Management system, manager, method for controlling device management system, method for controlling manager, and program

Abstract

To improve security of communication of a device management system.SOLUTION: In a device management system including a manager 101 configured to manage a network device and an agent configured to relay communication between the manager 101 and the network device, the manager 101 includes a setting unit configured to set verification setting as to whether to verify a certificate of the agent when performing encrypted communication with the agent, and a verification unit configured to verify the certificate by determining whether to verify the certificate of the agent according to the certificate and the verification setting registered in the manager 101 when performing encrypted communication with the agent. The agent includes a verification means for verifying the certificate by determining whether to verify the certificate of the manager 101 according to the certificate registered in the agent when performing encryption communication with the manager 101.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to security of communication between a manager and an agent of a device management system. [Background technology]

[0002] There are device management systems that manage devices connected to a network. Device management systems provide various services (functions) to the devices they manage. When there are a large number of devices to manage, the device management system may be configured with a single manager that manages the entire system and multiple agents that execute processes on the devices according to instructions from the management device. To ensure security, communication encryption is essential for communications with each device within the system. In encrypted communications, certificate verification is used to prevent spoofing of the communication partner. Patent Document 1 discloses an MFP that, when it receives a request for encrypted communication with an external server from an application that uses specified information, verifies the server certificate of the external server using a root certificate with specified attribute information set. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2021-33645 Summary of the Invention [Problem to be solved by the invention]

[0004] However, Patent Document 1 relates to communication between an MFP and a manager or agent, which is a management server, and does not take into account an agent placed between the MFP and the manager. In order to improve system security, certificate verification may also be required in communication between a manager and an agent.

[0005] The present invention aims to improve the security of communications in a device management system. [Means for solving the problem]

[0006] In order to solve the above problems, a device management system of the present invention is a device management system having an apparatus as a manager that manages network devices and an apparatus as an agent that relays communication between the manager and the network devices, wherein the manager has a setting means for setting a verification setting for whether to verify the agent's certificate when performing encrypted communication with the agent, and a verification means for determining whether to verify the agent's certificate in accordance with a certificate registered in the manager and the verification setting when performing encrypted communication with the agent, and if it is determined that the agent's certificate should be verified, acquiring a certificate from the agent and verifying the certificate.The agent has a verification means for determining whether to verify the manager's certificate in accordance with a certificate registered in the agent when performing encrypted communication with the manager, and if it is determined that verification should be performed, acquiring a certificate from the manager and verifying the certificate. [Effects of the Invention]

[0007] According to the present invention, it is possible to improve the security of communications in a device management system. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating a system configuration. [Figure 2] FIG. 2 is a diagram illustrating a hardware configuration of an information processing device on which a manager and an agent operate. [Figure 3] FIG. 2 is a diagram illustrating the software configuration of a manager and an agent. [Figure 4] FIG. 10 is a diagram illustrating an example of a certificate validation setting screen. [Figure 5]10 is a flowchart showing a verification process by a manager. [Figure 6] 10 is a flowchart showing a verification process by an agent. [Figure 7] 10 is a flowchart showing a warning display process. [Figure 8] FIG. 10 is a diagram illustrating an example of a warning screen. DETAILED DESCRIPTION OF THE INVENTION

[0009] Figure 1 shows the system configuration. In a device management system, a manager that manages network devices (hereafter referred to as devices) provides services to devices connected to the network via agents. When there are a large number of devices to manage, the device management system is configured with a manager device that manages the entire system, and multiple agent devices that execute processes on the devices according to instructions from the manager (large-scale configuration). On the other hand, when there are a small number of devices to manage, the manager and agents are configured on the same host computer (device) (small-scale configuration).

[0010] 1, the system includes a manager 101, a directory server 105, an agent 121, an agent 107, and multiple devices to be managed (device 102, device 103, device 110, and device 111). The agent 121 runs on a PC 120, which is the same host computer (hereinafter referred to as a host) as the manager 101. On the other hand, the agent 107 runs on a host different from the host on which the manager 101 runs.

[0011] Devices 102, 103, 110, and 111 are network devices managed by manager 101. Of these, devices 102 and 103 are connected to the same network 104 as agent 121. Communication between manager 101 and devices 102 and 103 is performed via agent 121. Devices 110 and 111 are connected to the same network 108 as agent 107. Communication between manager 101 and devices 110 and 111 is performed via router 109 and agent 107.

[0012] The manager 101, the directory server 105, the agent 121, the device 102, and the device 103 are interconnected by a network 104. The network 104 is, for example, a WAN. The agent 107, the device 110, and the device 111 are interconnected by a network 108. The network 108 is, for example, a LAN. Note that the networks 104 and 108 may be configured to enable data transmission and reception, and any communication method may be used. For example, the network may be configured as any one of a LAN, a WAN, a cellular network such as LTE or 5G, a wireless network, a telephone line, a dedicated digital line, etc., or a combination of these.

[0013] The network 104 and the network 108 are connected by a router 109. The router 109 can be configured to, for example, allow communication between the manager 101 and the agent 107 on the network 108, but block communication between the manager 101 and the devices 110 and 111. Note that, although this embodiment will be described using an example of a large-scale configuration with two agents and four devices, the configuration and operation will be the same as those described in this embodiment even when tens of thousands of devices are managed via a dozen or so agents.

[0014] 1 illustrates an example in which the manager 101 and the agents run on the same host and on different hosts, but the present invention is not limited to this. For example, in a large-scale device management system with many managed devices, multiple agents are configured on a host separate from the manager 101. On the other hand, in a small-scale device management system with few managed devices, the manager 101 and the agents run on the same host, and no agents run on a host separate from the manager 101. The system configuration of this embodiment may be any of a configuration in which the agents run on the same host as the manager 101, a configuration in which the agents run on a host separate from the manager 101, or a configuration in which these configurations are mixed.

[0015] The manager 101 provides various services (functions) for managing the network devices it manages. The manager 101 has a device management application. When providing services to devices, the manager 101 communicates with the devices using an agent. The manager 101 has a built-in web service server related to the functions it provides. The manager 101 may be realized by one or more information processing devices, a virtual machine (cloud service) that uses resources provided by a data center that includes information processing devices, or a combination of these.

