Patent Application
20180152301
This application is based on and claims priority under 35 USC 119 from Japanese Patent Application No. 2016-232408 filed on Nov. 30, 2016.
The present invention relates to an information processing apparatus and a non-transitory computer readable medium.
An aspect of the invention provides an information processing apparatus including: a receiving unit that receives an issue request for an electronic certificate from an external apparatus; an issuing unit that, when the issue request received by the receiving unit is for issuance of an electronic certificate using a first calculation method for calculating a hash value, issues the electronic certificate using the first calculation method; a transferring unit that, when the issue request received by the receiving unit is for issuance of an electronic certificate using a second calculation method different from the first calculation method, transfers the issue request to another information processing apparatus that issues an electronic certificate using the second calculation method; and a transmitting unit that, when receiving the electronic certificate using the second calculation method from the another information processing apparatus, transmits the received electronic certificate to the external apparatus that has transmitted the issue request.
Exemplary embodiments of the present invention will be described in detail based on the following figures, wherein:
First, in order to assist understanding of the invention, the background and summary of the invention will be described.
When data is transmitted and received via the Internet, encrypted communication called secure sockets layer (SSL) communication is used in order to improve the security of the data transmitted and received.
When SSL communication is performed, an electronic certificate (SSL server certificate) is used to protect the data against unauthorized access such as impersonation. The electronic certificate includes a public key of an apparatus and an electronic signature for the public key. The public key of the apparatus is used for encrypting SSL communication. The electronic signature is data encrypted by a secret key of a reliable third-party certification authority.
In general, an electronic signature system is widely used, in which a hash value of electronic data to be protected against falsification is calculated, and the hash value is encrypted with a secret key and added as the electronic signature.
Although various algorithms are present as algorithms (calculation methods) for calculating the hash value, at present, a hash value calculation algorithm that makes use of a hash function in the standard called Secure Hash Algorithm (SHA)-1 is commonly used.
In recent years, however, in order to further improve the security of SSL communication, the hash value calculation algorithm is widely scheduled to be changed from the SHA-1 standard to the SHA-2 standard.
For instance, in an algorithm called SHA-256 which is a system included in the SHA-2 standard, a hash length is 256 bits, and in contrast to the SHA-1 standard, the SHA-256 has a structure that increases the protection against malicious attacks and improves the security.
As a system which transmits and receives data using the above-described SSL communication, a specific system is proposed that implements the following services: automatic collection, by a service provider server, of information on the number of sheets used by, information on the life of consumables in, and information on malfunction of multifunctional apparatuses installed in an office or the like; preparation of an invoice; automatic delivery of consumables; and automatic notification of malfunction.
However, in an office where those multifunctional apparatuses are set, so-called firewall is often installed for the purpose of preventing information leakage, and the connection destinations such as uniform resource locators (URL) accessible by the multifunctional apparatuses may be limited.
Thus, in such a system configuration, when the hash value calculation algorithm (hash function) in an electronic signature system is attempted to be changed from the SHA-1 standard to the SHA-2 standard as described above, it is necessary to change the settings for the firewall so that a certification authority supporting the SHA-2 is accessible and an electronic certificate in the SHA-2 standard is obtainable by the multifunctional apparatuses.
However, even if an SSL communication program may be updated by a simple operation or remote control, in order to change the setting for the firewall or the like, time and effort is necessary to explain a situation to a system administrator or the like of an office where the image forming apparatus 10 is installed, and to ask the system administrator to change accessible connection destinations.
Next, an exemplary embodiment of the invention will be described in detail with reference to the drawings.
In the following, a case will be described in which SSL communication performed between an image forming apparatus and a service provider server is changed, where an algorithm using a hash function in the SHA-1 standard is replaced by an algorithm using a hash function in the SHA-2 standard.
First, a system configuration is illustrated in
The system illustrated in
Here, a firewall 50 is provided between the image forming apparatus 10 and the Internet 40. Therefore, the image forming apparatus 10 is in a state where access to only the certification authority server 21 and the service provider server 30 is permitted.
It is to be noted that the image forming apparatus 10 is so-called a multifunctional apparatus that has multiple functions such as a print function, a scan function, a copy function, and a facsimile function.
The service provider server 30 has a function of obtaining information on the number of sheets printed per month and the status of consumables of the image forming apparatus 10 by transmitting and receiving data to and from the image forming apparatus 10 via the Internet 40.
In the image forming apparatus 10, an SSL communication program supporting an SHA1 electronic certificate is installed, so that the image forming apparatus 10 transmits various pieces of information to the service provision apparatus 30 via the SSL communication.
