JP2021190964A - Information processing system, server device, and client device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve security.
SOLUTION: A server device receives a nons from a client device, and by combining the received nons and content data, a first combined content data is generated, and the first combined content data and the first combined content data are combined. A first signature is generated using the key, and the first signature and the content data are combined to generate the first signed content data, and the first signed content data is transmitted to the client device. Then, the client device receives the first signed content data from the server device, divides the first signed content data into the first signature and the content data, and separates the generated nonce and the content data. By combining, the second combined content data is generated, the second combined content data and the second key are used to generate the second signature, and the first signature is verified based on the second signature. If successful, the content data is output.
[Selection diagram] FIG. 6

Description

The present disclosure relates to a server device, a client device that receives content data from the server device, and an information processing system having the server device and the client device.

A client device that receives and processes content data from a server device is known. For example, an image forming apparatus that receives print data from a document management server apparatus and prints it is known.

Japanese Unexamined Patent Publication No. 2001-92608 Japanese Unexamined Patent Publication No. 2002-259108 Japanese Unexamined Patent Publication No. 2007-283562

It is desirable to increase the security of the client device that receives and processes content data from the server device.

The information processing system according to one form of the present disclosure is
With the server device
It includes the server device and a client device that is communicably connected via a network.
The server device has a storage device that stores a first key and content data to be supplied to the client device.
The client device has a storage device that stores a second key corresponding to the first key.
The client device is
After disabling the function to output the content data acquired from other than the server device,
Generate a nonce,
The nonce is transmitted to the server device, and the nonce is transmitted to the server device.
The server device is
The nonce is received from the client device and
By combining the received nonce and the content data, the first combined content data is generated.
Using the first combined content data and the first key to generate a first signature,
By combining the first signature and the content data, the first signed content data is generated.
The first signed content data is transmitted to the client device, and the first signed content data is transmitted to the client device.
The client device is
The first signed content data is received from the server device, and the first signed content data is received.
The first signed content data is divided into the first signature and the content data.
By combining the generated nonce and the content data, a second combined content data is generated.
Using the second combined content data and the second key, a second signature is generated.
If the verification of the first signature is successful based on the second signature, the content data is output.

According to the present disclosure, it is possible to improve the security of the client device that receives and processes the content data from the server device.

The effects described herein are not necessarily limited, and may be any of the effects described in the present disclosure.

The information processing system which concerns on the 1st Embodiment of this disclosure is shown. The hardware configuration of the image forming apparatus is shown. The hardware configuration of the server device is shown. The functional configuration of the information processing system is shown. The operation flow of the image forming apparatus (printing path invalidation processing) is shown. The operation flow of the information processing system is shown. The functional configuration of the information processing system according to the second embodiment is shown. The operation flow of the information processing system which concerns on the 2nd Embodiment is shown. The functional configuration of the information processing system according to the third embodiment is shown. The operation flow of the information processing system which concerns on 3rd Embodiment is shown.

Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.

I. First Embodiment

1. 1. Information processing system overview

FIG. 1 shows an information processing system according to the first embodiment of the present disclosure.

The information processing system 1 has a server device 20 and a client device 10. The server device 20 and the client device 10 are communicably connected to each other via a network N such as the Internet.

The server device 20 is a document management server device in this embodiment. The server device 20 transmits the content data (print data in this embodiment) to the client device 10 via the network N.

In the present embodiment, the client device 10 is an image forming device such as an MFP (Multifunction Peripheral). The client device 10 receives content data (print data) from the server device 20 via the network N and outputs (prints) it. Hereinafter, the client device 10 will be referred to as an image forming device 10.

2. 2. Hardware configuration of image forming device

FIG. 2 shows the hardware configuration of the image forming apparatus.

The image forming apparatus 10 includes a control circuit 100. The control circuit 100 is composed of a CPU 11a (Central Processing Unit) which is a processor, a RAM 11b (Random Access Memory), a ROM 11c (Read Only Memory) which is a memory, a dedicated hardware circuit, and the like, and is an overall image forming apparatus 10. Controls motion control. The CPU 11a loads the information processing program stored in the ROM 11c into the RAM 11b and executes it. The ROM 11c fixedly stores programs, data, and the like executed by the CPU 11a. ROM 11c is an example of a non-transient computer-readable recording medium.

