Image forming apparatus, control method thereof, and program

Abstract

To provide an image forming device, a control method, and a program that effectively prevent leakage of confidential information from an application program while suppressing the impact on performances of the image forming device.SOLUTION: In a method for controlling an image forming device, loading means of the image forming device determines whether a control code of a script file to be loaded is encrypted. If the control code to be loaded is encrypted (success in S801), integrity of an encryption key to be used for decryption is confirmed by signature verification S802 of the encryption key. If the signature verification of the encryption key succeeds (success in S802), the integrity of the control code is confirmed by digest verification S804 of a non-encrypted script as code verification processing. The loading means does not load or decrypt the encrypted control code to be loaded when the integrity of the control code is not confirmed even if the integrity of key information is confirmed.SELECTED DRAWING: Figure 8

Description

[Technical field]

[0001] The present invention relates to an image forming apparatus, a control method thereof, and a program. [Background technology]

[0002] In an image forming apparatus, for example, in order to add an optional function, it is possible to install and execute an application program.

[0003] In such an image forming apparatus, there is a possibility that an application program that has been maliciously tampered with may be installed and executed. In this case, there is a possibility that confidential information handled by the image forming apparatus may be read by the tampered application program and leaked. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2002-230511 A [Patent Document 2] JP 2009-258772 A Summary of the Invention [Problem to be solved by the invention]

[0005] In order to protect confidential information of an application program, it is conceivable to encrypt the application program and decrypt it when the application program is loaded, as in Patent Document 1.

[0006] However, if the entire application program is encrypted as in Patent Document 1, even information that is not inherently confidential will be encrypted. As a result, when an image forming device executes an application program, a process of decrypting the application program along with loading is always generated, which affects the performance of the image forming device.

[0007] For this reason, as disclosed in Patent Document 2, it is conceivable to encrypt a part of the application program.

[0008] However, when part of an application program is encrypted, there remains a possibility that the contents of encrypted processing may be read out by unencrypted processing due to malicious tampering with the application program.

[0009] Thus, in an image forming apparatus, it is required to effectively prevent leakage of confidential information from application programs while suppressing the impact on the performance of the image forming apparatus. [Means for solving the problem]

[0010] The image forming apparatus according to the present invention comprises: Contains unencrypted and encrypted control code Multiple control codes and , having an application ID and An image forming apparatus capable of executing an application program, Encrypted Control Code A Loading method and , Encryption key Key information to verify the integrity of the key information confirmation Means, before Note Multiple Control Code The unencrypted control code of the Control code to check integrity confirmation and a means for detecting the presence of the The key information confirmation means verifies the integrity of key information of an encryption key that is signed by a private key corresponding to the application ID and is used to decrypt the encrypted control code by verifying the signature of the encryption key using a public key corresponding to the private key, and the load means The integrity of said key information ,or, The above Unencrypted If the integrity of the control code cannot be confirmed, The above Encrypted System Code Law Do execution and when the integrity of the key information and the integrity of the unencrypted control code are confirmed, the loading means executes loading of the encrypted control code. . Effect of the Invention

[0011] According to the present invention, it is possible to effectively prevent leakage of confidential information from application programs while suppressing the impact on the performance of the image forming apparatus. [Brief description of the drawings]

[0012] [Figure 1] 1 is a diagram illustrating a hardware configuration of an image forming apparatus according to an embodiment of the present invention. [Diagram 2] 2 is an explanatory diagram of an execution environment of an extension application program realized by a software program recorded in the storage of the image forming apparatus of FIG. 1. [Diagram 3] 2 is an explanatory diagram of a state in which an extension application program is installed in the image forming apparatus in the image processing system including the image forming apparatus in FIG. 1. [Figure 4] 2. FIG. 3 is an explanatory diagram of a program module for executing an extended application program, which is realized in the image forming apparatus of FIG. [Diagram 5] 2 is an explanatory diagram of an extension application program that is optionally added to the storage of the image forming apparatus of FIG. 1. [Figure 6] 6 is an explanatory diagram of the dependency relationships between a plurality of script files of the extension application program of FIG. 5. [Figure 7] 6 is a flowchart of the execution control of the extended application program of FIG. 5. [Figure 8] 8 is a detailed flowchart of the script load process in FIG. 7. [Figure 9] 6 is an explanatory diagram of a correspondence table between the extension application program ID and the development vendor of the extension application program, which is data recorded in the storage of the image forming apparatus of FIG. 1 for the extension application program of FIG. 5. [Figure 10]1. FIG. 10 is an explanatory diagram of a correspondence table between development vendors of extended application programs and signature verification keys for each development vendor, as data recorded in the storage of the image forming apparatus of FIG. 1 in relation to FIG. 9. [Figure 11] 6 is an explanatory diagram of key information as data recorded in the storage of the image forming apparatus of FIG. 1 for the extended application program of FIG. 5. [Figure 12] 6 is an explanatory diagram of a script digest as data recorded in the storage of the image forming apparatus of FIG. 1 for the extended application program of FIG. 5. [Figure 13] FIG. 11 is an explanatory diagram of one problem that may occur in an image forming apparatus to which the present embodiment is not applied. [Figure 14] FIG. 10 is an explanatory diagram of an example of tampering that can be prevented by the present embodiment. [Figure 15] 11 is an explanatory diagram of another example of tampering that can be prevented by the present embodiment. FIG. [Figure 16] 11 is an explanatory diagram of another example of tampering that can be prevented by the present embodiment. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. However, the configurations described in the following embodiments are merely examples, and the scope of the present invention is not limited to the configurations described in the embodiments.

