Information processing unit, information processing method, and program

Abstract

To enable a user to efficiently obtain a certificate from a certificate authority.SOLUTION: When a MultiFunction Peripheral (MFP) receives a display request for a setting screen related to a certificate issuance request from a PC, the MFP causes a Web page controller to display a connection setting screen on the PC. A key pair / certificate acquisition controller acquires setting value information related to setting values that can be supported by a certificate authority having been set in a connection setting screen by using a GET method such as HTTP. Based on the acquired setting value information, the key pair / certificate acquisition controller causes the Web page controller to generate a certificate issuance request setting screen that disables selection of setting values other than setting values that can be supported by the certificate authority and that can be supported by the key pair / certificate acquisition controller, and causes a remote UI (RUI) to display a certificate issuance request setting screen.SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] The present invention relates to an information processing technique for obtaining a digital certificate. [Background technology]

[0002] In recent years, multifunction peripherals (MFPs) have become more than simply capable of printing and transmitting images; they are also equipped with functions for storing image data internally and providing file services to information processing devices such as PCs. Therefore, to maintain a safe and secure office environment, MFPs are also required to authenticate and communicate using digital certificates (hereinafter referred to as "certificates"). This certificate-based authentication technology, known as public key infrastructure (PKI) (see Non-Patent Document 1), is used in communication protocols. For example, the authenticity of a server can be verified by obtaining a server public key certificate (server certificate) from the server and the CA certificate of the CA that issued the server certificate. Furthermore, a client can provide a client public key certificate (client certificate) to a server such as a multifunction peripheral, allowing the server to verify the authenticity of the client. Protocols such as Enrollment over Secure Transport (EST) (see Non-Patent Document 1) allow clients and servers to request the issuance of certificates from a CA. Using this protocol, a client or server can obtain a certificate issued by a CA once, and then re-register it as needed before it expires, automatically obtaining a new certificate without user intervention. On the other hand, even when using a protocol such as EST, the user must perform an operation at least once to request a certificate and obtain a certificate. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Max Pritikin, Peter E. Yee, Dan Harkins, “Enrollment over Secure Transport”, [online], [Retrieved May 2, 2024], Internet<URL:https: / / datatracker.ietf.org / doc / html / rfc7030> Summary of the Invention [Problem to be solved by the invention]

[0004] However, when requesting a certificate, a user may enter a setting value on the UI screen that the certificate authority cannot process, resulting in the certificate not being issued and an error being returned. Generally, the setting values ​​that the certificate authority can handle are not made clear to the user, which can lead to repeated failures in obtaining a certificate.

[0005] Therefore, an object of the present disclosure is to enable a user to efficiently obtain a certificate from a certificate authority. [Means for solving the problem]

[0006] The technology disclosed herein is an information processing device capable of making a request for the issuance of a certificate to a certification authority, and is characterized by comprising: a control means for controlling a UI that accepts setting values ​​for the certificate issuance request; and an acquisition means for acquiring from the certification authority the setting values ​​that the certification authority can support, wherein the control means controls the UI so that setting values ​​that the certification authority cannot support cannot be accepted. [Effects of the Invention]

[0007] The present disclosure allows users to efficiently obtain certificates from certificate authorities. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating a system configuration according to an embodiment of the present invention. [Figure 2]FIG. 2 is a diagram illustrating a hardware configuration of the multifunction peripheral according to the embodiment. [Figure 3] FIG. 2 is a diagram illustrating a software configuration of the multifunction peripheral according to the embodiment. [Figure 4] FIG. 2 is a diagram illustrating a hardware configuration of a PC according to the present embodiment. [Figure 5] FIG. 2 is a diagram illustrating the software configuration of a PC according to the present embodiment. [Figure 6] 10 is a flowchart illustrating a process for setting a certificate issuance request according to the present embodiment. [Figure 7] 10 is a flowchart illustrating a certificate issuance request process. [Figure 8] 10 is an example of a connection setting screen for specifying a certificate authority. [Figure 9] 10 is an example of a setting screen related to a certificate issuance request. [Figure 10] 10 is an example of an error screen in the certificate issuance request setting. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[0010] Note that the following embodiments do not limit the scope of the present invention, and not all of the combinations of features described in the embodiments are necessarily essential to the solution of the present invention. Note that the following description will be given taking an example of a multifunction peripheral (MFP) as an information processing device that uses and manages certificates according to the embodiments. However, the scope of application is not limited to multifunction peripherals, and any information processing device that can use certificates may be used.

