JP2021033645A - Information processing apparatus and method of controlling the same, and program - Google Patents

Abstract

To safely exchange vendor assets in an encryption communication between an external server and an information processing apparatus.SOLUTION: The present invention is directed to an information processing apparatus on which one or a plurality of applications can run. The information processing apparatus has: management means for managing a route certificate for use in encrypted communication with an external server; determination means for determining, when a request for encrypted communication with the external server is received from an application, whether or not the application uses predetermined information of the information processing apparatus; and verification means for, if the determination means determines that the application uses the predetermined information, verifying a server certificate of the external server by using a route certificate set with predetermined attribute information among route certificates managed by the management means.SELECTED DRAWING: Figure 3

Description

The present invention relates to an information processing device, a control method thereof, and a program.

In communication between devices connected by a network, encryption of the communication path is an indispensable technology to ensure security. The purpose of encrypted communication includes measures against eavesdropping by encrypting the communication path, measures against falsification of the communication path by message authentication, and measures against spoofing of the communication partner by certificate verification.

In the certificate verification, it is verified whether or not the digital certificate (hereinafter referred to as a certificate) transmitted by the communication partner is digitally signed by an authoritative CA (Certificate Authority) station. Then, when it is confirmed that the verification result is correct, the information described in the certificate can be trusted. The verification procedure is defined by a standard such as Non-Patent Document 1.

The root CA certificate used here is usually pre-installed and shipped by the manufacturer in the shipping state of the information processing apparatus. However, there is an information processing device that is configured so that the user can freely add it so that it can be verified even in the server device to which the user connects individually. In this case, the root CA certificate obtained by the administrator is installed via the network interface or a local interface such as USB.

Some services provided on the Internet, such as the cloud, handle vendor assets that must not be tampered with by users, such as all software for information processing devices and paid software license information. In order to prevent unauthorized disclosure and tampering of vendor assets, we use server certificate verification to confirm communication with a trusted server.

RFC 5280, [online], [Searched on August 8, 1st year of Reiwa], Internet <URL: https: // tools. IETF. org / html / rfc5280>

In encrypted communication that handles vendor assets as described above, communication with a reliable server is guaranteed by verifying the server certificate provided by the server side. On the other hand, the root CA certificate used for validating the server certificate can be additionally installed by the user, but the additional installation should not affect the trust relationship with the server that handles the vendor assets.

An object of the present invention is to prevent communication to an unauthorized external server due to disclosure or falsification of unauthorized vendor assets due to additional installation of a user's root CA certificate.

In order to solve the above problems, the present invention has the following configuration. That is, it is an information processing device capable of operating one or more applications, and is a management means for managing a root certificate used when performing encrypted communication with an external server, and encryption from the application to the external server. When the communication request is received, the determination means for determining whether or not the application uses the predetermined information in the information processing apparatus, and the determination means for determining that the application uses the predetermined information. If so, it has a verification means for verifying the server certificate of the external server by using the root certificate in which the predetermined attribute information is set among the root certificates managed by the management means.

According to the present invention, it is possible to correctly verify an external server when performing encrypted communication, and it is possible to securely exchange vendor assets.

The schematic diagram which shows the structural example of the information processing system which concerns on one Embodiment of this invention. The figure which shows the configuration example of the software which operates in the MFP which concerns on this embodiment. The flowchart of the process of the digital certificate verification unit which concerns on 1st Embodiment. The figure for demonstrating the configuration and attribute information of the external application which concerns on this Embodiment. The flowchart of the processing of the encrypted communication part which concerns on this embodiment. The figure which shows the relationship between the structure of the key management part which concerns on this embodiment, and the outside. The flowchart of the process of the digital certificate verification unit which concerns on 2nd Embodiment. The flowchart of the export process of the key management unit which concerns on 3rd Embodiment. The flowchart of the import process of the key management unit which concerns on 3rd Embodiment.

