 1527 for inputting the priority of protocols that can be used for each of multiple certificate uses (TLS / IPSec / IEEE802.1X). Each of input fields 1521 to 1527 allows selection of a numerical value in the form of a pull-down list 1528. The numerical value indicates the ranking, with a smaller value indicating a higher priority, and a larger value indicating a lower priority.

[0119] The setting screen 1500 is controlled so that the same priority value cannot be set for the same purpose. For example, assume that for the purpose "TLS," "1" is set for ACME, "2" for EST, and "3" for SCEP. If the user changes the priority of ACME to "2" from this state, the CPU 201 changes the priority of EST from "2" to "1" in response to the change. As a result, ACME is set to "2," EST to "1," and SCEP to "3."

[0120] This allows users to set the priority of the combination of use and certificate request protocol, allowing for flexible settings based on the security strength required by the user and the convenience of the protocol.

[0121] <Second embodiment> Next, a second embodiment of the present disclosure will be described with reference to Fig. 16. As described in the first embodiment, after notification regarding the combination of the certificate signing request protocol and the certificate usage (communication protocol) is given, the setting screen is switched to the setting screen for the certificate signing request protocol with a higher priority in response to a user instruction. In the second embodiment, the values set by the user on the setting screen before switching are reflected and displayed on the screen after switching.

[0122] The hardware configuration and functional configuration (FIGS. 1 to 6) of the multifunction peripheral 100 and PC 103 of the second embodiment are the same as those of the first embodiment, so the same components are given the same reference numerals and detailed description will be omitted. Also, the connection settings for a certificate issuance request and the overall flow of the certificate issuance request (FIG. 8) and the RUI (FIGS. 9 to 12, FIG. 14) are the same as those of the first embodiment.

[0123] Figure 16 is a flowchart illustrating the flow of the certificate issuance request setting process in the second embodiment. This flowchart is a flowchart in which the processes of S1601 and S1602 have been added to the flowchart shown in Figure 13. The same steps are assigned the same step numbers as in Figure 13. S1601 is added between S1301 and S1302. S1602 is a process that is executed when switching to the setting screen for a protocol with a higher priority is performed in S1309. The following description will focus on the differences from the first embodiment.

[0124] As in the first embodiment, when a certificate issuance request for the selected method is received from the PC 103 (S810), the CPU 201 of the multifunction peripheral 100 starts the process of this flowchart.

[0125] In step S1301, the CPU 201 of the multifunction peripheral 100 receives information entered into a setting screen for a certificate issuance request for a protocol selected by the user from the PC 103 via the RUI. The CPU 201 acquires the values entered into the input fields of the setting screen.

[0126] Here, in S1601, the CPU 201 temporarily stores the information entered in the input fields of the certificate issuance request setting screen in the RAM 203. After that, the process proceeds to S1302.

[0127] The processing of S1302 to S1309 is the same as that of the first embodiment. That is, the CPU 201 acquires the value of [Key Usage] set on the setting screen of the protocol (SCEP, EST, or ACME) selected by the user. The CPU 201 determines whether there are any other protocols that can be used for the acquired [Key Usage] value, by referring to the second table 402. If there are other protocols that can be used, the CPU 201 determines whether there is a protocol with a higher priority than the currently selected protocol, by referring to the first table 401. If there is a protocol with a higher priority than the selected protocol, the CPU 201 displays a notification screen such as that shown in FIG. 13 via the RUI. If the user selects the use of a protocol with a higher priority on the notification screen, the screen switches to a certificate issuance request setting screen for the protocol with the highest priority for the selected purpose.

[0128] Thereafter, in S1602, the CPU 201 reflects the input information saved in the RAM 203 in S1601 as default values in the input fields of the switched certificate issuance request setting screen. For example, if the user changes from SCEP to ACME in response to the notification in S1307, the RUI displays the ACME certificate issuance request setting screen 1200. At this time, the information entered by the user on the SCEP certificate issuance request setting screen 1000 is displayed in the corresponding fields (such as [Name] and [Issued Party Information]) on the ACME certificate issuance request setting screen 1200.

