Information processing device and program

Abstract

This enhances data security compared to backing up plaintext encryption keys to a removable storage device. [Solution] The information processing device has a processor, and when the device is started up and meets predetermined conditions, the processor accepts an input operation for a one-time password, encrypts the first encryption key used to encrypt the first encrypted data stored in a first storage device that is removable from the first board using the one-time password, and stores it in the first storage device.

Description

Technical Field

[0001] The present invention relates to an information processing apparatus and a program.

Background Art

[0002] High security for user data is required for printing devices and other devices. For this reason, for example, it is required to satisfy the following conditions. (1) Data on a removable storage device shall be encrypted with a specific algorithm (2) The plaintext encryption key used for encryption shall not be stored on the same storage device as the encrypted data (3) The plaintext encryption key shall not be stored on a removable storage device

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] By the way, in a printing device or other device, it may be necessary to replace a circuit board during repair. In this case, the storage device is removed from the old circuit board and attached to the new circuit board. However, the encryption key used for data encryption is linked to the circuit board on a one-to-one basis. Therefore, even if the storage device of the old circuit board is transferred to the new circuit board, the data stored in the storage device cannot be decrypted and used as it is. This is because the encryption key of the old circuit board used for data encryption is different from the encryption key of the new circuit board.

[0005] An object of the present invention is to enhance data security as compared with the case of backing up a plaintext encryption key on a removable storage device. [Means for solving the problem]

[0006] The invention described in claim 1 is an information processing device having a processor, which, when activated under predetermined conditions, accepts an input operation for a one-time password, encrypts a first encryption key used to encrypt first encrypted data stored in a first storage device that is removable from a first circuit board using the one-time password, and stores it in the first storage device. The invention described in claim 2 is an information processing device according to claim 1, wherein the activation that satisfies the predetermined conditions is one of the following: activation with a specific key pressed, activation with a specific switch in a specific position, or activation with a predetermined device inserted. The invention described in claim 3 is an information processing device according to claim 1, wherein the processor receives the input of the one-time password through the operation screen of the device. The invention described in claim 4 is an information processing device according to claim 3, wherein the operation screen is a maintenance mode screen, and the processor accepts the input of the one-time password through the maintenance mode screen. The invention described in claim 5 is an information processing device according to claim 1, wherein, upon startup after replacing the first board with the second board, the processor fails to decrypt the first encrypted data stored in the first storage device transferred from the first board to the second board, and furthermore, if encrypted encryption key data exists in the first storage device, it displays on the operation screen an input screen for the one-time password used to decrypt the encryption key data. The invention described in claim 6 is an information processing apparatus according to claim 5, wherein the processor decrypts the first encrypted data stored in the first storage device into plaintext data using the first encryption key decrypted from the encryption key data with the one-time password, encrypts the decrypted plaintext data into second encrypted data using a second encryption key read from a second storage device that cannot be removed from the second substrate, and writes the second encrypted data to the first storage device. The invention described in claim 7 is an information processing apparatus according to claim 6, wherein the processor writes the second encrypted data to the first storage device and then deletes the encryption key data from the first storage device. The invention described in claim 8 is a program for a computer that enables the following functions: accepting input of a one-time password when the computer is started up under predetermined conditions; and encrypting a first encryption key used to encrypt first encrypted data stored in a first storage device that is removable from the first circuit board using the one-time password, and storing it in the first storage device. The invention described in claim 9 is a program according to claim 8 that further enables the computer to display a screen for inputting the one-time password used to decrypt the encryption key data on the operation screen if, upon startup after replacing the first board with the second board, the decryption of the first encrypted data stored in the first storage device transferred from the first board to the second board fails, and furthermore, encrypted encryption key data exists in the first storage device. [Effects of the Invention]

[0007] According to the invention described in claim 1, data security can be enhanced compared to backing up plaintext encryption keys on a removable storage device. According to the invention described in claim 2, the input of a one-time password can be limited to cases where predetermined conditions are met. According to the invention described in claim 3, even in situations where communication with an external device is not possible, it is possible to accept the input of a one-time password as long as the operation screen can be displayed. According to the invention described in claim 4, a one-time password can be entered as part of the maintenance work. According to the invention described in claim 5, when replacing a substrate, the encryption key data stored in the storage device that has been transferred from the first substrate to the second substrate can be decrypted. According to the invention described in claim 6, encrypted data stored in the first storage device inherited from the first substrate can be made available for use on the second substrate. According to the invention described in claim 7, only encrypted data can be stored in the first storage device. According to the invention described in claim 8, data security can be enhanced compared to backing up plaintext encryption keys on a removable storage device. According to the invention described in claim 9, when replacing a substrate, the encryption key data stored in the storage device that has been transferred from the first substrate to the second substrate can be decrypted. [Brief explanation of the drawing]