<First Embodiment>
Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. The following embodiments do not limit the invention according to the claims. Although a plurality of features are described in the embodiment, not all of the plurality of features are essential to the invention, and the plurality of features may be arbitrarily combined. Further, in the attached drawings, the same or similar configurations are designated by the same reference numbers, and duplicate explanations are omitted.

[System configuration]
FIG. 1 is a schematic view showing a configuration example of an information processing system according to an embodiment of the present invention. The information processing system includes an MFP (Multi-Faction Peripheral) 110, a LAN (Local Area Network) 120, a PC (Personal Computer) 130, an Internet 150, and a cloud server 140. The Internet 150 and the LAN 120 are communicably connected by a router 160. In FIG. 1, one device is shown for each device, but more devices may be included. Further, in the present embodiment, the MFP will be described as an example, but the present invention is not limited to this, and the present invention can be applied to any device that handles various information corresponding to vendor assets as described later. ..

The MFP 110 includes a network communication unit 111, an operation unit 113, a CPU 114, a RAM 115, and a storage device 116. In addition to the above configuration, the MFP 110 may include other parts such as a printer unit and a scanner unit depending on the function. By connecting to the cloud server 140, the MFP 110 can use various services (Web services, etc.) via the Internet 150. The cloud server 140 is an external server that provides various services to the MFP 110. In the present embodiment, the cloud server 140 can also collect the above-mentioned vendor asset information from the MFP 110. Further, the MFP 110 can set the MFP 110 and install the application via the LAN 120 based on the instruction from the PC 130. Further, the MFP 110 may be able to connect an external storage device such as USB (Universal Serial Bus).

[Software configuration]
FIG. 2 shows a configuration example of software operating in the MFP 110. In the present embodiment, a plurality of applications can be operated in the MFP 110, and here, two applications, the embedded application 201 and the external application 207, will be described as examples. The embedded application 201 is an application that is embedded in the MFP 110 from the beginning (for example, at the time of shipment of the device) among the applications that operate in the MFP 110. The encrypted communication unit 202 is called from an application to perform encrypted communication with an external device such as a PC 130 or a cloud server 140. The setting storage unit 203 stores the settings of the MFP 110 in a storage area such as the storage device 116. The digital certificate verification unit 204 is called from the cryptographic communication unit 202 to verify the certificate provided by the server or the like. The key management unit 205 manages the root CA certificate (also referred to as the root certificate) used for verifying the server certificate by the digital certificate verification unit 204.

The certificate installation unit 206 causes the key management unit 205 to manage the root certificate specified by the user. Unlike the embedded application 201, the external application 207 is an application that is installed from the outside at an arbitrary timing after the shipment of the MFP 110 and operates as an application of the MFP 110. The external application installation unit 208 installs the external application 207 according to the instruction of the user. The external application management unit 209 manages the information of the external application 207 according to the installation of the external application 207. The software update unit 210 acquires and updates the entire software on which the MFP 110 operates and data distributed by the vendor such as the root CA certificate.

The software is permanently stored in the storage device 116, and when used, it is loaded into the RAM 115 and then executed by the CPU 114. Further, the setting information stored in the setting storage unit 203 and the root CA certificate stored in the key management unit 205 are permanently stored by the storage device 116 and loaded into the RAM 115 when used by the respective software. It will be used.

The operation for setting the embedded application 201, the external application 207, the external application 208, the certificate installation unit 206, and the setting storage unit 203 is performed by the user operating the operation unit 113.

The certificate verification by the digital certificate verification unit 204 is performed by using the root CA certificate held by the MFP 110 as the server certificate sent from the server when connecting to the server. As the server certificate verification method, known methods such as RSA signature verification and ECDSA signature verification shall be used, and detailed description thereof is omitted here.

[Vendor asset utilization]
Next, the use of vendor assets of the application will be described. The vendor asset referred to here is predetermined information handled for services related to the MFP 110 by the vendor that provides the MFP 110, and is information that is not disclosed to the user. Vendor assets include, for example, usage information of firmware for operating the MFP 110, billing information such as the number of printers used by the MFP 110, and the like. The information handled by each application as a vendor asset is not particularly limited. For example, among the vendor assets that can be output by the MFP 110, the type of vendor asset used for each application may be defined.