The control circuit 100 includes an image reading unit 12 (image scanner), an image processing unit 14 (including a GPU (Graphics Processing Unit)), an image memory 15, an image forming unit 16 (printer), and an operation unit 17 (including a display unit 17a). It is connected to a large-capacity non-volatile storage device 18 such as a touch panel), an HDD (Hard Disk Drive) or SSD (Solid State Drive), a facsimile communication unit 19, a network communication interface 13, and the like. The control circuit 100 controls the operation of each of the connected parts and transmits / receives a signal or data to / from each part. The operation unit 17 (touch panel) is a form of an input device, and a voice input device including a microphone may be provided as the input device.

3. 3. Hardware configuration of server device

FIG. 3 shows the hardware configuration of the server device.

The server device 20 includes a CPU 21, a ROM 22, a RAM 23, a storage device 24, a network communication interface 25, an operating device 26, and a display device 27, and a bus 28 connecting them to each other.

The CPU 21, ROM 22, and RAM 23 constitute the control circuit 200. The CPU 21 loads the information processing program stored in the ROM 22 into the RAM 23 and executes it. The ROM 22 fixedly stores programs, data, and the like executed by the CPU 21. The ROM 22 is an example of a non-transient computer-readable recording medium.

4. Functional configuration of information processing system

FIG. 4 shows a functional configuration of an information processing system.

In the control circuit 100 of the image forming apparatus 10, the CPU 11a loads the information processing program stored in the ROM 11c into the RAM 11b and executes it to execute the print path setting management unit 101, the nonce generation unit 102, the data reception unit 103, and the signature reproduction. It operates as a unit 104, a signature verification unit 105, and a print job control unit 106.

In the control circuit 200 of the server device 20, the CPU 21 loads the information processing program stored in the ROM 22 into the RAM 23 and executes it, so that the print request acquisition unit 201, the nonce acquisition unit 202, the signature generation unit 203, and the data transmission unit 204 are executed. Works as.

5. Operation flow of image forming device (print path invalidation processing)

FIG. 5 shows an operation flow (print path invalidation process) of the image forming apparatus.

The print path setting management unit 101 of the image forming apparatus 10 determines whether or not the cooperation function with the server apparatus 20 (document management server apparatus) (that is, the function of printing the data received from the server apparatus 20) is effective (that is, the function of printing the data received from the server apparatus 20). Step S1). When the print route setting management unit 101 determines that the function of linking with the server device 20 is effective, it disables all the functions of outputting print data acquired from other than the server device 20 (step S1, YES).

Specifically, the print route setting management unit 101 closes the RAW port (step S3) if the RAW print function is valid (step S2, YES), and if the FTP print function is valid (step S4, YES). YES), the FTP port is closed (step S5), and if the USB memory printing function is enabled (step S6, YES), the USB port is closed (step S7). As long as the cooperation function with the server device 20 is valid, the print route setting management unit 101 continues to monitor whether all the functions for outputting print data acquired from other than the server device 20 are disabled (Loop).

6. Information processing system operation flow

FIG. 6 shows the operation flow of the information processing system.

The process of FIG. 6 is performed after the process of FIG. The print request acquisition unit 201 of the server device 20 receives a print request from the image forming device 10 or a terminal device (personal computer, tablet computer, smartphone, etc., not shown) (step S201). The print request specifies the content data D11 (hereinafter referred to as print data D11) stored in the server device 20 and the image forming device 10 to output the print data D11. The print request acquisition unit 201 reads out the print data D11 specified by the received print request from the storage device 24 (step S202).

The signature generation unit 203 of the server device 20 reads the first key K1 from the storage device 24 (step S203). The first key K1 is a common key of the hash function. The image forming apparatus 10 designated by the received print request also stores the second key K2, which is the common key of the hash function. The first key K1 and the second key K2, which are the common keys of the hash function, have the same value.

The nonce acquisition unit 202 of the server device 20 transmits a nonce generation instruction, which is an instruction for generating a nonce, to the image forming apparatus 10 designated by the received print request (step S203). Nonces are fixed-length random data to prevent replay attacks.

The nonce generation unit 102 of the image forming apparatus 10 receives the nonce generation instruction from the server apparatus 20 (step S101). The nonce generation unit 102 generates the nonce N1 and stores it in the RAM 11b (step S102). The nonce generation unit 102 transmits the nonce N1 to the server device 20 as a response to the nonce generation instruction (step S103).