[0011] FIG. 1 is a diagram illustrating a system configuration according to this embodiment of the present invention.

[0012] A multifunction peripheral 101 with a printing function is capable of transmitting and receiving print data, scanned image data, and the like to and from other information processing apparatuses via a network 110. The multifunction peripheral 101 also has a function for performing encrypted communications using TLS, IPSEC, IEEE802.1X, and the like, and holds a public-private key pair and a certificate used in these encryption processes. The multifunction peripheral 101 also has a web server function, and exposes to the network 110 a web-page type remote UI (hereinafter referred to as RUI) function that can execute processes for requesting and obtaining the issuance of a certificate. Here, the multifunction peripheral 101 is an example of an image forming apparatus, and the image forming apparatus is not limited to this, and may be a device that has the functions of a facsimile machine, a printer, or a copier, or a device that combines these functions.

[0013] The certification authority (CA) 102 has the functions of an issuing authority (IA) that issues certificates and the functions of a registration authority (RA) that accepts certificate issuance requests and performs registration processing. In other words, the certification authority 102 is a server device that has the functions of issuing and registering CA certificates via a network 110. An information processing device such as the multifunction peripheral 101 communicates with the certification authority 102 via the network 110 to request and obtain a certificate using a protocol for requesting the issuance of a certificate (hereinafter referred to as a certificate issuance request protocol). When the certification authority 102 receives a certificate issuance request from another information processing device via the network 110, it issues and registers a certificate based on the issuance request, and transmits the issued certificate to the issuance request source as a response to the issuance request. In this embodiment, the functions of the issuing authority and registration authority of the certification authority are implemented by the same server device. However, the issuing authority and registration authority may also be implemented by different server devices, and this is not particularly limited. Furthermore, in this embodiment, EST is used as the certificate signing request protocol, but it may be realized by a different certificate signing request protocol, and is not particularly limited.

[0014] The PC 103 is a personal computer equipped with a web browser and capable of viewing and using HTML documents and websites published by information processing devices connected to the network 110. A user of the PC 103 can configure the multifunction peripheral 101 by accessing the RUI of the multifunction peripheral 101 using the web browser.

[0015] FIG. 2 is a block diagram illustrating the hardware configuration of the multifunction peripheral 101 according to this embodiment. The CPU 201 executes the software program of the multifunction peripheral 101 and controls the entire device. The ROM 202 is a read-only memory that stores the boot program and fixed parameters of the multifunction peripheral 101. The RAM 203 is a random access memory that is used to store programs and temporary data when the CPU 201 controls the multifunction peripheral 101. The auxiliary storage unit 204 is an HDD, SSD, or the like, and stores system software, applications, and various data. The CPU 201 executes the boot program stored in the ROM 202, loads the program stored in the auxiliary storage unit 204 into the RAM 203, and controls the operation of the multifunction peripheral 101 by executing the loaded program. The network I / F control unit 205 controls the transmission and reception of data to and from the network 110. The scanner I / F control unit 206 controls the reading of documents by the scanner 211. The printer I / F control unit 207 controls the printing process by the printer 210. A panel control unit 208 controls a touch panel type operation panel 212, and controls the display of various information and the input of instructions from the user. A bus 209 interconnects the CPU 201, ROM 202, RAM 203, auxiliary storage unit 204, network I / F control unit 205, scanner I / F control unit 206, printer I / F control unit 207, and panel control unit 208. Control signals from the CPU 201 and data signals from each device are transmitted and received via this bus 209.