[0129] After the setting screen for the protocol with the highest priority is displayed, the process returns to step S1301. The CPU 201 executes steps S1301, S1601, and S1302 to S1309 on the setting screen for the certificate issuance request after switching to the displayed screen.

[0130] Thereafter, the process proceeds to S1310, where the CPU 201 executes a certificate issuance request process for the certification authority / registration authority 102 using the currently selected protocol, and ends this flowchart.

[0131] As described above, when changing to a certificate issuance request setting screen for a protocol with a higher priority during the certificate issuance request setting process, CPU 201 of multifunction peripheral 100 reflects the information entered on the setting screen before the change to the setting screen after the change. This saves the user the trouble of re-entering the same information, enabling efficient certificate issuance request setting.

[0132] <Third embodiment> Next, a third embodiment of the present disclosure will be described with reference to Fig. 17. In the first embodiment, on the certificate issuance request setting screen, a notification screen is displayed when the following conditions (1) to (3) are met. Condition (1) "No use" is not set in [Key use] (S1304). Condition (2) There is an available protocol other than the currently selected protocol for the set purpose (S1305). Condition (3) There is a protocol with a higher priority than the currently selected protocol for the set purpose (S1306).

[0133] In the third embodiment, in addition to the above three conditions, a condition for sending a notification is that a notification setting has been made. The notification setting is a setting for controlling whether or not to send a notification when there is an available protocol with a higher priority other than the currently selected protocol. For example, a notification flag is set, and the above conditions are added such that a notification is sent when the notification flag is set to ON.

[0134] The hardware configuration and functional configuration (FIGS. 1 to 6) of the multifunction peripheral 100 and PC 103 of the third embodiment are the same as those of the first embodiment, so the same components are given the same reference numerals and detailed description will be omitted. The connection settings for a certificate issuance request and the overall flow of the certificate issuance request (FIG. 8) and the RUI (FIGS. 9 to 12, FIG. 14) are the same as those of the first embodiment.

[0135] Fig. 17 is a flowchart illustrating the flow of the setting process of an issuance request in the third embodiment. This flowchart is a flowchart in which the processes of S1701 and S1702 are added to the flowchart of Fig. 13, and the same step numbers are assigned to the same steps as in Fig. 13. S1701 is a process executed when the determination in S1306 is YES. S1702 is a process executed when the user does not select the use of a protocol with a higher priority in S1308. The following description will focus on the differences from the first embodiment.

[0136] As in the first embodiment, when a certificate issuance request for the selected method is received from the PC 103 (S810), the CPU 201 of the multifunction peripheral 100 starts the process of this flowchart.

[0137] The processing of S1301 to S1310 is the same as that of the first embodiment. That is, the CPU 201 of the multifunction peripheral 100 receives information entered on the setting screen of the certificate issuance request for the protocol selected by the user from the PC 103 via the RUI. The CPU 201 acquires the value entered in the input field on the setting screen. The CPU 201 acquires the value of [Key Usage] set on the setting screen of the protocol (SCEP, EST, ACME) selected by the user.

[0138] In steps S1304 to S1306, the CPU 201 determines the above conditions (1) to (3). If all the conditions are met in steps S1304 to S1306, the CPU 201 in the third embodiment executes the determination in step S1701.

[0139] In S1701, CPU 201 determines whether a notification flag is ON or OFF. The notification flag is a flag that sets information indicating whether or not to implement notification when there is a protocol with a higher priority than the currently selected protocol for the selected purpose. The notification flag is initially set to ON. If the notification flag is set to ON, CPU 201 proceeds to S1307 and displays a notification screen on the RUI indicating that there is a protocol with a higher priority than the currently selected protocol.

[0140] If the user does not select to switch to a protocol with a higher priority on the notification screen in S1307, the notification flag is set to OFF. This is because if the user intentionally requests a certificate issuance using a method with a lower priority, the same notification will not be sent the next time a certificate issuance request is made with the same combination. Note that, since the user's decision may not be the same for different combinations, the notification flag is set for each combination of purpose and protocol.

[0141] If the notification flag is set to OFF in S1702, the process proceeds to S1310. That is, the notification process is skipped, and the certificate issuance request process of S1310 is executed using the currently selected protocol.