[0008] [Figure 1] This is a diagram illustrating an example of the configuration of an image forming apparatus. [Figure 2] This diagram illustrates an example of data stored in non-volatile memory. [Figure 3] This flowchart illustrates an example of some of the work procedures and processing operations related to replacing a control board. [Figure 4] This diagram illustrates an example of a menu screen displayed when the system is started in maintenance mode. [Figure 5] This diagram illustrates the processing steps 104-105 of Figure 3. [Figure 6] This diagram illustrates the process of replacing a control board by a customer engineer. [Figure 7] This flowchart illustrates an example of the work procedure and processing actions to be performed when a negative result is obtained in step 110 of Figure 3. [Figure 8] This is a flowchart for explaining an example of a processing operation executed when encryption key data is not recorded in a specific area of a non-volatile memory. [Figure 9] This is a diagram for explaining an example of a menu screen displayed at the first startup after replacing the control board. [Figure 10] This is a diagram for explaining an example of a processing operation executed at the first startup after replacing the control board.

Embodiments for Carrying Out the Invention

[0009] Hereinafter, embodiments of the present invention will be described with reference to the drawings. <Embodiment 1> <Configuration of Image Forming Apparatus> FIG. 1 is a diagram for explaining a configuration example of an image forming apparatus 1. The image forming apparatus 1 is an example of an information processing apparatus. The image forming apparatus 1 includes, for example, a control board 10, a control panel 11, a printing engine 12, a scanner 13, and a communication module 14.

[0010] The control panel 11 is a device that receives user operations. The control panel 11 is provided with, for example, a touch panel, buttons, and switches. The touch panel is a device having a structure in which a capacitive translucent thin film sensor is laminated on the surface of a display, for example. The touch panel is an example of a device having both functions of an input device and an output device. Buttons and switches are examples of mechanical operators. Hereinafter, various screens displayed on the touch panel are also referred to as operation screens.

[0011] The printing engine 12 includes mechanisms related to processing devices used for printing information on paper or other media. The processing device includes, for example, functional units related to rasterization processing, density correction, sharpness correction, contrast correction, and ground color removal. The mechanism of the printing engine 12 differs depending on the printing method. For example, the mechanism of the printing engine 12 is different for photo printing and inkjet printing. Furthermore, the mechanism for transporting the medium (i.e., the transport mechanism) differs depending on whether the medium is cut paper or roll paper.

[0012] The scanner 13 is a device that optically reads information from the surface of a document. The scanner 13 supports at least one of two methods: one in which the reading unit is moved relative to a stationary document, and another in which the document is moved relative to a stationary reading unit. The communication module 14 is a module that enables communication with external terminals. The communication module 14 includes a module used for connecting to a LAN (=Local Area Network) that is connected by wire or wirelessly, for example. The communication module 14 also includes a USB (=Universal Serial Bus) module, for example.

[0013] The control board 10 includes, for example, a processor 101, a system ROM (=Read Only Memory) 102, a RAM (=Random Access Memory) 103, a non-volatile memory 104 that can be removed from the control board 10, and a non-volatile memory 105 that is directly attached to the control board 10. The non-volatile memory 105, which is directly attached to the control board 10, is a storage device that cannot be removed from the control board 10. The non-volatile memory 105 is an example of a second storage device.

[0014] The processor 101 is a semiconductor device that implements various functions through the execution of a program. This program includes, for example, firmware 102A (see Figure 2) and UEFI (Unified Extensible Firmware Interface) 102B (see Figure 2).

[0015] Firmware 102A is a program that controls the operation and functions of the control panel 11 and other devices that constitute the image forming apparatus 1. UEFI102B is a boot program that controls the startup process. UEFI102B includes, for example, a customer engineer mode (hereinafter also referred to as "maintenance mode"). Customer engineer mode is executed when the startup meets predetermined conditions.

[0016] The system ROM 102 is directly soldered to the control board 10. In other words, the system ROM 102 is a memory device that cannot be physically removed from the control board 10 by customer engineers, etc. The system ROM 102 is, for example, soldered to the control board 10. RAM103 is a semiconductor memory used, for example, as an execution area for programs. For example, a computer is composed of a processor 101, a system ROM 102, and RAM103.

[0017] The non-volatile memory 104 is a storage device that can be removed from the control board 10. The non-volatile memory 104 includes, for example, an SD (Secure Digital) memory card, a hard disk drive (i.e., a magnetic recording device), and a ROM soldered to a sub-board connected to the control board 10 by a connector.