[0016] Fig. 3 is a block diagram illustrating the software modules of the multifunction peripheral 101 according to this embodiment. The software modules shown in Fig. 3 are implemented by the CPU 201 loading a program stored in the auxiliary storage unit 204 into the RAM 203 and executing it.

[0017] The network driver 301 controls the network I / F control unit 205 connected to the network 110 to send and receive data to and from the outside via the network 110. The network control unit 302 controls communication below the transport layer in a network communication protocol such as TCP / IP to send and receive data. The communication control unit 303 performs control using multiple communication protocols supported by the multifunction peripheral 101. In the process for obtaining and renewing a certificate using the Certificate Signing Request Protocol of this embodiment, the communication control unit 303 performs processing for generating and analyzing requests and responses defined in the HTTP or SOAP communication protocol to send and receive data. The communication control unit 303 also performs encrypted communication in TLS, IPSEC, and IEEE802.1X supported by the multifunction peripheral 101.

[0018] The web page control unit 304 generates HTML data for a web page capable of executing processes for requesting and acquiring a certificate, and controls communication for sending and receiving data associated with the processes executed on the web page. The web page control unit 304 executes processes for web page display requests sent from the network driver 301 via the communication control unit 303 and instructions for issuing and acquiring a certificate received on a web page. In response to a display request from a web page, the web page control unit 304 transmits HTML data of a default web page stored in the RAM 203 or the auxiliary storage unit 204, or HTML data generated in accordance with the contents of the display request. When the web page control unit 304 receives an instruction to execute processes for requesting and acquiring a certificate, it causes the key pair and certificate acquisition control unit 305 to execute the processes for requesting and acquiring a certificate.

[0019] The key pair and certificate acquisition control unit 305 executes the certificate issuance request and acquisition process based on instructions from the web page control unit 304. The key pair and certificate acquisition control unit 305 controls communication of the certificate issuance request protocol, and acquires and stores information about the certificate authority 102 with which it communicates. Information about the server that will become the certificate authority 102 processed by the key pair and certificate acquisition control unit 305 is stored in the CA information DB 321.

[0020] The CA information DB 321 is a database for storing data that the key pair and certificate acquisition control unit 305 can use to request a certificate issuance, and is stored in the auxiliary storage unit 204. The CA information DB 321 holds a table that associates the address of the server of the certificate authority 102 with setting values ​​that can be supported by the certificate authority 102. Table 1 shows a specific example of a table held by the CA information DB 321.

[0021] A table showing the setting values ​​that can be supported by the certificate authority 102 TIFF2025180517000002.tif41148

[0022] The information represented by each column in Table 1 is as follows: "ID" represents a number used to uniquely identify the server of the certification authority 102 stored in the CA information DB 321. "Server name" represents the URL of the server of the certification authority 102 where the information is stored. "Key length" represents the encryption method and key length of the key pair that can be used by the certification authority 102 to issue a certificate. "Signature algorithm" represents the signature method that can be used by the certification authority 102 to generate a signature.

[0023] The encryption processing unit 306 performs various processes for encrypted communication, such as encryption and decryption of data required for encrypted communication such as PKCS#7, PKCS#10, etc., generation and verification of digital signatures, generation of hash values, etc. The encryption processing unit 306 also performs various encryption processes required for generation and analysis of request and response data for certificate acquisition and renewal processing according to this embodiment.

[0024] The key pair and certificate management unit 307 manages the key pairs and certificates held by the multifunction peripheral 101. The key pair and certificate management unit 307 stores data on the key pairs and certificates together with various setting values ​​in the RAM 203 or the auxiliary storage unit 204. Although not shown in the drawings in this embodiment, processes such as displaying details of the key pairs and certificates, generating them, and deleting them can also be performed based on instructions from the user via the operation panel 212. The operation panel 212 and the panel control unit 208 are controlled by the UI control unit 308. In encrypted communications such as TLS, IPSEC, and IEEE802.1X executed by the communication control unit 303, data on the key pairs and certificates to be used is obtained from the key pair and certificate management unit 307, and encryption processing is performed by the encryption processing unit 306.

