JP5277576B2 - Information processing apparatus and cryptographic processing program - Google Patents

Description

  The present invention relates to an information processing apparatus and a cryptographic processing program, and more particularly to an information processing apparatus and a cryptographic processing program that perform cryptographic processing of data using a cryptographic engine.

With the recent increase in awareness of information security, information processing devices such as personal computers, image processing devices, or communication devices encrypt data using a predetermined encryption method to increase the confidentiality of data being communicated. (See, for example, Patent Document 1).
JP 2006-217152 A

  In a conventional information processing apparatus, an encryption engine (for example, OpenSSL) is incorporated in a daemon (for example, httpd) corresponding to a predetermined communication method. However, in the conventional information processing apparatus, it is necessary to fetch the cryptographic engine for each daemon that uses the cryptographic engine, and the same cryptographic engine is duplicated and the memory such as ROM / RAM is wasted. was there.

  Further, the conventional information processing apparatus has a problem in that when the encryption engine of the daemon corresponding to a predetermined communication method is changed, the daemon needs to be modified and the encryption engine cannot be easily changed.

  The present invention has been made in view of the above points, and an object of the present invention is to provide an information processing apparatus and a cryptographic processing program that can prevent memory waste and that can easily change a cryptographic engine.

In order to solve the above-mentioned problems, the present invention provides an information processing apparatus that performs cryptographic processing of data using a cryptographic engine, and includes one or more application means and data received by each protocol from a network side. Network control means for transmitting data received from the application means to the network side, encryption processing means for performing encryption processing on the data, and a plurality of other corresponding to the protocol included in the network control means Between the processing means and the cryptographic processing means, and a cryptographic processing interface means for transmitting and receiving commands relating to cryptographic processing and data to be cryptographically processed, wherein the cryptographic processing means communicates with the other processing means. between the command and the dark regarding the encryption processing Transmission / reception means for transmitting / receiving data to be processed by the encryption processing interface means , a cryptographic engine for performing cryptographic processing on the data, and the data between the transmission / reception means and the cryptographic engine And a command analysis unit that analyzes the command and performs cryptographic processing according to the command using the cryptographic engine and the cryptographic engine interface unit.

In addition, the present invention provides an information processing apparatus that performs cryptographic processing of data using a cryptographic engine, one or more application means, and distributes data received by each protocol from the network side to the application means and receives from the application means Network control means for transmitting the data to the network side, cryptographic processing means for performing cryptographic processing on the data, a plurality of other processing means corresponding to the protocol included in the network control means, and the cryptographic processing means between, to function as the encryption processing interface means for transmitting and receiving data that is the subject of the command and the encryption processing related cryptographic processing, the cryptographic processing unit, between said other processing means, the command and the cipher processing relating to the cryptographic processing Data that is subject to Transmitting / receiving means for transmitting / receiving via the cryptographic processing interface means, a cryptographic engine for performing cryptographic processing on the data, and a cryptographic engine interface means for transmitting / receiving the data between the transmitting / receiving means and the cryptographic engine And a command processing unit that analyzes the command and performs a cryptographic process corresponding to the command using the cryptographic engine and a cryptographic engine interface unit.

  In addition, what applied the component, expression, or arbitrary combination of the component of this invention to a method, an apparatus, a system, a computer program, a recording medium, a data structure, etc. is also effective as an aspect of this invention.

  According to the present invention, it is possible to provide an information processing apparatus and a cryptographic processing program that can prevent memory from being wasted and that can easily change a cryptographic engine.

  Next, the best mode for carrying out the present invention will be described based on the following embodiments with reference to the drawings. First, in order to facilitate understanding of the present invention, the principle of the present invention will be described.

  FIG. 1 is a block diagram for explaining the principle of the present invention. In the present invention, the cryptographic engine 4 is cut out from the daemon 1 corresponding to a predetermined communication method, and the cryptographic engine 4 is modularized as a process so that the daemons 1 can use the cryptographic engine 4 in common. Each daemon 1 corresponds to another processing means.