There are various reasons why it is not disclosed to users. For example, in order to protect the system from unauthorized alterations that threaten the normal operation of a plurality of software as shown in FIG. 2, or to cause service inability or unauthorized billing avoidance due to device maintenance or falsification of billing information. This is to prevent attacks. An application that handles this information can instruct the strictness of the root CA certificate used for certificate verification so that server spoofing cannot occur during encrypted communication.

There are two ways to declare that an application deals with vendor assets. One is to pass an attribute indicating that the application handles vendor assets as an argument when the application calls the encrypted communication unit 202. In FIG. 2, the embedded application 201 passes the information of the “vendor asset usage attribute” as the vendor attribute to the encrypted communication unit 202. This indicates that the embedded application 201 utilizes the vendor assets. In the case of the embedded application 201, since it can be determined in advance whether or not the vendor handles the vendor assets, it is permitted for the embedded application 201 to directly specify in this way.

As another method of declaring that the application handles vendor assets, it is possible to declare by describing the vendor asset usage attribute information in the attribute file at the time of installation. For example, in the case of the external application 207 installed after the MFP110 is shipped, it can be declared by describing the vendor asset usage attribute information in the attribute file that defines the vendor attribute of the application even if the application itself does not specify it. .. In the present embodiment, it is assumed that the external application 207 does not directly specify whether or not to handle the vendor assets, but the present embodiment is not limited to this configuration.

FIG. 4 is a diagram for explaining the configuration of the external application 207 and the attribute information. The external application 207 has the data structure of the application package file 401 as the actual configuration, and is configured to include the application data 402 and the application attribute file 403. The application data 402 indicates the substance of the software code that can be operated by the CPU 114. The application attribute file 403 is data in a text format or an XML (eXtensible Markup Language) format in which the attributes of the application are described.

The data 404 schematically shows an example of the internal configuration of the application attribute file 403. In the data 404, Application-Name indicates the name of the application, and "Sample" is set. The Application-ID indicates a unique ID (identification information) given to the application, and "abc" is set. It is the responsibility of the MFP110 vendor to assign the ID uniquely. Application-Type indicates the type of application. Examples of application types include an applet (“applet”) that uses the operation unit 113 and a servlet (“servlet”) that functions as a network server. Vendor-Assets is a vendor asset utilization attribute that indicates whether or not the application handles vendor assets. If "True" is set, the application handles vendor assets, and if "False" is set, it does not.

The external application 207 having such a configuration is installed in the external application management unit 209 in the MFP 110 via the network or from a storage medium such as a USB memory by using the external application installation unit 208. The method of providing the application package file corresponding to the external application 207 here is not particularly limited.

The external application management unit 209 has a database 405 that stores information about installed applications. The database 405 stores values using each attribute shown in the application attribute file 403 of the installed application as a key. Specifically, the values of Application-Name, Application-ID, Application-Type, and Vendor-Assets shown in the data 404 are managed. For example, the information related to the application package file 401 corresponds to the record 406, and the contents described in the application attribute file 403 are stored in the database 405. As described above, when the information described in Vender-Assets is "True", it is possible to indicate that the application handles vendor assets. The attribute shown in the data 404 is an example, and other attribute values may be further described. In addition, the information managed in the database 405 of the external application management unit 209 may increase accordingly.

[Key Management Department]
Next, the key management unit 205 according to the present embodiment will be described. FIG. 6 is a diagram for explaining the relationship between the configuration of the key management unit 205 and the outside. The key management unit 205 is started when the operation of the MFP 110 is started, and thereafter, the operation continues until the power of the MFP 110 is cut off. The key management unit 205 manages the root CA certificate used when the verification process by the digital certificate verification unit 204 is performed on the storage device 116, and passes the root CA certificate as requested.