[0025] A print / read processor 310 performs printing processing using the printer 210 and document reading processing using the scanner 211. A device controller 311 generates control commands and control data for the multifunction peripheral 101 and controls the multifunction peripheral 101 in an overall manner.

[0026] FIG. 4 is a block diagram illustrating the hardware configuration of the PC 103 according to this embodiment.

[0027] The CPU 401 executes the software program of the PC 103 and controls the entire device. The ROM 302 is a read-only memory that stores the boot program and fixed parameters of the PC 103. The RAM 403 is a random access memory that is used to store programs and temporary data when the CPU 401 controls the PC 103. The auxiliary storage unit 404 is an HDD, SSD, or the like, and stores system software, applications, and various data. The CPU 401 executes the boot program stored in the ROM 402, loads the program stored in the auxiliary storage unit 404 into the RAM 403, and controls the operation of the PC 103 by executing the loaded program. The network I / F control unit 405 controls the sending and receiving of data to and from the network 110. The UI control unit 406 controls input processing via operation of the mouse 409 and keyboard 410. The display unit 407 controls the display 411 and controls the display of various information. A bus 408 interconnects the CPU 401, ROM 402, RAM 403, auxiliary storage unit 404, network I / F control unit 405, UI control unit 406, and display unit 407. Control signals from the CPU 401 and data signals from each device are transmitted and received via this bus 408.

[0028] Fig. 5 is a block diagram illustrating software modules included in the PC 103 according to this embodiment. The software modules shown in Fig. 5 are implemented by the CPU 401 expanding a program stored in the auxiliary storage unit 404 into the RAM 403 and executing it.

[0029] The network driver 501 controls the network I / F control unit 405 connected to the network 110 to send and receive data to and from the outside via the network 110. The network control unit 502 controls communication below the transport layer in a network communication protocol such as TCP / IP to send and receive data. The communication control unit 503 performs processing for generating and analyzing requests and responses defined in one of the multiple communication protocols supported by the PC 103, in this embodiment, the HTTP or SOAP communication protocol, and sends and receives data. The PC 103 accesses the RUI of the multifunction peripheral 101 via the communication control unit 503 and performs settings related to processing for obtaining and updating a certificate.

[0030] The web browser 504 is an application capable of displaying and operating web pages, and can display and operate web pages published by the multifunction peripheral 101 .

[0031] A display control unit 505 controls the screen that the web browser 504 displays on the display 411. A UI control unit 506 controls inputs from the mouse 409 and keyboard 410 for performing various operations on the web browser 504.

[0032] FIG. 6 is a flowchart illustrating a process for setting a certificate issuance request in the system according to this embodiment.

[0033] In this embodiment, the administrator of the multifunction peripheral 101 uses the web browser 504 installed on the PC 103 to connect to the RUI for requesting and obtaining a certificate that is made public by the multifunction peripheral 101, and performs operations such as issuing instructions related to the certificate issuance request and obtaining process. Here, the setting screen displayed on the web browser when making a certificate issuance request will be described with reference to Figures 8 and 9.

[0034] 8 is a diagram showing an example of a setting screen for specifying the certificate authority 102, which is displayed in the RUI published by the multifunction peripheral 101 according to this embodiment. The Web page shown in FIG. 8 is described using HTML data generated by the Web page control unit 304 shown in FIG. 3. This setting screen for specifying the certificate authority 102 is displayed on the display 411 when the RUI of the multifunction peripheral 101 is accessed using the Web browser 504 on the PC 103. Thereafter, unless otherwise noted, Web pages in this embodiment are displayed in a similar manner.