[0016] Agent 107 and agent 121 perform device management processing based on instructions from manager 101. Agent 107 and agent 121 have agent applications. Agent 107 and agent 121 have built-in web service servers related to functions provided by the manager. Agent 107 and agent 121 are linked to devices according to the device addresses, etc. Agent 121 is linked to device 102 and device 103. Agent 107 is linked to device 110 and device 111.

[0017] The directory server 105 is an information processing device that manages user information such as user accounts. The manager 101 and the directory server 105 are connected to each other via a network 104. The manager 101 can also be configured so that a user of the directory server 105 can log in as a user of the manager 101. The directory server 105 may be realized by one or more information processing devices, a virtual machine (cloud service) that uses resources provided by a data center that includes information processing devices, or a combination of these.

[0018] Devices 102, 103, 110, and 111 are network devices that are managed by manager 101 and can communicate with manager 101 via corresponding agents. The network devices are, for example, multifunction printers (MFPs) that integrate multiple functions such as printing, reading, and faxing. Note that the network devices may also be printers, scanners, 3D printers, information processing devices such as PCs, image processing devices such as cameras, smart home appliances, and the like.

[0019] Here, a process flow for providing a service to a network device by the network device management system will be described using the agent 121 and the device 102 as an example. The manager 101 instructs the agent 121 to operate the device 102. The agent 121 follows the instructions of the manager 101 to communicate with the device 102 and perform operations such as sending a request to the device 102. The agent 121 then sends the results of the operation on the device 102 to the manager 101. Examples of operations by the agent 121 on the device 102 include obtaining information from the device 102, changing setting values ​​of the device 102, instructing the device 102 to install an application, and instructing the device 102 to update firmware. In this way, communication is performed between the manager 101 and the agent 121, and between the agent 121 and the device 102. Therefore, there is no direct communication between the device 102 and the manager 101.

[0020] 2 is a diagram showing the hardware configuration of an information processing device on which a manager and an agent run. Here, the explanation will be given using the manager 101 as an example, but the host computer and PC 120 on which the agent 121, agent 107, and directory server 105 run also have the same hardware configuration as the manager 101. The manager 101 includes a CPU 201, RAM 202, ROM 203, KBDC 204, VC 205, DC 206, HDD 207, and NIC 208. These components are connected to a system bus 209.

[0021] The CPU 201 controls the entire manager 101. The CPU 201 loads programs stored in memory (ROM 203 or HDD 207) into RAM 202 as needed, executes them, and generally controls each unit connected to the system bus 209. The CPU 201 may also load software (programs) downloaded via a network into RAM 202 as needed and execute them to generally control each unit connected to the system bus 209. The RAM 202 (Random Access Memory) is a memory from which data can be read and written, and functions as the main memory or work area of ​​the CPU 201. The ROM (Read Only Memory) 203 is a memory only for reading data, and stores, for example, the basic control program of the manager 101. The HDD (Hard Disk Drive) 207 stores various applications including a boot program, an operating system (OS), and an authentication client, as well as certificates, data, and the like. The external storage device 210 is a memory such as a hard disk drive (HDD) or a solid-state drive (SSD). The external storage device 210 stores various applications, database data, user files, and the like.

[0022] The KBDC 204 controls input to the manager 101. The KBDC 204 sends input information from input devices such as a keyboard or pointing device (not shown), a virtual keyboard, or voice input to the CPU 201, thereby controlling input to the manager 101. The VC 205 is a video controller that controls display on a display device (not shown). The display device may be, for example, an LCD (Liquid Crystal Display) or a head-mounted display capable of VR (Virtual Reality) display. The DC 206 is a disk controller that controls access to the external storage device 210. The NIC 208 is a communication controller, and the manager 101 connects to the network 104 via the NIC 208. The CPU 201 connects to the network 104 via the NIC 208, enabling data communication with each device on the network.

[0023] Figure 3 is a diagram illustrating the software configuration of the device management server and agent. Figure 3(A) is a diagram illustrating the software configuration of the manager 101. The manager 101 calls up a device management application program from memory and executes it with the CPU 201, thereby realizing processing by the function modules shown in Figure 3(A). The function modules shown in Figure 3(A) are provided, for example, as a device management application.

[0024] The manager 101 includes an agent management unit 301, a device management unit 302, an HTTPS connection unit 303, an HTTPS server 304, a certificate management unit 305, a verification unit 306, a display unit 308, and a task management unit 309. The agent management unit 301 manages information related to agents (agent 121 and agent 107) within the system. The device management unit 302 manages information related to devices to be managed (e.g., device 102, device 103, device 110, and device 111). The information related to devices includes information related to which agent the device is linked. The task management unit 309 manages tasks. As part of its task management, the task management unit 309 manages the content and results of operations on devices. Furthermore, the task management unit 309 instructs agents to operate devices by executing tasks. The management information managed by the task management unit 309 is stored in a database (not shown).

[0025] The manager 101 and the agent 107 communicate with each other mainly using HTTPS. The HTTPS connection unit 303 is the connection source in HTTPS communication, and the HTTPS server 304 is the connection destination in HTTPS communication. The HTTPS connection unit 303 performs processing to connect to an external HTTPS server, such as the HTTPS server 311 of the agent 107. The HTTPS server 304 is a web service server built into the manager 101 that is related to services provided by the manager 101. The HTTPS server 304 receives requests from external devices such as agents and devices, and returns responses to the requests. The HTTPS server 304 also provides a WEB UI that enables a user to operate the manager 101.

[0026] The certificate management unit 305 manages the certificates used when performing encrypted communication. Certificates are used to verify the identity of the connection destination and to prove that the certificate has not been tampered with. The certificate management unit 305 manages the certificates set in the HTTPS server of the manager 101. A self-signed certificate is registered in the manager 101 as the initial setting. The user can replace the self-signed certificate with a certificate (hereinafter referred to as a server certificate) digitally signed by an intermediate Certificate Authority (CA). The certificate management unit 305 accepts the registration (import) of a new server certificate by the user. Therefore, either a self-signed certificate or a server certificate is registered as a certificate in the manager 101. Certificates registered in the manager 101 are stored in the HDD 207.