[0142] If the user selects switching to a protocol with a higher priority in the notification of S1307, the process proceeds to S1309. In S1309, the CPU 201 switches to the certificate issuance request setting screen for the protocol with the highest priority, and returns to S1301. If the user does not select switching to a protocol with a higher priority in the notification of S1307, the process proceeds to S1702.

[0143] In S1702, the CPU 201 sets the notification flag to OFF. Then, the process proceeds to S1310. After that, the certificate issuance request process is executed using the selected protocol, and this flowchart ends.

[0144] In order to enable the user to set the notification flag to ON again, for example, a notification setting menu may be provided in the menu list of the RUI. The notification setting menu allows the user to switch the notification setting (notification flag) ON / OFF for the combination of purpose and certificate signing request protocol. Note that the notification setting is not limited to the method using the notification flag described above, and may be realized by any other method.

[0145] As described above, if the user intentionally selects a protocol with a low priority during the certificate issuance request generation process, the CPU 201 of the multifunction device 100 can store that setting and omit the same notification from the next time onwards.

[0146] <Fourth embodiment> Next, a fourth embodiment of the present disclosure will be described. In the multifunction peripheral 100 of the above-described embodiment, after the user inputs information into the certificate issuance request setting screen, the multifunction peripheral 100 notifies the user of the combination of protocol and purpose selected by the user. In the fourth embodiment, when there are multiple combinations of protocol and purpose, the multifunction peripheral 100 prevents the user from selecting a second combination, which is a combination with a lower priority than a first combination, which is the combination with the highest priority. This allows the user to select a protocol and purpose without hesitation.

[0147] The hardware configuration and functional configuration (FIGS. 1 to 6) of the multifunction peripheral 100 and PC 103 of the fourth embodiment are the same as those of the first embodiment, so the same components are given the same reference numerals and detailed descriptions are omitted. Also, the connection settings for a certificate issuance request and the overall flow of the certificate issuance request (FIG. 8) are the same as those of the first embodiment.

[0148] Fig. 18 is a flowchart illustrating the flow of the setting process for a certificate issuance request in the fourth embodiment. The process shown in this flowchart is executed by the multifunction peripheral 100 after, for example, a request to display a setting screen for a certificate issuance request is sent from the PC 103 to the multifunction peripheral 100 in S807 of Fig. 8.

[0149] In step S1801, when the CPU 201 of the multifunction peripheral 100 receives a request to display a setting screen for a certificate issuance request transmitted from the PC 103, the process proceeds to step S1802.

[0150] In S1802, the CPU 201 acquires priority information stored in the HDD 204 and generates a certificate issuance request setting screen based on the priority information. The priority information is information indicating the priority of combinations of protocols and uses, such as the first table 401 shown in FIG. 4(a). The CPU 201 references the first table 401 in FIG. 4(a), and if there is a second combination with a lower priority than the first combination with the highest priority, generates a setting screen in a display state in which the user cannot select the second combination. The display state in which the user cannot select the second combination is a state in which UI widgets related to the second combination are masked. UI widgets are objects that make up the screen, such as objects representing each menu in the menu list 1910, input field objects and selection field objects in the input field 1920, etc. Masked display is a display state in which operations are not accepted, and is grayed out or hidden. The CPU 201 then proceeds to S1803. Details of the processing in S1802 will be described later. Specific examples of screens will be described later.

[0151] In S1803, the CPU 201 displays the certificate issuance request setting screen generated in S1802 on the RUI. The administrator of the multifunction peripheral 100 uses the web browser 604 installed on the PC 103 to connect to the RUI for requesting and obtaining the certificate made public by the multifunction peripheral 100, and displays and operates the certificate issuance request setting screen. Examples of the certificate issuance request setting screen will now be described with reference to FIGS. 19 to 21.

[0152] 19 to 21 show examples of certificate issuance request setting screens 1900, 2000, and 2100 in the fourth embodiment. These setting screens 1900, 2000, and 2100 are displayed on the web browser 604 installed in the PC 103. In step S1802, the setting screens 1900, 2000, and 2100 have some UI widgets masked so that a certificate issuance request is not made with a combination with a low priority. Specifically, the UI widgets that make up the screen are masked so that the user does not select a second combination with a lower priority than the first combination with the highest priority.