  The modularized cryptographic engine 4 is controlled by a cryptographic processing module (DESS) 3. The cryptographic processing module 3 is a process having a cryptographic engine 4. The cryptographic processing module 3 dynamically fetches the cryptographic engine 4 and provides a cryptographic processing service to each daemon 1. The DESS I / F 2 is an interface for each daemon 1 to use the cryptographic processing module 3. Each daemon 1 uses the cryptographic processing module 3 via the DESS I / F 2.

  In FIG. 1, httpd, ncsd, sshd, and snmpd are shown as an example of the daemon 1. In FIG. 1, OpenSSL and BSAFE are shown as an example of the cryptographic engine 4.

  With the configuration shown in FIG. 1, each daemon 1 can dynamically select the cryptographic engine 4 to be used, and the cryptographic engine 4 can be easily changed. Further, each daemon 1 does not need to fetch the encryption engine 4 individually, so that the capacity of a memory such as a ROM / RAM can be saved.

  Next, a multifunction machine will be described as an example of the information processing apparatus according to the present invention. FIG. 2 is a hardware configuration diagram of an embodiment of the multifunction machine according to the present invention.

  The multifunction machine 10 includes a controller 11, an operation panel 12, an FCU 13, and an engine unit 14. 2 includes a CPU 21, a system memory 22, a north bridge (NB) 23, a south bridge (SB) 24, an ASIC 25, a local memory 26, an HDD 27, a network interface card (NIC) 28, and the like. , And Centronics 29.

  The operation panel 12 is connected to the ASIC 25 of the controller 11. The FCU 13 and the engine unit 14 are connected to the ASIC 25 of the controller 11 via the PCI bus 30.

  In the controller 11, a local memory 26, an HDD 27, and the like are connected to the ASIC 25, and a CPU 21 and an ASIC 25 are connected to each other via an NB 23 of a CPU chip set. The controller 11 corresponds to the case where the interface of the CPU 21 is not disclosed by connecting the CPU 21 and the ASIC 25 via the NB 23. The ASIC 25 and the NB 23 are connected via an AGP (Accelerated Graphics Port) 31.

  As described above, since the multifunction peripheral 10 shown in FIG. 2 controls execution of one or more processes, the ASIC 25 and the NB 23 are connected not via the low-speed PCI bus but via the AGP 31 to prevent performance degradation.

  The CPU 21 performs overall control of the multifunction machine 10. For example, the CPU 21 activates and executes each module of a service layer described later as a process on the OS and activates and executes an application.

  The NB 23 is a bridge for connecting the CPU 21, system memory 22, SB 24, ASIC 25, NIC 28, and Centronics 29. The SB 24, the NIC 28, and the Centronics 29 are connected to the NB 23 via the PCI bus 32. The SB 24 is a bridge for connecting the PCI bus 32 to a ROM, peripheral devices, and the like.

  The system memory 22 is a memory used as a drawing memory or the like of the multifunction machine 10. The local memory 26 is a memory used as a copy image buffer and a code buffer. The ASIC 25 is an IC for image processing applications having hardware elements for image processing. The HDD 27 is an example of storage (auxiliary storage device) that stores image data, document data, programs, font data, forms, and the like.

  The NIC 28 is an interface device that connects the multifunction peripheral 10 to a network. The Centronics 29 is an interface conforming to the Centronics standard, which is a printer output standard for personal computers.

  The operation panel 12 is an operation unit that accepts an input operation from the operator and performs display for the operator. An FCU (fax control unit) 13 is a unit that performs control related to fax, and transmits and receives facsimile data.

  FIG. 3 is a software configuration diagram of an embodiment of the multifunction machine according to the present invention. The multi-function device 10 includes an application 41, an API (application program interface) 42, a service layer 43 configured to include one or more service modules, an IPC (interprocess communication) unit 44, a thread control unit (pthread) 45, and An OS (Operating System) 46 is included.