The nonce acquisition unit 202 of the server device 20 receives the nonce N1 from the image forming device 10. The signature generation unit 203 of the server device 20 generates the first combined print data D12 by combining the received nonce N1 with the print data D11 (step S202) read from the storage device 24 (step). S205). The signature generation unit 203 generates the first signature D13 by using the first combined print data D12 and the first key K1 (step S203) read from the storage device 24. Specifically, the signature generation unit 203 generates a message authentication code (MAC) as the first signature D13 by inputting the first key K1 (common key) into the hash function (step S206). An example of a message authentication code (MAC) is HMAC (Hash-based Message Authentication Code).

The signature generation unit 203 of the server device 20 generates the first signed print data D14 by combining the first signature D13 (message authentication code) and the print data D11 (step S207). The data transmission unit 204 of the server device 20 transmits the first signed print data D14 to the image forming device 10 (step S208).

The data receiving unit 103 of the image forming apparatus 10 receives the first signed print data D14 from the server apparatus 20 (step S104).

The signature reproduction unit 104 of the image forming apparatus 10 divides the first signed print data D14 into the first signature D13 (message authentication code) and the print data D11 (step S105). The signature reproduction unit 104 combines the generated and stored nonce N1 (step S102) with the print data D11 (step S105) divided from the first signed print data D14 to form a second combined print data. Generate D22 (step S106). The signature reproduction unit 104 reads the second key K2 (common key of the hash function) from the storage device 18 (step S107). The signature reproduction unit 104 reproduces and generates the second signature D23 using the second combined print data D22 and the second key K2 read from the storage device 18. Specifically, the signature reproduction unit 104 generates a message authentication code (HMAC) as the second signature D23 by inputting the second key K2 (common key) into the hash function (step S108).

The signature verification unit 105 of the image forming apparatus 10 has a first signature D13 (1st signature D13) divided from the first signed print data D14 received from the server apparatus 20 based on the second signature D23 (step S108) reproduced and generated. Step S105) is verified. Specifically, the signature verification unit 105 determines whether or not the first signature D13 (message authentication code) and the second signature D23 (message authentication code) match (step S109). As described above, the first key K1 possessed by the server device 20 and the second key K2 possessed by the image forming apparatus 10 are common keys of the hash function and have the same value. Therefore, if the first signed print data D14 received from the server device 20 is valid (if the data is received from a legitimate server device), the first signature D13 and the second signature D23 are one. The verification is successful (step S109, YES).

If the verification is successful (step S109, YES), the print job control unit 106 of the image forming apparatus 10 issues a print job for printing the print data D11 (step S105) divided from the first signed print data D14. Generate (step S110). The print job control unit 106 outputs the generated print job to the image forming unit 16 (printer) and prints it (step S111).

On the other hand, a case where the first signature D13 and the second signature D23 do not match and the verification fails (step S109, NO) will be described. The image forming apparatus 10 stores one second key K2 (common key) for each of the registered server apparatus 20. That is, if a plurality of server devices 20 are registered in the image forming device 10, the image forming device 10 stores the same number of (plural) second keys K2 (common keys).

Therefore, when the plurality of second keys K2 (common keys) are stored (step S112, NO), the signature reproduction unit 104 uses the second keys one by one for the plurality of second keys K2. K2 is read out (step S107), and the second key K2 is used to generate the second signature D23 (step S108). If the signature verification unit 105 succeeds in verifying the first signature D13 based on any of the second signatures D23 (step S109, YES), the print job control unit 106 generates a print job (step S110). Print (step S111). However, if the signature verification unit 105 does not succeed in verifying the first signature D13 based on all the second signatures D23 (step S109, NO), the signature verification unit 105 records an error and the print data D11 prints. Not done (step S113). By recording the error, the system administrator can notice and deal with the fraudulent activity. "When the verification of the first signature D13 is not successful based on all the second signatures D23 (step S109, NO)" means that the first signed print data D14 is registered in the image forming apparatus 10. It is limited to the case where it was received from a server device that has not been used. As a result, the image forming apparatus 10 can print the print data D11 stored in the server apparatus 20 registered in the image forming apparatus 10, and even if the image forming apparatus 10 receives the data from the server apparatus not registered in the image forming apparatus 10. You will not be able to print.

II. Second embodiment

In the following description, the same configurations and operations as those already described will be described with reference numerals of the same or similar, and the description and illustration will be omitted, and the differences will be mainly described.