The management table 604 is a management table of the root CA certificate managed by the key management unit 205, and is configured on the storage device 116. The database 608 shows an example of the information stored in the management table 604. Column 609 shows the actual file name of the root CA certificate stored in storage 116. Column 610 shows the certificate name used when displaying on the operation unit 113. Column 611 shows the vendor attributes set for the root CA certificate.

The root CA certificate 605-607 indicates an actual file of the root CA certificate held in the storage device 116. “Rootca1.cer” to “rootca3.cer” indicated for each root CA certificate indicate the actual file name of the root CA certificate and correspond to column 609 of the database 608. When the registration procedure is performed on the key management unit 205, the root CA certificate is recorded in the management table 604 with the file name and the certificate name of the root CA certificate in columns 609 and 610, respectively. Further, for each root CA certificate, the setting of "with vendor attribute" or "without vendor attribute" is recorded in column 611 depending on the module to be registered.

The vendor attributes according to this embodiment will be described. The certificate installation unit 206 is a module used when the user registers the root CA certificate. Since any root CA certificate installed using such a module is allowed, there is a risk of unauthorized access due to spoofing that can be used to verify the server certificate of the server that accesses the vendor assets. Therefore, in the present embodiment, the root CA certificate installed by the certificate installation unit 206 is registered in the database 608 as "no vendor attribute".

On the other hand, the software update unit 210 is used to update the entire software provided by the vendor. The software updated here includes, for example, the firmware of the MFP, and all of them are guaranteed to be of vendor origin. Some of the software delivered may include a root CA certificate, which is a vendor-provided certificate and is reliable. Therefore, such a root CA certificate can be used to verify the server certificate of the server that accesses the vendor assets. Therefore, in the present embodiment, the root CA certificate installed by the software update unit 210 is registered in the database 608 as "with vendor attribute". The root CA certificate set as "with vendor attribute" is not limited to the above, and if it is guaranteed to be derived from the vendor, the root CA certificate installed by another method is used. It may be set in the book. For example, it may be installed by a user having specific authority such as a service person, or it may be installed via a specific service tool. Further, the root CA certificate installed in advance at the time of shipment of the MFP 110 may be set as "with vendor attribute".

[Cryptographic communication unit]
Next, the operation of the encrypted communication unit 202 according to the present embodiment will be described. The encrypted communication unit 202 is a module that is called from the embedded application 201 or the external application 207 and performs encrypted communication according to a standard. As a standard for encrypted communication, SSL / TLS (Secure Secure Layer / Transport Layer Security) that encrypts at the transport layer or application layer in the 7 layers of OSI (Open System Interaction) and IPSec that encrypts at the network layer. However, other than these standards can be applied.

FIG. 5 is a flowchart of processing of the encrypted communication unit 202 according to the present embodiment. The encrypted communication unit 202 is activated when a request for encrypted communication is received from the embedded application 201 or the external application 207, and ends the operation when the encrypted communication is completed. When a plurality of encrypted communications are requested at the same time, the plurality of encrypted communication units operate independently.

In S501, the encrypted communication unit 202 receives a request for encrypted communication from the application. When the encrypted communication is started, the application ID and the vendor asset attribute are passed from the application. However, as described above, the vendor asset attribute is not essential information because it is not passed when the application is the external application 207.

In S502, the encrypted communication unit 202 determines whether the application is on the client side or the server side. That is, it is determined whether the application operates as a server or a client. This may be determined from the value passed as a parameter when making an encrypted communication request from the application side. If it is determined to be the client side (YES in S502), the process proceeds to S503, and if it is determined to be the server side (NO in S502), the process proceeds to S508.

In S503, the encrypted communication unit 202 requests the server certificate from the server that is the opposite (communication partner). Then, in response, the encrypted communication unit 202 receives the server certificate.

In S504, the cryptographic communication unit 202 requests the digital certificate verification unit 204 to verify the server certificate received from the server in S503. At this time, the cryptographic communication unit 202 passes the application ID passed from the application in S501 and the vendor asset attribute of the application to the digital certificate verification unit 204 together with the server certificate acquired in S503. The verification process by the digital certificate verification unit 204 here will be described later with reference to FIG. After that, the cryptographic communication unit 202 acquires the verification result of the server certificate from the digital certificate verification unit 204.