[0153] The CPU 201 of the multifunction device 100 accepts information set by the user on the certificate issuance request setting screens 1900, 2000, and 2100, and makes a certificate issuance request to the certification authority / registration authority 102 based on the values set by the user. The CPU 201 also registers the issued certificate in the multifunction device 100.

[0154] 19 shows an example of a SCEP certificate issuance request settings screen 1900 in which some UI components are masked. As indicated by reference numerals 1930 and 1931, the entire input field 1920 and the SCEP certificate issuance request 1913 in the menu list 1910 are masked, making them inoperable by the user. This is because the multifunction peripheral 100 is equipped with a protocol (EST / ACME) that has a higher priority than SCEP for all applications (TLS, IEEE802.1X, IPSec).

[0155] 20 shows an example of an EST certificate issuance request settings screen 2000 in which some UI widgets are masked. As indicated by reference numeral 2002, the SCEP certificate issuance request 1913 in the menu list 1910 is masked. Also, as indicated by reference numeral 2001, "TLS" in the [Key Usage] column of the input field 1920 is masked. In other words, the EST certificate issuance request is displayed so that "TLS" cannot be selected as [Key Usage].

[0156] 21 is an example of an ACME certificate issuance request settings screen 2100. As indicated by reference numeral 2101, the SCEP certificate issuance request 1913 in the menu list 1910 is masked to prevent user manipulation. Additionally, in the [Key Usage] column of the input field 1920, all uses other than "TLS" are hidden to prevent user manipulation.

[0157] Returning to the description of FIG. In S1804, the CPU 201 waits until the user has completed inputting the setting values into the RUI (certificate issuance request setting screen), and when the input of the setting values is complete, the CPU 201 proceeds to S1805. In step S1805, the CPU 201 executes the certificate signing request process using the selected certificate signing request protocol, and ends this flowchart.

[0158] Fig. 22 is a flowchart showing the steps of the UI masking process executed in S1802 of Fig. 18. In this flowchart, CPU 201 generates a UI (certificate issuance request setting screen) in accordance with priority information related to the certificate issuance request protocol requested in the display request received from PC 103 in S1801. That is, CPU 201 references first table 401 shown in Fig. 4(a) and generates a setting screen in which protocols with low priority are masked to prevent the user from selecting them. Below, as an example, a case will be described in which EST certificate issuance request 1914 is selected from menu list 1910 and a display request for EST certificate issuance request 1914 is received.

[0159] In S2201, the CPU 201 determines whether the first table 401 shown in FIG. 4A contains a protocol (hereinafter, a non-selectable protocol) that is not combined with the application set with the highest priority (hereinafter, a first application). If the non-selectable protocol is in the first table 401, the process proceeds to S2202. If the non-selectable protocol is not in the first table 401, the process proceeds to S2203. In the example of the first table 401 shown in FIG. 4A, the first application (priority "1") of the protocol "ACME" is set to TLS. The first applications (priority "1") of the protocol "EST" are IEEE802.1X and IPSeC. However, the row for the protocol "SCEP" does not contain a first application with a priority of "1." Therefore, SCEP is identified as the non-selectable protocol described above. In other words, from the perspective of security, which is an index for determining priority, the protocol "SCEP" is deemed not to be used for any application in the multifunction peripheral 100.

[0160] In S2202, the CPU 201 generates a UI that prevents the selection of unselectable protocols. That is, the CPU 201 masks the SCEP certificate issuance request 1913 in the menu list 1910 so that it cannot be operated, as shown in Fig. 19, Fig. 20, and Fig. 21. Alternatively, the CPU 201 masks the entire input field 1920 on the SCEP certificate issuance request setting screen 1900, as shown in Fig. 19.

[0161] In S2203, the CPU 201 determines whether there is a use (hereinafter, a second use) other than the first use that has the highest priority for the protocol selected by the user (the protocol requested by the display request received in S2201). In other words, the CPU 201 determines whether there is a use (second use) that has a lower priority set than the first use. If there is a second use, the process proceeds to S2204; if there is no second use, the process ends this flowchart. In the example of the first table 401, a use for which a priority of "2" or "3" is set is a second use. For example, in the row for the protocol "EST" in the first table 401, a priority of "2" is set for the use "TLS," and a priority of "1" is set for "IEEE802.1X" and "IPSEC." In other words, if the protocol "EST" is selected by the user, "TLS" is identified as the second use.