Specifically, as illustrated in
In general, an effective period is set to such an electronic certificate, and when the effective period of an electronic certificate used has expired, an effective electronic certificate needs to be re-issued by requesting to a certification authority for re-issue of an electronic certificate.
Next,
First, in the image forming apparatus 10, the SSL communication program supporting an SHA1 electronic certificate is updated to an SSL communication program supporting an SHA2 electronic certificate. For instance, the update can be made by an operation in the image forming apparatus 10.
Since the previous SSL communication program has been thus updated to an SSL communication program supporting an SHA2 electronic certificate in the image forming apparatus 10, when an electronic certificate currently used is re-issued, an issue request for an SHA1 electronic certificate is transmitted to a certification authority.
In the system configuration illustrated in
However, the fire wall 50 is not set to allow the image forming apparatus 10 to have access to the certification authority server 22, and thus the image forming apparatus 10 cannot have direct access to the authentication authority server 22.
Thus, in a communication system according to an exemplary embodiment of the invention, the certification authority server 21 performs an operation different from a normal operation, thereby allowing the image forming apparatus 10 to obtain an electronic certificate using SHA2.
First,
As illustrated in
The CPU 11 executes predetermined processing in accordance with a control program stored in the memory 12 or the storage device 13, and controls the operation of the certification authority server 21. It is to be noted that although it has been described that the CPU 11 reads and executes the control program stored in the memory 12 or the storage device 13 in the exemplary embodiment, the program may be stored in a storage medium such as a CD-ROM and be provided to the CPU 11.
As illustrated in
The transceiver 31 receives an issue request for an electronic certificate via the Internet 40 from the image forming apparatus 10 which is an external apparatus. When the receiver 35 receives an SHA2 electronic certificate from the certification authority server 22 which is another information processing apparatus, the transceiver 31 transmits the received SHA2 electronic certificate to the image forming apparatus 10 which has transmitted an issue request for an electronic certificate.
The determiner 32 determines whether the electronic certificate issue request received by the transceiver 31 is an issue request for requesting issue of an SHA1 electronic certificate or an issue request for requesting issue of an SHA2 electronic certificate in which a hash value is calculated by an algorithm different from SHA1.
When it is determined by the determiner 32 that the issue request received by the transceiver 31 is an issue request for requesting issue of an SHA1 electronic certificate, the electronic certificate issuer 33 issues an SHA1 electronic certificate.
The SHA1 electronic certificate issued by the electronic certificate issuer 33 is transmitted to the image forming apparatus 10 by the transceiver 31.
When it is determined by the determiner 32 that the issue request received by the transceiver 31 is for requesting issue of an SHA2 electronic certificate which is more secure than an SHA1 electronic certificate, the transferrer 34 transfers the issue request for an SHA2 electronic certificate to the certification authority server 22.
The receiver 35 receives the SHA2 electronic certificate transmitted from the certification authority server 22.
Next, the operation of electronic certificate issue processing performed by the certification authority server 21 in the communication system of this exemplary embodiment will be described with reference to the flowchart of
First, when the transceiver 31 receives an issue request for an electronic certificate from the image forming apparatus 10 (step S101), the determiner 32 determines whether the received issue request for an electronic certificate is an issue request for an SHA1 electronic certificate or an issue request for an SHA2 electronic certificate (step S102).
When it is determined that the received issue request is an issue request for an SHA1 electronic certificate (no in step S102), the electronic certificate issuer 33 issues an SHA1 electronic certificate (step S103).
When it is determined that the received issue request is an issue request for an SHA2 electronic certificate (yes in step S102), the issue request for an SHA2 electronic certificate is transferred to the certification authority server 22 by the transferrer 34 (step S104).
SHA2 electronic certificate issue processing is then performed by the certification authority server 22 based on the received issue request for an electronic certificate.
The SHA2 electronic certificate issued by the certification authority server 22 is transmitted to the certification authority server 21, and the SHA2 electronic certificate is received by the receiver 35 in the certification authority server 21 (step S105).
Finally, either one of the SHA1 electronic certificate issued by the electronic certificate issuer 33 and the SHA2 electronic certificate received by the receiver 35 from the certification authority server 22 is transmitted by the transceiver 31 to the image forming apparatus 10 which has transmitted the issue request for an electronic certificate (step S106).
The manner how data is transmitted and received between the image forming apparatus 10 and the certification authority servers 21 and 22 by execution of the processing will be described with reference to the sequence charts of
First, the case where the image forming apparatus 10 transmits an issue request for an SHA1 electronic certificate to the certification authority server 21 will be described with reference to the sequence chart of
When the image forming apparatus 10 transmits an SHA1 electronic certificate issue request to the certification authority server 21 (step S201), the certification authority server 21 receives the issue request and issues an SHA1 electronic certificate (step S202).
