Information processing apparatus, image forming apparatus, and control method

Abstract

To provide an information processing apparatus and the like that can safely store a cipher key.SOLUTION: An information processing apparatus stores secret information inside the apparatus, and comprises: a storage that stores data and is encrypted by a cipher key; a non-secure first storage unit for storing the cipher key; a secure second storage unit that is additionally mounted in the apparatus and for storing the cipher key; a display unit that displays various setting menus; an input unit for a user to perform various inputs; and a control unit that controls the storage of the cipher key and the display of the display unit. In a state in which the storage is encrypted and the second storage unit is mounted in the apparatus, when an instruction to store the cipher key in the second storage unit is input to the input unit, the control unit stores the cipher key in the second storage unit.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to an information processing device and the like. [Background technology]

[0002] 2. Description of the Related Art In an information processing apparatus or a multifunction peripheral (an example of an image forming apparatus) equipped with an information processing apparatus, information encrypted with an encryption key is stored in a storage (memory device).

[0003] Patent Document 1 discloses that in an information processing device or the like equipped with a TPM (Trust Platform Module), the encryption key is protected at a high level of security by storing the encryption key in a secure device such as the TPM. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2008-234217 Summary of the Invention [Problem to be solved by the invention]

[0005] However, TPM is not necessarily installed as standard in information processing devices or multifunction peripherals, and if a device such as a TPM is added to a device later, problems arise with the processing of encryption keys stored in the EEPROM (Electrically Erasable and Programmable Read Only Memory) already installed in the information processing device or multifunction peripheral.

[0006] In view of the above circumstances, the present disclosure aims to provide an information processing device and the like that can safely store encryption keys. [Means for solving the problem]

[0007] The present disclosure relates to an information processing device that stores secret information within its own device, comprising: a storage that stores data and encrypts it with an encryption key; a non-secure first memory unit for storing the encryption key; a secure second memory unit that can be added and stores the encryption key; a display unit that displays various setting menus; an input unit through which a user enters various inputs; and a control unit that controls the storage of the encryption key and the display of the display unit, wherein the control unit stores the encryption key in the second memory unit when an instruction to store the encryption key in the second memory unit is input to the input unit when the storage is encrypted and the second memory unit is attached.

[0008] The present disclosure relates to an image forming apparatus that includes the information processing apparatus and stores image data in a storage device.

[0009] The present disclosure relates to a control method for an information processing device that stores secret information within the device, the control method comprising the steps of: storing data in storage and encrypting the storage with an encryption key; storing the encryption key in a non-secure first memory unit; storing the encryption key in a secure second memory unit that can be added; a display step of displaying various setting menus on a display unit; an input step in which a user enters various inputs; and a control step of saving the encryption key and controlling the display on the display unit, wherein the control step is characterized in that, when the storage is encrypted and the second memory unit is attached, an instruction to save the encryption key in the second memory unit is input to the input unit, the encryption key is saved in the second memory unit. [Effects of the Invention]

[0010] According to the information processing device and the like of the present disclosure, it is possible to provide an information processing device and the like that can safely store an encryption key. [Brief explanation of the drawings]

[0011] [Figure 1] 1 is a diagram illustrating the overall configuration of an image forming apparatus equipped with an information processing apparatus according to a first embodiment. [Figure 2] FIG. [Figure 3] FIG. 1 is an explanatory diagram comparing devices used for a first memory and a second memory. [Figure 4] FIG. 10 is a comparative explanatory diagram of security states. [Figure 5] FIG. 10 is an explanatory diagram of a setting menu screen. [Figure 6] 3 is a control flowchart. [Figure 7] 10 is a control flowchart of the information processing device according to the second embodiment. [Figure 8] FIG. 10 is an explanatory diagram of a setting menu screen according to the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0012] An embodiment for carrying out the present disclosure will be described below with reference to the drawings.

[0013] It should be noted that the following embodiment is an example for explaining the present disclosure, and the technical scope of the invention described in the claims is not limited to the following description.

[0014] [1. First embodiment] [1.1 Overall structure] First, the configuration of an image forming apparatus 10 equipped with an information processing apparatus 200 according to the first embodiment will be described.