[0014] FIG. 1 is a diagram showing the hardware configuration of an image forming apparatus 2 according to an embodiment of the present invention.

[0015] The image forming apparatus 2 in FIG. 1 includes an operation unit 112, a USB storage 114, a scanner 170, a printer 195, and a controller unit 100 to which these are connected. The controller unit 100 includes a CPU 101, a RAM 102, a ROM 103, a storage 104, an image bus I / F 105, an operation unit I / F 106, a network I / F 110, a USB host I / F 113, and a system bus 107 to which these are connected. An image bus 108 is connected to the image bus I / F 105. To the image bus 108, a device I / F 120, a scanner image processing unit 180, and a printer image processing unit 190 are connected.

[0016] A scanner 170 and a printer 195 are connected to the device I / F 120. The scanner 170 reads an image of an original document and generates image data. The printer 195 prints the image data on paper. The device I / F 120 inputs and outputs image data related to processing of the scanner 170 or the printer 195. The device I / F 120 may perform synchronous / asynchronous conversion of image data.

[0017] The scanner image processing unit 180 corrects, processes, and edits the image data generated by the scanner 170 .

[0018] A printer image processor 190 corrects image data to be printed out in accordance with a printer 195 and converts the resolution.

[0019] The image bus I / F 105 is a bus bridge that connects a system bus 107 of the image processing apparatus with an image bus 108 capable of transferring image data at high speed. Here, the image bus 108 may be, for example, a PCI bus or an IEEE format bus.

[0020] The operation unit I / F 106 is connected to the operation unit 112. The operation unit 112 may have a touch panel that can display and operate an image. In this case, the operation unit I / F 106 outputs an image to be displayed on the touch panel to the operation unit 112, and acquires input information by a user's operation on the touch panel and outputs the information to the CPU 101.

[0021] The network I / F 110 is connected to a LAN and transmits and receives data to and from other devices connected to the LAN.

[0022] The USB host I / F 113 is connected to a USB storage 114. The USB storage 114 is a non-volatile semiconductor memory. The USB storage 114 is removably connected to the image forming apparatus 2.

[0023] The USB host I / F 113 communicates with the USB storage 114 to store data in the USB storage 114 , and obtains data from the USB storage 114 and outputs it to the CPU 101 .

[0024] A plurality of USB devices including a USB storage 114 may be connectable to the USB host I / F 113 .

[0025] The ROM 103 and the storage 104 are non-volatile memories. A boot program is recorded in the ROM 103. The storage 104 records programs related to the control of the image processing device and various data used by the programs. The storage 104 may record image data related to the processing of the image forming device 2.

[0026] The RAM 102 is a volatile memory and is provided with an area in which the programs executed by the CPU 101 are loaded, a work area used by the CPU 101 when executing the programs, a temporary storage area for image data, and the like.

[0027] The CPU 101 reads and executes programs recorded in the ROM 103 and the storage 104. In this way, the CPU 101 functions as a control unit that performs overall control of the image forming apparatus 2.

[0028] The CPU 101 as a control unit executes control for a copy function in which image data read by the scanner 170 is printed by the printer 195, for example.

[0029] In addition, the CPU 101 as a control unit may execute an operating system program and application programs, for example. The application programs include extended application programs that are added for optional functions of the image forming apparatus 2, for example.

[0030] In addition, for example, the USB storage 114 may store a program to be added or updated and recorded in the storage 104. In this case, the CPU 101 as the control unit reads the program from the USB storage 114 and records it in the storage 104.

[0031] FIG. 2 is an explanatory diagram of an execution environment of an extended application program realized by a software program recorded in the storage 104 of the image forming apparatus 2 of FIG. The CPU 101 executes a program for a virtual machine (VM) recorded in the storage 104 as a function of the operating system program. In this way, the CPU 101 generates an execution environment for the extended application program in FIG.

[0032] The operating system program includes a native program 210 for implementing basic functions of an image processing device such as a printer 195, a FAX, and a scanner 170. In addition to the native program 210, the operating system program may include a program for a virtual machine 230 that is an execution environment for an extended application program.

[0033] In the execution environment of the extended application program in FIG. 2, a native program 210, a virtual machine system service 220, a virtual machine 230, and an extended application program 240 are executed on an OS 201, which is an operating system.

[0034] The native program 210 has a native thread 214 for controlling each unit of the image forming apparatus 2 such as the printer 195, FAX, and scanner 170, and a virtual machine thread 215 for running the virtual machine 230.

[0035] The virtual machine threads 215 are generated in a number corresponding to the number of virtual machines 230 executed by the image forming apparatus 2. Here, three threads 211, 212, and 213 are generated as the virtual machine threads 215.

[0036] The virtual machine system service 220 is a utility library that is commonly used by the extended application program 240 .

[0037] Here, as the virtual machine system service 220, a standard virtual machine system service 221 that operates the virtual machine 230 at a minimum level, and an extended virtual machine system service 222 are shown.