[0035] By inputting and changing setting values ​​on this connection setting screen, it becomes possible to execute settings for a certificate issuance request held by the multifunction device 101 from the PC 103. The connection setting screen includes input fields for a server name 801 and a port number 802 for inputting the host name of the server on which the certificate issuance service provided by the certificate authority 102 operates and the connection destination port number, and an OK button 803 for completing the settings. The multifunction device 101 connects to the certificate authority 102 based on the information set and saved on this connection setting screen.

[0036] 9(a) and 9(b) show setting screens related to a certificate issuance request made by the multifunction peripheral 101, which are displayed on the web browser 504. The multifunction peripheral 101 makes a certificate issuance request to the certification authority 102 based on the setting values ​​set on this certificate issuance request screen, and registers the issued certificate in the multifunction peripheral 101.

[0037] FIG. 9(a) shows a conventional setting screen for a certificate issuance request. Certificate acquisition request information 901 is a field for inputting setting values ​​for a certificate issuance request to be sent to the certificate authority 102. In this embodiment, the setting values ​​include a [Server Name], which is the URL of the certificate authority 102's server, a [Key Length], which sets the key length of the key pair to be generated, and a [Signature Algorithm], which sets the digital signature method. Other setting values ​​include an input field for issuer information [Input Issuer Information], a [Key Usage], which specifies the method of encrypted communication using the public key to be incorporated into the issued certificate, and a [Challenge Password], which is included in the certificate issuance request. An OK button 902 is a button for instructing the certificate authority 102 to start a certificate issuance request based on the setting values ​​entered on the certificate issuance request screen.

[0038] 9(b) shows a setting screen for a certificate issuance request that displays setting items based on setting values ​​that can be supported by the certificate authority 102 according to this embodiment. A caution message 903 is a message indicating that a specific setting must be entered. Non-selectable options 904 are displayed in a grayed-out format when options that cannot be selected for a specific setting item are entered. A caution mark 905 is a mark indicating that a specific setting must be entered. Note that although non-selectable options are grayed out here, they may also be hidden.

[0039] In S601, when the multifunction peripheral 101 receives a request to display a setting screen related to a certificate issuance request from the PC 103, the web page control unit 304 causes the display 411 of the PC 103 to display the connection setting screen shown in Fig. 8. The user inputs the server name (URL) and port number of the certificate authority 102 on the displayed connection setting screen.

[0040] In S602, the key pair / certificate acquisition control unit 305 uses a GET method such as HTTP to acquire setting value information related to compatible setting values ​​from the certificate authority 102 set on the connection setting screen. This process may be performed when the OK button 803 on the connection setting screen is pressed, or may be performed in parallel with the display of the connection setting screen if the server name and port number of the certificate authority 102 are set in advance.

[0041] In S603, the key pair / certificate acquisition control unit 305 receives the response from the certificate authority 102 and determines whether or not acquisition of the setting value information from the certificate authority 102 was successful. If acquisition of the setting value information was successful, the process proceeds to S604; if acquisition failed, the process proceeds to S608. Note that, at this time, if the setting value information cannot be acquired from the certificate authority 102 within a predetermined time and the setting value information is stored in the CA information DB 321 in S604 (described later), the setting value information may be acquired from the CA information DB 321. For example, a server name in Table 1 may be identified from the server name 801 of the certificate authority 102 set on the connection setting screen shown in FIG. 8, and the setting value corresponding to the identified server name may be acquired as a setting value compatible with the certificate authority 102.

[0042] In S604, based on the acquired setting value information, the key pair / certificate acquisition control unit 305 compares setting values ​​that are compatible with the certificate authority 102 with setting values ​​that are compatible with the key pair / certificate acquisition control unit 305. At this time, the key pair / certificate acquisition control unit 305 may store the acquired setting values ​​that are compatible with the certificate authority 102 in the CA information DB 321 in association with the server name of the certificate authority 102 that is set on the connection setting screen shown in FIG.