In the first embodiment, the first key K1 and the second key K2 are common keys of the hash function, and the first signature D13 and the second signature D23 are message authentication codes (HMAC).

On the other hand, in the second embodiment, the first key K1 is the private key of the public key cryptography, and the second key K2 is the public key of the public key cryptography. The first signature D13 and the second signature D23 are cryptographic digests (digital signatures). RSA cryptography is an example of public key cryptography.

FIG. 7 shows a functional configuration of the information processing system according to the second embodiment.

FIG. 8 shows an operation flow of the information processing system according to the second embodiment.

The signature generation unit 203 of the server device 20 reads the first key K1 from the storage device 24 (step S203). The first key K1 is a private key for RSA encryption. The image forming apparatus 10 designated by the received print request stores the second key K2, which is the public key of RSA cryptography.

The signature generation unit 203 of the server device 20 generates the first signature D13 using the first combined print data D12 (step S205) and the first key K1 (step S203) read from the storage device 24. .. Specifically, the signature generation unit 203 uses a one-way hash function (SHA or the like) to generate a first signature from the first combined print data D12. The signature generation unit 203 generates a cipher digest as the encrypted first signature D13 by encrypting the generated first signature using the first key K1 (RSA encryption private key) (the cipher digest is generated as the encrypted first signature D13 (). Step S206).

The signature generation unit 203 of the server device 20 generates the first signed print data D14 by combining the encrypted first signature D13 (encryption digest) and the print data D11 (step S207). The data transmission unit 204 of the server device 20 transmits the first signed print data D14 to the image forming device 10 (step S208).

The data receiving unit 103 of the image forming apparatus 10 receives the first signed print data D14 from the server apparatus 20 (step S104).

The signature reproduction unit 104 of the image forming apparatus 10 divides the first signed print data D14 into the encrypted first signature D13 (encryption digest) and the print data D11 (step S105). The signature reproduction unit 104 combines the generated and stored nonce N1 (step S102) with the print data D11 (step S105) divided from the first signed print data D14 to form a second combined print data. Generate D22 (step S106). The signature reproduction unit 104 reads the second key K2 (RSA encryption public key) from the storage device 18 (step S107). The signature reproduction unit 104 generates the first digest D13'by decrypting the encrypted first signature D13 (encryption digest) using the second key K2 (RSA encryption public key) ( Step S107'). The signature reproduction unit 104 reproduces and generates a second digest D23 as the second signature D23 from the second combined print data D22 by using a one-way hash function (SHA or the like) (step S108).

The signature verification unit 105 of the image forming apparatus 10 has a first signature D13 (first digest D13') obtained by decoding based on the second signature D23 (second digest D23) (step S108) reproduced and generated. ) (Step S107'). Specifically, the signature verification unit 105 determines whether or not the first signature D13 (first digest D13') obtained by decryption and the second signature D23 (second digest D23) match. Is determined (step S109). As described above, the first key K1 possessed by the server device 20 is the private key of the RSA encryption, and the second key K2 possessed by the image forming apparatus 10 is the public key of the RSA encryption. Therefore, if the first signed print data D14 received from the server device 20 is valid (if the data is received from a legitimate server device), the first signature D13 (first digest D13') is determined. It matches the second signature D23 (second digest D23) and the verification is successful (step S109, YES).

III. Third embodiment

In the first embodiment, the server device 20 generated the first signed print data D14 based on the entire print data D11. On the other hand, in the third embodiment, the server device 20 divides the print data D11 into a plurality of print data blocks and processes the print data D11 in the same manner as in the first embodiment.

FIG. 9 shows a functional configuration of the information processing system according to the third embodiment.

FIG. 10 shows an operation flow of the information processing system according to the third embodiment.

The print request acquisition unit 201 of the server device 20 generates a plurality of print data blocks D11B by dividing the print data D11 (step S202) read from the storage device 24 into a plurality of print data blocks D11B (step S202').

The signature generation unit 203 of the server device 20 selects the first print data block D11B from the plurality of print data blocks D11B (step S202') (step S205'). The signature generation unit 203 generates the first combined print data block D12 by combining the received nonce N1 and the selected print data block D11B (step S205). The signature generation unit 203 generates a first signature D13 (message authentication code) using the first combined print data block D12 and the first key K1 (step S203) read from the storage device 24 (step). S206).

The signature generation unit 203 generates the first signed print data block D14 by combining the first signature D13 (message authentication code) and the print data block D11B (step S207). The data transmission unit 204 of the server device 20 transmits the first signed print data block D14 to the image forming device 10 (step S208).