[0038] The extended virtual machine system service 222 provides access to each module of the image forming apparatus 2 and OS functions.

[0039] The extended application program 240 can access each module of the image forming apparatus 2 by calling the function of the virtual machine system service 220. It is no longer necessary to write a process for accessing each module of the image forming apparatus 2 in the extended application program 240, which reduces development time. The virtual machine 230 executes an API specified by a byte control code of the extended application program 240, thereby calling the virtual machine system service 220 associated with the API.

[0040] The standard virtual machine system services 221 include a function for loading an extended application program 240 .

[0041] The virtual machine 230 forms an execution environment for the extended application program 240 . The virtual machine 230 understands and executes the programs that control the extended application programs 240 .

[0042] The extended application program 240 always runs on the virtual machine 230 . The virtual machines 230 are managed by memory spaces that are logically separated for each virtual machine 230. In principle, different virtual machines 230 cannot share memory spaces among themselves.

[0043] A virtual machine 230 is generated for each extended application program 240. In principle, memory space cannot be shared between extended application programs 240.

[0044] The extended application program 240 that runs on the virtual machine 230 runs on instructions that are exclusive to the virtual machine 230, different from the instructions that run on the CPU 101. These instructions are called byte control codes. On the other hand, instructions that are exclusive to the CPU 101 are called native control codes.

[0045] The virtual machine 230 interprets and processes the byte control code one by one. In this case, the CPU 101 executes control based on the native control code and control based on the byte control code of the virtual machine 230 in parallel.

[0046] The virtual machine 230 can be of a type that interprets and processes the byte control code as is, or a type that converts the byte control code into a native control code and executes it.

[0047] The virtual machine 230 in this embodiment is the former type, but may be the latter type.

[0048] Generally, if the type of CPU 101 is different, there will be no compatibility between the instructions that run on the CPU 101. Also, if the virtual machine 230 is different, there will be no compatibility between the instructions that run on the virtual machine 230.

[0049] 2 is realized as a software module that runs on the CPU 101. The virtual machine 230 may also be realized as a hardware module.

[0050] The virtual machine 230 executes an extended application program 240 .

[0051] The virtual machine 230 may be created for each thread of the extended application program 240 .

[0052] 2, the extended application program A 241 has two threads. In this case, a "Virtual Machine A-1" 231 and a "Virtual Machine A-2" 232 are generated as the virtual machines 230.

[0053] The extended application program B 242 has one thread. In this case, a “Virtual Machine B-1” 233 is generated as the virtual machine 230.

[0054] On the main menu screen displayed on the operation unit 112 of the image forming apparatus 2, an icon for each extension application program 240 is displayed.

[0055] When the user selects and operates this icon, the operation unit I / F 106 detects the operation via the operation unit 112 , and outputs the operation content to the CPU 101 . The CPU 101 starts and executes the extended application program 240 selected by the user.

[0056] FIG. 3 is an explanatory diagram of a state in which an extension application program 240 is installed in the image forming apparatus 2 in the image processing system 1 including the image forming apparatus 2 of FIG.

[0057] 3 includes an image forming apparatus 2, a computer apparatus 3, and a communication cable 4 connecting the image forming apparatus 2 and the computer apparatus 3. The communication cable 4 may be compliant with, for example, IEEE802.3 or IEEE802.11.

[0058] The computing device 3 generates an extended application program 240 .

[0059] The computer device 3 transmits data of the extension application program 240 to the image forming device 2 using an installation means for the extension application program provided by the image forming device 2 .

[0060] As a result, the extended application program 240 is installed in the storage 104 of the image forming apparatus 2 .

[0061] FIG. 4 is an explanatory diagram of a program module for executing the extended application program 240, which is realized in the image forming apparatus 2 of FIG. 1 as a part of FIG.

[0062] The program module in FIG. 4 is generated in the execution environment of the extended application program 240 in FIG.

[0063] The servlet service 404 is a module that accepts a request when it is accessed via the network I / F 110 via HTTP, and distributes processing to a module according to the accessed URL.

[0064] The module here is, for example, an extended application program management unit 402 or a standard function control unit 401 .

[0065] The UI control unit 403 is a module that displays a screen on the operation unit 112, accepts operations from the user, and notifies the appropriate module of the operation information. The module here is, for example, an extended application program management unit 402 or a standard function control unit 401 .

[0066] The extension application program management unit 402 is a module that manages the installation, start-up, etc. of the extension application program 240 that is installed.

[0067] The extended application program execution control unit 405 is a module that controls the execution of the extended application program 240 started by the extended application program management unit 402 .

[0068] Specifically, the extended application program execution control unit 405 controls the virtual machine thread, the virtual machine image processing system service, the virtual machine 230, and the extended application program 240.

[0069] A standard function control unit 401 is a module that controls the standard functions of the image forming apparatus 2, such as copying and faxing, and controls necessary for other image forming apparatuses (for example, control of the USB host path I / F).

[0070] The storage control unit 406 is a module that records and manages the setting information of the image forming device.

[0071] Each of the above-mentioned modules accesses the storage control unit 406 to refer to setting values ​​and to set setting values.