[0043] In S605, the key pair / certificate acquisition control unit 305 determines whether any of the setting values ​​compatible with the encryption processing unit 306 is compatible with the certificate authority 102. If any setting value compatible with the encryption processing unit 306 and the certificate authority 102 is present, the process proceeds to S606; if no such setting value is present, the process proceeds to S607.

[0044] In S606, the key pair and certificate acquisition control unit 305 causes the web page control unit 304 to generate a certificate issuance request setting screen in which setting values ​​supported by the encryption processing unit 306 are made unselectable except for setting values ​​supported by the certificate authority 102, and causes the RUI to display the generated screen. For example, like unselectable option 904, some options for setting items, i.e., setting values ​​that the certificate authority 102 cannot support, are displayed grayed out. At this time, if there is a setting item that the certificate authority 102 requires to be included in the certificate issuance request among the setting values ​​supported by the certificate authority 102, the certificate issuance request setting screen may be generated so as to force the user to input a value for that setting item. For example, if the setting values ​​supported by the certificate authority 102 include a challenge password item, the certificate authority 102 requests that the challenge password, which is the password of the certificate authority 102, be included in the certificate issuance request. At this time, the key pair and certificate acquisition control unit 305 may generate the certificate issuance request setting screen so as to force the user to input the setting item. For example, in FIG. 9(b), a warning message 903 or a warning mark 905 indicating that input is required may be highlighted, or the OK button 902 may not be pressed until the required setting items are input, thereby preventing the setting from being completed.

[0045] In S607, the key pair and certificate acquisition control unit 305 causes the web page control unit 304 to generate an error screen and displays it on the RUI. An example of an error screen for certificate issuance request setup is shown in Figure 10. An error message 1001 indicates the details of the error, and pressing the OK button 1002 terminates the certificate issuance request setup in accordance with the error, and the process proceeds to S610.

[0046] In S608, the key pair / certificate acquisition control unit 305 causes the web page control unit 304 to generate a screen that allows the selection of all setting values ​​that can be supported by the encryption processing unit 306, and causes the RUI to display this as a certificate issuance request setting screen.

[0047] In S609, the Web page control unit 304 waits until the user of the RUI completes the settings, and when the settings are complete, notifies the key pair and certificate acquisition control unit 305 of the set values.

[0048] In S610, the key pair / certificate acquisition control unit 305 executes a certificate issuance request, and the series of processes ends. The certificate issuance request process will be described in detail with reference to FIG.

[0049] Fig. 7 is a flowchart for explaining the processing of the certificate issuance request in S610 of Fig. 6 by the multifunction peripheral 101 according to this embodiment. This processing is achieved by the CPU 201 executing the program of the key pair and certificate acquisition control unit 305 loaded in the RAM 203.

[0050] In S701, the key pair / certificate acquisition control unit 305 acquires setting value information including values ​​such as [Key length] and [Input of issuer information] that were set on the certificate issuance request setting screen when it was confirmed that the settings were completed in S609 of Figure 6.

[0051] In S702, the key pair and certificate acquisition control unit 305 acquires the CA certificate of the certification authority 102 stored in the key and certificate information storage unit 322 via the key pair and certificate management unit 307.

[0052] In S703, the key pair / certificate acquisition control unit 305 uses the encryption processing unit 306 to generate a key pair and a certificate signing request (CSR) based on the setting value information acquired in S701. Note that the CSR in this embodiment is in the PKCS#10 (RFC2986: PKCS#10: Certification Request Syntax Specification) format defined in EST. The CSR includes the public key of the generated key pair and the setting value information acquired in S701.

[0053] In S704, the key pair / certificate acquisition control unit 305 determines whether or not the generation of the CSR in S703 was successful, and if it is determined to be successful, proceeds to S705, and if it is unsuccessful, proceeds to S710.

[0054] In S705, the key pair / certificate acquisition control unit 305 connects to the certification authority 102 using the TCP / IP protocol based on the setting value information acquired in S701, and transmits the CSR generated in S703 to the certification authority 102 using the POST method of the HTTP protocol, etc. Then, the key pair / certificate acquisition control unit 305 receives response data to the CSR from the certification authority 102.