[0018] The non-volatile memory 104 stores, for example, encrypted data 104A (see Figure 2) and unencrypted data 104B (see Figure 2). The encrypted data 104A refers to configuration information encrypted with, for example, an encryption key 105A (see Figure 2) unique to the control board 10. The configuration information includes, for example, user information and security information. The user information here includes, for example, information that identifies the user, user settings for various functions, usage logs, and error logs. Unencrypted data 104B is data that is stored without encryption.

[0019] The non-volatile memory 105 is a storage device directly attached to the control board 10. The non-volatile memory 105 includes, for example, EEP (Electrically Erasable Programmable) ROM, flash ROM, and TPM (Trusted Platform Module). The non-volatile memory 105 stores the plaintext encryption key 105A. This is to satisfy the requirement that the encrypted data 104A and the plaintext encryption key 105A used for encryption must not be stored on the same storage device. The initial value of the encryption key 105A is unique to the control board 10. However, the user may generate and use a different key.

[0020] Figure 2 illustrates an example of data stored in non-volatile memory. As mentioned earlier, the system ROM 102 stores, for example, firmware 102A and UEFI 102B. Furthermore, the non-volatile memory 104, which is removable from the control board 10 (see Figure 1), stores, for example, encrypted data 104A and unencrypted data 104B. Furthermore, the non-volatile memory 105, which is directly attached to the control board 10, stores the plaintext encryption key 105A.

[0021] <Replacement of control board and processing operation> Figure 3 is a flowchart illustrating an example of the work procedure and some of the processing operations related to the replacement of the control board 10 (see Figure 1). In the figure, the symbol S represents a step. The processing operation shown in Figure 3 is realized through the execution of UEFI 102B (see Figure 2) by processor 101 (see Figure 1).

[0022] First, the processor 101 determines whether the startup meets predetermined conditions (step 101). The predetermined conditions assume specific operations assigned to preparing the control board 10 for replacement. Startups resulting from specific operations include, for example, startup with a specific key pressed, startup with a specific switch in a specific position, and startup with a predetermined device inserted. For example, if any one of these conditions is met, it is considered that the predetermined conditions are met.

[0023] Specific keys include, for example, a home button, job confirmation button, clear button, pause button, interrupt button, stop button, start button, reset button, and machine confirmation (meter confirmation) button. In this embodiment, it is assumed that the system starts when any one of these buttons is pressed, but it may also be required that a predetermined number of buttons be pressed simultaneously to start the system. These buttons are physical keys.

[0024] Certain types of switches include, for example, DIP switches and lever switches. The DIP switch may be a slide type, a piano type, or a rotary type. A DIP switch may also contain multiple switches. If it contains multiple switches, for example, a specific switch may be assigned to activate maintenance mode. A lever switch may have two or more directions in which the lever can be tilted. In this case, the state in which the lever is tilted in a specific direction is defined as "the state in which a specific switch is in a specific position." Power switches are also included in lever switches. These switches are also physical keys.

[0025] If the startup conditions are met beforehand, a positive result is obtained in step 101. In this case, the processor 101 displays a menu for swapping memory devices (step 102). Figure 4 illustrates an example of a menu screen displayed when the system is started in maintenance mode. This menu screen is displayed on the control panel 11 of the image forming apparatus 1 (see Figure 1). Note that this menu screen is an example of the screen displayed in maintenance mode. In the example screen shown in Figure 4, the screen includes a title 111, a description 112, a one-time password input field 113, and a settings button 114.

[0026] Title 111 might display something like "Memory Device Replacement Menu". Instruction 112 contains instructions for customer engineers, etc. In the case of Figure 4, instruction 112 displays, "Please set a one-time password before replacing the storage device."

[0027] In Figure 4, the one-time password input field 113 is provided for a 4-digit string (for example, a number from 0 to 9999). 4 digits is just an example; a string of 5 or more digits may be required. The more digits, the higher the security. Note that the characters used in the one-time password are not limited to numbers; letters and symbols may also be included.

[0028] Entering a string into input field 113 here is just one example of an input operation. In this embodiment, the validity period of the one-time password is, for example, 10 minutes. However, the validity period is not limited to 10 minutes; it may be longer or shorter. A separate input field for confirmation may also be provided. In Figure 4, when the setting button 114 is pressed, the input of the one-time password is confirmed.

[0029] However, input confirmation may be considered complete when all input fields are filled with characters, or when the string entered in the one-time password input field 113 matches the string entered in the confirmation input field. If these functions are adopted, the settings button 114 is unnecessary.

[0030] Let's return to the explanation of Figure 3. After step 102 is completed, the processor 101 determines whether or not the one-time password setting has been accepted (step 103). If the one-time password setup is not complete, a negative result is obtained in step 103. In this case, the processor 101 repeats the determination in step 103.