In S505, the cryptographic communication unit 202 determines whether or not the verification by the digital certificate verification unit 204 is successful. If the verification is successful (YES in S505), the process proceeds to S506, and if the verification fails (NO in S505), the process proceeds to S507.

In S506, the encrypted communication unit 202 continues until the communication with the server corresponding to the encrypted communication request received in S501 is completed. After that, this processing flow is terminated.

In S507, the encrypted communication unit 202 cuts off the connection with the server corresponding to the encrypted communication request received in S501. Then, this processing flow is terminated.

In S508, the encrypted communication unit 202 transmits the server certificate to the client. In this case, the application operates as a server, so there is no need to verify the server certificate. After that, the process proceeds to S506, and the encrypted communication unit 202 continues the communication with the client until the communication corresponding to the encrypted communication request received in S501 is completed. Then, this processing flow is terminated.

[Server certificate verification process]
Next, the server certificate verification process by the digital certificate verification unit 204 according to the present embodiment will be described. FIG. 3 is a flowchart illustrating the operation of the digital certificate verification unit 204. The digital certificate verification unit 204 starts the operation by being called from the cryptographic communication unit 202, and stops the operation when the processing is completed. The start timing here corresponds to the timing at which the request in S504 of FIG. 5 is received from the encrypted communication unit 202.

In S301, the digital certificate verification unit 204 receives the server certificate to be verified from the cryptographic communication unit 202. At the same time, the application ID is acquired.

In S302, the digital certificate verification unit 204 determines in S301 whether or not the instruction that the vendor asset attribute is used has been received from the application. As described above, when the application is the embedded application 201, it is possible to directly instruct whether or not to use the vendor asset attribute by the vendor asset attribute. On the other hand, when the application is the external application 207, the instruction that the vendor asset attribute is used is not given. On the other hand, if it is determined that there is an instruction (YES in S302), the process proceeds to S305, and if it is determined that there is no instruction (NO in S302), the process proceeds to S303.

In S303, the digital certificate verification unit 204 refers to the database 405 of the external application management unit 209 based on the application ID of the application acquired in S301, and confirms the vendor asset attribute (Vendor-Assets information).

In S304, the digital certificate verification unit 204 determines whether or not the value of the vendor asset attribute referred to in S303 is "True". As described above, the case of "True" indicates that the external application handles vendor assets. If the value of the vendor asset attribute is determined to be "True" (YES in S304), the process proceeds to S305, and if it is determined to be "False" (NO in S304), the process proceeds to S306. When the value of the vendor asset attribute is "False", all the root CA certificates held in the storage device 116 are searched.

In S305, the digital certificate verification unit 204 temporarily excludes the root CA certificate to be verified that does not have the vendor attribute. That is, among the root CA certificates included in the database 608 of the management table 604, the root CA certificate whose value in column 611 has a value of "no vendor attribute" is excluded. In the case of the example of FIG. 6, the root CA certificate 607 (“rootca3.cer”) is excluded.

In S306, the digital certificate verification unit 204 searches for a root CA certificate that can verify the server certificate from the root CA certificate to be searched.

In S307, the digital certificate verification unit 204 determines whether or not there is a root CA certificate that can verify the server certificate based on the search result of S306. If it is determined that the root CA certificate exists (YES in S307), the process proceeds to S308, and if it does not exist, the process proceeds to S310.

In S308, the digital certificate verification unit 204 verifies the server certificate using the root CA certificate searched in S306. As the server certificate verification method, commonly used known methods such as RSA signature verification and ECDSA signature verification shall be used, and detailed explanations will be omitted.

In S309, the digital certificate verification unit 204 determines whether or not the verification in S308 is successful. If the verification is successful (YES in S309), the process proceeds to S311, and if the verification fails (NO in S309), the process proceeds to S310.