[0015] As shown in Figure 1, the image forming apparatus 10 is a multifunction printer (MFP) such as a complex machine that has a document reading unit 112 on top of the image forming apparatus 10 to read an image of a document and output the image by electrophotography. An MFP is a device that combines the functions of office equipment such as a copier, printer, image scanner, and facsimile in a single housing.

[0016] As will be described later, in the image forming apparatus 10, when the storage 162 is a multifunction device having an encryption function and an encryption key is stored in the first memory 164, which is an unsecured EEPROM (Electrically Erasable Programmable Read-Only Memory) storage device, a menu item for storing the encryption key in the second memory 166, which is a secure storage device, is displayed on the display unit 150. When the menu item is selected by the user, the encryption key is moved from the first memory 164 to the second memory 166, and thereafter the display of the menu item on the display unit 150 is grayed out or hidden.

[0017] As shown in FIG. 2, the image forming device 10 mainly includes a control unit 100, an image input unit 110, a document reading unit 112, an image processing unit 120, an image forming unit 130, an operation unit 140, a display unit 150, a memory unit 160, and a communication unit 170.

[0018] The control unit 100 is a functional unit for controlling the entire image forming apparatus 10.

[0019] The control unit 100 realizes various functions by reading and executing various programs, and is configured, for example, by one or more arithmetic devices (e.g., CPUs (Central Processing Units)). As will be described later, the storage 162 of the storage unit 160 has a function of encrypting data using an encryption key. The encryption key is initially stored in a non-secure first memory 164, but if a secure second memory 166 is additionally installed (additionally attached) after the image forming apparatus 10 is shipped, the storage unit 162 has a function of storing the encryption key in the second memory 166 in response to a user's instruction.

[0020] The image input unit 110 is a functional unit for inputting image data to be input to the image forming apparatus 10. The image input unit 110 is connected to an original reading unit 112, which is a functional unit for reading an image of an original, and inputs image data output from the original reading unit 112.

[0021] The image input unit 110 may also input image data from a storage medium such as a USB memory or an SD card. Also, image data may be input from another terminal device via the communication unit 170 that connects to the other terminal device.

[0022] The document reading unit 112 has a function of optically reading a document placed on a contact glass (not shown) or the like, and transferring the read data to the image processing unit 120 .

[0023] Image forming unit 130 is a functional unit for forming output data based on image data onto a recording medium (e.g., recording paper). For example, as shown in Fig. 1, recording paper is fed from paper feed cassette 122, and after an image is formed on the surface of the recording paper in image forming unit 130, the paper is discharged from discharge tray 124. Image forming unit 130 is configured, for example, by a laser printer or the like that uses an electrophotographic system.

[0024] The image processing unit 120 has an image processing function of converting the image data read by the document reading unit 112 into a set file format (TIFF, GIF, JPEG, etc.), and then forms an output image based on the image data that has been subjected to image processing.

[0025] The operation unit (corresponding to the "input unit") 140 is a functional unit for receiving operation instructions from the user, and is composed of various key switches, devices for detecting input by contact, etc. The user inputs the functions and output conditions to be used via the operation unit 140.

[0026] The display unit 150 is a functional unit for displaying various information to the user, and is configured by, for example, an LCD (Liquid Crystal Display) or the like.

[0027] That is, the operation unit 140 provides a user interface for operating the image forming apparatus 10, and the display unit 150 displays various setting menu screens and messages for the image forming apparatus.

[0028] 1, the image forming apparatus 10 may include a touch panel as part of the configuration of the operation unit 140, in which the operation panel 141 and the display unit 150 are integrally formed. In this case, the method for detecting input to the touch panel may be any common detection method, such as a resistive film method, an infrared method, an electromagnetic induction method, or a capacitance method.

[0029] The memory unit 160 is a functional unit that saves (stores) in the storage 162 various programs including a control program required for the operation of the image forming apparatus 10, various data including read data, and data such as user information.

[0030] The storage unit 160 is configured by, for example, a nonvolatile read-only memory (ROM), a random access memory (RAM), a nonvolatile electrically erasable programmable read-only memory (EEPROM), a hard disk drive (HDD), a solid state drive (SSD), etc. The storage 162 can be any of various mass storage devices such as an HDD or SSD.