[0031] On the other hand, if the one-time password setup is complete, a positive result is obtained in step 103. In this case, the processor 101 encrypts the encryption key with the one-time password to generate encryption key data (step 104). The plaintext encryption key 105A (see Figure 2) is stored in the non-volatile memory 105 (see Figure 2). Next, the processor 101 stores the generated encryption key data in a removable non-volatile memory 104 (see Figure 2) (step 105).

[0032] Figure 5 is a diagram illustrating the processing operations in steps 104 to 105. In Figure 5, the control board 10 mounted on the image forming apparatus 1 (see Figure 1) is referred to as "control board A". This "control board A" is the control board 10 that is experiencing a malfunction or other issue. Also in Figure 5, the encryption key 105A stored in the non-volatile memory 105 directly attached to the control board 10 is referred to as "encryption key A". "Encryption key A" is an encryption key unique to "control board A".

[0033] Note that "Control Board A" is an example of the first board. Furthermore, the non-volatile memory 104 attached to "control board A" is an example of a first storage device. Furthermore, the encrypted data 104A stored in the non-volatile memory 104 is an example of the first encrypted data. Furthermore, "encryption key A," used to encrypt encrypted data 104A, is an example of a first encryption key.

[0034] As explained in step 104, when the one-time password setting is accepted, "encryption key A" is encrypted with the one-time password and stored in the non-volatile memory 104 as encryption key data 104C. As a result, the non-volatile memory 104 stores encrypted data 104A and encrypted key data 104C.

[0035] As mentioned above, from a security standpoint, it is not permitted to store the encrypted data 104A and the plaintext "encryption key A" used to generate it on the same storage device. Furthermore, it is not permitted to store the plaintext "encryption key A" in a non-volatile memory 104 that is removable from the control board 10. However, in this embodiment, the non-volatile memory 104 stores encryption key data 104C obtained by encrypting "encryption key A". Therefore, the two conditions mentioned above are satisfied.

[0036] Let's return to the explanation of Figure 3. Once the encryption key data 104C (see Figure 5) is stored in the non-volatile memory 104, the processor 101 is powered off (step 106). When the power is turned off, the control board 10 (see Figure 1) can be removed from the image forming apparatus 1 (see Figure 1). In this embodiment, the circuit board replacement is performed by a customer engineer.

[0037] Figure 6 illustrates the procedure for replacing the control board 10 by a customer engineer. Figure 6 is denoted with reference numerals corresponding to the parts that correspond to those in Figure 5. As shown in Figure 6, the customer engineer removes the non-volatile memory 104 from the faulty control board 10 (i.e., control board A) and installs it on another control board 10 (i.e., control board B).

[0038] Here, "control board B" is an example of a second board. The non-volatile memory 105 of "control board B" stores "encryption key B" as an encryption key 105A unique to "control board B". "Encryption key B" is an example of a second encryption key. After the customer engineer installs the "control board B," which has the non-volatile memory 105 installed, into the image forming apparatus 1, they turn on the main power. When the main power is turned on, the boot program UEFI102B (see Figure 2) starts up.

[0039] Return to the explanation of step 101 in Figure 3. When the main power is turned on, the determination process in step 101 is executed again. If the startup meets predetermined conditions, the operations described above are repeated. Here, we will explain startups that do not meet predetermined conditions. In this case, a negative result is obtained in step 101. Cases in which a negative result is obtained in step 101 include, for example, when the control board 10 (see Figure 1) is operating normally and when the system is started immediately after the control board 10 has been replaced.

[0040] If a negative result is obtained in step 101, the processor 101 obtains the encryption key 105A (see Figure 1) from the non-removable non-volatile memory 105 (see Figure 1) (step 107). The encryption key 105A obtained differs depending on whether the control board 10 is operating normally (i.e., the control board 10 has not been replaced) or if the system is started immediately after the control board 10 has been replaced. For example, if the control board 10 is operating normally, "encryption key A" is obtained. On the other hand, if the control board 10 has been replaced, "encryption key B" is obtained.

[0041] Next, the processor 101 decrypts the encrypted data 104A (see Figure 5) with the encryption key (step 108). Next, the processor 101 determines whether or not the decryption was successful (step 109). If decoding is successful, a positive result is obtained in step 109. Successful decoding occurs, for example, when the control board 10 is functioning normally. Normal operation includes cases where the newly installed control board 10 (i.e., control board B) was able to inherit the setting information.

[0042] If a positive result is obtained in step 109, the processor 101 starts the firmware and the main program in order (step 110). The processor 101 performs the boot process using the decoded configuration information. On the other hand, if decryption of the encrypted data fails, a negative result is obtained in step 109. One example of a failure to decrypt the encrypted data is a startup immediately after replacing the control board 10.