  The application 41 includes a printer application, a copy application, a fax application, a scanner application, and the like that perform processing relating to image formation such as a printer, a copy, a fax, and a scanner. The application 41 uses the service module of the service layer 43 using the API 42.

  The service layer 43 interprets the processing request from the application 41 and generates a hardware acquisition request for the engine unit 14 and the like, and manages the hardware to arbitrate the acquisition request.

  The IPC unit 44 is used to exchange data between operating modules (processes). The thread control unit 45 is, for example, a library that controls threads. The OS 46 executes the service modules of the application 41 and the service layer 43 in parallel as processes.

  The cryptographic processing module (DESS) 3 is included in the service layer 43 in the same manner as the network control service (NCS) 51. The NCS 51 distributes data received from the network side by each protocol to each application, and performs mediation when data from each application is transmitted to the network side. For example, the NCS 51 controls communication with a client connected to the multifunction machine 10 via a network. The multifunction machine 10 shown in FIG. 3 can process in common with the service layer 43 the processes commonly required by the application 41.

  FIG. 4 is a functional block diagram of an embodiment of the cryptographic processing module and the cryptographic processing module interface. The cryptographic processing module interface (DESS I / F) 2 includes a command transmission unit 61, a command reception unit 62, a data transmission unit 63, and a data reception unit 64.

  The DESS 3 is configured to include a command reception unit 65, a command transmission unit 66, a data reception unit 67, a data transmission unit 68, a command analysis unit 69, a session management unit 70, a cryptographic engine I / F 71, and a cryptographic engine 4.

  The command transmission unit 61 and the command reception unit 62 of the DESS I / F 2 perform command transmission and response reception with the DESS 3. The data transmission unit 63 and the data reception unit 64 of the DESS I / F 2 perform transmission of data before encryption processing and reception of data after encryption processing with the DESS 3.

  The DESS I / F 2 receives a command and data before encryption processing from each daemon 1 included in the NCS 51, and transmits a response to each daemon 1 and data after encryption processing. For example, each daemon 1 uses the DESS 3 via the DESS I / F 2 based on the request from the application 41.

  The command receiving unit 65 and the command transmitting unit 66 of the DESS 3 perform command reception and response transmission with the DESS I / F 2. The command includes, for example, execution of encryption processing, execution of decryption processing, and selection of a cryptographic engine. The data receiving unit 67 and the data transmitting unit 68 of the DESS 3 receive data before encryption processing and transmit data after encryption processing with the DESS I / F 2.

  The command analyzing unit 69 analyzes the command received by the command receiving unit 65 and performs processing according to the command. The command analysis unit 69 assigns a session and performs processing according to the command using the cryptographic engine I / F 71. The session management unit 70 counts the number of sessions established between each daemon 1 included in the NCS 51, and manages the number of sessions within the range of the number of sessions that can be simultaneously processed.

  The cryptographic engine I / F 71 is a part that absorbs differences between the cryptographic engines 4 due to differences in calling methods when the cryptographic engine 4 is used. The cryptographic engine 4 is a part that performs cryptographic processing on data, such as OpenSSL and BSAFE.

  In addition, although the structure which has the encryption engine 4 inside was shown in DESS3 of FIG. 4, it is good also as a structure which makes the encryption engine 4 an external module and reads the encryption engine 4 from the exterior of DESS3 as needed. For example, the DESS 3 may be configured to download the cryptographic engine 4 from outside the multifunction device 10 as necessary. In this way, if the cryptographic engine 4 is formed as an external module and the cryptographic engine 4 is read from the outside of the DESS 3 as necessary, the capacity of a memory such as a ROM / RAM can be further saved.

  5 and 6 are configuration diagrams of an example of DESS configured to read a cryptographic engine. In the configuration diagram of FIG. 5, DESS 3 reads OpenSSL as an example of encryption engine 4 from the outside. In the configuration diagram of FIG. 6, DESS 3 reads BSAFE from the outside as an example of encryption engine 4.