[0031] The memory unit 160 has an encryption function in the storage 162 that stores data. This encryption function implements a security measure to protect the data inside by encrypting the storage 162 itself with an encryption key. In other words, when this storage function is enabled, when an authorized user accesses the storage, the data is displayed in a decrypted state, but when an unauthorized third party accesses the storage, the data cannot be decrypted, thereby keeping the storage secure. In addition, if storage 162 does not have hardware with a data encryption function, the control unit 100 may encrypt the data, write the encrypted data directly to storage 162, and then decrypt the data in the control unit 100 when reading the data.

[0032] The encryption key is initially stored in a first memory (corresponding to the "first storage unit") 164, which is a non-secure non-volatile memory consisting of an EEPROM that is installed in the image forming device at the time of shipment. After shipment, a second memory (corresponding to the "second storage unit") 166 using a secure Trusted Platform Module (TPM) for storing the encryption key can be added to the image forming device at an appropriate time, and the encryption key can be stored by selecting a menu item. Note that a non-secure storage medium other than an EEPROM can also be used for the first memory 164. Furthermore, a TPM chip, which is a secure cryptographic processor designed to perform encryption operations, is preferred for the second memory 166, but any storage module capable of securely storing the encryption key can be used.

[0033] FIG. 3 shows a comparison of the functionality, safety, and chip cost of an EEPROM chip used in the first memory 164 and a TPM chip used in the second memory 166.

[0034] As shown in Figure 3, EEPROM (Electronically Erasable Programmable ROM) is a type of non-volatile memory that allows any part of it to be electrically rewritten if done infrequently, and has the function of non-volatile memory for storing binary data. The chips are inexpensive and low cost, but anyone can read and write to it freely, which means that there is a risk that the encryption key may be decrypted or destroyed, making it less secure.

[0035] In contrast, TPM is a device with various security functions built into its chip, and although the chip is expensive, it allows stored data to be read and written only if the firmware hash value matches a pre-registered value, providing a high level of security in that the encryption key cannot be obtained if the firmware has been tampered with.

[0036] The communication unit 170 establishes a communication connection with an external device. A communication interface (communication I / F) used for transmitting and receiving data is provided as the communication unit 170. The communication I / F allows data stored in a storage unit of the image forming apparatus 10 to be transmitted and received to and from another computer device connected via a network in response to a user operation on the image forming apparatus 10.

[0037] [1.2 Functional Configuration] As shown in the functional block diagram of FIG. 2, the information processing apparatus according to the embodiment is an information processing apparatus 200 that is installed in an image forming apparatus 10 and that holds confidential information within its own apparatus. [Storage 162, first memory 164, second memory 166]

[0038] The information processing device 200 comprises a storage 162 that stores various data such as image data and encrypts it with an encryption key, a non-secure first memory 164 for storing the encryption key, a secure second memory 166 that can be added after shipment and for storing the encryption key, a display unit 150 that displays various setting menus, an operation unit (corresponding to an "input unit") 140 through which the user enters various inputs, and a control unit 100 that controls the storage of the encryption key and the display on the display unit.When the second memory 166 is installed with the storage 162 encrypted and the encryption key stored in the first memory 164, the control unit 100 displays a setting menu for saving the encryption key in the second memory 166 on the display unit 150, and when an instruction to save the encryption key in the second memory is input to the operation unit 140, the control unit 100 transfers the encryption key stored in the first memory 164 to the second memory 166.

[0039] [Security Status] FIG. 4 illustrates an overview of each security state (standard mode state, standard security state, DSK enabled state, HCD-PP compliant state) in the information processing device 200 and the purpose of each use.

[0040] In FIG. 4, "DSK" refers to a Data Security Kit for strengthening the data security function of an MFD (Multifunction Device: synonymous with MFP).

[0041] HCD-PP (Protection Profile for Hardcopy Devices) is a set of security requirements created jointly by the Information-technology Promotion Agency, Japan (IPA) and the National Information Assurance Partnership (NIAP), an IT security certification body for the US government, in cooperation with manufacturers and other parties.

[0042] [Settings menu screen] FIG. 5 shows an example of a setting menu screen 210 for saving an encryption key in the second memory 166, which is displayed on the display unit 150 of the operation panel (touch panel) 141.

