JP5391756B2 - Image forming apparatus, information management method, and program - Google Patents

Description

  The present invention relates to an image forming apparatus, an information management method, and a program, and more particularly to an image forming apparatus, an information management method, and a program that use a certificate related to SSL communication.

  In recent years, image forming apparatuses have become highly functional, and various services can be provided in cooperation with computers connected via a network. Ensuring communication safety is an important issue in cooperation with computers via networks. Therefore, secure communication using an encryption technique is also required for communication performed by the image forming apparatus.

  SSL (Secure Socket Layer) exists as one of the secure communication technologies. In SSL, a certificate including a public key and a private key paired with the public key are used. That is, the transmitting side encrypts information with the public key and transmits the information, and the receiving side decrypts the information with the secret key. Therefore, information leakage and the like are prevented in the communication path.

  Then, management of certificates and private keys becomes very important in SSL communication. That is, when the certificate and the private key are stolen, it becomes easy for others to impersonate and wiretap communication information.

  The present invention has been made in view of the above points, and provides an image forming apparatus, an information management method, and a program that can appropriately manage certificates and private keys used for SSL communication. Objective.

  Accordingly, in order to solve the above-described problem, the present invention provides an image forming apparatus, a secure storage unit that stores an encryption key unique to the image forming apparatus, and a client certificate and a private key used for SSL communication. Input receiving means for receiving an input; and certificate management means for encrypting the input client certificate and private key with the unique encryption key and storing them in a certificate storage means.

  In such an image forming apparatus, it is possible to appropriately manage certificates and private keys used for SSL communication.

  Certificates and private keys used for SSL communication can be appropriately managed.

1 is a diagram illustrating an example of a hardware configuration of an image forming apparatus according to an embodiment of the present invention. FIG. 3 is a diagram illustrating a software configuration example of an image forming apparatus in an embodiment of the present invention. It is a figure for demonstrating the data structure example of the certificate for information storage. It is a figure for demonstrating the data flow regarding the certificate and private key in this Embodiment. It is a figure for demonstrating the structural example of a certificate management part. It is a figure which shows the structural example of the system in embodiment of this invention. It is a sequence diagram for demonstrating the process sequence of the production | generation process of the information storage certificate. It is a figure which shows the example of the preservation | save form of a certificate and a private key. It is a sequence diagram for demonstrating the process sequence at the time of utilization of a certificate and a private key. It is a figure for demonstrating the process sequence of the preservation | save process or reading process of a certificate or a private key by a certificate management part.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram illustrating a hardware configuration example of an image forming apparatus according to an embodiment of the present invention. 1, the image forming apparatus 10 includes hardware such as a controller 11, a scanner 12, a printer 13, a modem 14, an operation panel 15, a network interface 16, and an SD card slot 17.

  The controller 11 includes a CPU 111, a RAM 112, a ROM 113, an HDD 114, a TPM (Trusted Platform Module) 115, and the like. The ROM 113 stores various programs and data used by the programs. The RAM 112 is used as a storage area for loading a program, a work area for the loaded program, and the like. The CPU 111 realizes various functions by processing a program loaded in the RAM 112. The HDD 114 records programs and various data used by the programs. The TPM 115 is an example of a secure storage unit and is also called a security chip. The TPM 115 is unique to each image forming apparatus 10. If the TPM 115 is removed from the image forming apparatus 10, the image forming apparatus 10 cannot be activated. Further, the TPM 115 cannot be removed and the contents of the TPM 115 cannot be read by another image forming apparatus 10 or a computer. In the present embodiment, the TPM 115 generates and stores an encryption key. The encryption key is used for encryption and decryption of a client certificate (electronic certificate) and a private key that the image forming apparatus 10 uses for SSL (Secure Socket Layer) communication. Since the encryption key is generated by the unique TPM 115 for each image forming apparatus 10, the encryption key is different (unique) for each image forming apparatus 10. In order to avoid confusion between the secret key used for SSL communication and the encryption key stored in the TPM 115, the latter encryption key is hereinafter referred to as “device unique key”.