[0027] The certificate management unit 305 also manages information about certificates acquired from agents. There are multiple times when the manager 101 acquires certificates from agents. For example, when the manager 101 connects to an agent via HTTPS, it requests the agent to acquire the certificate. When a new certificate is registered to an agent, the agent immediately sends the registered certificate to the manager 101, and the manager 101 acquires the certificate. The agent also sends a certificate to the manager 101 at predetermined regular intervals, and the manager 101 acquires the certificate. The certificate management unit 305 manages the latest certificates acquired from each agent.

[0028] The verification unit 306 verifies the certificate. In this embodiment, the verification unit 306 verifies whether the certificate acquired from the agent has been digitally signed by an intermediate certificate authority (CA). A public key is recorded in the server certificate. A standard processing method of the OS is used as a certificate verification method. The certificate verification is performed, for example, in accordance with the PKI (Public-Key Infrastructure) standard and based on standards such as RFC 5280. It is also possible to add a certificate designated by the user to a certificate list of the OS, and have the certificate added to the list treated as a trusted certificate. Note that the certificate verification method is not limited to this.

[0029] The verification unit 306 has a verification setting unit 307 that sets the verification setting as to whether to verify the agent's certificate when performing encrypted communication. The verification setting unit 307 provides a setting screen for performing the verification setting, accepts an instruction from the user to enable / disable the verification setting, and saves the setting. The verification unit 306 also determines whether to verify the agent's certificate when performing encrypted communication with the agent. The verification unit 306 of the manager 101 determines whether to perform verification based on the certificate registered in the manager 101 and the verification setting set by the user.

[0030] The display unit 308 controls the display of the screen provided by the manager 101. In this embodiment, the display unit 308 displays a certificate verification setting screen provided by the verification unit 306 and a warning display screen provided by the certificate management unit 305. The display unit 308 may control the VC 205 to display the screen on a display device (not shown), or may display the screen on a web browser.

[0031] Fig. 3(B) is a diagram illustrating the software configuration of an agent. Here, the agent 107 will be described as an example, but the other agents 121 also have a similar configuration. The agent 107 calls an application program for the device management agent from memory and executes it with the CPU 201, thereby realizing processing by the function modules shown in Fig. 3(B). The function modules shown in Fig. 3(B) are function modules related to services provided by the manager 101, and are provided, for example, as agent applications provided by the manager 101.

[0032] The agent 107 includes an HTTPS connection unit 310, an HTTPS server 311, a cache control unit 312, a certificate management unit 313, a verification unit 314, and a task execution unit 315. The task execution unit 315 executes tasks instructed by the manager 101. The task execution unit 315 executes operations on devices in accordance with instructions from the manager 101, and then transmits the results to the manager 101.

[0033] The manager 101 and the agent 107 communicate with each other primarily using HTTPS. The HTTPS connection unit 310 is the source of the HTTPS communication, and the HTTPS server 311 is the destination of the HTTPS communication. The HTTPS connection unit 310 performs processing to connect to an external HTTPS server, such as the HTTPS server 304 of the manager 101. The HTTPS server 311 is a web service server built into the agent 107 that handles services provided by the agent 107. The HTTPS server 311 receives requests from external devices such as the manager 101 and devices and returns responses to the requests. The cache control unit 312 provides a cache function for content within the manager 101. Static content, such as data for firmware updates, can be cached in the agent 107 for a certain period of time. Therefore, when the same static content is requested by a different device, the agent 107 can send the temporarily stored cached content to the device, thereby providing the content more quickly. Furthermore, using the cache reduces communication between the manager 101 and the agent 107 and reduces the load on the manager 101.

[0034] The certificate management unit 313 manages certificates used when performing encrypted communication. The certificate management unit 305 manages certificates set in the HTTPS server of the agent 107. A self-signed certificate is registered in the agent 107 as an initial setting. The user can replace the self-signed certificate with a server certificate digitally signed by an intermediate certificate authority (CA). The certificate management unit 313 accepts registration (import) of a new server certificate by the user. Therefore, either a self-signed certificate or a server certificate is registered as a certificate in the agent 107. A certificate registered in the agent 107 is stored in the HDD 207 of the agent 107. When the certificate management unit 313 receives a certificate acquisition request from the manager 101, it transmits the certificate to the manager 101. Furthermore, when a new certificate is registered in the agent 107, the certificate management unit 313 transmits the certificate to the manager 101. Furthermore, if it is determined that the certificate should be sent to the manager 101 periodically, the certificate management unit 313 sends the certificate to the manager 101 at a periodic timing that is predetermined for the manager 101.

[0035] Generally, the replacement of a self-signed certificate with a server certificate is first performed for the manager 101, which manages the entire system, and then, if necessary, the server certificate is also replaced for the agent 107. Therefore, in this embodiment, if a server certificate is registered in the agent 107, it is assumed that the server certificate is also registered in the manager 101. Also, if a server certificate is not registered in the manager 101, it is assumed that the server certificate is not registered in the agent 107 either.

[0036] The verification unit 314 verifies the certificate. In this embodiment, the verification unit 314 verifies whether the certificate acquired from the manager 101 has been digitally signed by an intermediate certificate authority (CA). A public key is described in the server certificate. The method of verifying the certificate by the verification unit 314 is the same as the method of verifying the certificate by the verification unit 306 of the manager 101. Furthermore, when performing encrypted communication with the manager 101, the verification unit 314 determines whether to verify the certificate of the manager 101. The agent 314 determines whether to perform verification based on the certificate registered in the agent itself.

[0037] A certificate is required when performing encrypted communication using an HTTPS server. After installation, a self-signed certificate is set as the digital certificate used for encrypted communication in the HTTPS servers of the manager 101 and each agent (agent 107, agent 121). A self-signed certificate is a certificate in which the certificate issuer is the same as the certificate recipient. Generally, the reliability of a self-signed certificate is lower than that of a certificate issued by a certificate authority, and the certificate is determined to be invalid during certificate verification. A user can replace the HTTPS server certificate from a self-signed certificate with a valid server certificate issued by a more reliable certificate authority prepared by the user. In this embodiment, it is assumed that certificate replacement is performed by both the manager 101 and the agent, or by the manager 101 alone. However, this embodiment does not assume that the certificate of the agent that executes instructions from the manager 101 is replaced without replacing the certificate of the manager 101 that manages the entire system.