[0162] In S2204, the CPU 201 displays a UI to prevent the user from selecting the secondary use, which has a lower priority, and then ends the process. In the above example, when the user requests the issuance of an EST certificate, the CPU 201 generates an EST certificate issuance request setting screen 2000. At this time, the CPU 201 masks UI components such as the check box for TLS (secondary use) in the [Key Use] field, as shown in Fig. 20.

[0163] If a user requests the issuance of an ACME certificate, the priority "1" is set for TLS in the ACME row in first table 401, and no priority is set for IEEE802.1X or IPSEC. In other words, only TLS can be used. In this case, as shown in Figure 21, check boxes other than TLS (first usage) in the [Key Usage] column are masked (not shown in Figure 21).

[0164] As described above, in the fourth embodiment, the multifunction peripheral 100 controls the display state of the setting screen based on the priority of the protocol and application combination so that a certificate issuance request is not made for a low-priority combination. This makes it possible to prevent the user from selecting a protocol or application that results in a low-priority combination. Therefore, in an environment where multiple certificate signing request protocols are available, it is possible to prevent the user from making incorrect settings when requesting the issuance of a digital certificate and improve user convenience. Furthermore, it becomes possible for the user to make a certificate issuance request using a certificate signing request protocol appropriate for the certificate application, making it possible to prevent a decrease in security level or functionality due to a mismatch between the protocol and application.

[0165] Note that the processing order, screen configuration, input items on the setting screen, etc. shown in each of the above-described embodiments are merely examples, and the present disclosure is not limited thereto. Furthermore, the certificate issuing request protocol and communication protocol (application) are not limited to those exemplified, and may be a part of these, or may include other protocols. Furthermore, it is preferable that the priority information and availability information shown in FIG. 4 be updated as protocols and communication protocols installed in the multifunction peripheral 100 are added or changed.

[0166] In the above-described embodiment, the screen display and input are performed between the multifunction peripheral 100 and the PC 103 via the RUI, but the screens shown in each embodiment may be displayed using the operation panel of the multifunction peripheral 100, and the user may input information. Also, data may be transferred between devices offline using a USB memory or the like.

[0167] 13, 16, 17, 18, and 22, these processes may be executed by the CPU 501 of the PC 103. In this case, functional units equivalent to the key pair / certificate acquisition control unit 305, key pair / certificate management unit 307, certificate acquisition information 321, key / certificate information 322, encryption processing unit 306, etc., shown in Fig. 3 are provided in the PC 103. The functions shown in Fig. 7 within the key pair / certificate acquisition control unit 305 are also provided in the PC 103.

[0168] While preferred embodiments of the present disclosure have been described above with reference to the accompanying drawings, the present disclosure is not limited to such examples. It is clear that those skilled in the art can conceive of various modifications or alterations within the scope of the technical ideas disclosed herein, and it is understood that such modifications also fall within the technical scope of the present disclosure.

[0169] <Other embodiments> The present disclosure can also be realized by providing a program that realizes one or more functions of the above-described embodiments to a system or device via a network or a storage medium, and having one or more processors in the computer of the system or device read and execute the program. It can also be realized by a circuit (e.g., ASIC) that realizes one or more functions.

[0170] The disclosure of the above-described embodiment includes the following configurations.

[0171] (Configuration 1) a requesting means for requesting the certificate issuing server to issue a digital certificate using one of a plurality of protocols; a receiving means for receiving a user's selection of one of the plurality of protocols and one of the plurality of uses of the digital certificate; a notification means for notifying the combination of the selected protocol and the selected purpose accepted by the acceptance means; An information processing device comprising:

[0172] (Configuration 2) an acquisition unit for acquiring priority information that is information in which a priority is set for each combination of the plurality of uses and the plurality of protocols; The information processing device according to configuration 1, characterized in that the notification means performs the notification when it determines, based on the priority information acquired by the acquisition means, that there is a second combination that has a higher priority than a first combination, which is a combination of the purpose of the selection accepted by the acceptance means and the protocol of the selection.