[0055] In S706, the key pair / certificate acquisition control unit 305 determines whether or not the response data was successfully received in S705, and if successful, proceeds to S707, and if not, proceeds to S710.

[0056] In S707, the key pair / certificate acquisition control unit 305 verifies the signature data included in the response data received in S705 using the public key included in the CA certificate acquired in S702.

[0057] In S708, the key pair / certificate acquisition control unit 305 determines whether or not the signature verification in S707 was successful, and if successful, proceeds to S709, and if unsuccessful, proceeds to S712.

[0058] In S709, the key pair / certificate acquisition control unit 305 causes the encryption processing unit 306 to analyze the response data received in S705 and acquire a server certificate from the response data.

[0059] In S710, the key pair and certificate acquisition control unit 305 sets the purpose of the certificate acquired in S709 based on the information about [Key Usage] included in the setting value information acquired in S701, associates it with the key pair generated in S703, and registers it as a server certificate. At this time, the key pair and certificate acquisition control unit 305 associates the public key pair generated in S1503 with the certificate acquired in S1516, and stores them in the key and certificate information storage unit 322 via the key pair and certificate management unit 307.

[0060] In S711, the key pair / certificate acquisition control unit 305 determines whether or not the server certificate registration process in S715 was successful, and if successful, proceeds to S712, and if unsuccessful, proceeds to S712.

[0061] In S712, the key pair / certificate acquisition control unit 305 executes error processing and ends the processing. Here, the key pair / certificate acquisition control unit 305 may cause the web page control unit 304 to generate an error screen indicating what kind of error occurred in S704, S706, S708, or S711, and display the error screen on the RUI. For example, if a response could not be received in S706, this error screen may display details of the cause of the error, such as failure to connect to the certificate authority 102, failure to send the CSR, or failure to receive a response from the certificate authority 102. Similarly, if registration could not be performed in S711, the error screen may display details of the cause of the error, such as failure to obtain a certificate, failure to register a certificate, or failure to set the certificate's purpose.

[0062] As described above, according to this embodiment, when a user sets up a certificate issuance request, only setting values ​​that are compatible with both the certificate authority 102 and the multifunction peripheral 101 can be selected on the UI. This allows a user who sets up a certificate issuance request on the multifunction peripheral to efficiently obtain a certificate.

[0063] The setting values ​​that can be selected on the UI may be setting values ​​that are compatible not only with the multifunction device 101 and the certificate authority 102, but also with the PC 103. In this case, the multifunction device 101 may acquire, from the PC 103, setting value information related to setting values ​​that the PC 103 can support.

[0064] (Other Examples) The present invention can also be realized by supplying a program that realizes one or more functions of the above-described embodiments to a system or device via a network or a storage medium, and having one or more processors in the computer of the system or device read and execute the program.The present invention can also be realized by a circuit (e.g., ASIC) that realizes one or more functions.