[0072] In this manner, the image forming apparatus 2 is capable of executing the extended application program 240 that is made up of a plurality of control codes and a plurality of data.

[0073] The image forming apparatus 2 is capable of installing and executing an extension application program 240 in order to add an optional function, for example.

[0074] In such an image forming apparatus 2, there is a possibility that an extended application program 240 that has been maliciously tampered with may be installed and executed.

[0075] In this case, there is a possibility that confidential information handled by the image forming apparatus 2 may be read by the tampered extended application program 240 and leaked.

[0076] FIG. 5 is an explanatory diagram of an extension application program 240 that is optionally added to the storage 104 of the image forming apparatus 2 of FIG.

[0077] The archive 501 of the extended application program 240 in FIG. 5 includes a plurality of script files including a plurality of control data executed as the extended application program 240 .

[0078] In addition to a number of script files, the archive 501 also includes various data files for verifying the authenticity and integrity of the extension application program 240 .

[0079] The files that make up the extended application program 240 in FIG. 5 are roughly divided into five types.

[0080] The first kind of files are script files 502 to 504 in which the operation of the extended application program 240 is written in a programming language.

[0081] The script files 502 to 504 include a pre-encrypted script file 503. The script files 502 and 504 are not encrypted.

[0082] The data in the script file 503 is encrypted with an encryption key generated according to a specified procedure. A third party cannot directly check the contents of the original data in the script file 503.

[0083] In this way, the extended application program 240 is composed of a plurality of script files including a plurality of control codes for the extended application program 240. By encrypting some of the script files, the plurality of control codes of the extended application program 240 are partially encrypted on a script-by-script basis. The extended application program 240 includes encrypted control codes and unencrypted control codes as the plurality of control codes.

[0084] By combining an encrypted script file 503 and an unencrypted script file 502, it is possible to achieve both execution performance and confidentiality protection when loading and executing the control codes contained in those script files 503.

[0085] The second type of files are resource files 505 to 506 that store image data, display messages, and the like used in application programs.

[0086] The third type of file is a file 507 containing key information necessary for decrypting confidential information.

[0087] The fourth type of file is a script digest file 508 for verifying the integrity of the script file.

[0088] A script digest is a digest used to verify the integrity of a script that constitutes an application program.

[0089] The script digest is generated in advance based on the script that constitutes the application program.

[0090] The script digest is recorded in a file 508 in a state where it is encrypted with the encryption key used to encrypt the script.

[0091] The fifth type of file is an application program ID file 509 that identifies an application program.

[0092] The application program ID is a unique ID for each application program.

[0093] The number of each type of file varies depending on the application program.

[0094] FIG. 6 is an explanatory diagram of the dependency relationships between a plurality of script files in the extended application program 240 of FIG.

[0095] Generally, when the computer device 3 executes the extended application program 240, it reads the entire executable file, expands it into memory, and then executes it.

[0096] The image forming device 2 does not necessarily have an abundant memory capacity like the computer device 3.

[0097] For this reason, in the image forming apparatus 2, the control code of the extended application program 240 is divided into a plurality of script files, for example, for each function. Also, when executing the extended application program 240, the image forming apparatus 2 sequentially reads each script file, and loads and executes the control code as needed.

[0098] This allows the memory required for executing the extended application program 240 in the image forming apparatus 2 to be reduced.

[0099] In FIG. 6, when the CPU 101 of the image forming apparatus 2 executes the extended application program 240, first, the CPU 101 loads and executes a main script file 601.

[0100] After loading and executing the main script file 601, the CPU 101 also loads and executes a sub1 script file 602, a sub2 script file 603, and a sub3 script file 604.

[0101] After loading and executing the sub1 script file 602, the CPU 101 loads and executes the sub4 script file 605, the sub5 script file 606, and the sub6 script file 607.

[0102] After loading and executing the sub2 script file 603, the CPU 101 loads and executes the sub6 script file 607 and the sub3 script file 608.

[0103] After loading and executing the sub3 script file 604, the CPU 101 loads and executes the sub1 script file 609 and the sub7 script file 610.

[0104] The dependency relationship that determines the execution order of the script files differs for each extended application program 240.

[0105] Furthermore, even within one extended application program 240, the dependency relationship between script files that are loaded and executed in a chain change depending on the processing content.

[0106] For example, even if the main script file 601 is loaded and executed, the CPU 101 may load and execute only the sub1 script file 602 and the sub2 script file 603. In this case, the CPU 101 does not load and execute the sub3 script file 604.

[0107] FIG. 7 is a flowchart of the execution control of the extended application program 240 of FIG.

[0108] The CPU 101 of the image forming apparatus 2 realizes the execution environment shown in FIG.

[0109] The CPU 101 executes the control shown in FIG.

[0110] In step S701, the CPU 101 loads the script file to be executed next in the extension application program 240.

[0111] If the script file to be loaded is encrypted, the CPU 101 decrypts it.

[0112] The CPU 101 may load a plurality of control codes contained in the loaded script file into the RAM 102 .

[0113] In step S702, CPU 101 executes an instruction fetch of the loaded script file. Unprocessed control codes included in the loaded script file are read into CPU 101 line by line in order.