  The scanner 12 is hardware for reading image data from a document. The printer 13 is hardware for printing image data on printing paper. The modem 14 is hardware for connecting to a telephone line, and is used to execute transmission / reception of image data by FAX communication. The operation panel 15 is hardware including input means such as buttons for accepting input from a user and display means such as a liquid crystal panel. The network interface 16 is hardware for connecting to a network such as a LAN (whether wired or wireless). The SD card slot 17 is used for reading a program recorded on the SD card 80. That is, in the image forming apparatus 10, not only the program recorded in the ROM 113 but also the program recorded in the SD card 80 can be loaded into the RAM 112 and executed.

  FIG. 2 is a diagram illustrating a software configuration example of the image forming apparatus according to the embodiment of the present invention. As shown in the figure, the image forming apparatus 10 includes three Java (registered trademark) VMs (Virtual Machines: VMs) of VMs 121a, 121b, and 121c (hereinafter referred to as “VM 121” when not distinguished from each other). Machine). The VM 121 converts a program in a byte code format unique to Java (registered trademark) into a native code and causes the CPU 111 to execute the program. However, the image forming apparatus 10 does not need to have a plurality of VMs 121, and may have at least one VM 121.

  Software components (hereinafter simply referred to as “components”) operating in each VM 121 are classified and implemented in logical layers such as an application mechanism 131, a service mechanism 132, a device mechanism 133, and an aspect layer 134.

  The application mechanism 131 includes a component that executes processing for providing a service (for example, copying, printing, etc.) in a unit that is basically recognized by the user. In the figure, the component A operating on the VM 121 a is illustrated as a component belonging to the application mechanism 131.

  The service mechanism 132 includes a component that realizes a more primitive function that is used (commonly) by a plurality of components belonging to the application mechanism 131. In the figure, the component B operating on the VM 121b is illustrated as a component belonging to the service mechanism 132.

  A component that controls the hardware of the image forming apparatus 10 belongs to the device mechanism 133. In the drawing, the component C operating on the VM 121 a is illustrated as a component belonging to the device mechanism 133.

  The aspect layer 134 has a function that is commonly used by components belonging to the application mechanism 131, the service mechanism 132, and the device mechanism 133. In the figure, the aspect layer 134 includes an information storage certificate generation unit 140, a certificate management unit 150, and the like.

  The information storage certificate generation unit 140 generates an information storage certificate. In the present embodiment, the information storage certificate is information required when using a client certificate used for SSL communication (that is, information used for SSL communication; hereinafter referred to as “accompanying information”). Is an electronic certificate for storing (storing), and its data structure is the same as that of the client certificate. For example, in the present embodiment, when the client certificate conforms to the X509 format, which is one of the public key certificate standards, the information storage certificate conforms to the X509 format. This is so that the information storage certificate can be handled in the same manner as the client certificate.

  FIG. 3 is a diagram for explaining an example of the data structure of the information storage certificate. In the figure, a structure conforming to the X509 format is shown. Certificates in X509 format are version (version of X509), serialNumber (serial number), signature (signature method of certificate), issuer (identifier name of certificate authority that issued the certificate), validity (public key) Expiration date (start date / time and end date / time)), subject (identifier of the owner of the private key corresponding to the public key included in the certificate), subjectPublicKeyInfo (public key of the certificate), issuerUniqueIdentifier (unique identifier of the certificate authority) ), SubjectUniqueIdentifier (owner's unique identifier), extensions (extension field), and the like.

  Among these items, “issure” and “subject” have a high degree of freedom regarding the description content. Therefore, in the present embodiment, the accompanying information is stored in the information storage certificate issue. Since this certificate is generated by a self-signature, the same accompanying information is also stored in the subject. Therefore, the same accompanying information may be used in the subject.

  In the figure, IP, USER, PASS, PATH, etc. are shown as examples of the accompanying information. IP is an IP address of a communication partner (for example, an SSL server) in SSL communication using a client certificate. USER and PASS are a user name and a password required for accessing a resource managed by a communication partner. PATH is a path name of a resource managed by the communication partner.

  Note that the configuration of the information is merely an example. The configuration of the information can be appropriately defined according to the use of the client certificate.