[0043] The encrypted data 104A immediately after the control board 10 was replaced is the data that was stored in the non-volatile memory 104 inherited from "control board A". In other words, it is data encrypted with "encryption key A". However, the encryption key used for decryption is "encryption key B," which is read from the non-volatile memory 105 (see Figure 6) of the replaced "control board B." In this case, decryption fails because the encryption key used for encryption and the encryption key used for decryption are different.

[0044] Figure 7 is a flowchart illustrating an example of the work procedure and processing actions to be performed when a negative result is obtained in step 109 (see Figure 3). If a negative result is obtained in step 109, the processor 101 accesses a specific area prepared in the removable non-volatile memory 104 to check for the presence or absence of the encryption key data 104C (see Figure 5) (step 111).

[0045] In this embodiment, a specific area is predetermined. In other words, the usable area of ​​the non-volatile memory 104 is determined according to its purpose. Therefore, the processor 101 accesses the recording area allocated to the encryption key data 104C (data obtained by encrypting encryption key A with a one-time password). Next, the processor 101 determines whether or not the encryption key data 104C (see Figure 10) is recorded (step 112).

[0046] For example, if data consisting of all zeros is read, it is assumed that no encryption key data is recorded. In this case, a negative result is obtained in step 112. Figure 8 is a flowchart illustrating an example of the processing actions performed when encryption key data is not recorded in a specific area of ​​the non-volatile memory 104. If a negative result is obtained in step 112, the processor 101 determines whether or not the initialization was accepted (step 113).

[0047] The option to contact a customer engineer regarding whether or not to perform initialization will be displayed in Control Panel 11 (see Figure 1). If the initialization request is received from the customer engineer, a positive result is obtained in step 113. In this case, the processor 101 initializes the encrypted data 104A (step 114). After this, the processor 101 proceeds to step 125 (see Figure 7). Specifically, the processor 101 proceeds to reboot. On the other hand, if initialization is not accepted, a negative result is obtained in step 113. In this case, the processor 101 powers off (step 115).

[0048] Let's return to the explanation of Figure 7. If data of a predetermined length (e.g., 32 bits) is recorded in a specific area, it is assumed that encryption key data is recorded there. In this case, a positive result is obtained in step 112. If a positive result is obtained in step 112, the processor 101 determines whether or not it has accepted the input of a one-time password (step 116). Furthermore, the determination in step 116 may be limited to within the validity period of the one-time password. If the validity period has expired, a notification to restart the data transfer process may be displayed on a separate screen.

[0049] Figure 9 illustrates an example of a menu screen displayed during the first startup after replacing the control board (see Figure 1). Figure 9 includes corresponding reference numerals for parts that correspond to those in Figure 4. This menu screen is an example of a one-time password input screen. In the example screen shown in Figure 9, the screen includes a title 111, a description 112A, a one-time password input field 113, and an OK button 115.

[0050] Title 111 might display something like "Memory Device Replacement Menu". Instructions for customer engineers, etc., are included in the explanatory document 112A. As shown in Figure 9, explanatory document 112A reads, "Please enter the one-time password you set before replacing the control board."

[0051] In the case of Figure 9, the one-time password input field 113 also provides a field for a 4-digit string (for example, a number from 0 to 9999). The number of digits in the input field is the same as the menu screen shown in Figure 4. In Figure 9, pressing the OK button confirms the input of the one-time password. Alternatively, input confirmation may be considered complete when all input fields are filled with characters, or when the string entered in the one-time password input field 113 matches the string entered in the confirmation input field. If these functions are adopted, the OK button 115 is unnecessary.

[0052] Let's return to the explanation of Figure 7. If the one-time password is not entered, a negative result is obtained in step 116. In this case, the processor 101 repeats the determination in step 116. On the other hand, if a one-time password is accepted, a positive result is obtained in step 116. In this case, the processor 101 decrypts the encryption key data 104C using the one-time password (step 117).

[0053] Next, processor 101 determines whether decryption using the one-time password was successful (step 118). If decryption using a one-time password fails, a negative result is obtained in step 115. In this case, the processor 101 displays a one-time password input error screen (step 119). The input error screen is displayed on the control panel 11 (see Figure 1). After this, the processor 101 returns to step 116 and prepares to receive a new one-time password.