[0114] In step S703, CPU 101 determines whether the command has ended. CPU 101 sequentially fetches multiple control codes contained in the loaded script file. When the last control code in the loaded script file is fetched, there are no unprocessed control codes left. If the unprocessed control code cannot be read by the command fetch, CPU 101 determines that the command has ended and ends this control. If the command has not ended, CPU 101 advances the process to step S704.

[0115] In step S704, the CPU 101 determines the instruction type of the fetched control code.

[0116] In step S705, CPU 101 determines whether the command type determined in step S704 is a load command. If it is a load command, CPU 101 returns the process to step S701. CPU 101 executes the process from step S701 to load another script file related to the load command. If the command type is not a load command, CPU 101 advances the process to step S706.

[0117] In step S706, CPU 101 executes the control code as the fetched instruction. After that, CPU 101 returns the process to step S702. CPU 101 continues to execute the control codes for the script file loaded in step S701 until it determines in step S703 that the instruction has ended.

[0118] In this manner, in this embodiment, when the extended application program 240 is executed, a plurality of control codes included in the extended application program 240 are loaded and executed as needed in units of script files.

[0119] The CPU 101 , as a loading means, can load and execute the individual control codes that constitute the extension application program 240 .

[0120] FIG. 8 is a detailed flowchart of the script load process of FIG. In the script file load process S701 in FIG. 7, the CPU 101 executes the process in FIG. 8 as a load means.

[0121] In step S801, CPU 101 determines whether the control code of the script file to be loaded is encrypted.

[0122] This allows the CPU 101, as encryption determining means, to determine whether or not the script file of the control code to be loaded is encrypted.

[0123] If the data is encrypted, CPU 101 advances the process to step S802. If the data is not encrypted, CPU 101 advances the process to step S803.

[0124] In step S802, CPU 101 verifies the signature of the key information as a key verification process, and verifies that the key information is an encryption key for the application program indicated by file 509 of the application program ID.

[0125] This allows the CPU 101, as a key information verification means, to check the integrity of the key information used for decryption when the control code of the script file to be loaded is encrypted.

[0126] If the verification is successful, CPU 101 decrypts the key information using the private key held in the application program management unit, and proceeds to step S804. If the verification is unsuccessful, CPU 101 proceeds to step S805.

[0127] In step S804, CPU 101 performs code verification processing by verifying the integrity of the scripts using the script digest information based on all of the non-encrypted script files that constitute the application program.

[0128] This allows the CPU 101, as a control code verification means, to check the integrity of all script files for the extended application program 240 that includes the script file of the control code to be loaded. The CPU 101 can essentially check the integrity of all control code in the extended application program 240.

[0129] If the verification is successful, CPU 101 advances the process to step S806, whereas if the verification is unsuccessful, CPU 101 advances the process to step S805.

[0130] Step S805 is a process to be performed when verification of the script file to be loaded in step S802 or step S804 fails. CPU 101 executes a process for when loading has failed because the script file cannot be safely decrypted. After that, CPU 101 ends the loading process.

[0131] As a result, even if the integrity of the key information has been confirmed, if the integrity of the control code has not been confirmed, CPU 101 will not load the script file of the encrypted control code that is to be loaded. Furthermore, since CPU 101 will not load the script file of the encrypted control code, it will not execute the control code.

[0132] Step S806 is a process performed when the verification of the script file to be loaded is successful in both steps S802 and S804. Since CPU 101 has confirmed that the script file can be safely decrypted, it actually executes the loading process and the decryption process of the script file.

[0133] The CPU 101 uses the private key held in the above-mentioned application program management unit to decrypt the multiple control codes in the script file.

[0134] Thus, CPU 101, as a loading means, loads and decrypts the script file of the encrypted control code only when the integrity of the key information and further the integrity of the control code have been confirmed.

[0135] After that, the CPU 101 ends the load process.

[0136] Step S803 is a process to be performed when the script file to be loaded is not encrypted. CPU 101 loads the plaintext script file.

[0137] As a result, when the CPU 101 determines that the script file of the control code to be loaded is not encrypted, the CPU 101, as a loading means, loads the script file of the control code as is.

[0138] After that, the CPU 101 ends the load process.

[0139] As shown in FIG. 6, when an application program is executed, the multiple scripts that make up the application program are not all loaded at once at the beginning, but rather the script files that need to be processed are loaded as they are required.

[0140] Then, only when the CPU 101 loads a script file that includes encrypted confidential information, the CPU 101 checks the integrity of the script file before decrypting it.

[0141] In contrast, when loading an unencrypted script file, the CPU 101 checks only whether the file is encrypted and immediately loads it.

[0142] The load time before unencrypted script files can be executed is reduced.

[0143] This allows script files to be loaded at high speed compared to when all of the script files that make up an application program are encrypted.

[0144] Furthermore, for encrypted script files, the signature of the encryption key is not simply verified, but the integrity of the multiple script files constituting the application program is also verified. This makes it possible to detect that an application program is incomplete if some of the multiple unencrypted script files constituting the application program have been tampered with. It is possible to determine the incompleteness of the application program before actually loading the encrypted script file. This makes it possible to prevent encrypted script files from being decrypted in an application program that has been tampered with.

[0145] Next, the data of the extended application program 240 used when loading the script file of the extended application program 240 will be described with reference to FIG. 9 to FIG.