[0065] The present disclosure includes the following configurations and methods. [Configuration 1] An information processing device capable of making a certificate issuance request to a certificate authority, a control means for controlling a UI that accepts setting values ​​for the certificate issuance request; an acquisition means for acquiring the setting value that the certification authority can support from the certification authority; Equipped with the control means controls the UI so that the setting value that the certification authority cannot support is not accepted. 1. An information processing device comprising: [Configuration 2] the setting values ​​include a setting value related to an encrypted communication method using the certificate; 2. The information processing device according to configuration 1, [Configuration 3] the setting values ​​include a setting value for specifying the key length of a public key to be incorporated into the certificate; 3. The information processing device according to configuration 1 or 2. [Configuration 4] the setting values ​​include a setting value related to a signature method for issuing the certificate; 4. The information processing device according to any one of configurations 1 to 3. [Configuration 5] the setting value accepted by the accepting means is the setting value that can be supported by the certificate authority and an external device that performs encrypted communication using the certificate; 5. The information processing device according to any one of configurations 1 to 4. [Configuration 6] When the acquisition means cannot acquire the setting value that the certificate authority can support within a predetermined time, the acceptance means sets the setting value accepted by the acceptance means to the setting value that the information processing device and the external device can support. 6. The information processing device according to configuration 5. [Configuration 7] the accepting means includes a display control means for displaying, on a UI for inputting the setting values, setting values ​​accepted by the accepting means in a manner that allows selection, and displaying setting values ​​not accepted by the accepting means in a manner that prevents selection, 7. The information processing device according to any one of configurations 1 to 6. [Configuration 8] the UI is a remote UI for receiving the setting values ​​from an external device; 8. The information processing device according to configuration 7. [Configuration 9] the display control means highlights essential setting values ​​among the setting values ​​on the UI. 9. The information processing device according to any one of configurations 7 and 8. [Configuration 10] the receiving means does not finish receiving the setting values ​​until at least the required setting values ​​are input. 10. The information processing device according to configuration 9. [Configuration 11] The certificate is a server certificate for performing encrypted communication. 11. The information processing device according to any one of configurations 1 to 10. [Configuration 12] An information processing method for making a certificate issuance request to a certification authority, comprising: controlling a UI that accepts setting values ​​for the certificate issuance request; acquiring, from the certificate authority, the setting value that the certificate authority can support; Equipped with the controlling step controls the UI so that the setting value that the certificate authority cannot support is not accepted. 1. An information processing method comprising: [Configuration 13] 12. A program for causing a computer to function as the information processing device according to any one of configurations 1 to 11.

Claims

1. An information processing device capable of making a certificate issuance request to a certificate authority, a control means for controlling a UI that accepts setting values ​​for the certificate issuance request; an acquisition means for acquiring the setting value that the certification authority can support from the certification authority; Equipped with the control means controls the UI so that the setting value that the certificate authority cannot support is not accepted.

1. An information processing device comprising:

2. the setting values ​​include a setting value related to an encrypted communication method using the certificate; 2. The information processing apparatus according to claim 1, wherein:

3. the setting values ​​include a setting value for specifying the key length of a public key to be incorporated into the certificate; 2. The information processing apparatus according to claim 1, wherein:

4. the setting values ​​include a setting value related to a signature method for issuing the certificate; 2. The information processing apparatus according to claim 1, wherein:

5. the setting value accepted by the accepting means is the setting value that can be supported by the certificate authority and an external device that performs encrypted communication using the certificate; 2. The information processing apparatus according to claim 1, wherein:

6. When the acquisition means cannot acquire the setting value that the certificate authority can support within a predetermined time, the acceptance means sets the setting value accepted by the acceptance means to the setting value that the information processing device and the external device can support.

6. The information processing apparatus according to claim 5,

7. the accepting means includes a display control means for displaying, on a UI for inputting the setting values, setting values ​​accepted by the accepting means in a manner that allows selection, and displaying setting values ​​not accepted by the accepting means in a manner that prevents selection, 2. The information processing apparatus according to claim 1, wherein:

8. the UI is a remote UI for receiving the setting value from an external device; 8. The information processing apparatus according to claim 7,

9. the display control means highlights essential setting values ​​among the setting values ​​on the UI.

8. The information processing apparatus according to claim 7,

10. the receiving means does not finish receiving the setting values ​​until at least the required setting values ​​are input.

10. The information processing apparatus according to claim 9,

11. The certificate is a server certificate for performing encrypted communication.

11. The information processing apparatus according to claim 1,

12. An information processing method for making a certificate issuance request to a certification authority, comprising: controlling a UI that accepts setting values ​​for the certificate issuance request; acquiring, from the certificate authority, the setting value that the certificate authority can support; Equipped with The controlling step controls the UI so that the setting value that the certificate authority cannot support cannot be accepted.

1. An information processing method comprising:

13. A program for causing a computer to function as the information processing device according to any one of claims 1 to 10.

Images