Electronic certificate issuance system, electronic certificate issuing device, communication device, and program therefor

• US 8,037,308 B2
• Filed: 03/29/2007
• Issued: 10/11/2011
• Est. Priority Date: 03/31/2006
• Status: Active Grant

• Current Assignee: Brother Kogyo Kabushiki Kaisha
• Original Assignee: Brother Kogyo Kabushiki Kaisha
• Inventors: Miyazawa, Masafumi
• Primary Examiner(s): Kim; Jung
• Assistant Examiner(s): Khoshnoodi; Nadia
• Application Number:
  US11/727,911
• Publication Number:
  US 20070234043A1
• Time in Patent Office: 1,657 Days
• Field of Search: None
• US Class Current: 713/175
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

An electronic certificate issuance system comprising at least one communication device, and an electronic certificate issuing device for issuing a set of an electronic certificate and a private key corresponding to the electronic certificate as a certification set for each of the at least one communication device, is provided. The electronic certificate issuing device includes a first connecting interface, an obtaining system, which is adapted to obtain a node ID assigned to each of the at least one communication device, a generating system, and a writing system. The at least one communication device includes a second connecting interface, a judging system, and an installing system.

Claims

1. An electronic certificate issuance system comprising:

a plurality of communication devices; and

an electronic certificate issuing device for issuing an electronic certificate and a private key corresponding to the electronic certificate as a certification set for each of the plurality of communication devices,

wherein the electronic certificate issuing device includes;

a first connecting interface, through which an external storage device can be removably connected to the electronic certificate issuing device;

an obtaining system configured to obtain a node ID assigned to each of the plurality of communication devices by requesting each of the plurality of communication devices for the node ID;

a generating system configured to generate a certification set for each of the plurality of communication devices whom a node ID was obtained, the electronic certificate in each certification set including the node ID obtained by the obtaining system as owner ID information of the electronic certificate and the private key corresponding to the electronic certificate for each of the plurality of communication devices; and

a writing system configured to collectively write a plurality of certification sets, one certification set for each of the plurality of communication devices whom a node ID was obtained generated by the generating system into the external storage device connected to the first connecting interface in a batch, and

wherein each of the plurality of communication devices includes;

a second connecting interface, through which the external storage device can be removably connected to the communication device;

a judging system configured to, when the external storage device is connected to the communication device through the second connecting interface, judge as to whether one of the collectively written plurality of certification sets stored in said external storage device is for the communication device, said judging being based upon a comparison of the owner ID information included in said electronic certificate in each of the collectively written plurality of certification sets and the node ID assigned to the communication device; and

an installing system configured to install the electronic certificate and the private key corresponding to the electronic certificate into the communication device itself based upon the judging.

2. The electronic certificate issuance system according to claim 1,

wherein the plurality of communication devices and the electronic certificate issuing device are communicably connected to each other through a network;

and

wherein the obtaining system obtains the node ID assigned to each of the plurality of communication devices by broadcasting a request for the node ID to the each of the plurality of communication devices.

3. The electronic certificate issuance system according to claim 1, wherein the electronic certificate issuing device includes a labeling system configured to assign an electronic label identifying the node ID included in the electronic certificate as the owner ID information of the electronic certificate for each of the collectively written plurality of certification sets generated by the generating system;

and

wherein the judging system further uses said electronic label assigned by the labeling system to judge whether one of the collectively written plurality of certification sets stored in said external storage device is for the communication device.

4. The electronic certificate issuance system according to claim 1,

wherein the electronic certificate issuing device includes a file creating system to create a plurality of data files, each of which contains a set of data representing the electronic certificate with the node ID as the owner ID information of the electronic certificate and the private key corresponding to the electronic certificate;

and

wherein the writing system is configured to collectively write the plurality of data files in a batch into the external storage device connected to electronic certificate issuing device through the first connecting interface.

5. The electronic certificate issuance system according to claim 4, wherein the file creating system is configured to encrypt each of the plurality of data files.

6. The electronic certificate issuance system according to claim 4,

wherein each of the plurality of communication devices is configured to generate an encryption key to encrypt the data file created by the file creating system;

wherein each of the plurality of communication devices is provided with an ID information transmitting system, which transmits the node ID assigned to the communication device and the generated encryption key to the electronic certificate issuing device through a network;

wherein the electronic certificate issuing device is communicably connected with the plurality of communication devices through the network;

wherein the obtaining system of the electronic certificate issuing device obtains the node ID assigned to each of the plurality of communication devices and the encryption key through the network from each of the plurality of communication devices for which the electronic certificate is issued; and

wherein the file creating system encrypts each of the plurality of data files by using a corresponding encryption key obtained by the obtaining system from the communication device having the node ID which is identical to the owner ID information of the electronic certificate to be contained in the encrypted data file.