[0146] The data of FIGS. 9 to 11 may be recorded in the storage 104 as part of the extended application program 240.

[0147] 9 to 11 may be appropriately read and used for verification when loading a script file to execute the extended application program 240. The data in Figures 9 to 11 may be recorded in the storage 104 in its original format, or may be recorded in the storage 104 in a modified state so as not to affect the verification.

[0148] FIG. 9 is an explanatory diagram of a correspondence table 901 between the extended application program ID and the developer vendor of the extended application program 240. As shown in FIG.

[0149] The correspondence table 901 in FIG. 9 may be recorded in the storage 104 of the image forming apparatus 2 in FIG. 1 for the extended application program 240 in FIG.

[0150] 9 has a plurality of records for each extended application program 240. Each record includes an extended application program ID and the vendor name of the developer.

[0151] FIG. 10 is an explanatory diagram of a correspondence table 1001 between development vendors of extended application programs 240 and signature verification keys for each development vendor, which is data recorded in the storage 104 of the image forming apparatus 2 of FIG. 1 in relation to FIG. 9.

[0152] Correspondence table 1001 in Fig. 10 has a record for each development vendor included in correspondence table 901 in Fig. 9. Each record includes the vendor name of the development vendor of the extended application program 240 and a signature verification key used by the development vendor to encrypt the extended application program 240.

[0153] When checking the signature of the encryption key in step S802, the CPU 101 can identify the key information used to verify the signature of the encryption key of the extended application program 240 by referring to the correspondence table 901 in FIG. 9 and the correspondence table 1001 in FIG.

[0154] FIG. 11 is an explanatory diagram of key information 507 as data recorded in the storage 104 of the image forming apparatus 2 in FIG. 1 for the extended application program 240 in FIG.

[0155] 11 includes a random key 1201 required for decrypting an encrypted script file, and random key signature verification information 1202. The signature verification information 1202 is signature information of an encryption key.

[0156] This allows the CPU 101, as a loading means, to decrypt the encrypted control code using the key information 507 included in the extension application program 240.

[0157] The CPU 101 can decrypt the control code of the script file by decrypting the data of the script file of the extended application program 240 using the random key 1201 of the key information as encryption key information.

[0158] The signature verification information 1202, which is a random key signature, is performed using a signature key managed for each developer vendor of the extended application program 240. The random key signature can be used to verify the signature of the encryption key information.

[0159] The two pieces of information, the random key 1201 and the random key signature verification information 1202, are encrypted in the key information recorded in the storage 104 by a public key that is paired with the private key held by the extended application program management unit 402. The public key that is paired with this private key may be pre-stored in the storage 104 of the image forming apparatus 2. This allows the CPU 101, as a loading means, to verify the signature verification information by using the public key that is pre-stored in the storage 104 of the image forming apparatus 2.

[0160] In this case, the signature key is managed for each developer vendor of the extended application program 240. Alternatively, the signature key may be managed for each extended application program 240, for example.

[0161] FIG. 12 is an explanatory diagram of a script digest as data recorded in the storage 104 of the image forming apparatus 2 in FIG. 1 for the extended application program 240 in FIG.

[0162] FIG. 12 shows several files of an extended application program 240 similar to that of FIG.

[0163] In this case, the developer vendor of the extended application program 240 generates script digest data based on a plurality of files that constitute the extended application program 240 in order to verify the integrity.

[0164] In the example of FIG. 12, the developer vendor generates script digest data for all unencrypted script files 1101, 1103 among the scripts that constitute the extended application program 240. The script digest may be data that indicates the overall status of essentially all scripts that constitute the extended application program 240. The script digest may be data that indicates the overall status of some of all scripts that constitute the extended application program 240. The script digest may be data that indicates the overall status of all scripts that can be modified. The developer vendor can generate the script digest data by adding up the sizes of all unencrypted script files 1101, 1103, for example. By excluding the script file 1102 that is encrypted and unlikely to be directly tampered with, the amount of calculation required for processing can be reduced when generating the script digest and when checking the integrity using the script digest.

[0165] The script digest data is encrypted with the encryption key used to encrypt the script, and stored in a script digest file of the extended application program 240. As a result, the script digest data is included in the extended application program 240 as a part of the extended application program 240.

[0166] In this manner, the extended application program 240 includes a script digest for verifying the integrity of the control code in the extended application program 240 as one of a number of pieces of data used by the control code. The script digest is generated as control code verification information from digests of all unencrypted scripts in the extended application program 240, and is encrypted with key information.

[0167] When loading a script file of a control code, the CPU 101 can verify the integrity of the control code by using a script digest of the extended application program 240 as a control code verification means. Here, the script digest is for all unencrypted, modifiable scripts in the extended application program 240. In other words, the CPU 101 can verify the integrity of a plurality of control codes constituting the extended application program 240, including the control code to be loaded, by using control code verification information as a control code verification means.

[0168] Unlike the above-mentioned process, the development vendor may generate script digest data based on a plurality of files that are a part of all files that make up the extended application program 240. The development vendor may generate script digest data based on a plurality of files according to its own rules for generating script digest data. For example, the development vendor may intentionally include, in the extended application program 240, a dummy script that is not necessary for controlling the extended application program 240, without encrypting it, and not include it in the generated script digest data. In any case, the development vendor may generate script digest data based on a plurality of script files that make up the extended application program 240, according to a predetermined rule.