[0038] HTTPS servers use https (Hypertext Transfer Protocol Secure) for encrypted communication. https is encrypted using SSL (Secure Sockets Layer) / TLS (Transport Layer Security), and https communication is performed over a secure connection. In https communication, the communication is encrypted using a key, and the server is verified (authenticated) using a certificate. Encryption protects the communication content from being eavesdropped on or tampered with by malicious third parties. In addition, verifying (authenticating) the server using a certificate confirms the communication partner, preventing spoofing by malicious third parties.

[0039] In server verification using a certificate, it is verified whether the server certificate sent by the destination is digitally signed by an intermediate certificate authority (CA). The verification procedure is performed in accordance with the PKI standard. For example, when the manager 101, which is the source of the connection, performs encrypted communication with the agent 107, which is the destination of the connection, the manager 101 verifies the certificate of the agent 107. On the other hand, when the agent 107, which is the source of the connection, performs encrypted communication with the manager 101, which is the destination of the connection, the agent 107 verifies the certificate of the manager 101.

[0040] When a manager and an agent are running on the same host, there is no risk of communications being intercepted by a third party or of the connection destination being spoofed, so there is no need to verify the certificate. Therefore, when a manager and an agent are running on the same host, such as manager 101 and agent 121, the manager 101 does not verify the certificate of the agent 121. Similarly, when a manager and an agent are running on the same host, the agent 121 does not verify the certificate of the manager 101.

[0041] In this embodiment, the manager 101 can be set to determine whether or not to verify the server certificate. If the setting to verify the server certificate is set, the manager 101 will verify the server certificate of the agent when connecting to the HTTPS server of the agent. On the other hand, if the risk of spoofing is low due to the network configuration, it is also possible to set the manager 101 not to verify the server certificate, and if the setting not to verify the server certificate is set, the manager 101 will not verify the server certificate of the agent.

[0042] 4 is a diagram showing an example of a server certificate verification setting screen. The server certificate verification setting screen 400 is a screen provided by the manager 101. The verification setting screen 400 is displayed when a user who has logged in to a service provided by the device management system has the authority to perform certificate verification settings. The verification setting screen 400 is a screen provided by the verification setting unit 307 of the verification unit 306 of the manager 101, and the display of which is controlled by the display unit 308.

[0043] The verification setting screen 400 displays a check mark 401 for setting whether or not to perform verification, a save button 402, and a list 403 of HTTPS server certificates for the manager and agent(s). The user checks the check mark 401 when setting the server certificate to be verified, and unchecks the check mark 401 when setting the server certificate not to be verified. Then, when the save button 402 is pressed, the verification setting unit 307 saves the setting of whether verification is enabled or disabled according to the current check mark 401.

[0044] In this embodiment, the server certificate validation setting can be changed to valid only when all certificates in the certificate list 403 are valid. In other words, the user can check the check mark 401 only when all certificates in the certificate list 403 are valid. The certificate list 403 displays the manager's certificate 410 and the certificates of each agent. Items displayed for each certificate include, for example, name 404, address 405, subject 406, issuer 407, expiration date 408, and valid / invalid 409.

[0045] Name 404 is the name of the manager corresponding to the certificate, or the name of the agent set by the user. Address 405 is the address of the HTTPS server. The agent, Euroserver 411, is the same host as the manager 101 and uses the same server certificate. Subject 406 is information about the owner of the certificate that is the subject of the certificate. CN indicates the common name, O indicates the organization name, and C indicates the country name. In the case of a self-signed certificate, "Management Agent" is displayed in the CN of subject 406. Issuer 407 is information about the issuer that issued the certificate. CN indicates the common name, O indicates the organization name, and C indicates the country name. In the case of a certificate issued by a certification authority, the name of the issuing authority is displayed in the CN of issuer 407, and in the case of a self-signed certificate, "Management Agent" is displayed.

[0046] Expiration date 408 is the expiration date of the certificate. In the certificate list 403, if the expiration date of a valid certificate is closer than a predetermined period (for example, the expiration date is within one month), a warning is displayed. The warning may be displayed, for example, by coloring the background color of the certificate row, such as yellow, or by displaying an icon. In the example shown in FIG. 4(A), the certificate of the America server 412, which is an agent, is valid but is close to expiring, so the background color is light gray. On the other hand, the expiration dates of the manager 101 and the Euro server 411 are farther away than the period, so no warning is displayed.

[0047] Valid / Invalid 409 indicates whether the certificate is valid. If the certificate replaced by the user is valid, "Valid" is displayed. If it is a self-signed certificate or if the certificate replaced by the user is invalid, "Invalid" is displayed. All certificates shown in FIG. 4(A) are valid. On the other hand, the certificate shown in FIG. 4(B) indicates that the certificate of the Asia server 421, which is the agent, is a self-signed certificate and is therefore invalid. If Valid / Invalid 409 is "Invalid," a warning is displayed. The warning may be displayed, for example, by displaying a background color, such as red, on the certificate row, or by displaying an icon. In the verification setting screen 420 shown in FIG. 4(B), the background color is dark gray because the certificate of the Asia server 421 is a self-signed certificate and therefore invalid.

[0048] In this embodiment, the check mark 401 can be checked only if all certificates in the certificate list 403 are valid. If there are any invalid certificates, the check mark 401 can be unchecked, but cannot be checked. Therefore, all certificates shown on the verification setting screen 400 in FIG. 4(A) are valid, and in this state the user can check the check mark 401. On the other hand, the verification setting screen 420 in FIG. 4(B) shows a state in which verification is enabled (the check mark 401 is checked) before the certificate of the Asia server 421 is added, and then the self-signed certificate of the Asia server 421 is added. If there are any invalid certificates as in FIG. 4(B), the check mark 401 can be unchecked, but once unchecked, it cannot be checked again.

[0049] Next, the process of determining whether or not to verify a certificate when the manager 101 and an agent communicate, and of verifying the certificate if it is determined that verification should be performed, will be described for both the case where the manager 101 is the connection source and the case where the agent is the connection source. First, the process of verifying the certificate of the HTTPS server 311 of the agent when the manager 101, which is the connection source, connects to the agent, which is the connection destination, will be described. FIG. 5 is a flowchart showing the certificate verification process by the manager. Each process shown in FIG. 5 is realized by the CPU 201 of the manager 101 calling and executing a program from memory (ROM 203, HDD 207, external storage device 210). This process is performed when the manager connects to the agent to perform HTTPS communication.