7. The electronic certificate issuance system according to claim 1,

wherein the electronic certificate issuing device includes a file creating system to create a plurality of data files, each of which has a file name and contains a set of data representing the electronic certificate and the private key corresponding to the electronic certificate issued by the electronic certificate issuing device;

wherein the file name of the data file is represented by the node ID as the owner ID information of the electronic certificate;

wherein the writing system is configured to collectively write the plurality of data files in a batch into the external storage device connected to the electronic certificate issuing device through the first connecting interface;

wherein the judging system of each of the communication devices determines whether one of the plurality of data files stored in the external storage device is for the communication device based upon a comparison of the file name associated with each of the plurality of data files and the node ID assigned to the communication device; and

wherein the installing system of each of the communication devices installs the electronic certificate and the private key corresponding to the electronic certificate in the set of data contained in the data file into the communication device when the judging system determines that a data file that includes the electronic certificate and the private key corresponding to the electronic certificate is for the communication device.

8. An electronic certificate issuance system comprising:

a plurality of communication devices; and

an electronic certificate issuing device for issuing an electronic certificate and a private key corresponding to the electronic certificate as a certification set for each of the plurality of communication device said electronic certificate including an owner ID information,

wherein the electronic certificate issuing device includes;

a first connecting interface, through which an external storage device can be removably connected to the electronic certificate issuing device;

an obtaining system configured to obtain node ID information indicating a routable network address to be assigned to the plurality of communication devices;

a generating system configured to generate the certification set including the electronic certificate and the private key corresponding to the electronic certificate and further including configuration data, which contains an instruction for each of the plurality of communication devices to set a routable network address of the communication device to the owner ID information contained in the electronic certificate in the certification set; and

a writing system configured to collectively write a plurality of certification sets, one certification set for each of the plurality of communication devices including the configuration data, the electronic certificate, and the private key corresponding to the electronic certificate generated by the generating system for each of the plurality of communication devices, into the external storage device connected to the first connecting interface in a batch, and

wherein the at least one communication device includes;

a second connecting interface, through which the external storage device can be removably connected to the communication device;

a judging system configured to, when the external storage device is connected to each of the plurality of communication devices through the second connecting interface, judge as to whether there is at least one certificate set stored in said external storage; and

a configuration installing system configured to arbitrarily select one certificate set among said at least one certificate sets, sets the routable network address of the communication device to the owner ID information contained in the electronic certificate in the certification set, and install the electronic certificate and the private key corresponding to the electronic certificate included in the selected certificate set into the communication device.

9. An electronic certificate issuance system comprising:

a plurality of communication device, which are communicably connected to a network; and

an electronic certificate issuing device, which is communicably connected with the plurality of communication devices through the network, for issuing an electronic certificate for the plurality of communication devices,

wherein the electronic certificate issuing device includes;

a first connecting interface, through which an external storage device can be removably connected to the electronic certificate issuing device;

an obtaining system configured to obtain a node ID assigned to each of the plurality of communication devices and a public key corresponding to a private key generated in each of the plurality of communication devices by requesting each of the plurality of the communication devices for the node ID through the network;

a generating system configured to generate an electronic certificate for each of the plurality of communication devices whom a node ID was obtained, the electronic certificate including the node ID obtained from the communication device by the obtaining system as owner ID information of the electronic certificate, the public key from the communication device and certify authenticity of the public key obtained from each of the plurality of communication devices by the obtaining system;

a writing system configured to collectively write a plurality of the electronic certificates generated for each of the plurality of communication devices by the generating system into the external storage device connected to the first connecting interface in a batch,

wherein each of the plurality of communication devices includes;

a second connecting interface, through which the external storage device can be removably connected to the communication device;

a key generating system, which generates the private key to be used in the communication device and the public key corresponding to the private key;

an ID information transmitting system, which transmits the public key generated by the key generating system and the node ID assigned to the communication device to the electronic certificate issuing device through the network;

a judging system configured to judge as to whether an electronic certificate issued for the communication device is written in the external storage device when the external storage device is connected to the communication device through the second connecting interface; and

an installing system, which installs the electronic certificate into the communication device when the judging system determines the electronic certificate issued for the communication device is written in the external storage device.

10. The electronic certificate issuance system according to claim 9, wherein the obtaining system obtains the node ID assigned to each of the plurality of communication devices by broadcasting a request for the node ID to the each of the plurality of communication devices.

11. The electronic certificate issuance system according to claim 9, wherein the judging system determines whether one of the electronic certificates stored in the external storage device is for the communication device by referring to the public key generated by the key generating system.

12. The electronic certificate issuance system according to claim 9, wherein said public and private key are temporally stored and said judging system judges whether an electronic certificate issued for the communication device is written in the external storage device when the external storage device is connected to the communication device through the second connecting interface by comparing the public key from the electronic certificate with the temporally stored public key.