[0054] On the other hand, if decryption using a one-time password is successful, a positive result is obtained in step 118. In this case, the processor 101 determines whether the encryption key is valid or not (step 120). The determination of whether the encryption key is valid or not is made, for example, by the data length. For example, the data length of a valid encryption key is assumed to be 32 bits. In this case, if the data length of the decrypted encryption key exceeds 32 bits, the decrypted encryption key is determined to be "invalid". In this case, a negative result is obtained in step 120. Having obtained a negative result in step 120, the processor 101 proceeds to the same step as when a negative result was obtained in step 112 (i.e., step 113 (see Figure 8)).

[0055] On the other hand, if the decrypted encryption key is "determined" to be valid, a positive result is obtained in step 120. In this case, the processor 101 decrypts the encrypted data 104A with the decrypted encryption key (i.e., encryption key A) (step 121). This decryption process generates plaintext configuration information. The plaintext configuration information is temporarily stored, for example, in RAM 103 (see Figure 1). The plaintext configuration information is an example of plaintext data. Next, the processor 101 encrypts the plaintext configuration information with an encryption key (i.e., encryption key B) unique to the control board 10 (i.e., control board B) to generate new encrypted data 104A1 (see Figure 10) (step 122). Encrypted data 104A1 is an example of second encrypted data.

[0056] Next, the processor 101 stores the generated encrypted data 104A1 in the removable non-volatile memory 104 (step 123). Subsequently, the processor 101 deletes the encryption key data 104C (see Figure 10) from the removable non-volatile memory 104 (step 124). Here, the encryption key data 104C is data obtained by encrypting "encryption key A" with a one-time password. Subsequently, processor 101 proceeds to reboot (step 125).

[0057] Figure 10 illustrates an example of the processing operations performed during the first startup after replacing the control board 10. Figure 10 is denoted with reference numerals corresponding to the parts shown in Figures 5 and 6. The upper part of Figure 10 shows the data storage state immediately after replacing the control board 10. Therefore, the non-volatile memory 104 stores encrypted data 104A (configuration information encrypted with encryption key A) and encryption key data 104C. Incidentally, the control board 10 shown in Figure 10 is the new "control board B". Also, in the case of Figure 10, the encryption key 105A stored in the non-volatile memory 105 is "encryption key B".

[0058] In the state shown in the upper part of Figure 10, when steps 117 to 124 (see Figure 7) are executed, as shown in the lower part of Figure 10, only the encrypted data 104A1 encrypted with "encryption key B" is stored in the non-volatile memory 104. In other words, the encryption key data 104C (data encrypted with encryption key A using a one-time password) that was stored when the non-volatile memory 104 was installed on the new "control board B" has been deleted.

[0059] <Summary> In the mechanism described above, after storing the encryption key data (data obtained by encrypting the encryption key with a one-time password) in the non-volatile memory 104, the non-volatile memory 104 is removed from the current control board A. At this time, the non-volatile memory 104 contains two things: encrypted data 104A and encryption key data 104C. However, the encryption key data 104C is encrypted, not in plaintext. Therefore, even if the non-volatile memory 104 is leaked, the plaintext configuration information cannot be decrypted from the encryption key data 104C.

[0060] Incidentally, the one-time password is known only to the customer engineer who set it up. Therefore, by receiving the one-time password from the customer engineer after the non-volatile memory 104 is installed, it becomes possible to decrypt the encryption key 105A while ensuring security. Once encryption key A is decrypted, it becomes possible to decrypt the configuration information on the control board B.

[0061] The decrypted configuration information is encrypted with encryption key B, which is unique to control board B, and stored in non-volatile memory 104. In any case, the configuration information used on control board A is stored in a state that can be used on the new control board B. The mechanism described in this embodiment requires only a non-volatile memory 104 that can be removed from the control board A. In other words, there is no need for communication with an external terminal or the like to import the encryption key A used to encrypt the encrypted data 104A into the new control board B.

[0062] Therefore, the aforementioned mechanism can be adopted if there is one non-volatile memory 104 that can be removed from control board A. Since only one removable non-volatile memory 104 is needed on control board A, the number of non-volatile memory 104 that can be freely attached to and removed from control board B may be two or more.

[0063] Furthermore, with the aforementioned mechanism, a separate non-volatile memory is not required for the transfer of encryption key A, in addition to the non-volatile memory 104 in which the encrypted data 104A is stored. Therefore, the range of image forming apparatus 1 that can implement the aforementioned mechanism is expanded. Furthermore, in the aforementioned mechanism, if the boot program UEFI102B is running, it is possible to transfer the encryption key A, which is unique to control board A, to control board B. Therefore, even if a failure occurs that prevents the OS from starting, user configuration information can be recovered.

[0064] Furthermore, in the aforementioned mechanism, the storage of encryption key data (data obtained by encrypting encryption key A with a one-time password) is completed within the same control board A. In other words, communication between control board A and devices connected via the network is not required. Therefore, as long as the boot program UEFI102B is running, it is possible to recover user configuration information.