[0043] This setting menu screen 210 displays a menu item 210a entitled "Enable protection of storage encryption key." Checking a checkbox 210a1 displayed alongside this menu item 210a enables the setting. Other menu items displayed include a menu item 210b entitled "Reject requests from external sites," a menu item 210c entitled "Restore firmware if corruption is detected," and a menu item 210d entitled "Backup encryption key." Checking a checkbox displayed alongside each menu item enables the selected function. Of course, operations for each menu item on the setting menu screen 210 can be similarly accepted and set using switches on the operation unit 140 other than the operation panel (touch panel) 141 or input from another terminal.

[0044] 6 is a flowchart showing the flow of the setting menu display process performed by the control unit 100 in the information processing device 200 of the embodiment. In the following and in FIG. 6, each step from 100 onwards will be abbreviated as S100.

[0045] First, in the image forming apparatus 10 after shipment, the control unit 100 determines whether the information processing apparatus 200 has encrypted the storage 162 (S100). In this embodiment, the storage 162 is encrypted when the information processing apparatus 200 transitions to the standard security state or the DSK enabled state. When the storage 162 is encrypted, the encryption key is also stored in the first memory 164. This ensures that a storage location for the encryption key is secured before the second memory 166 is attached, even if the encryption key is not stored in a memory other than the first memory 164.

[0046] If it is determined in S100 that storage 162 is not encrypted (S100: No), menu item 210a (see FIG. 5) for saving the encryption key in second memory 166 made up of TPM is hidden on setting menu screen 210 of display unit 150 (S160). Thereafter, the setting menu display process is terminated.

[0047] In this way, by hiding menu item 210a for saving the encryption key in second memory 166 on setting menu screen 210, the user can be notified that storage 162 is not encrypted. This notification can prompt the user to perform an operation to encrypt storage 162, for example, or can recognize the possibility that a problem has occurred in storage 162, allowing the user to perform the appropriate operation that should be performed next.

[0048] On the other hand, if it is determined in S100 that the storage 162 is encrypted (S100: Yes), it is determined whether or not the second memory (TPM) 166 is attached to the information processing device 200 (S110).

[0049] If it is determined that the second memory 166 has already been attached to the information processing device 200 (S110: Yes), it is determined whether or not the encryption key has already been stored in the second memory 166 (S120).

[0050] If it is determined that the encryption key is not already stored in the second memory 166 (S120: No), a menu item 210a ("Enable protection of storage encryption key" in FIG. 5) for saving the encryption key in the second memory 166 is displayed on the setting menu screen 210 of the display unit 150 (S130). As described above, when the storage 162 is encrypted and the encryption key is stored in the first memory 164 made up of EEPROM, a setting menu for saving the encryption key in the second memory 166 made up of TPM is displayed.

[0051] Next, it is determined whether the menu item 210a for saving the encryption key in the second memory (TPM) 166 is enabled (S140), and if it is determined that it is not enabled (S140: No), the setting menu display process is terminated.

[0052] On the other hand, if it is determined that menu item 210a for saving the encryption key in second memory (TPM) 166 has been enabled (S140: Yes), the encryption key is moved from first memory (EEPROM) 164 to second memory (TPM) 166 (S150). When the setting menu of menu item 210a is enabled, the encryption key is moved from first memory 164 to second memory 166.

[0053] When the encryption key stored in the first memory 164 is transferred to the second memory 166, a process is performed to erase the encryption key stored in the first memory. This reliably eliminates the state in which the encryption key stored in the second memory 166 remains stored in the insecure first memory 164, and quickly eliminates the low security state.

[0054] Furthermore, if it is determined in S110 that second memory 166 is not attached to information processing device 200 (S110: No), the process proceeds to S160. In S160, menu item 210a for saving the encryption key in second memory 166 is hidden on setting menu screen 210. By the process of S160, even if storage 162 is encrypted, menu item 210a is hidden, making it impossible or difficult to save the encryption key in second memory 166, thereby notifying the user that encryption of storage 162 has not been completed. This notification can prompt the user to attach second memory 166.