In S310, the digital certificate verification unit 204 returns to the encrypted communication unit 202 that the verification of the server certificate has failed. Then, this processing flow is terminated.

In S311 the digital certificate verification unit 204 returns to the encrypted communication unit 202 that the verification of the server certificate has been successful. Then, this processing flow is terminated.

As described above, in the present embodiment, when the application handles the vendor assets, when the root CA certificate to be verified is used, only the root CA certificate installed from the trusted module is used. This makes it possible to exchange vendor assets safely.

<Second embodiment>
Some MFP 110s have a verification setting for whether or not to verify the server certificate in the setting storage unit 203. Therefore, as a second embodiment of the present invention, a mode in which such a configuration is provided will be described. The points that overlap with the first embodiment will be omitted, and the differences will be described.

[Digital Certificate Verification Department]
FIG. 7 is a flowchart illustrating the operation of the digital certificate verification unit 204 according to the present embodiment. The same processing as that of the processing of FIG. 3 described in the first embodiment is assigned the same reference number, and only the difference will be described.

After the processing of S303, in S701, the digital certificate verification unit 204 determines whether or not the value of the vendor asset attribute referred to in S303 is "True". As described above, the case of "True" indicates that the external application handles vendor assets. If the value of the vendor asset attribute is determined to be "True" (YES in S701), the process proceeds to S305, and if it is determined to be "False" (NO in S701), the process proceeds to S702.

In S702, the digital certificate verification unit 204 acquires the verification setting of the server certificate from the setting storage unit 203.

In S703, the digital certificate verification unit 204 determines whether or not the verification setting acquired in S702 is “ON”. When the verification setting is "ON", it means that the server certificate is verified. If it is "ON" (YES in S703), the process proceeds to S306, and if it is "OFF" (NO in S703), the process proceeds to S311.

As described above, in the present embodiment, the application that handles vendor assets can perform verification using a reliable root CA certificate, and the application that does not handle vendor assets can arbitrarily obtain a certificate according to the certificate verification settings. Controls the implementation of verification. This makes it possible to maintain the availability related to the verification of the server certificate.

<Third embodiment>
Hereinafter, a third embodiment of the present invention will be described. The points that overlap with the first and second embodiments will be omitted, and the differences will be described. Moreover, this embodiment can be arbitrarily combined with the above-mentioned embodiment.

Even if the storage device 116 of the MFP 110 fails, there are an export function and an import function as operations for restoring the original state. By exporting all the settings of the MFP110 to an external storage medium or server as a setting file, even if the storage device 116 of the MFP110 is replaced due to a failure, it can be recovered by importing the exported setting file. And. However, since the exported configuration file can be rewritten by the user at hand, the root CA certificate may also be tampered with. As a result, reliability may be lost when such information is used.

Therefore, in the present embodiment, in the case of the root CA certificate whose vendor attribute value is "with vendor attribute", the root CA certificate is encrypted and then exported so that the user cannot rewrite it. In addition, at the time of import, in the case of a root CA certificate having a vendor attribute, decryption processing is performed before importing.

[Export process]
FIG. 8 is a flowchart illustrating the operation of the export process of the key management unit 205 according to the present embodiment. This processing flow is started when the user of the MFP 110 instructs the execution of the export processing of various data of the MFP 110.

In S801, the key management unit 205 generates a common key unique to the machine. This common key is not open to the users of the MFP 110. In this embodiment, a common key (for example, the machine number of the MFP 110) generated from information independent of the storage device 116 is used. The generation method is not particularly limited, and any method may be used.

In S802, the key management unit 205 pays attention to the first root CA certificate among the root CA certificates managed in the management table 604, and reads the vendor attribute information.

In S803, the key management unit 205 determines whether or not the value is “with vendor attribute” as a result of reading S802. If it is determined that "there is a vendor attribute" (YES in S803), the process proceeds to S804, and if it is determined that "there is no vendor attribute" (NO in S803), the process proceeds to S805.