  The certificate management unit 150 manages certificates and private keys using the HDD 114. In managing certificates and private keys, the certificate management unit 150 encrypts and decrypts certificates and private keys using a device unique key stored in the TPM 115. In addition to the client certificate and the information storage certificate, a CA (Certificate Authority) certificate may be managed. In the present embodiment, the simple term “certificate” includes at least a client certificate and an information storage certificate, and may include a CA certificate.

  FIG. 4 is a diagram for explaining a data flow regarding a certificate and a private key in the present embodiment.

  In the figure, a certificate and a private key are input (imported) by a UI (User Interface) component 137 (however, the information storage certificate is generated by the information storage certificate generation unit 140). The UI component 137 is a specific example of various components in FIG. 2, and is a component that controls an interface with a user regardless of whether the environment is a local environment or a remote environment. Accordingly, the certificate and private key input by the UI component 137 may be input via the operation panel 15 or may be input from a computer connected via the image forming apparatus 10 network. Good. Alternatively, it may be input from a portable recording medium such as the SD card 80.

  The certificate and private key input from the UI component 137 are encrypted by the certificate management unit 150 and stored in the HDD 114. In encryption, the certificate management unit 150 uses a device unique key stored in the TPM 115.

  In the figure, an SSL server 135 and an SSL client 136 are specific examples of various components in FIG. The SSL server 135 is a component that functions as a server in SSL communication. The SSL client is a component that functions as a client in SSL communication. The SSL server 135 and the SSL client 136 correspond to users of certificates and private keys in FIG.

  Upon receiving a certificate and private key acquisition request from the SSL server 135 or SSL client 136, the certificate management unit 150 decrypts the certificate and private key stored in the HDD 114 with the device unique key, and The data is output to the SSL client 136. In the figure, the HDD 114 is used as a storage location for the certificate and the private key, but the storage location is not limited to the HDD 114. Other storage may be used.

  Next, the configuration of the certificate management unit will be described. FIG. 5 is a diagram for explaining a configuration example of the certificate management unit.

  In the figure, the certificate management unit 150 includes a KeyStore class 151, a KeyStore SPI 152, a certificate management provider 153, a JNI library 154, a certificate access library 155, and the like.

  The KeyStore class 151 is a class as a framework for managing certificates and encryption keys in SPI (Service Provider Interface) of JCE (Java (registered trademark) Cryptography Extension): Java (registered trademark) encryption extension function. It also has an implementation related to the management. In the present embodiment, an interface of the KeyStore class 151 is visible from each component that uses the certificate management unit 150. That is, the certificate management unit 150 is used via a method provided in the KeyStore class 151.

  The KeyStore SPI 152 is a JCE SPI (Service Provider Interface) related to the KeyStore class 151. That is, the KeyStore SPI 152 is positioned as an extension point of the KeyStore class 151. Specifically, the KeyStore class 151 can be extended by an implementation having an interface defined in the KeyStore SPI 152. An implementation with such an interface is called a provider.

  The certificate management provider 153 is a provider for the KeyStore class 151. That is, the certificate management provider 153 has an interface conforming to the KeyStore SPI 152, and is called transparently in response to a method call of the KeyStore class 151. In response to the call, the certificate management provider 153 executes processing for realizing the unique function in the present embodiment with respect to certificate and private key management.

  The certificate access library 155 executes a function for writing (saving) the certificate and the private key to the HDD 114 and a function for reading from the HDD 114. The certificate access library 55 also performs encryption or decryption using the device unique key stored in the TPM 115 in the writing function and the reading function.

  The certificate access library 155 is a library of native code that is described in C language or the like and then converted into machine language through compilation and linking. That is, since the Java (registered trademark) code cannot access the TPM 115 or the like, the function for writing and reading the certificate and the private key is implemented by the native code.

  The JNI library 154 is a so-called JNI (Java (registered trademark) Native Interface) for enabling use of the certificate access library 155 that is a native code by the certificate management provider 153 that is a Java (registered trademark) code. .

  That is, the process for realizing the unique function in the present embodiment executed by the certificate management provider 153 is a process for managing certificates and private keys using the certificate access library 155. .