The signature generation unit 203 generates the first combined print data block D12 one by one for all of the plurality of print data blocks D11B (Loop in step S209) (step S205), and generates the first signature D13. (Step S206), the first signed print data block D14 is generated (step S207), and is transmitted (step S208).

The data receiving unit 103 of the image forming apparatus 10 sequentially receives the plurality of first signed print data blocks D14 from the server apparatus 20 (step S104). The image forming apparatus 10 performs the following processing one by one for all of the plurality of first signed print data blocks D14.

The signature reproduction unit 104 of the image forming apparatus 10 divides the first signed print data block D14 into the first signature D13 (message authentication code) and the print data block D11B (step S105). The signature reproduction unit 104 combines the generated and stored nonce N1 (step S102) with the print data block D11B (step S105) divided from the first signed print data block D14 to form a second combination. The print data block D22 is generated (step S106). The signature reproduction unit 104 reads the second key K2 (common key of the hash function) from the storage device 18 (step S107). The signature reproduction unit 104 reproduces and generates the second signature D23 using the second combined print data block D22 and the second key K2 read from the storage device 18. Specifically, the signature reproduction unit 104 generates a message authentication code (HMAC) as the second signature D23 by inputting the second key K2 (common key) into the hash function (step S108).

The signature verification unit 105 of the image forming apparatus 10 is divided from the first signed print data block D14 received from the server apparatus 20 based on the second signature D23 (step S108) reproduced and generated, and the first signature D13. (Step S105) is verified (step S109). If the first signed print data block D14 received from the server device 20 is valid (if the data is received from a legitimate server device), the first signature D13 and the second signature D23 match. , Verification is successful (step S109, YES).

If the verification is successful (step S109, YES), the print job control unit 106 of the image forming apparatus 10 generates a print job for printing the first print data block D11B (step S105) (step S114, YES). (Step S110). The print job control unit 106 outputs the generated print job to the image forming unit 16 (printer) and prints it (step S111). The print job control unit 106 also outputs the second and subsequent print data blocks D11B (step S114, NO) to the image forming unit 16 (printer) for printing (step S111). As a result, the print job control unit 106 prints all the print data blocks D11B.

IV. Modification example

The image forming apparatus 10 may store the second key K2 locally or may acquire it from an external server apparatus (not shown) when necessary.

As a modification of the first embodiment and the second embodiment, the first signed print data D14 transmitted from the server device 20 to the image forming device 10 may be encrypted. Specifically, the server device 20 encrypts the first signed print data D14 and transmits the encrypted first signed print data D14 to the image forming device 10 (step S208). The image forming apparatus 10 receives the encrypted first signed print data D14 from the server apparatus 20 (step S104), decodes the encrypted first signed print data D14, and decodes the first one. The signed print data D14 is divided into a first signature D13 and print data D11 (step S105).

Further, the server device 20 may compress the first signed print data D14, then encrypt and transmit the encrypted first signed print data D14 to the image forming device 10 (step S208). .. The image forming apparatus 10 receives the encrypted first signed print data D14 from the server apparatus 20 (step S104), decodes the encrypted first signed print data D14, and decodes the first one. The signed print data D14 may be decompressed and then divided into the first signature D13 and the print data D11 (step S105).

As a modification of the third embodiment, the first signed print data block D14 transmitted from the server device 20 to the image forming device 10 may be encrypted. All first signed print data blocks D14 may be encrypted, or at least one first signed print data block D14 may be encrypted. Specifically, the server device 20 encrypts at least the first first signed print data block D14 among the plurality of first signed print data blocks D14, and at least the first encrypted one. The first signed print data block D14 is transmitted to the image forming apparatus 10 (step S208). The image forming apparatus 10 receives a plurality of first signed print data blocks D14 including at least one encrypted first signed print data block D14 from the server apparatus 20 (step S104). A plurality of first signed print data blocks including at least one encrypted first signed print data block D14 decrypted and decrypted at least one first signed print data block D14. D14 is divided into a plurality of first signatures D13 and a plurality of print data blocks, respectively (step S105). In this case as well, the server device 20 and the image forming device 10 may encrypt the first signed print data block D14 after compression and decompress it after decryption.