  In the configuration diagram of FIG. 7, DESS 3 simultaneously reads OpenSSL and BSAFE from the outside as an example of the encryption engine 4. In the configuration diagram of FIG. 8, when the read cryptographic engine 4 becomes unnecessary, OpenSSL as an example of the read cryptographic engine 4 is discarded.

  FIG. 9 is an explanatory diagram for explaining a mechanism in which the cryptographic engine I / F absorbs differences between the cryptographic engines due to differences in calling methods. As shown in FIG. 9, the cryptographic engine I / F 71 provides the following common I / F to the command analysis unit 69 without depending on the cryptographic engine 4. For example, the cryptographic engine I / F 71 provides ENC_Init (), ENC_Update (), and ENC_Final () as a common I / F to the command analysis unit 69.

  When using OpenSSL as the encryption engine 4, the encryption engine I / F 71 converts ENC_Init () received from the command analysis unit 69 into OpenSSL_Init (), and transmits it to the OpenSSL as the encryption engine 4. Also, ENC_Update () received from the command analysis unit 69 is converted to OpenSSL_Update () and transmitted to the OpenSSL as the encryption engine 4. Furthermore, ENC_Final () received from the command analysis unit 69 is converted to OpenSSL_Final () and transmitted to the OpenSSL as the cryptographic engine 4.

  When using BSAFE as the cipher engine 4, the cipher engine I / F 71 converts ENC_Init () received from the command analysis unit 69 into BSAFE_CTX () and BSAFE_Init (), and transmits it to the BSAFE as the cipher engine 4. Also, ENC_Update () received from the command analysis unit 69 is converted into BSAFE_Update () and transmitted to the BSAFE as the cryptographic engine 4. Further, ENC_Final () received from the command analysis unit 69 is converted into BSAFE_Final () and transmitted to the BSAFE as the cryptographic engine 4.

  As described above, the cryptographic engine I / F 71 corresponds to the cryptographic engine 4 based on ENC_Init (), ENC_Update (), and ENC_Final (), which are common I / Fs that are not dependent on the cryptographic engine 4 received from the command analysis unit 69. By calling the I / F, the difference between the cryptographic engines 4 can be absorbed.

  Hereinafter, the processing procedure of DESS I / F and DESS will be described with reference to sequence diagrams. FIG. 10 is a sequence diagram showing an example of the processing procedure of the DESS I / F and DESS. The sequence diagram of FIG. 10 represents an example in which OpenSSL is selected as the cryptographic engine 4.

  In step S1, the DESS I / F 2 is requested to start encryption from httpd as an example of the daemon 1 included in the NCS 51. In step S2, the DESS I / F 2 requests session registration from the session management unit 70 in the DESS 3. In step S3, the DESS I / F 2 is notified from the session management unit 70 of information (for example, a session identifier) of the session registered in the session management unit 70. Here, it is assumed that the session identifier is notified from the session management unit 70. The DESS I / F 2 manages the notified session identifier and httpd as an example of the daemon 1 in association with each other.

  In step S4, the DESS I / F 2 is requested to use OpenSSL as the cryptographic engine 4 from httpd as an example of the daemon 1. In step S5, the DESS I / F 2 requests the command analysis unit 69 to use OpenSSL as the cryptographic engine 4. Note that the above-described session identifier (1) is added to the request from the DESS I / F 2 to the command analysis unit 69. In addition, the above-described session identifier (1) is also added to the requests in steps S6 and S8 to S16 described later. In step S 6, the command analysis unit 69 notifies the cryptographic engine I / F 71 that OpenSSL is used as the cryptographic engine 4.

  In step S7, the DESS I / F 2 is requested to perform cryptographic processing from httpd as an example of the daemon 1. In step S8, the DESS I / F 2 transmits a command ENC_Init (1) to the command analysis unit 69. In step S9, the command analysis unit 69 transmits the received command ENC_Init (1) to the cryptographic engine I / F 71.