  In the present embodiment, an example in which the image forming apparatus 10 having the above-described software configuration is applied to a system as shown in FIG. 6 will be described.

  FIG. 6 is a diagram illustrating a configuration example of a system in the embodiment of the present invention. In FIG. 1, an image forming apparatus 10 is connected to one or more SSL server apparatuses 20 such as SSL server apparatuses 20a and 20b via a network such as a LAN (Local Area Network) or the Internet.

  Each SSL server device 20 is a computer that functions as a server in SSL (Secure Socket Layer) communication, and provides a predetermined service (for example, provision of Web content) to the image forming device 10.

  In the image forming apparatus 10, a component that communicates with the SSL server apparatus 20 is an https client 136a. The https client 136a is one of the various components in FIG. 2, and is an example of the SSL client 136 in FIG. The https client 136a acquires a certificate and a private key from the certificate management unit 136a during SSL communication with the SSL server device 20.

  The UI component 137 generates an information storage certificate in the information storage certificate generation unit 140 in response to an instruction input by the user on a display screen displayed on the operation panel 15 or a computer connected via the network. Request. The UI component 137 requests the certificate management unit 150 to manage the generated information storage certificate.

  Hereinafter, a processing procedure of the image forming apparatus 10 in the system configuration of FIG. 6 will be described. FIG. 7 is a sequence diagram for explaining the processing procedure of the information storage certificate generation processing.

  In steps S101 to S104, the UI component 137 notifies the information storage certificate generation unit 140 of accompanying information to be stored in the information storage certificate input by the user via the operation panel 15 or the like. FIG. 7 shows an example in which the IP address (S101) of the connection destination SSL server 20, the user name and password required for authentication at the time of connection (S102, S103), and other setting information (S104) are notified. Has been. Subsequently, the UI component 137 requests the information storage certificate generation unit 140 to generate an information storage certificate (S105). Note that steps S101 to S105 may be executed in one step. That is, the information notified in steps S101 to S104 may be notified as an argument of the information storage certificate generation request.

  Subsequently, the information storage certificate generation unit 140 generates a self-signed certificate including the information notified in steps S105 to S104 as an information storage certificate (see FIG. 3), and the generated information storage The certificate for use is output to the UI component 137 (S106).

  Subsequently, the UI component 137 receives input of a client certificate and a secret key corresponding to the generated information storage certificate via the operation panel 15, the network, the SD card 80, or the like (S107). Note that step S107 may be executed before step S101. Further, the client certificate and the private key may be introduced in advance asynchronously with the processing of FIG. 7 and managed by the certificate management unit 150. In this case, in step S107, a list of client certificate aliases already managed by the certificate management unit 150 is displayed on the operation panel 15 or the like, and the client certificate corresponding to the information storage certificate from the list is displayed. May be selected. An alias is an identification name assigned to each certificate in order to manage the certificate.

  Subsequently, the UI component 137 requests the certificate management unit 150 to save the information storage certificate, the client certificate, and the private key (write to the storage) (S108). This request is made using an interface (method) provided by the KeyStore class 151. An alias is designated according to the save request. When the client certificate is newly stored, the alias is input by the user, for example.

  Subsequently, the certificate management unit 150 stores (stores) the information storage certificate, the client certificate, the private key, and the like in the HDD 114 in association with the designated alias (S109). During the storage process, the certificate management unit 150 encrypts the information storage certificate, the client certificate, the private key, and the like using the device unique key stored in the TPM 115.

  In step S107, the CA certificate may also be input. In this case, in step S109, the CA certificate is also saved.

  FIG. 8 is a diagram illustrating an example of a certificate and private key storage mode. As shown in the figure, each set of private keys and certificates is stored in association with an alias assigned to each set. For example, a set of a private key A, a CA certificate A, a client certificate A, and an information storage certificate A is associated with the alias A and stored.

  The certificate is managed as an array of certificates having a client certificate, a CA certificate, and an information storage certificate as elements. Thus, in this embodiment, the information storage certificate is managed integrally with the corresponding client certificate. Therefore, the client certificate and the information accompanying it can be handled in an integrated manner. The information storage certificate can be managed together with the client certificate in the same array because the information storage certificate has the same data structure as the client certificate.