[0050] In S501 to S503, the verification unit 306 of the manager determines whether or not to verify the certificate. First, in S501, the verification unit 306 determines whether the destination agent is running on the same host as the manager. For example, if the manager and agent are running on the same PC 120, as in the case of the manager 101 and agent 121, the verification unit 306 of the manager 101 determines that the destination agent is running on the same host. On the other hand, if the manager and agent 107 are not running on the same host, as in the case of the manager 101 and agent 107, the verification unit 306 of the manager 101 determines that the destination agent is running on a different host. If the destination agent is running on the same host, there is no risk of a man-in-the-middle attack on communication between the manager and the agent, and therefore certificate verification is not necessary. If the destination agent is running on the same host as the manager, the process of S504 is performed. On the other hand, if the destination agent is running on a host different from the manager, the process of S502 is performed.

[0051] In S502, the verification unit 306 determines whether the manager's server certificate has been registered. The server certificate is a certificate digitally signed by an intermediate certificate authority (CA) that has been replaced by the user from a self-signed certificate. If the manager's self-signed certificate has not been replaced by a server certificate, it is considered that the agent functioning as a relay device that relays instructions from the manager has not also replaced its self-signed certificate with a server certificate. Therefore, in this embodiment, if the user has not registered a server certificate in the manager, it is assumed that the agent has not registered a server certificate either. Therefore, if the manager has not registered a server certificate, it means that the agent has not registered a server certificate to be verified, and there is no need to verify the agent's server certificate. If the manager's server certificate has been registered, the process of S503 is performed. On the other hand, if the manager's server certificate has not been registered, such as when the certificate is a self-signed certificate, the process of S504 is performed.

[0052] In S503, the verification unit 306 determines whether the setting for verifying the certificate is enabled (ON). The verification setting is set by the user on the verification setting screen 400, and the setting is saved by the verification setting unit 307. In this embodiment, the certificate is verified only when the setting for verifying the certificate is enabled by the user. If the setting for verifying the certificate is enabled, the process of S505 is performed. On the other hand, if the setting for verifying the certificate is disabled, the process of S504 is performed.

[0053] In S504, the HTTPS connection unit 303 communicates with the agent without verifying the agent's server certificate. The HTTPS connection unit 303 performs a TLS communication handshake process that does not verify the agent's server certificate, and starts secure encrypted communication with the agent. Specifically, the verification unit 306 creates a handler that does not verify the agent's server certificate and passes the created handler to the HTTPS connection unit 303. The HTTPS connection unit 303 creates an HTTP client by specifying the created handler and sends a request to the agent using the created HTTP client. The HTTPS connection unit 303 then receives a response to the request from the agent and continues communication. As described above, in this embodiment, the agent's server certificate is not verified if the manager and agent are running on the same host, the manager's server certificate is not registered, or the certificate verification setting is disabled.

[0054] In S505 to S509, the verification unit 306 and the HTTPS connection unit 303 perform a handshake process for TLS communication to verify the certificate. If the verification is successful, secure encrypted communication with the agent is initiated, and if the verification is unsuccessful, the communication is cut off. First, in S505, the HTTPS connection unit 303 obtains a certificate from the destination agent. Specifically, the verification unit 306 creates a handler that verifies the agent's server certificate and passes the created handler to the HTTPS connection unit 303. The HTTPS connection unit 303 creates an HTTP client by specifying the created handler and sends a request to the agent using the created HTTP client. The HTTPS connection unit 303 then receives a response to the request from the agent. The response from the agent includes the agent's certificate.

[0055] In S506, the verification unit 306 verifies the certificate acquired from the agent. The verification unit 306 verifies whether the certificate acquired from the agent has been digitally signed by an intermediate certificate authority (CA). The certificate verification is performed, for example, in accordance with the PKI standard. In S507, it is determined whether the certificate verification in S506 was successful. If the certificate verification was successful, the process of S509 is performed. On the other hand, if the certificate verification was not successful, the process of S508 is performed. For example, if the certificate is a self-signed certificate or an expired server certificate, the certificate verification fails.

[0056] In S508, the HTTPS connection unit 303 cuts off communication with the agent. If the certificate verification is not successful, the communication is cut off because there is a possibility that the communication partner is being spoofed and communication cannot be performed safely. In S509, the HTTPS connection unit 303 starts secure encrypted communication with the agent for which the successfully verified certificate is registered. This makes it possible to perform certificate verification if the certificate of an agent running on a host different from the manager has been replaced from a self-signed certificate to a server certificate and the user has selected a setting to perform certificate verification.

[0057] In this manner, in this embodiment, the certificate of an agent running on a host different from the manager is verified if a server certificate is registered in the manager and the verification setting is set to on. By verifying the certificate, the security of communication can be improved. On the other hand, if the manager and agent are running on the same host, if the manager's server certificate is not registered, or if the certificate verification setting is disabled, the agent's server certificate is not verified.

[0058] Next, a process for verifying the certificate of the HTTPS server 304 of the manager 101 when the agent, which is the connection source, connects to the manager 101, which is the connection destination, will be described. FIG. 6 is a flowchart showing the certificate verification process by the agent. Each process shown in FIG. 6 is realized by the CPU 201 of the agent calling and executing a program from memory (ROM 203, HDD 207, external storage device 210). This process is executed when the agent connects to the manager to perform HTTPS communication.

[0059] In S601 and S602, the agent verification unit 314 determines whether or not to verify the certificate. First, in S601, the verification unit 314 determines whether the destination manager is running on the same host as the agent. If the destination manager is running on the same host, there is no risk of a man-in-the-middle attack on communication between the agent and the manager, so there is no need to verify the certificate. If the destination manager is running on the same host as the agent, the process of S603 is performed. On the other hand, if the destination manager is running on a host different from the agent, the process of S602 is performed. For example, when the agent 121 connects to the manager 101, the certificate is not verified because they are running on the same host. On the other hand, when the agent 107 connects to the manager 101, the certificate is not verified because they are running on a different host, so if a server certificate is registered in the manager 101, the certificate must be verified.