[0055] Furthermore, if it is determined in S120 that the encryption key has already been saved in second memory 166 (S120: Yes), the process proceeds to S170. In S170, a display process is performed in which menu item 210a for saving the encryption key in second memory 166 on setting menu screen 210 is grayed out (gray-out process). Thereafter, the setting menu display process ends. After the processes of S140, S150, 160, and 170 are completed, the process returns to the start and waits for the next operation to be input.

[0056] The above-described graying-out process causes the display of menu item 210a to be different from normal, thereby informing and alerting the user that an encryption key has already been stored in second memory 166. In addition to the graying-out process, a specific display such as "TPM in use" can be displayed.

[0057] In this way, when the storage 162 is encrypted and the encryption key is stored in the second memory 166, a specific display is displayed on the setting menu screen to notify the user that the storage 162 is in a secure state. The specific display can be various displays other than "TPM in use."

[0058] Also, there is no setting menu for returning the encryption key stored in the second memory 166 to the first memory 164. In this case, a message is displayed indicating that the encryption key cannot be returned to the first memory before it is moved to the second memory 166. For example, a message is displayed saying, "The encryption key stored in the TPM cannot be returned to the EEPROM." In this way, after the encryption key is stored in a secure state in the second memory 166, it can be maintained in a secure state to enhance the security state.

[0059] In addition, the control unit 100 may back up and store the encryption key stored in the second memory in a third memory (storage unit) consisting of a USB memory that can be attached to and detached from the information processing device 200.In this case, it is highly convenient and preferable to display the setting menu on the display unit.

[0060] [2. Second Embodiment] Fig. 7 is a flowchart of the information processing device according to the second embodiment, and Fig. 8 shows a setting menu screen 210' according to the second embodiment.

[0061] In the second embodiment shown in Fig. 7, when encrypting the storage 162, the encryption key can be selected and stored in the first memory 164 or the second memory 166. The same steps as in Fig. 6 are assigned the same step numbers.

[0062] The second embodiment differs from the first embodiment in that, as shown in FIG. 7, when it is determined that the storage 162 is encrypted (S100: Yes), it is determined whether or not to store the encryption key in the first memory 164 consisting of an EEPROM (S200). Specifically, as shown in Fig. 8, a menu item 210e ("Save encryption key in EEPROM" in Fig. 8) is displayed on the setting menu screen 210' of the display unit 150, and it is determined whether the setting of the menu item 210e has been enabled by the user. If the setting of the menu item 210e has been enabled and it is determined that the encryption key should be saved in the first memory 164, the encryption key is saved in the first memory 164 (S210), and the process proceeds to S160.

[0063] On the other hand, if it is determined in S200 that the encryption key is not to be stored in the first memory 164, the process proceeds to S110 and the subsequent processes are performed.

[0064] The second embodiment is highly convenient when there is no problem with leaving the encryption key stored in the first memory 164 made of a non-secure EEPROM or when the second memory is not installed, as it can store the encryption key in the first memory 164. On the other hand, when it is desired to store the encryption key in a secure TPM, it is possible to select to store the encryption key in the second memory 166 made of a TPM, which is highly convenient.

[0065] As shown in FIG. 8, a menu item 210a' for selecting whether to save the encryption key in the second memory and a menu item 210e for selecting whether to save the encryption key in the first memory 164 (EEPROM) are displayed on the setting menu screen 210 of the display unit 150, but this is not limited to this, and only menu item 2101e may be displayed.

[0066] In addition to the first and second embodiments, various modifications can be made. For example, in the second embodiment, the process of S200 can be appropriately set to be performed between S110 and S120.

[0067] Although the embodiments have been described above, the specific configuration is not limited to the embodiments, and designs that do not deviate from the gist of the present invention are also included in the scope of the claims.

[0068] In the embodiments, the programs that run on each device are programs that control the CPU, etc. (programs that make a computer function) so as to realize the functions of the above-described embodiments. Information handled by these devices is temporarily stored in a temporary storage device (e.g., RAM) during processing, and then stored in various ROMs and HDDs, and is read, modified, and written by the CPU as needed.