[0173] (Configuration 3) 3. The information processing device according to configuration 2, wherein the notification by the notification means includes a presentation of a protocol recommended for use in the selected application.

[0174] (Configuration 4) 3. The information processing device according to configuration 2, wherein the protocol recommended for use is a protocol related to the second combination.

[0175] (Configuration 5) The receiving means 5. The information processing device according to claim 1, wherein a first UI screen is displayed for a user to set information required to request issuance of the electronic certificate using the selected protocol and a use of the electronic certificate.

[0176] (Configuration 6) 6. The information processing device according to any one of configurations 3 to 5, wherein the accepting unit further accepts a change to the protocol recommended for use.

[0177] (Configuration 7) The information processing device according to configuration 6, wherein when the change to the recommended protocol is accepted, the accepting means displays a second UI screen for the user to set information necessary to request the issuance of the electronic certificate using the recommended protocol and the intended use of the electronic certificate.

[0178] (Configuration 8) The information processing device according to configuration 7, wherein the reception means reflects on the second UI screen information required to request the issuance of the electronic certificate using the protocol related to the selection, and information required to request the issuance of the electronic certificate set on a first UI screen for a user to set the use of the electronic certificate.

[0179] (Configuration 9) The system further includes a setting unit for setting whether or not the notification unit should issue the notification, 9. The information processing device according to any one of configurations 1 to 8, wherein the notification means performs the notification when the setting means sets the notification to be performed.

[0180] (Configuration 10) the notification by the notification means includes presentation of a protocol recommended for use in the selected application; The accepting means further accepts a change to the protocol recommended for use, and if the change to the protocol recommended for use is not made, 10. The information processing device according to configuration 9, wherein the setting means sets the notification means not to notify the combination of the selected purpose and the recommended protocol.

[0181] (Configuration 11) The information processing device according to configuration 7, wherein when the notification is made by the notification means, the request means requests the certificate issuing server to issue the electronic certificate when the information required to request the issuance of the electronic certificate using the recommended protocol and the purpose of the electronic certificate are set on the second UI screen.

[0182] (Configuration 12) 11. The information processing device according to any one of configurations 1 to 10, wherein the requesting means requests the certificate issuing server to issue the digital certificate at a specified date and time.

[0183] (Configuration 13) 13. The information processing device according to any one of configurations 1 to 12, wherein the notification means displays the notification on a screen.

[0184] (Configuration 14) 14. The information processing device according to any one of configurations 1 to 13, wherein the notification means transmits the notification by email.

[0185] (Configuration 15) 3. The information processing device according to configuration 2, wherein the priority information is set and stored in advance.

[0186] (Configuration 16) 3. The information processing device according to configuration 2, wherein the priority information is set by a user.

[0187] (Configuration 17) 17. The information processing device according to any one of configurations 1 to 16, wherein the notification by the notification means relates to at least security.

[0188] (Configuration 18) a requesting means for requesting the certificate issuing server to issue a digital certificate using one of a plurality of protocols; an acquisition means for acquiring priority information that is information that sets priorities for each combination of the plurality of uses of the digital certificate and the plurality of protocols; a display control means for displaying a UI screen for a user to set information necessary for requesting issuance of the digital certificate, including the purpose of use of the digital certificate, in a display state that reflects the priority information acquired by the acquisition means; and An information processing device comprising:

[0189] (Configuration 19) The display control means The UI screen is displayed in a display state in which a second combination having a lower priority than a first combination having the highest priority is not selectable based on the priority information acquired by the acquisition means. 19. The information processing device according to configuration 18.

[0190] (Configuration 20) The display control means If there is an unselectable protocol that is a protocol that does not exist in combination with the application set with the highest priority based on the priority information acquired by the acquisition means, the UI screen is displayed in a state in which the unselectable protocol is unselectable. 19. The information processing device according to configuration 18.

[0191] (Configuration 21) 20. The information processing device according to configuration 19, wherein the display state in which the selection is disabled is a masked display of the uses related to the second combination.

[0192] (Configuration 22) 21. The information processing device according to configuration 20, wherein the display state in which the selection is disabled is a masked display of the portion relating to the unselectable protocol.