As a modification of the third embodiment, the server device 20 does not have to generate the first signed print data block D14 from all the print data blocks D11B. The server device 20 may generate at least the first signed print data block D14 from at least the first data block D11B. In this case, the image forming apparatus 10 receives at least the first signed print data block D14 and the remaining print data blocks D11B, and receives at least the first signed print data block D14 only. Verify. If the verification is successful, the image forming apparatus 10 outputs all the print data blocks D11B. On the other hand, if the verification fails, the image forming apparatus 10 does not output all the print data blocks D11B.

A modification in the case where the server device 20 generates at least the first signed print data block D14 is given. The server device 20 encrypts and encrypts at least the first first signed content data block D14 and the remaining content data blocks and D11B, and at least the first signed content data block D14. And the remaining encrypted content data block D11B may be transmitted to the image forming apparatus 10. The image forming apparatus 10 receives at least one encrypted first signed content data block D14 and the remaining encrypted content data block D11B from the server apparatus 20, and at least one encrypted one. The first signed content data block D14 of the eye and the remaining encrypted content data block D11B may be decrypted.

When combining signing and encryption, it is not always necessary to sign all print data blocks D11B, for example, the first block is signed with the session key used for encryption, and the subsequent blocks are signed with this session key. You can take the method of performing only encryption. In this case, the second and subsequent blocks need only be decoded.

V. Conclusion

Cryptographic technology is used for various purposes in image forming apparatus. For example, it is known that the communication path between the server (or personal computer) and the image forming apparatus is encrypted in order to prevent data eavesdropping, and the data in the HDD is encrypted as a countermeasure against the theft of the HDD in the image forming apparatus. Has been done.

According to known techniques, the server device holds an encryption key corresponding to the client device (image forming device) and encrypts data using the encryption key. As a result, only the client device (image forming device) having the corresponding decoding key can print the data. However, this method can prevent the image managed by the server device from being printed illegally, but if the unauthorized server device or the unauthorized terminal sends data to the image forming device, the image forming device will use the data. Can be printed. Further, the image forming apparatus accepts a large number of print data formats. Therefore, the image forming apparatus may not be able to accurately detect that the decoding has failed. If the image forming apparatus cannot detect the decoding failure and accepts it as print data, the image forming apparatus prints this data as random data. As a result, the image forming apparatus wastes paper and toner.

According to another known technique, public key cryptography is used to mutually authenticate document server devices, client devices, and image forming devices. However, for example, if an unauthorized server device has a valid public key certificate, the unauthorized server device may access the image forming apparatus. Further, an unauthorized server device or terminal device may access the image forming apparatus via one of a plurality of printing paths of the image forming apparatus.

According to another known technique, the image forming apparatus prohibits printing based on the information obtained from the authentication server apparatus. However, this method also has a problem that it is vulnerable to a replay attack in addition to the above problem.

Most of the conventional techniques try to maintain security by using public key cryptography, but in the environment where the system is configured using a large number of dynamically increasing / decreasing server devices as in the present, and the public key certificate There is also a problem that the management of public key certificates becomes complicated when the expiration date is set short.

For the purpose of improving security and cost management, a document management server device with an authentication function may be introduced and linked with the image forming device. When linked, the user will print as follows. First, (a) the user registers the print data in the document management server device. After that, the user goes to the image forming apparatus and (b) authenticates himself / herself on the image forming apparatus. (C) If the authentication is successful, the image forming apparatus acquires print data from the document management server apparatus. (D) The image forming apparatus prints the acquired print data.

By using a known technique, it is possible to protect the communication of (a), (b) and (c) by encryption of the communication path and prevent eavesdropping. When the data acquired in (c) is stored in the HDD and the HDD is encrypted, it is safe even if the HDD is stolen. Printing by an unauthorized user is prevented by the authentication in (b). By using each of the above-mentioned known techniques, it is possible to prevent printing by an illegally added image forming apparatus.

However, even if these conventional techniques are used, it is difficult to prevent printing that bypasses a legitimate document management server device. For example, it is possible to directly transmit print data from an unauthorized server device to an image forming device and have it printed.

In view of the above circumstances, it is desirable to prevent printing that bypasses legitimate server devices.

Therefore, in the present embodiment, while the cooperation function with the server device 20 is enabled, a plurality of print paths supported by the image forming device 10 (for example, RAW printing, FTP printing, printing from a USB memory). By disabling, printing without going through the server device 20 is disabled. Further, in the present embodiment, by signing the print data and verifying the print data, it is possible to prevent the print data from being obtained or falsified from the unauthorized server device 20. The signature is a message authentication code (first embodiment) generated by HMAC, which is a known encryption technology, or a digital signature (third embodiment) generated by using RSA.