In S804, the key management unit 205 encrypts the actual file of the root CA certificate of interest using the common key generated in S801 and stores it in an arbitrary storage area. As the arbitrary storage area here, an external storage device designated by the user, a server on the network, or the like may be used. Then, the process proceeds to S806.

In S805, the key management unit 205 saves the actual file of the root CA certificate of interest in plain text in an arbitrary storage area. Then, the process proceeds to S806.

In S806, the key management unit 205 searches the management table 604 for the unprocessed root CA certificate.

In S807, the key management unit 205 determines whether or not there is an unprocessed root CA certificate file as a result of the search in S806. When it is determined that there is an unprocessed root CA certificate file (YES in S807), the process returns to S802 and the process is repeated for the unprocessed root CA certificate. In the case of the example of FIG. 6, the processing is sequentially repeated for the three entity files of the root CA certificate 605 to 607. If it is determined that there is no unprocessed root CA certificate file (NO in S807), the process proceeds to S808.

In S808, the key management unit 205 stores the management table 604 itself in an arbitrary storage area. The storage location of the management table 604 and the storage location of the actual file in S804 or S805 may be the same or may be different. Then, this processing flow is terminated.

[Import process]
FIG. 9 is a flowchart illustrating the operation of the import process of the key management unit 205 according to the present embodiment. This processing flow is started when the user of the MFP 110 instructs the execution of the import processing of various data of the MFP 110. Further, the import data used in this process shall be the export data obtained by the export process shown in FIG. 8, and the storage location of the data shall be specified by the user or the like.

In S901, the key management unit 205 generates a common key unique to the aircraft. The generation method is not particularly limited, and any method may be used. Here, the corresponding common key is generated by the same method as in S801 of the export process shown in FIG.

In S902, the key management unit 205 reads the management table 604 included in the export data from an arbitrary storage area. The storage area for reading the management table 604 may be specified by the user.

In S903, the key management unit 205 pays attention to the first root CA certificate among the root CA certificates managed in the management table 604, and reads the vendor attribute information.

In S904, the key management unit 205 determines whether or not the value is "with vendor attribute" as a result of reading S903. If it is determined that "there is a vendor attribute" (YES in S904), the process proceeds to S905, and if it is determined that "there is no vendor attribute" (NO in S904), the process proceeds to S906.

In S905, the key management unit 205 reads the actual file of the root CA certificate of interest from an arbitrary storage area, decrypts it using the common key generated in S901, and stores it in the storage device 116. Then, the process proceeds to S907.

In S906, the key management unit 205 reads the actual file of the root CA certificate of interest from an arbitrary storage area and stores it in the storage device 116. Here, it is assumed that the actual file of the root CA certificate of interest is not encrypted based on the process of S805 of FIG. 8, and the read actual file is stored in the storage device 116 as it is. Then, the process proceeds to S907.

In S907, the key management unit 205 searches the management table 604 included in the export data for the unprocessed root CA certificate.

In S908, the key management unit determines whether or not there is an unprocessed root CA certificate file as a result of the search in S907. When it is determined that there is an unprocessed root CA certificate file (YES in S908), the process returns to S903 and the process is repeated for the unprocessed root CA certificate. In the case of the example of FIG. 6, the processing is sequentially repeated for the three entity files of the root CA certificate 605 to 607. When it is determined that there is no unprocessed root CA certificate file (NO in S908), this processing flow is terminated.

As described above, according to the present embodiment, even when the reliable root CA certificate stored in the device is exported and imported to the outside, the encryption / decryption is performed with the common key. As a result, the user cannot see or tamper with the contents of the root CA certificate used for authenticating the application that uses the vendor assets, so that the restoration can be performed while maintaining the reliability.

<Other Embodiments>
The present invention supplies a program that realizes one or more functions of the above-described embodiment to a system or a device via a network or a storage medium, and one or more processors in the computer of the system or the device read and execute the program. But it is feasible. It can also be realized by a circuit (for example, ASIC) that realizes one or more functions.