[0193] (Configuration 23) 23. The information processing device according to any one of configurations 1 to 22, wherein the plurality of protocols include ACME, EST, and SCEP.

[0194] (Configuration 24) 23. The information processing device according to any one of configurations 1 to 22, wherein the plurality of uses include TSL, IEEE802.1X, and IPSec.

[0195] (Configuration 25) a request step of requesting a certificate issuing server to issue a digital certificate using one of a plurality of protocols; a receiving step of receiving at least a user's selection of one of the plurality of protocols and one of the plurality of uses of the digital certificate; a notification step of notifying the combination of the selected protocol and the selected purpose accepted in the acceptance step; 2. A method for setting a certificate signing request, comprising:

[0196] (Configuration 26) a request step of requesting a certificate issuing server to issue a digital certificate using one of a plurality of protocols; an acquiring step of acquiring priority information, which is information that sets priorities for each combination of the plurality of uses of the digital certificate and the plurality of protocols; a display control step of displaying a setting screen for a user to set information necessary for requesting issuance of the digital certificate, including the purpose of use of the digital certificate, in a display state that reflects the priority information acquired in the acquisition step; 2. A method for setting a certificate signing request, comprising:

[0197] (Configuration 27) A program to be executed by a computer, a request step of requesting a certificate issuing server to issue a digital certificate using one of a plurality of protocols; a receiving step of receiving at least a user's selection of one of the plurality of protocols and one of the plurality of uses of the digital certificate; a notification step of notifying the combination of the selected protocol and the selected purpose accepted in the acceptance step; Programs including.

[0198] (Configuration 28) A program to be executed by a computer, a request step of requesting a certificate issuing server to issue a digital certificate using one of a plurality of protocols; an acquiring step of acquiring priority information, which is information that sets priorities for each combination of the plurality of uses of the digital certificate and the plurality of protocols; a display control step of displaying a setting screen for a user to set information necessary for requesting issuance of the digital certificate, including the purpose of use of the digital certificate, in a display state that reflects the priority information acquired in the acquisition step; Programs including.

Claims

1. a requesting means for requesting the certificate issuing server to issue a digital certificate using one of a plurality of protocols; a receiving means for receiving a user's selection of one of the plurality of protocols and one of the plurality of uses of the digital certificate; a notification means for notifying the combination of the selected protocol and the selected purpose accepted by the acceptance means; An information processing device comprising:

2. an acquisition unit for acquiring priority information that is information in which a priority is set for each combination of the plurality of uses and the plurality of protocols; The information processing device according to claim 1, characterized in that the notification means performs the notification when it determines, based on the priority information acquired by the acquisition means, that there is a second combination that has a higher priority than a first combination, which is a combination of the purpose related to the selection accepted by the acceptance means and the protocol related to the selection.

3. 3. The information processing apparatus according to claim 2, wherein the notification by the notification means includes a presentation of a protocol recommended for use with respect to the selected purpose.

4. 4. The information processing apparatus according to claim 3, wherein the protocol recommended for use is a protocol related to the second combination.

5. The receiving means 2. The information processing device according to claim 1, further comprising: a first UI screen for a user to set information required to request the issuance of the electronic certificate using the selected protocol and the intended use of the electronic certificate.

6. 4. The information processing apparatus according to claim 3, wherein the accepting unit further accepts a change to the protocol recommended for use.

7. 7. The information processing device according to claim 6, wherein, when a change to the recommended protocol is accepted, the accepting means displays a second UI screen for the user to set information necessary to request the issuance of the electronic certificate using the recommended protocol and the intended use of the electronic certificate.

8. The information processing device according to claim 7, characterized in that the reception means reflects on the second UI screen the information necessary to request the issuance of the electronic certificate using the protocol related to the selection, and the information necessary to request the issuance of the electronic certificate set on a first UI screen for the user to set the use of the electronic certificate.

9. The system further includes a setting unit for setting whether or not the notification unit should issue the notification, 2. The information processing apparatus according to claim 1, wherein the notification means issues the notification when the setting means has set the notification to be executed.