[0060] In S602, the verification unit 314 determines whether the agent's server certificate has been registered. The server certificate is a certificate digitally signed by an intermediate certificate authority (CA) and replaced by a self-signed certificate by the user. When a self-signed certificate is replaced with a server certificate in an agent functioning as a relay device that relays instructions from the manager, it is considered that the manager also replaces the self-signed certificate with a server certificate first. Furthermore, although the manager determines whether or not to verify the certificate, it is difficult for the agent to securely acquire the verification setting set in the manager. Therefore, whether or not verification is necessary is determined based on the presence or absence of the agent's certificate, regardless of the verification setting. Therefore, in this embodiment, when a server certificate has been registered in the agent by the user, it is highly likely that a server certificate has also been registered in the manager, and it is assumed that server certificate verification will be performed. If the agent's server certificate has been registered, the process proceeds to S604. On the other hand, if the agent's server certificate has not been registered, it is assumed that server certificate verification will not be performed. If the agent's server certificate has not been registered, the process proceeds to S603.

[0061] In S603, the HTTPS connection unit 310 communicates with the manager without verifying the manager's server certificate. The HTTPS connection unit 310 performs a TLS communication handshake process that does not verify the manager's server certificate, and starts secure encrypted communication with the manager. Specifically, the verification unit 314 creates a handler that does not verify the agent's server certificate and passes the created handler to the HTTPS connection unit 310. The HTTPS connection unit 310 creates an HTTP client by specifying the created handler and sends a request to the manager using the created HTTP client. The HTTPS connection unit 310 then receives a response to the request from the manager and continues communication. As described above, in this embodiment, communication is performed without verifying the manager's server certificate when the agent and manager are running on the same host or when the agent's server certificate is not registered.

[0062] In S604 to S608, the verification unit 314 and HTTPS connection unit 310 perform a TLS communication handshake process to verify the certificate. If the verification is successful, secure encrypted communication with the manager is initiated; if the verification is unsuccessful, the communication is cut off. First, in S604, the HTTPS connection unit 310 sends a request including a certificate acquisition request to the connected manager, and obtains the manager's certificate as a response. Specifically, the verification unit 314 creates a handler that verifies the agent's server certificate and passes the created handler to the HTTPS connection unit 310. The HTTPS connection unit 310 creates an HTTP client by specifying the created handler, and sends a request to the manager using the created HTTP client. The HTTPS connection unit 310 then receives a response to the request from the manager. The response from the manager includes the manager's certificate.

[0063] In S605, the verification unit 314 verifies the certificate acquired from the manager. The verification unit 313 verifies whether the certificate acquired from the manager has been digitally signed by an intermediate certificate authority (CA). The certificate verification is performed, for example, in accordance with the PKI standard. In S606, it is determined whether the certificate verification in S605 was successful. If the certificate verification was successful, the process of S608 is performed. On the other hand, if the certificate verification was not successful, the process of S607 is performed. For example, if the certificate is a self-signed certificate or an expired server certificate, the certificate verification fails.

[0064] In S607, the HTTPS connection unit 310 cuts off communication with the manager. If the certificate verification is not successful, the communication is cut off because there is a possibility that the communication partner is being spoofed and communication cannot be carried out safely. In S608, the HTTPS connection unit 310 starts secure encrypted communication with the manager in which the successfully verified certificate is registered. This enables certificate verification to be performed and communication security to be improved when the certificate of a manager running on a host different from the agent has been replaced from a self-signed certificate to a server certificate.

[0065] In this manner, in this embodiment, the certificate of a manager running on a different host from the agent is verified if a server certificate is registered in the agent. By verifying the certificate, the security of communication can be improved. On the other hand, if the manager and agent are running on the same host, or if the agent's server certificate is not registered, the manager's server certificate is not verified.

[0066] To further enhance security even after a server certificate is registered in the manager 101 and an agent, the manager 101 checks the validity of the certificate and displays a warning about the certificate. In this embodiment, as described with reference to FIG. 4, a verification setting for verifying the certificate can be set. When the manager 101 and an agent on a different host exist, if the verification setting is set to off (disabled), a warning screen is displayed urging the user to turn the verification setting on (enabled). By enabling the verification setting, certificate verification can be performed when the manager 101 connects to an agent that is not running on the same host, thereby enhancing communication security. Furthermore, when the certificate verification setting is enabled, if an invalid certificate exists or if a certificate that is about to expire exists, a warning screen is displayed urging the user to update the certificate. Registering a valid certificate enhances communication security. The warning screen displayed in the warning display process is provided by the certificate management unit 305 of the manager 101, and its display is controlled by the display unit 308. The user may be able to set whether or not to execute the warning display process, or the warning display process may be executed every time a specified user logs in after the manager 101's self-signed certificate has been replaced with a server certificate.

[0067] The process of displaying a warning about a certificate in the manager 101 will be described with reference to Figs. 7 and 8. Fig. 7 is a flowchart showing the warning display process. Each process shown in Fig. 7 is realized by the CPU 201 of the manager 101 calling up and executing a program from memory (ROM 203, HDD 207, external storage device 210). Fig. 8 is a diagram showing an example of a warning screen. The warning display process is executed when a user who has the authority to configure certificate validation settings logs in to a service provided by the device management system.

[0068] In S701, the certificate management unit 305 acquires information about a list of certificates that it manages. The certificate list information includes information about the manager 101's certificate and the agent's certificate. The certificate information acquired may be the same information as that displayed in the certificate list 403 in Fig. 4, or it may be configured to acquire only the valid / invalid and expiration date of each certificate.

[0069] In S702, the certificate management unit 305 determines whether the verification setting of the certificate managed by the verification unit 306 is on (valid). If the verification setting of the certificate is on, the process of S703 is performed. On the other hand, if the verification setting of the certificate is off, the process of S707 is performed.

[0070] As explained in the verification setting screen 400, the verification setting can be changed from off to on only when all certificates managed by the certificate management unit 305 are valid. However, after the verification setting is turned on, a certificate managed by the certificate management unit 305 may become invalid due to various factors, such as the expiration date. In S703, the certificate management unit 305 checks whether any invalid certificates exist among the certificates of the manager 101 and agents it manages. If any invalid certificates exist, the process proceeds to S706. On the other hand, if all certificates are valid and there are no invalid certificates, the process proceeds to S704.