[0069] Here, the recording medium for storing the program may be any non-transitory recording medium such as a semiconductor medium (e.g., a ROM or a non-volatile memory card), an optical recording medium or a magneto-optical recording medium (e.g., a DVD (Digital Versatile Disc), an MO (Magneto Optical Disc), an MD (Mini Disc), a CD (Compact Disc), a BD (Blu-ray (registered trademark) Disc), etc.), or a magnetic recording medium (e.g., a magnetic tape, a flexible disk, etc.).

[0070] In addition, not only are the functions of the above-described embodiments realized by executing the loaded program, but the functions of the present disclosure may also be realized by processing in cooperation with an operating system or other application programs, etc., based on the instructions of the program.

[0071] Furthermore, when distributing a program on the market, the program can be stored in a portable storage device and distributed, or transferred to a server computer connected via a network such as the Internet. In this case, the storage device of the server computer is of course included in the present invention.

[0072] Furthermore, some or all of the devices in the above-described embodiments may be realized as LSI (Large Scale Integration), which is typically an integrated circuit. Each functional block of each device may be individually formed into a chip, or some or all of them may be integrated into a chip. Furthermore, the integrated circuit method is not limited to LSI, and may be realized using a dedicated circuit or a general-purpose processor. Furthermore, if an integrated circuit technology that can replace LSI emerges due to advances in semiconductor technology, it is of course possible to use an integrated circuit based on that technology. [Explanation of symbols]

[0073] 10 Image forming device 100 control section 140 Operation unit (corresponding to "input unit") 141 Operation Panel 150 Display section 160 Storage section 162 Storage 164 First Memory 166 Second Memory 200 Information processing device 210 Settings menu screen 210a Menu Items

Claims

1. An information processing device that stores secret information within its own device, Storage that stores data and encrypts it with an encryption key; a first non-secure storage unit for storing the encryption key; a secure second storage unit that can be added and that stores the encryption key; A display unit that displays various setting menus; an input unit through which a user inputs various information; a control unit that controls storage of the encryption key and display on the display unit, The control unit stores the encryption key in the second memory unit when the storage is encrypted and the second memory unit is attached, and an instruction to store the encryption key in the second memory unit is input to the input unit.

2. The information processing device according to claim 1, characterized in that when the second memory unit is attached with the storage encrypted and the encryption key stored in the first memory unit, the control unit displays a setting menu on the display unit for saving the encryption key in the second memory unit, and when an instruction to save the encryption key in the second memory unit is input to the input unit, the control unit transfers the encryption key stored in the first memory unit to the second memory unit.

3. 3. The information processing device according to claim 1, wherein the control unit does not display a setting menu for transferring the encryption key to a second storage unit on a display unit when the storage is not encrypted.

4. 3. The information processing apparatus according to claim 1, wherein the control unit stores the encryption key in the first storage unit when the storage encryption is performed.

5. 2 . The information processing apparatus according to claim 1 , wherein the control unit is configured to selectively store the encryption key in a first storage unit or a second storage unit during the storage encryption.

6. 3. The information processing device according to claim 2, wherein the control unit erases the encryption key stored in the first storage unit when transferring the encryption key stored in the first storage unit to the second storage unit.

7. 3. The information processing device according to claim 1, wherein the control unit displays a specific message on the setting menu when the storage is encrypted and the encryption key is stored in a second storage unit.

8. 3. The information processing device according to claim 2, wherein the control unit prevents the encryption key stored in the first storage unit from being returned to the first storage unit after the encryption key has been transferred to the second storage unit.

9. The information processing device according to claim 1, characterized in that the control unit displays on the display unit a setting menu for backing up and saving the encryption key stored in the second storage unit in a third storage unit that is detachable from the information processing device.

10. 10. An image forming apparatus comprising the information processing apparatus according to claim 1, and storing image data in a storage.

11. A method for controlling an information processing device that stores secret information in the device, comprising: storing the data in a storage device and encrypting the storage device with an encryption key; storing the encryption key in a non-secure first storage unit; storing the encryption key in a second storage unit that is add-on and secure; a display step of displaying various setting menus on a display unit; an input step in which a user inputs various information; a control step of storing the encryption key and controlling the display on the display unit, A control method for an information processing device, characterized in that the control step stores the encryption key in the second memory unit when an instruction to store the encryption key in the second memory unit is input in the input step, while the storage is encrypted and the second memory unit is attached.

Images