[0065] <Other Embodiments> (1) Although embodiments of the present invention have been described above, the technical scope of the present invention is not limited to the embodiments described above. It is clear from the claims that embodiments with various modifications or improvements made to those described above are also included in the technical scope of the present invention.

[0066] (2) In the above embodiment, a customer engineer was shown replacing the control board 10 (see Figure 1), but the replacement of the control board 10 may also be performed by the user of the image forming apparatus 1 (see Figure 1).

[0067] (3) In the above-described embodiment, the case in which there is one non-volatile memory 104 (see Figure 1) that can be removed from the control board 10 was described, but there may be multiple removable non-volatile memories 104.

[0068] (4) In the embodiments described above, the example given was that the encrypted data 104A (see Figure 2) is encrypted setting information, but the embodiments are not limited to this. The encrypted data 104A may include, for example, a contact list registered in the image forming apparatus 1, print settings, and images of captured documents. Documents include images, photographs, and outputs from various application programs. Images and photographs include, for example, photocopied images, faxed images, and scanned images.

[0069] (5) In the above-described embodiment, the case of replacing the control board 10 of the image forming apparatus 1 was illustrated, but the target equipment is not limited to the image forming apparatus 1. The target equipment can be any equipment in which encrypted data 104A is stored in the non-volatile memory 104.

[0070] (6) In the embodiments described above, each process is performed on any computer. Furthermore, any computer may perform these processes using a processor as hardware, a program as software, or a combination thereof. In that case, the processor is configured to work with the program to perform various processes in the embodiment, and can also function as a unit or means in the embodiment.

[0071] Furthermore, the order in which the processor executes the processes is not limited to the order described and may be changed as appropriate. Any computer may be a general-purpose computer, a computer designed for a specific purpose, a workstation, or any other system capable of performing each process. A processor may consist of one or more pieces of hardware, and the type of hardware is not limited. For example, a processor may consist of a CPU (=Central Processing Unit), an MPU (=Micro Processing Unit), a programmable logic device such as an FPGA (=Field Programmable Gate Array), a dedicated circuit for performing specific processing such as an ASIC (=Application Specific Integrated Circuit), a GPU (=Graphic Processing Unit), or an NPU (=Neural Processing Unit).

[0072] Furthermore, the hardware may be a combination of different types of hardware. When multiple hardware components are configured to execute one or more processes of a processor, these components may reside in physically separate devices or in the same device. Also, in any embodiment, the order of each process performed by the processor is not limited to the order described above and may be changed as appropriate. The hardware is composed of electrical circuits, etc., which are combinations of circuit elements such as semiconductor elements.

[0073] Furthermore, the program may be firmware or software such as microcode. Alternatively, the program may be, for example, a group of program modules, each of which may be implemented by a processor configured to perform its respective function. The program may also be program code or multiple code segments stored in one or more non-temporary computer-readable media (e.g., storage media or other storage devices).

[0074] A program may be divided and stored on multiple non-temporary computer-readable media located on devices that are physically separated from each other. Program code or code segments may represent any combination of procedures, functions, subprograms, routines, subroutines, modules, software packages, classes, or instructions, data structures, or program statements. Program code or code segments may be connected to other code segments or hardware circuits by sending and receiving information, data, arguments, parameters, or memory contents.

[0075] (7) The present invention can also be applied to programs and program products.

[0076] <Note> (((1))) An information processing device having a processor, wherein, upon startup meeting predetermined conditions, the processor accepts an input operation for a one-time password, encrypts the first encryption key used to encrypt the first encrypted data stored in a first storage device removable from the first board using the one-time password, and stores it in the first storage device. (((2))) The information processing device described in (((1))) is characterized in that the startup that satisfies the predetermined conditions is one of the following: startup with a specific key pressed, startup with a specific switch in a specific position, or startup with a predetermined device inserted. (((3))) The information processing device according to (((1))) or (((2))), wherein the processor accepts the input of the one-time password through the operation screen of the device. (((4))) The information processing device according to (((3))), wherein the operation screen is a maintenance mode screen, and the processor accepts the input of the one-time password through the maintenance mode screen. (((5))) The information processing device according to any one of (((1))) to (((4))), wherein, upon startup after replacing the first board with the second board, the processor fails to decrypt the first encrypted data stored in the first storage device transferred from the first board to the second board, and furthermore, if encrypted encryption key data exists in the first storage device, it displays on the operation screen an input screen for the one-time password used to decrypt the encryption key data. (((6))) The information processing apparatus according to (((5))), wherein the processor decrypts the first encrypted data stored in the first storage device into plaintext data using the first encryption key decrypted from the encryption key data with the one-time password, encrypts the decrypted plaintext data into second encrypted data using a second encryption key read from a second storage device that cannot be removed from the second board, and writes the second encrypted data to the first storage device. (((7))) The information processing apparatus according to (((6))), wherein the processor writes the second encrypted data to the first storage device and then deletes the encryption key data from the first storage device. (((8))) A program for a computer that enables the following functions when the computer is started up and meets predetermined conditions: the function of accepting the input of a one-time password; and the function of encrypting the first encryption key used to encrypt the first encrypted data stored in a first storage device that is removable from the first circuit board using the one-time password, and storing it in the first storage device. (((9))) The program described in (((8))) for further implementing a function in the computer to display a screen for inputting the one-time password used to decrypt the encryption key data on the operation screen if, upon startup after replacing the first board with the second board, the decryption of the first encrypted data stored in the first storage device transferred from the first board to the second board fails, and furthermore, encrypted encryption key data exists in the first storage device.