13. A communication device with a node ID assigned thereto, comprising:

a key generating system, which generates a private key to be used in the communication device and a public key corresponding to the private key;

an ID information transmitting system, which transmits the public key generated by the key generating system and the node ID assigned to the communication device to an electronic certificate issuing device through the network;

a connecting interface through which an external storage device containing a plurality of encrypted data sets, each of said plurality of encrypted data sets includes data representing an electronic certificate and a private key corresponding to the electronic certificate can be removably connected to the communication device, said encrypting using said public key generated by the key generating system;

a judging system configured to, when the external storage device is connected to the connecting interface, judge as to whether one of the plurality of encrypted data sets stored in said external storage device is for the communication device, said judging being based upon a comparison of a owner ID information contained in an electronic certificate in each of the at least one encrypted data set and the node ID assigned to the communication device; and

an installing system configured to install a decrypted electronic certificate based on the judgement of the judging system.

14. The communication device according to claim 13,

wherein each of the plurality of data sets contained in the external storage device consist of a data file having a file name, the file name being the owner ID information of the electronic certificate;

wherein when the external device is connected to the communication device through the connecting interface the judging system judges whether one of the plurality of data sets is for the communication device by comparing the file name for the data file corresponding to each of the plurality of data sets with the node ID assigned to the communication device as a data file which has a file name being identical to the node ID assigned to the communication device is written in the external storage device; and

wherein the installing system installs corresponding one of the plurality of data sets written in the external storage device into the communication device when the judging system determines the data file having a file name which is identical to the node ID assigned to the communication device is written in the external storage device.

15. A communication device comprising:

a connecting interface through which an external storage device can be removably connected;

a judging system for judging as to whether a plurality of data sets including configuration data, each of said plurality of data sets contains a routable network address for the communication device and an instruction for the communication device to set the contained routable network address to the communication device, an electronic certificate, which includes a routable network address as owner ID information of the electronic certificate being identical to the routable network address indicated in the configuration data, and a private key corresponding to the electronic certificate, is written in the external storage device; and

a configuration installing system configured to arbitrarily select one data set among the plurality of data sets written in the external storage device, sets the routable network address of the communication device to the routable network address node ID contained in the configuration data which is included in the selected certificate set, and install the electronic certificate and the private key corresponding to the electronic certificate included in the selected certificate set into the communication device.

16. A computer readable storage device comprising computer readable instructions for controlling a computer, having a connecting interface through which an external storage device is connected to the computer, to have an electronic certificate and a private key corresponding to the electronic certificate issued for the computer, by executing steps of:

generating a private key to be used in a communication device and a public key corresponding to the private key;

transmitting the public key and a node ID assigned to the communication device to an electronic certificate issuing device through the network;

judging when the external storage device is connected to the computer through the connecting interface whether one of a plurality of encrypted data sets stored in said external storage device is for the computer, each of the plurality of encrypted data sets including an encrypted electronic certificate including a node ID as owner ID information of the encrypted electronic certificate being identical to a node ID assigned to the communication device and the private key corresponding to the encrypted electronic certificate, said judging being based upon a comparison of a owner ID information contained in an electronic certificate in each of the plurality of encrypted data sets and the node ID assigned to the communication device; and

installing a decrypted electronic certificate and the private key corresponding to the encrypted electronic certificate written in the external storage device into the communication device based on the judging.

17. A computer readable storage device comprising computer readable instructions for controlling a computer, having a connecting interface through which an external storage device is connected to the computer, to execute a method of:

judging whether a plurality of data sets, each of said plurality of data sets includes configuration data, which contains a routable network address for a communication device and an instruction for the communication device to set the contained routable network address to the communication device, an electronic certificate, which includes a routable network address as owner ID information of the electronic certificate being identical to the routable network address indicated in the configuration data, and a private key corresponding to the electronic certificate, is written in the external storage device;

selecting arbitrarily one data set among said plurality of data sets written in the external storage device;

setting the routable network address of the communication device to the routable network address contained in the configuration data which is included in the selected certificate set; and

installing the electronic certificate and the private key corresponding to the electronic certificate included in the selected certificate set into the communication device.

18. A communication device comprising:

a connecting interface, through which an external storage device can be removably connected to the communication device;

a judging system configured to, when the external storage device is connected to the communication device through the connecting interface, judge as to whether one of a plurality of certification sets stored in said external storage device is for the communication device, each certification set includes an electronic certificate with a node ID as owner ID information of the electronic certificate and a private key corresponding to the electronic certificate, said judging being based upon a comparison of the owner ID information included in said electronic certificate in each of the plurality of certification sets and the node ID assigned to the communication device; and

an installing system configured to install the electronic certificate and the private key corresponding to the electronic certificate into the communication device based upon the judging.

19. A computer readable storage device comprising computer readable instructions for controlling a computer in a communication device, the communication device having a connecting interface through which an external storage device is connected, to execute the method of:

judging, when the external storage device is connected to the communication device through the connecting interface, whether one of a plurality of certification sets stored in said external storage device is for the communication device, each of said plurality of data sets includes an electronic certificate with a node ID as owner ID information of the electronic certificate and a private key corresponding to the electronic certificate, said judging being based upon a comparison of the owner ID information included in said electronic certificate in each of the plurality of certification sets and the node ID assigned to the communication device; and

installing the electronic certificate and the private key corresponding to the electronic certificate into the communication device based upon the judging.