The SHA1 electronic certificate is then transmitted from the certification authority server 21 to the image forming apparatus 10 (step S203).
Next, the case where the image forming apparatus 10 transmits an issue request for an SHA2 electronic certificate to the certification authority server 21 will be described with reference to the sequence chart of
In the image forming apparatus 10, even when the SSL communication program supporting SHA1 is changed to an SSL communication program supporting SHA2, the transmission destination of an issue request for an electronic certificate is still the certification authority server 21.
Therefore, the image forming apparatus 10 transmits an issue request for an SHA2 electronic certificate to the certification authority server 21 (step S301).
Then, the certification authority server 21, which has received the issue request for an SHA2 electronic certificate, transfers the received issue request for an SHA2 electronic certificate to the certification authority server 22 because issue processing for the issue request cannot be performed by the certification authority server 21 (step S302).
The certification authority server 22, which has received the issue request for an SHA2 electronic certificate transferred from the certification authority server 21, performs the issue processing of an SHA2 electronic certificate based on the received issue request (step S303). The certification authority server 22 then transmits the issued SHA2 electronic certificate to the certification authority server 21 (step S304).
The certification authority server 21, which has received the transmitted SHA2 electronic certificate, transmits the received SHA2 electronic certificate to the image forming apparatus 10 (step S305).
The execution of the aforementioned processing allows the image forming apparatus 10 to receive an SHA2 electronic certificate from the certification authority server 21 by only transmitting an issue request for an SHA2 electronic certificate to the certification authority server 21.
It is to be noted that in the exemplary embodiment described above, the certification authority server 21 determines whether the issue request is for SHA1 or SHA2 based on the issue request for an electronic certificate received from the image forming apparatus 10.
However, information allowing to determine whether the image forming apparatus 10 supports an SHA1 electronic signature system or supports an SHA2 electronic signature system may be stored in the certification authority server 21, and whether an electronic certificate is to be issued by the certification authority server 21 or an issue request for an electronic certificate is to be transferred to the certification authority server 22 may be determined using the information.
The certification authority server 21A illustrated in
The supported algorithm information storage 36 stores a supported algorithm list table that provides information which allows to determine whether the image forming apparatus 10 supports an SHA1 electronic signature system or supports an SHA2 electronic signature system.
An example of the supported algorithm list table is illustrated in
The supported algorithm list table illustrated in
Thus, when an issue request for an electronic certificate is received from the image forming apparatus 10, and information on the model name and the serial number of the image forming apparatus 10 which has transmitted the issue request is known, the determiner 32A can determine whether the image forming apparatus 10 supports an SHA1 electronic certificate or supports an SHA2 electronic certificate.
When the determiner 32A determines that the image forming apparatus 10, from which an issue request is received by the transceiver 31, supports an SHA1 electronic certificate, the electronic certificate issuer 33 issues an SHA1 electronic certificate.
When the determiner 32A determines that the image forming apparatus 10, from which an issue request is received by the transceiver 31, supports an SHA2 electronic certificate, the transferrer 34 transfers the issue request for an SHA2 electronic certificate to the certification authority server 22.
Specifically, the transferrer 34 selectively transfers the issue request received by the transceiver 31 to the certification authority server 22 based on the information on the supported algorithm list table stored in the supported algorithm information storage 36.
In the exemplary embodiment, description has been provided using the case where an electronic certificate used in the SSL communication is changed from a certificate in an electronic signature system using a hash function in the SHA1 standard to a certificate in an electronic signature system using a hash function in the SHA2 standard. However, the invention is not limited to this, and the invention is similarly applicable to a case where an electronic certificate is switched between electronic signature systems with different standards.
Also, in the exemplary embodiment, description has been provided using the case where SSL communication is performed between the image forming apparatus 10 and the service provider server 30. However, the invention is similarly applicable to a system in which SSL communication using an electronic certificate is performed.
The foregoing description of the exemplary embodiments of the present invention has been provided for the purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise forms disclosed. Obviously, many modifications and variations will be apparent to practitioners skilled in the art. The embodiments were chosen and described in order to best explain the principles of the invention and its practical applications, thereby enabling others skilled in the art to understand the invention for various embodiments and with the various modifications as are suited to the particular use contemplated. It is intended that the scope of the invention be defined by the following claims and their equivalents.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2016-232408 | Nov 2016 | JP | national |