[0071] In S706, the display unit 308 displays a first warning screen provided by the certificate management unit 305. FIG. 8A is a diagram showing an example of the first warning screen. The first warning screen 800 displays a message indicating that communication is not possible because the certificate is invalid. The first warning screen 800 may also display information indicating the target (manager or agent) whose certificate is invalid and a message urging the user to replace the certificate with a valid one. Note that in the case of the manager 101 and agent 121 running on the same host, certificate verification is not performed, so communication is possible even if the certificate is invalid. However, the first warning screen 800 is displayed to prompt the user to replace the invalid certificate with a valid certificate. In the example shown in FIG. 4B, the certificate of the Asia server 421, which is an agent, is a self-signed certificate and is therefore invalid. In this case, the first warning screen 800 displays "Agent Asia" as the target of the warning.

[0072] In S704, the certificate management unit 305 determines whether or not any certificates that are to expire within a specified period exist among the certificates of the manager 101 and agents that it manages. The default period can be set by the user. As an example, assume that 30 days is set as the default period. If any certificates are to expire within 30 days, it is determined that there are certificates that will expire within the specified period, and the process of S705 is performed. On the other hand, if there are no certificates that will expire within 30 days, it is determined that there are no certificates that will expire within the specified period, and this process ends.

[0073] In S705, the display unit 308 displays a second warning screen provided by the certificate management unit 305. FIG. 8(B) is a diagram showing an example of the second warning screen. The second warning screen 801 displays a message indicating that the certificate is about to expire. Furthermore, the second warning screen 801 may display information indicating the target (manager or agent) whose certificate is about to expire, or a message indicating that communication will no longer be possible after the expiration date. In the example shown in FIG. 4(B), the certificate of the America server 412, which is an agent, is valid but is about to expire. In this case, the second warning screen 801 displays "Agent America" ​​as the target of the warning.

[0074] 7 shows an example in which the warning display process is terminated after the first warning screen is displayed, but this is not limiting. After the first warning screen is displayed, the process of S704 may be performed to check whether there are any certificates that are about to expire, and if there are any certificates that need to be updated, the second warning screen may be displayed. Alternatively, the process of S704 may be performed after it is determined in the process of S703 that an invalid certificate exists. If both an invalid certificate and a certificate that is about to expire exist, two warnings, the first warning screen and the second warning screen, may be displayed on a single warning screen.

[0075] In S707, the certificate management unit 305 determines whether or not there is an agent running on a host different from the manager 101. If there is an agent running on a host different from the manager 101, the process of S708 is performed. On the other hand, if there is no agent running on a host different from the manager 101, that is, if the only agent running on the same host as the manager 101, there is no risk of the connection destination being spoofed, and so this process is terminated.

[0076] In S708, the display unit 308 displays a third warning screen provided by the certificate management unit 305. Fig. 8(C) is a diagram showing an example of the third warning screen. The third warning screen 802 displays a message indicating that the certificate validation setting has been disabled. Furthermore, the third warning screen 802 may display a message indicating the possibility of a man-in-the-middle attack or a message urging the user to enable the validation setting.

[0077] When the validation setting is enabled and there is an invalid certificate among the certificates managed by the certificate management unit 305, the manager 101 displays a first warning screen ( FIG. 8(A) ) that prompts the user to replace the invalid certificate. Furthermore, when the validation setting is enabled and there is a certificate managed by the certificate management unit 305 whose expiration date will arrive within a predetermined period, the manager 101 displays a second warning screen ( FIG. 8(B) ) that prompts the user to update the certificate that is about to expire. When the validation setting is disabled and there is an agent running on a host computer different from the manager 101, the manager 101 displays a third warning screen ( FIG. 8(C) ) that prompts the user to enable the validation setting. These warning screens are displayed when a user who has the authority to configure certificate validation settings logs in to a service provided by the device management system. By displaying the warning screen, the manager 101 can provide information to the user to enable certificate management and certificate validation settings appropriately.

[0078] As described above, according to this embodiment, when the self-signed certificates of the manager and agent are replaced with server certificates issued by a certificate authority, certificate verification becomes possible when encrypted communication is performed. When the manager connects to the agent, if a server certificate is registered in the manager, it determines whether to verify the agent's certificate according to the verification setting, and if the verification setting is enabled, the agent's certificate can be verified. Furthermore, when the agent connects to the manager, if a server certificate is registered in the agent, the manager's certificate can be verified. In this way, by enabling verification using a server certificate, the security of communication in the device management system can be improved.

[0079] The disclosure of this embodiment includes the following configuration of a device management system. (Configuration 1) 1. A device management system having a device as a manager that manages network devices, and a device as an agent that relays communication between the manager and the network devices, The manager: a setting means for setting a verification setting as to whether or not to verify the certificate of the agent when performing encrypted communication with the agent; a verification means for determining whether to verify the certificate of the agent in accordance with the certificate registered in the manager and the verification setting when performing encrypted communication with the agent, and for obtaining the certificate from the agent and verifying the certificate if it is determined that verification should be performed; The agent: a verification means for determining whether to verify the manager's certificate based on the certificate registered in the agent when performing encrypted communication with the manager, and for obtaining the certificate from the manager and verifying the certificate if it is determined that verification should be performed. (Configuration 2) 2. The device management system according to configuration 1, wherein when the agent that communicates with the manager is running on the same host computer, neither the manager nor the agent verifies the certificate used when performing encrypted communication. (Configuration 3) 3. The device management system according to configuration 1 or 2, wherein the agent does not acquire the verification settings set in the manager, and determines whether to verify the manager's certificate regardless of the verification settings. (Configuration 4) the verification means of the manager determines to verify the certificate of the agent when a certificate issued by a certificate authority is registered in the manager and the verification setting is valid; 4. A device management system according to any one of configurations 1 to 3, wherein the verification means of the agent determines to verify the manager's certificate if a certificate issued by a certificate authority is registered in the agent. (Configuration 5) 5. The device management system according to any one of configurations 1 to 4, wherein the agent transmits a certificate to the manager when it receives a request to obtain a certificate from the manager, when a new certificate is registered in the agent, and at predetermined regular intervals. (Configuration 6) 6. The device management system according to any one of configurations 1 to 5, wherein the manager further comprises a management means for managing a certificate used when performing encrypted communication registered in the manager and a certificate used when performing encrypted communication obtained from the agent. (Configuration 7) the setting means provides a setting screen for accepting the verification setting from a user; The device management system according to configuration 6, characterized in that the setting screen displays a list of certificates of the manager and the agent managed by the management means, and if all of the certificates are valid, the setting means accepts a user instruction to enable the verification setting. (Configuration 8) a display unit that displays a warning screen regarding the validation setting and the certificate when a user who has the authority to perform the validation setting logs in to a service provided by the device management system; the display means, when the validation setting is valid, displays a first warning screen to prompt the user to replace an invalid certificate if the certificates managed by the management means are invalid, and displays a second warning screen to prompt the user to update a certificate if the certificates managed by the management means are valid and the expiration date of the certificate will arrive within a predetermined period; The device management system according to configuration 6 or 7, wherein the display means displays a third warning screen prompting the user to enable the verification setting when the verification setting is disabled and an agent running on a host computer different from the manager exists. (Configuration 9) the manager communicates with the agent when it is determined that the certificate of the agent will not be verified, or when it verifies the certificate of the agent and determines that the certificate is valid, and cuts off communication with the agent when it verifies the certificate of the agent and determines that the certificate is invalid; 9. A device management system according to claim 1, wherein the agent communicates with the manager when it is determined that the manager's certificate will not be verified, or when it verifies the manager's certificate and determines that the certificate is valid, and when it verifies the manager's certificate and determines that the certificate is invalid, the agent cuts off communication with the manager.