  Next, a processing procedure when using the stored certificate and private key will be described. FIG. 9 is a sequence diagram for explaining a processing procedure when using a certificate and a private key.

  For example, in response to an input of a predetermined web page display request to the operation panel 15, the https client 136 a designates an alias and inputs a certificate and private key acquisition request to the certificate management unit 150 (S 201). The acquisition request is input via an interface (method) provided by the KeyStore class 151. Subsequently, the certificate management unit 150 reads (acquires) the private key and certificate array corresponding to the designated alias from the HDD 114, and uses the device unique key stored in the TPM 115 to Each certificate is decrypted (S202). Subsequently, the certificate management unit 150 outputs the decrypted private key and certificate to the https client 136a (S203). Strictly speaking, steps S201 to S203 are executed separately for the private key and the certificate arrangement.

  Subsequently, the https client 136a acquires the accompanying information recorded in the information storage certificate issue included in the acquired certificate array (S204). Subsequently, the https client 136a makes a connection request to the SSL server device 20 relating to the IP address of the connection destination included in the acquired accompanying information (S205). Subsequently, an exchange based on SSL is performed. That is, the https client 136a verifies the CA certificate of the connection destination SSL server device 20 (S206). When the validity of the CA certificate is confirmed, the https client 136a presents (transmits) its own client certificate to the SSL server device 20 (S207). When the security of communication is ensured based on SSL, the https client 136a, for example, designates a user name and password acquired from an information storage certificate, and sends an access request to protected content to an SSL server. It transmits to the apparatus 20 (S208). When the authentication based on the user name and password is successful, the SSL server device 20 returns the content to the https client 136a (S209).

  In addition, after step S208, there are various types according to the functions realized by the https client 136a. That is, it is convenient that information necessary for the function is recorded as accompanying information in the information storage certificate.

  Next, details of step S108 in FIG. 7 or step S203 in FIG. 9 will be described. FIG. 10 is a diagram for explaining a processing procedure of a certificate or private key storage process or read process by the certificate management unit.

  In step S301, a password and an alias are specified from a certain component, and a private key or certificate storage request or read request is input via the method of the KeyStore class 151 (S301). The password specified here is a password for protecting a certificate or the like, and is given in advance to each component, for example. In the case of a storage request, a private key or certificate to be stored is designated. Here, the information storage certificate has the same data structure as the client certificate. Therefore, the client certificate can be specified by a data type variable in accordance with the interface specification of the method of the KeyStore class. In other words, the information storage certificate can be specified as an argument of the method of the KeyStore class 151 because it has the same data structure as the client certificate.

  Subsequently, the KeyStore class 151 checks the designated password (S302). When a valid password is specified, the certificate management provider 153 stores a certificate, a private key, or a certificate for the request source component based on a code-based access control mechanism in Java (registered trademark). The presence / absence of access authority to the area is determined (S303). The code-based access control mechanism is a mechanism for controlling access to each resource for each class. Since the mechanism is provided as a standard of Java (registered trademark), detailed description thereof is omitted here.

  When the access authority of the request source component is recognized based on the code-based access control mechanism, the certificate management provider 153 acquires a device unique key from the TPM 115 using the certificate access library 155 (S304). When the request from the component is a certificate or private key read request (when the called method is related to a read request), the certificate management provider 153 uses the certificate access library 155 to verify the certificate. An arrangement of documents or a secret key is obtained from the HDD 114 (S305), and decrypted with the device unique key (S306). The decrypted certificate or private key is returned as the return value of the called method. Here, since the information storage certificate has the same data structure as the client certificate or the like, it can be returned as a return value of a data type according to the interface specification of the KeyStore class 151.

  When the request from the component is a certificate or private key storage request (when the called method is related to the storage request), the certificate management provider 153 uses the certificate access library 155 to verify the certificate. The certificate or secret key is encrypted with the device unique key (S315), and the encrypted certificate or secret key is stored in the HDD 114 (S316).