The image forming apparatus 10 verifies the signature by using the second key K2 which is the authentication information of the server apparatus 20. Therefore, even if the signature uses public key cryptography, the image forming apparatus 10 does not accept the legitimate public key cryptography possessed by the unauthorized server device 20. The second key K2, which serves as authentication information, is a common key (first embodiment) in the case of a message authentication code, and a public key certificate (second embodiment) in the case of a digital signature. The image forming apparatus 10 and the authentication information management server apparatus have a list of authentication information to be accepted.

The server device 20 acquires fraud prevention data (nonce N1) from the image forming device 10 and generates a first signature D13 based on the nonce N1. This can prevent replay attacks.

When the server device 20 increases or decreases according to the load amount, the number of authentication information can be reduced by using the message authentication code for the signature (first embodiment). Therefore, the image forming apparatus 10 can easily manage the plurality of server devices 20. In other words, when setting a common key for a plurality of server devices 20, the image forming device 10 only needs to hold one common second key K2. On the other hand, when a digital signature (public key cryptography) is used for the signature (second embodiment), the image forming apparatus 10 may have a plurality of server devices 20 via an authentication information management server device (not shown). Can be easily managed. In other words, it is not necessary to update the authentication information list of all the image forming devices 10 every time the server device 20 increases or decreases.

By dividing the print data D11 and then signing it (third embodiment), the time until the start of printing can be shortened. This is because, especially when the print data is large, it is not necessary to verify the signature after receiving all the print data D11. By starting printing from the print data block D11B for which verification has been completed, it is possible to reduce the perceived delay of the user.

According to this embodiment, the image forming apparatus 10 invalidates the plurality of supported print paths (RAW, FTP printing, etc.). Further, the server device 20 holding the print data signs the print data by cryptographic technology, the image forming device 10 on the printing side verifies the signature, and if successful, prints the print data. As a result, the image forming apparatus 10 can print only the print data acquired from the recognized server apparatus 20, and refuse to print the print data obtained from the non-target server apparatus or terminal apparatus. This makes it possible to prevent printing that bypasses the server device 20.

Although each embodiment and each modification of the present technology have been described above, the present technology is not limited to the above-described embodiment, and various changes may be made without departing from the gist of the present technology. Of course.

Information processing system 1
Image forming apparatus 10
Server device 20
Print route setting management unit 101
Nonce generator 102
Data receiver 103
Signature reproduction unit 104
Signature Verification Unit 105
Print job control unit 106
Print request acquisition unit 201
Nonce acquisition unit 202
Signature generator 203
Data transmitter 204

Claims (9)