[0077] According to the information processing device described in (((1))), data security can be enhanced compared to the case where plaintext encryption keys are backed up on a removable storage device. According to the information processing device described in (((2))), the input of a one-time password can be limited to cases where predetermined conditions are met. According to the information processing device described in (((3))), even when communication with an external device is not possible, it is possible to accept the input of a one-time password as long as the operation screen can be displayed. According to the information processing device related to (((4))), a one-time password can be entered as part of the maintenance work. According to the information processing device described in (((5))), when replacing a circuit board, the encryption key data stored in the storage device that was transferred from the first circuit board to the second circuit board can be decrypted. According to the information processing device described in (((6))), encrypted data stored in the first storage device inherited from the first board can be made available for use on the second board. According to the information processing related to (((7))), only encrypted data can be left in the first storage device. According to the program described in ((8)), data security can be enhanced compared to backing up plaintext encryption keys to a removable storage device. According to the program related to (((9))), when replacing the circuit board, the encryption key data stored in the memory device that was transferred from the first circuit board to the second circuit board can be decrypted. [Explanation of symbols]

[0078] 1…Image forming apparatus, 10…Control board, 11…Control panel, 12…Printing engine, 13…Scanner, 14…Communication module, 101…Processor, 102…System ROM, 102A…Firmware, 102B…UEFI, 103…RAM, 104, 105…Non-volatile memory, 104A, 104A1…Encrypted data, 104B…Unencrypted data, 104C…Encryption key data, 105A…Encryption key

Claims

1. It has a processor, The aforementioned processor, If the system is activated under predetermined conditions, it will accept the input of a one-time password. The first encryption key used to encrypt the first encrypted data stored in a first storage device that is removable from the first substrate is encrypted with the one-time password and stored in the first storage device. Information processing device.

2. The aforementioned predetermined conditions for startup are any of the following: startup with a specific key pressed, startup with a specific switch in a specific position, or startup with a predetermined device inserted. The information processing apparatus according to claim 1.

3. The processor accepts the input of the one-time password through the operation screen of its device. The information processing apparatus according to claim 1.

4. The aforementioned operation screen is the maintenance mode screen. The processor accepts the input of the one-time password through the maintenance mode screen. The information processing apparatus according to claim 3.

5. The aforementioned processor, If, during startup after replacing the first board with the second board, the decryption of the first encrypted data stored in the first storage device transferred from the first board to the second board fails, and furthermore, encrypted encryption key data exists in the first storage device, The operation screen displays the input screen for the one-time password used to decrypt the aforementioned encryption key data. The information processing apparatus according to claim 1.

6. The aforementioned processor, Using the first encryption key decrypted from the encryption key data with the one-time password, the first encrypted data stored in the first storage device is decrypted into plaintext data. The decrypted plaintext data is encrypted into second encrypted data using a second encryption key read from a second storage device that cannot be removed from the second substrate. The second encrypted data is written to the first storage device. The information processing apparatus according to claim 5.

7. The aforementioned processor, After writing the second encrypted data to the first storage device, delete the encryption key data from the first storage device. The information processing apparatus according to claim 6.

8. On the computer, When the system is activated under predetermined conditions, it will accept the input of a one-time password. A function to encrypt the first encryption key used to encrypt the first encrypted data stored in a first storage device that is removable from the first circuit board using the one-time password, and to store it in the first storage device, A program to achieve this.

9. To the aforementioned computer, If, during startup after replacing the first board with the second board, the decryption of the first encrypted data stored in the first storage device transferred from the first board to the second board fails, and furthermore, encrypted encryption key data exists in the first storage device, A function to display the input screen for the one-time password used to decrypt the aforementioned encryption key data on the operation screen, The program described in claim 8 for further implementation.

Images