[0169] Next, an example of tampering that can be prevented by the image forming apparatus 2 of the present embodiment described above will be described.

[0170] FIG. 13 is an explanatory diagram of one problem that may occur in an image forming apparatus 2 to which this embodiment is not applied.

[0171] In FIG. 13, a first application 2401 and a second application 2402 are recorded in the storage 104 of the image forming apparatus 2 .

[0172] The second application 2402 is a legitimate extended application program 240 that uses confidential information.

[0173] The second application 2402 has an application program ID file (ID2), a plurality of unencrypted plain script files (2-1, 2-3, 2-4), and an encrypted script file (2-2).

[0174] Then, the malicious user copies the second application 2402 to generate the first application 2401 that has been tampered with.

[0175] When the first application 2401 is executed in the image forming apparatus 2, the CPU 101 loads and decrypts the file of the encrypted script illegally copied to the first application 2401. As a result, the processing content of the encrypted script is expanded in plain text in the virtual machine 230 for the first application 2401. A malicious user can obtain confidential information expanded in plain text.

[0176] CPU 101 in this embodiment executes the processes of steps S801 to S804 in Fig. 8 before loading a file of the encrypted script. Therefore, CPU 101 does not load a file of the encrypted script of the first application 2401. The process contents of the encrypted script are not expanded in plain text in virtual machine 230 for the first application 2401. A malicious user cannot obtain confidential information because the confidential information is not expanded in plain text.

[0177] FIG. 14 is an explanatory diagram of an example of tampering that can be prevented by this embodiment.

[0178] In FIG. 14, a tampered first application 2403 has the same resource file, key information file, and script digest file as a legitimate second application 2402 .

[0179] Before loading the encrypted script file, CPU 101 of this embodiment verifies the signature of the key information in step S802 of Fig. 8. The tampered key information file of the first application 2403 is the same key information file as that of the genuine second application 2402, and does not match that of the developer vendor of the first application 2403. In this case, CPU 101 determines in step S802 that the key information is not an encryption key for the application program indicated by the application program ID (509), and does not load the encrypted script file.

[0180] As a result, malicious users cannot obtain sensitive information because it is not unpacked in plaintext.

[0181] FIG. 15 is an explanatory diagram of another example of tampering that can be prevented by this embodiment.

[0182] This is an example of a case where the resource file is further forged in the first application 2404 tampered with in FIG.

[0183] Even in this case, in step S804, CPU 101 verifies the completeness of the script using the script digest information based on all of the multiple unencrypted script files that make up the application program, and determines that the scripts are not complete.

[0184] As a result, the CPU 101 does not load the encrypted script file, and a malicious user cannot obtain the confidential information because it is not extracted in plain text.

[0185] FIG. 16 is an explanatory diagram of another example of tampering that can be prevented by this embodiment.

[0186] At this time, the malicious user tampers with the plain script file of the second application 2402, and modifies the first application 2405 as a result of the tampering so that information about the encrypted script file is obtained via the plain script.

[0187] Even in this case, in step S804, CPU 101 verifies the integrity of the script by using the script digest information based on all of the multiple unencrypted script files that configure the application program, and determines that the script of first application 2405 that has been tampered with is not intact.

[0188] As a result, the CPU 101 does not load the encrypted script file, and a malicious user cannot obtain the confidential information because it is not extracted in plain text.

[0189] As described above, in this embodiment, when the control code to be loaded is encrypted, multiple integrity checks are performed. Specifically, in this embodiment, the integrity of the key information used to decrypt the encrypted control code and the integrity of the control code in the extended application program 240 including the control code to be loaded are checked. Then, in this embodiment, even if the integrity of the key information is checked, if the integrity of the control code is not checked, the loading or decryption of the encrypted control code to be loaded is interrupted and not executed. In this embodiment, the encrypted control code is loaded and decrypted only when the integrity of the key information is checked and the integrity of the control code is also checked.

[0190] In this embodiment, this makes it possible to prevent, for example, a case where a part of the authentic extended application program 240 is tampered with, and the control code encrypted in the tampered extended application program is loaded and decrypted. In the tampered extended application program, there is a high possibility that the integrity of the control code cannot be confirmed as in the original extended application program 240 due to the tampering.

[0191] In this manner, in this embodiment, by including unencrypted control code in the extended application program 240, it is possible to suppress the impact on the performance of the image forming apparatus 2. Moreover, in this embodiment, the unencrypted control code can effectively prevent leakage of confidential information from the extended application program 240.

[0192] The present invention has been described above in detail based on preferred embodiments thereof, but the present invention is not limited to these specific embodiments, and various forms that do not deviate from the gist of the present invention are also included in the present invention.