With the server device
It includes the server device and a client device that is communicably connected via a network.
The server device has a storage device that stores a first key and content data to be supplied to the client device.
The client device has a storage device that stores a second key corresponding to the first key.
The client device is
After disabling the function to output the content data acquired from other than the server device,
Generate a nonce,
The nonce is transmitted to the server device, and the nonce is transmitted to the server device.
The server device is
The nonce is received from the client device and
By combining the received nonce and the content data, the first combined content data is generated.
Using the first combined content data and the first key to generate a first signature,
By combining the first signature and the content data, the first signed content data is generated.
The first signed content data is transmitted to the client device, and the first signed content data is transmitted to the client device.
The client device is
The first signed content data is received from the server device, and the first signed content data is received.
The first signed content data is divided into the first signature and the content data.
By combining the generated nonce and the content data, a second combined content data is generated.
Using the second combined content data and the second key, a second signature is generated.
An information processing system that outputs the content data when the verification of the first signature is successful based on the second signature. The information processing system according to claim 1.
The content data is print data and is
The client device is an image forming device and is an image forming device.
The client device is an information processing system that generates and transmits the nonce after disabling the function of outputting print data acquired from other than the server device. The information processing system according to claim 1 or 2.
The first key and the second key are common keys of the hash function, and are
The server device and the client device generate a message authentication code (MAC) as the first signature and the second signature by inputting the common key into the hash function.
The client device is an information processing system that outputs the content data as if the verification was successful when the message authentication code, which is the first signature, and the message authentication code, which is the second signature, match. The information processing system according to claim 1 or 2.
The first key is a private key of public key cryptography.
The second key is the public key of the public key cryptography.
The server device is
From the first combined content data, the first digest, which is the first signature, is generated.
By encrypting the first digest using the secret key, which is the first key, an encrypted first signature cryptographic digest is generated.
The client device is
The first signed content data is divided into the encrypted digest, which is the encrypted first signature, and the content data.
By combining the generated nonce and the content data, a second combined content data is generated.
By decrypting the cryptographic digest using the public key, which is the second key, the first digest, which is the first signature, is generated.
From the second combined content data, a second digest, which is the second signature, is generated.
An information processing system that outputs the content data as if the verification was successful when the first digest, which is the first signature, and the second digest, which is the second signature, match. The information processing system according to any one of claims 1 to 4.
The server device is
The first signed content data is encrypted and
The encrypted first signed content data is transmitted to the client device, and the encrypted content data is transmitted to the client device.
The client device is
The encrypted first signed content data is received from the server device, and the encrypted first signed content data is received.
Decrypting the encrypted first signed content data,
An information processing system that divides the decrypted first signed content data into the first signature and the content data. The information processing system according to any one of claims 1 to 4.
The server device is
By dividing the content data into a plurality of pieces, a plurality of content data blocks are generated.
By combining the received nonce with at least the first content data block among the plurality of content data blocks, at least the first combined content data block is generated.
Using the at least the first combined content data block and the first key to generate at least the first first signature.
By combining the at least the first signature and the at least the first content data block, at least the first signed content data block is generated.
The at least one first signed content data block and the remaining content data block among the plurality of content data blocks are transmitted to the client device.
The client device is
The at least one first signed content data block and the remaining content data block are received from the server device.
The at least the first signed content data block is divided into the at least the first signature and the at least the first content data block.
By combining the generated nonce with the at least the first content data block, at least the first second combined content data block is generated.
Using the at least the first second combined content data block and the second key to generate at least the first second signature.
An information processing system that outputs a plurality of content data blocks when the verification of the at least the first first signature is successful based on the at least the first second signature. The information processing system according to claim 6.
The server device is
The at least one first signed content data block and the remaining content data block are encrypted.
The encrypted at least one first signed content data block and the encrypted remaining content data block are transmitted to the client device.
The client device is
The encrypted at least one first signed content data block and the remaining encrypted content data block are received from the server device.
An information processing system that decrypts at least the first encrypted content data block and the remaining encrypted content data block. With the server device
The server device of an information processing system having the server device and a client device communicably connected via a network.
The server device has a storage device that stores a first key and content data to be supplied to the client device.
The client device has a storage device that stores a second key corresponding to the first key.
The client device is
After disabling the function to output the content data acquired from other than the server device,
Generate a nonce,
The nonce is transmitted to the server device, and the nonce is transmitted to the server device.
The server device is
The nonce is received from the client device and
By combining the received nonce and the content data, the first combined content data is generated.
Using the first combined content data and the first key to generate a first signature,
By combining the first signature and the content data, the first signed content data is generated.
The first signed content data is transmitted to the client device, and the first signed content data is transmitted to the client device.
The client device is
The first signed content data is received from the server device, and the first signed content data is received.
The first signed content data is divided into the first signature and the content data.
By combining the generated nonce and the content data, a second combined content data is generated.
Using the second combined content data and the second key, a second signature is generated.
A server device that outputs the content data when the verification of the first signature is successful based on the second signature. With the server device
A client device of an information processing system having a server device and a client device communicably connected via a network.
The server device has a storage device that stores a first key and content data to be supplied to the client device.
The client device has a storage device that stores a second key corresponding to the first key.
The client device is
After disabling the function to output the content data acquired from other than the server device,
Generate a nonce,
The nonce is transmitted to the server device, and the nonce is transmitted to the server device.
The server device is
The nonce is received from the client device and
By combining the received nonce and the content data, the first combined content data is generated.
Using the first combined content data and the first key to generate a first signature,
By combining the first signature and the content data, the first signed content data is generated.
The first signed content data is transmitted to the client device, and the first signed content data is transmitted to the client device.
The client device is
The first signed content data is received from the server device, and the first signed content data is received.
The first signed content data is divided into the first signature and the content data.
By combining the generated nonce and the content data, a second combined content data is generated.
Using the second combined content data and the second key, a second signature is generated.
A client device that outputs the content data when the verification of the first signature is successful based on the second signature.

Images