  As described above, according to the present embodiment, the client certificate and private key used for SSL communication are encrypted with the device unique key stored in the TPM 115 and stored in the HDD 115. Therefore, it is possible to improve the security related to management of client certificates and private keys. That is, even if a client certificate or the like is stolen from the HDD 115, it is very difficult to decrypt the client certificate or the like because the client certificate or the like is encrypted with the device unique key. Since the device unique key is stored in the TPM 115, it is very difficult to steal the device unique key in a usable state. Therefore, in practice, the client certificate, the private key, and the like can be used only in the image forming apparatus 10.

  Further, according to the present embodiment, information necessary for SSL communication using a client certificate is managed integrally with the client certificate. Therefore, the management configuration of the client certificate and accompanying information can be simplified, and the convenience of the client certificate can be improved.

  Note that the function of the image forming apparatus 10 of the present embodiment may be applied to other network devices.

  As mentioned above, although the Example of this invention was explained in full detail, this invention is not limited to such specific embodiment, In the range of the summary of this invention described in the claim, various deformation | transformation・ Change is possible.

DESCRIPTION OF SYMBOLS 10 Image forming apparatus 11 Controller 12 Scanner 13 Printer 14 Modem 15 Operation panel 16 Network interface 17 SD card slot 20, 20a, 20b SSL server apparatus 80 SD card 111 CPU
112 RAM
113 ROM
114 HDD
115 TPM
131 Application mechanism 132 Service mechanism 133 Device mechanism 134 Aspect layer 135 SSL server 136 SSL client 137 UI component 140 Information storage certificate generation unit 150 Certificate management unit 151 KeyStore class 152 KeySortSPI
153 Certificate Management Provider 154 JNI Library 155 Certificate Access Library

JP 2007-251842 A

Claims (3)

An image forming apparatus,
Secure storage means storing an encryption key unique to the image forming apparatus;
Input accepting means for accepting input of a client certificate and private key used for SSL communication;
An information storage certificate generating means for generating an information storage certificate having the same data structure as the preliminary client certificate and including accompanying information used for the SSL communication;
The inputted client certificate and private key are encrypted with the unique encryption key, stored in certificate storage means, the information storage certificate is encrypted with the unique encryption key, and associated with the client certificate and certificate management unit Ru is stored in the certificate storage unit Te,
Communication control means for executing SSL communication,
The certificate management unit obtains the client certificate and the private key and the information storage certificate associated with the client certificate from the certificate storage unit in response to a request from the communication control unit. An image forming apparatus that decrypts the client certificate and private key and the information storage certificate with the unique encryption key . An information management method executed by an image forming apparatus,
An input acceptance procedure for accepting input of a client certificate and a private key used for SSL communication;
An information storage certificate generating procedure for generating an information storage certificate having the same data structure as the pre-client client certificate and including accompanying information used for the SSL communication;
The input client certificate and private key are encrypted with an encryption key unique to the image forming apparatus stored in a secure storage unit, stored in the certificate storage unit, and the information storage certificate is stored in the unique storage key. encrypted by the encryption key, and certificate storage procedure Ru is stored in the certificate storage unit in association with the client certificate,
Obtaining the client certificate and private key and the information storage certificate associated with the client certificate from the certificate storage means, the client certificate and private key and the information storage certificate, A certificate acquisition procedure for decrypting the certificate with the unique encryption key;
An information management method comprising: a communication procedure for performing SSL communication using the acquired client certificate and private key and the information storage certificate . In the image forming device,
An input acceptance procedure for accepting input of a client certificate and a private key used for SSL communication;
An information storage certificate generating procedure for generating an information storage certificate having the same data structure as the pre-client client certificate and including accompanying information used for the SSL communication;
The input client certificate and private key are encrypted with an encryption key unique to the image forming apparatus stored in a secure storage unit, stored in the certificate storage unit, and the information storage certificate is stored in the unique storage key. encrypted by the encryption key, and certificate storage procedure Ru is stored in the certificate storage unit in association with the client certificate,
Obtaining the client certificate and private key and the information storage certificate associated with the client certificate from the certificate storage means, the client certificate and private key and the information storage certificate, A certificate acquisition procedure for decrypting the certificate with the unique encryption key;
A program for executing a communication procedure for executing SSL communication using the acquired client certificate and private key and the information storage certificate .

Images