[0193] The present invention can also be realized by supplying a program that realizes one or more of the functions of the above-mentioned embodiments to a system or device via a network or a storage medium, and having one or more processors of a computer in the system or device read and execute the program. The present invention can also be realized by a circuit (e.g., ASIC) that realizes one or more of the functions. [Explanation of symbols]

[0194] 2. Image forming device 101 CPU (loading means) 104 Storage 112 Operation section 230 Virtual Machines 240 Extended Application Program 502,504 Unencrypted script files 503 Encrypted script file 1201 Random Key 1202 Signature Verification Information

Claims

1. An image forming apparatus capable of executing an application program having a plurality of control codes, including unencrypted control codes and encrypted control codes, and an application ID, comprising: a loading means for loading the encrypted control code; a key information verifying means for verifying the integrity of key information of an encryption key; a control code verification means for verifying the integrity of the unencrypted control code among the plurality of control codes, the key information verification means verifies the integrity of key information of an encryption key signed by a private key corresponding to the application ID and used to decrypt the encrypted control code by verifying the signature of the encryption key using a public key corresponding to the private key; said loading means does not load said encrypted control code if the integrity of said key information or the integrity of said unencrypted control code is not confirmed; The loading means loads the encrypted control code when the integrity of the key information and the integrity of the unencrypted control code are confirmed.

1. An image forming apparatus comprising:

2. the application program has a plurality of scripts including the plurality of control codes; 2. The image forming apparatus according to claim 1, wherein the control codes are partially encrypted in units of scripts.

3. The application program further comprises verification information for verifying the integrity of the unencrypted control code; the verification information is information generated from an unencrypted script among the plurality of scripts and encrypted with the encryption key; The control code verification means verifies the integrity of the unencrypted control codes using the verification information, thereby verifying the integrity of the unencrypted scripts.

3. The image forming apparatus according to claim 2,

4. the application program has the key information of the encryption key for decrypting the encrypted control code, the image forming apparatus has a decryption unit that decrypts the encrypted control code by using the encryption key; the decryption means does not decrypt the encrypted control code if the integrity of the key information or the integrity of the unencrypted control code is not confirmed; The decryption means executes decryption of the encrypted control code when the integrity of the key information and the integrity of the unencrypted control code are confirmed.

4. The image forming apparatus according to claim 1, wherein the first and second electrodes are arranged in a first direction.

5. 5. The image forming apparatus according to claim 1, wherein the key information includes the encryption key used to decrypt the encrypted control code and signature information used to verify a signature of the encryption key.

6. the signature information is signed with the private key corresponding to a developer vendor of the application program or the private key corresponding to the application program; 6. The image forming apparatus according to claim 5, wherein the key information verification unit verifies the signature information by using the public key corresponding to the private key.

7. The application program includes the unencrypted control code, which is dummy control code that is not necessary for execution of the application program, 4. The image forming apparatus according to claim 3, wherein the verification information is generated from all unencrypted control codes contained in the application program, the control codes not including the dummy control codes.

8. A method for controlling an image forming apparatus capable of executing an application program having a plurality of control codes, including unencrypted control codes and encrypted control codes, and an application ID, comprising: a loading process for loading the encrypted control code; a key information verification process for verifying the integrity of the key information of the encryption key; a control code verification process for verifying the integrity of the unencrypted control code among the plurality of control codes; the key information confirmation process confirms the integrity of key information of an encryption key that is signed by a private key corresponding to the application ID and is used to decrypt the encrypted control code by verifying the signature of the encryption key using a public key corresponding to the private key; in the loading process, if the integrity of the key information or the integrity of the unencrypted control code is not confirmed, the loading of the encrypted control code is not executed; In the loading process, if the integrity of the key information and the integrity of the unencrypted control code are confirmed, the encrypted control code is loaded. 2 is a control method for an image forming apparatus according to claim 1 .

9. The application program has a plurality of scripts including the plurality of control codes, 9. The method for controlling an image forming apparatus according to claim 8, wherein the plurality of control codes are partially encrypted in units of scripts.

10. The application program further comprising verification information for verifying the integrity of the unencrypted control code; the verification information is information generated from an unencrypted script among the plurality of scripts and encrypted with the encryption key; In the control code verification process, the integrity of the unencrypted control code is verified using the verification information, thereby verifying the integrity of the unencrypted scripts.

10. The method for controlling an image forming apparatus according to claim 9.

11. The application program has the key information of the encryption key for decrypting the encrypted control code, the control method for the image forming apparatus includes a decryption process of decrypting the encrypted control code by using the encryption key; in the decryption process, if the integrity of the key information or the integrity of the unencrypted control code is not confirmed, the decryption of the encrypted control code is not performed; In the decryption process, when the integrity of the key information and the integrity of the unencrypted control code are confirmed, the encrypted control code is decrypted.

11. The method for controlling an image forming apparatus according to claim 8.

12. A control method for an image forming apparatus described in any one of claims 8 to 11, characterized in that the key information includes the encryption key used to decrypt the encrypted control code and signature information used to verify the signature of the encryption key.

13. The signature information is signed with the private key corresponding to a developer vendor of the application program or the private key corresponding to the application program, 13. The method according to claim 12, wherein in the key information verification process, the signature information is verified using the public key corresponding to the private key.

14. The application program includes the unencrypted control code, which is dummy control code not necessary for execution of the application program, 11. The control method for an image forming apparatus according to claim 10, wherein the verification information is generated from all unencrypted control codes contained in the application program, the control codes not including the dummy control codes.

15. A program characterized by causing an image forming apparatus to execute the control method described in any one of claims 8 to 14.

Images