10. the notification by the notification means includes presentation of a protocol recommended for use in the selected application; The accepting means further accepts a change to the protocol recommended for use, and if the change to the protocol recommended for use is not made, 10. The information processing apparatus according to claim 9, wherein the setting unit sets the combination of the selected purpose and the recommended protocol so that the notification unit does not issue the notification.

11. 8. The information processing device according to claim 7, wherein when the notification is made by the notification means, the request means requests the certificate issuing server to issue the electronic certificate when information necessary to request the issuance of the electronic certificate using the recommended protocol and the purpose of the electronic certificate are set on the second UI screen.

12. 8. The information processing apparatus according to claim 7, wherein the requesting means requests the certificate issuing server to issue the digital certificate at a specified date and time.

13. 13. The information processing apparatus according to claim 1, wherein the notification means displays the notification on a screen.

14. 13. The information processing apparatus according to claim 1, wherein the notification means transmits the notification by email.

15. 3. The information processing apparatus according to claim 2, wherein the priority information is set and stored in advance.

16. 3. The information processing apparatus according to claim 2, wherein the priority information is set by a user.

17. 2. The information processing apparatus according to claim 1, wherein the notification by the notification means relates to at least security.

18. a requesting means for requesting the certificate issuing server to issue a digital certificate using one of a plurality of protocols; an acquisition means for acquiring priority information that is information that sets priorities for each combination of the plurality of uses of the digital certificate and the plurality of protocols; a display control means for displaying a UI screen for a user to set information necessary for requesting issuance of the digital certificate, including the purpose of use of the digital certificate, in a display state that reflects the priority information acquired by the acquisition means; and An information processing device comprising:

19. The display control means The UI screen is displayed in a display state in which a second combination having a lower priority than a first combination having the highest priority is not selectable based on the priority information acquired by the acquisition means.

19. The information processing apparatus according to claim 18,

20. The display control means If there is an unselectable protocol that is a protocol that does not exist in combination with the application for which the highest priority is set based on the priority information acquired by the acquisition means, the UI screen is displayed in a state in which the unselectable protocol is unselectable.

19. The information processing apparatus according to claim 18,

21. 20. The information processing apparatus according to claim 19, wherein the display state in which the selection is disabled is a masked display of the uses related to the second combination.

22. 21. The information processing apparatus according to claim 20, wherein the display state in which the selection is disabled is a masked display of a portion relating to the unselectable protocol.

23. 20. The information processing apparatus according to claim 1, wherein the plurality of protocols include ACME, EST, and SCEP.

24. 20. The information processing apparatus according to claim 1, wherein the plurality of uses include TSL, IEEE802.1X, and IPSec.

25. a request step of requesting a certificate issuing server to issue a digital certificate using one of a plurality of protocols; a receiving step of receiving at least a user's selection of one of the plurality of protocols and one of the plurality of uses of the digital certificate; a notification step of notifying the combination of the selected protocol and the selected purpose accepted in the acceptance step; 2. A method for setting a certificate signing request, comprising:

26. a request step of requesting a certificate issuing server to issue a digital certificate using one of a plurality of protocols; an acquiring step of acquiring priority information that is information that sets priorities for each combination of the plurality of uses of the digital certificate and the plurality of protocols; a display control step of displaying a setting screen for a user to set information necessary for requesting issuance of the digital certificate, including the purpose of use of the digital certificate, in a display state that reflects the priority information acquired in the acquisition step; and 2. A method for setting a certificate signing request, comprising:

27. A program to be executed by a computer, a request step of requesting a certificate issuing server to issue a digital certificate using one of a plurality of protocols; a receiving step of receiving at least a user's selection of one of the plurality of protocols and one of the plurality of uses of the digital certificate; a notification step of notifying the combination of the selected protocol and the selected purpose accepted in the acceptance step; Programs including.

28. A program to be executed by a computer, a request step of requesting a certificate issuing server to issue a digital certificate using one of a plurality of protocols; an acquiring step of acquiring priority information that is information that sets priorities for each combination of the plurality of uses of the digital certificate and the plurality of protocols; a display control step of displaying a setting screen for a user to set information necessary for requesting issuance of the digital certificate, including the purpose of use of the digital certificate, in a display state that reflects the priority information acquired in the acquisition step; and Programs including.

Images