110 ... MFP, 114 ... CPU, 116 ... Storage device, 201 ... Embedded application, 202 ... Cryptographic communication unit, 203 ... Setting storage unit, 204 ... Digital certificate verification unit, 205 ... Key management unit, 206 ... Certificate installation unit , 207 ... External application, 208 ... External application installation unit, 209 ... External application management department, 210 ... Software update department

Claims (13)

An information processing device that can operate one or more applications.
A management means for managing the root certificate used for encrypted communication with an external server,
When a request for encrypted communication with the external server is received from the application, a determination means for determining whether or not the application uses predetermined information in the information processing device, and a determination means.
When the determination means determines that the application uses the predetermined information, the root certificate in which the predetermined attribute information is set is used among the root certificates managed by the management means. An information processing device having a verification means for verifying a server certificate of the external server. It also has an installation method to install a new root certificate based on the user's instructions,
The information processing device according to claim 1, wherein the management means does not set the predetermined attribute information in the root certificate installed by the installation means. Further having an update means for updating the firmware provided in the information processing device,
The information processing device according to claim 1 or 2, wherein the management means sets the predetermined attribute information in the root certificate included in the data used for the update by the update means. The management means according to any one of claims 1 to 3, wherein the root certificate installed at the time of shipment of the information processing apparatus is managed by setting the predetermined attribute information. Information processing device. It further has a second management means for managing the information of the application installed in the information processing apparatus.
When the determination means receives a request for encrypted communication with the external server from the application, the determination means determines whether or not an instruction indicating whether or not to use the predetermined information is received from the application.
Claim 1 is characterized in that when the instruction is not accepted, it is determined whether or not the application uses the predetermined information based on the information managed by the second management means. The information processing apparatus according to any one of 4 to 4. It also has a setting means for setting whether or not to verify the server certificate of the external server.
The verification means is set so that the application that requested the encrypted communication with the external server by the determination means does not use the predetermined attribute and the server certificate is not verified by the setting means. The information processing apparatus according to any one of claims 1 to 5, wherein the server certificate is not verified when the server certificate is used. A generation means for generating a common key using information unique to the information processing device, and
Among the root certificates installed in the information processing apparatus, an export means for encrypting and exporting the root certificate in which the predetermined attribute information is set by using the common key generated by the generation means, and an export means.
When importing the data output by the export means into the information processing apparatus, an import means that decrypts and imports the root certificate encrypted by using the common key generated by the generation means. The information processing apparatus according to any one of claims 1 to 6, further comprising. The export means according to claim 7, wherein among the root certificates installed in the information processing apparatus, the root certificate in which the predetermined attribute information is not set is exported without being encrypted. The information processing device described. The information processing apparatus according to any one of claims 1 to 8, wherein the predetermined information is information on vendor assets defined as being managed by the vendor of the information processing apparatus. The information processing device according to any one of claims 1 to 9, wherein the predetermined attribute information is information indicating that the information processing device is provided by a vendor of the information processing device. The information processing apparatus according to any one of claims 1 to 10, further comprising a communication means for performing encrypted communication with the external server based on the verification result of the verification means. A control method for an information processing device capable of operating one or more applications.
A management process that manages the root certificate used for encrypted communication with an external server by management means, and
A determination step of determining whether or not the application uses predetermined information in the information processing device when a request for encrypted communication with the external server is received from the application.
When it is determined in the determination step that the application uses the predetermined information, the root certificate in which the predetermined attribute information is set is used among the root certificates managed by the management means. A control method for an information processing device, which comprises a verification step for verifying a server certificate of the external server. A computer that can run one or more applications,
A management means for managing root certificates used for encrypted communication with external servers,
A determination means for determining whether or not an application uses predetermined information in the information processing device when a request for encrypted communication with the external server is received from the application.
When the determination means determines that the application uses the predetermined information, the root certificate in which the predetermined attribute information is set is used among the root certificates managed by the management means. A program for functioning as a verification means for verifying the server certificate of the external server.

Images