[0080] (Other embodiments) The present invention can also be realized by supplying a program that realizes one or more functions of the above-described embodiments to a system or device via a network or a storage medium, and having one or more processors in the computer of the system or device read and execute the program.The present invention can also be realized by a circuit (e.g., ASIC) that realizes one or more functions.

[0081] Although the preferred embodiments of the present invention have been described above, the present invention is not limited to these embodiments and various modifications and changes are possible within the scope of the gist of the present invention.

Claims

1. 1. A device management system having a device as a manager that manages network devices, and a device as an agent that relays communication between the manager and the network devices, The manager: a setting means for setting a verification setting as to whether or not to verify the certificate of the agent when performing encrypted communication with the agent; a verification means for determining whether to verify the certificate of the agent in accordance with the certificate registered in the manager and the verification setting when performing encrypted communication with the agent, and for obtaining the certificate from the agent and verifying the certificate if it is determined that verification should be performed; The agent: a verification means for determining whether to verify the manager's certificate based on the certificate registered in the agent when performing encrypted communication with the manager, and for obtaining the certificate from the manager and verifying the certificate if it is determined that verification should be performed.

2. 2. The device management system according to claim 1, wherein when the agent communicating with the manager is running on the same host computer, neither the manager nor the agent verifies the certificate used when performing encrypted communication.

3. The device management system according to claim 1 , wherein the agent does not acquire the verification setting set in the manager, and determines whether to verify the certificate of the manager regardless of the verification setting.

4. the verification means of the manager determines to verify the certificate of the agent when a certificate issued by a certificate authority is registered in the manager and the verification setting is valid; 2. The device management system according to claim 1, wherein the verification means of the agent determines to verify the certificate of the manager when a certificate issued by a certificate authority is registered in the agent.

5. 2. The device management system according to claim 1, wherein the agent transmits a certificate to the manager when it receives a request to obtain a certificate from the manager, when a new certificate is registered in the agent, and at predetermined regular intervals.

6. 2. The device management system according to claim 1, wherein the manager further comprises a management unit for managing a certificate used when performing encrypted communication registered in the manager and a certificate used when performing encrypted communication obtained from the agent.

7. the setting means provides a setting screen for accepting the verification setting from a user; 7. The device management system of claim 6, wherein the setting screen displays a list of certificates for the manager and the agent managed by the management means, and if all of the certificates are valid, the setting means accepts a user instruction to enable the verification setting.

8. a display unit that displays a warning screen regarding the validation setting and the certificate when a user who has the authority to perform the validation setting logs in to a service provided by the device management system; the display means, when the validation setting is valid, displays a first warning screen to prompt the user to replace an invalid certificate if the certificates managed by the management means are invalid, and displays a second warning screen to prompt the user to update a certificate if the certificates managed by the management means are valid and the expiration date of the certificate will arrive within a predetermined period; 7. The device management system according to claim 6, wherein the display means displays a third warning screen prompting the user to enable the verification setting when the verification setting is disabled and there is an agent running on a host computer different from the manager.

9. the manager communicates with the agent when it is determined that the certificate of the agent will not be verified, or when it verifies the certificate of the agent and determines that the certificate is valid, and cuts off communication with the agent when it verifies the certificate of the agent and determines that the certificate is invalid; 2. The device management system of claim 1, wherein the agent communicates with the manager when it is determined that the manager's certificate will not be verified, or when it verifies the manager's certificate and determines that the certificate is valid, and when it verifies the manager's certificate and determines that the certificate is invalid, it cuts off communication with the manager.

10. A manager device that manages network devices via an agent, a setting means for setting a verification setting as to whether or not to verify the certificate of the agent when performing encrypted communication with the agent; a manager characterized by having a verification means for determining whether to verify the agent's certificate based on the certificate registered in the manager and the verification settings when performing encrypted communication with the agent, and for obtaining the certificate from the agent and verifying the certificate if it is determined that verification should be performed.

11. A control method for a device management system having a device as a manager that manages network devices and a device as an agent that relays communication between the manager and the network devices, comprising: In the manager, a step of setting a verification setting as to whether to verify the certificate of the agent when performing encrypted communication with the agent; a step of determining whether to verify the certificate of the agent according to the certificate registered in the manager and the verification setting when performing encrypted communication with the agent; When it is determined that the certificate of the agent is to be verified, the step of obtaining a certificate from the agent and verifying the certificate is included; In the agent, a step of determining whether to verify the manager's certificate according to the certificate registered in the agent when performing encrypted communication with the manager; a step of obtaining a certificate from the manager and verifying the certificate when it is determined that the manager's certificate should be verified.

12. A method for controlling a device as a manager that manages network devices via an agent, comprising: a step of setting a verification setting as to whether to verify the certificate of the agent when performing encrypted communication with the agent; a step of determining whether to verify the certificate of the agent according to the certificate registered in the manager and the verification setting when performing encrypted communication with the agent; a step of obtaining a certificate from the agent and verifying the certificate when it is determined that the certificate of the agent should be verified.

13. A program that causes a manager computer to execute each step according to claim 12.

Images