  In step S10, the cryptographic engine I / F 71 converts ENC_Init (1), which is a common I / F, into OpenSSL_Init (), and transmits the same to the OpenSSL as the cryptographic engine 4.

  In step S11, the DESS I / F 2 transmits a command ENC_Update (1) to the command analysis unit 69. In step S12, the command analysis unit 69 transmits the received command ENC_Update (1) to the cryptographic engine I / F 71.

  In step S13, the cryptographic engine I / F 71 converts ENC_Update (1), which is a common I / F, into OpenSSL_Update (), and transmits it to the OpenSSL as the cryptographic engine 4.

  In step S14, the DESS I / F 2 transmits a command ENC_Final (1) to the command analysis unit 69. In step S15, the command analysis unit 69 transmits the received command ENC_Final (1) to the cryptographic engine I / F 71.

  In step S16, the cryptographic engine I / F 71 converts ENC_Final (1), which is a common I / F, into OpenSSL_Final (), and transmits it to the OpenSSL as the cryptographic engine 4.

  In step S17, the DESS I / F 2 is requested to end the encryption from httpd as an example of the daemon 1 included in the NCS 51. In step S18, the DESS I / F 2 requests the session management unit 70 in the DESS 3 to delete the session (1). The DESS I / F 2 discards the association between the session identifier requested to be deleted and httpd as an example of the daemon 1.

  As described above, the cryptographic engine I / F 71 calls an I / F corresponding to the cryptographic engine 4 based on ENC_Init (), ENC_Update (), and ENC_Final (), which are common I / Fs that do not depend on the cryptographic engine 4. Thus, the difference between the cryptographic engines 4 can be absorbed.

  FIG. 11 is a sequence diagram showing an example of processing procedures of the DESS I / F and DESS. The sequence diagram of FIG. 11 represents an example in which OpenSSL4-1 and BSAFE4-2 are simultaneously selected as a plurality of cryptographic engines 4. Note that the sequence diagram of FIG. 11 includes the same parts as those in the sequence diagram of FIG.

  In step S21, the DESS I / F 2 is requested to start encryption from httpd as an example of the daemon 1. In step S22, the DESS I / F 2 requests session registration from the session management unit 70 in the DESS 3. In step S23, the DESS I / F 2 notifies the session management unit 70 of the session identifier (1) registered in the session management unit 70.

  In step S24, the DESS I / F 2 is requested to use OpenSSL4-1 as the encryption engine 4 from httpd as an example of the daemon 1. In step S25, the DESS I / F 2 requests the command analysis unit 69 to use OpenSSL4-1 as the cryptographic engine 4. In step S26, the command analysis unit 69 notifies the cryptographic engine I / F 71 that OpenSSL4-1 is used as the cryptographic engine 4.

  In step S27, the DESS I / F 2 is requested to perform encryption processing from httpd as an example of the daemon 1. In step S28, the DESS I / F 2 transmits a command ENC_Init (1) to the command analysis unit 69. In step S29, the command analysis unit 69 transmits the received command ENC_Init (1) to the cryptographic engine I / F 71.

  In step S30, the cryptographic engine I / F 71 converts ENC_Init (1), which is a common I / F, into OpenSSL_Init (), and transmits it as the cryptographic engine 4 to the OpenSSL 4-1.

  In step S31, the DESS I / F 2 is requested to start encryption from httpd as an example of the daemon 1. In step S32, the DESS I / F 2 requests session registration from the session management unit 70 in the DESS 3. In step S33, the DESS I / F 2 notifies the session management unit 70 of the session identifier (2) registered in the session management unit 70.

  In step S 34, the DESS I / F 2 is requested to use BSAFE 4-2 as the cryptographic engine 4 from httpd as an example of the daemon 1. In step S35, the DESS I / F 2 requests the command analysis unit 69 to use the BSAFE4-2 as the encryption engine 4. In step S 36, the command analysis unit 69 notifies the cryptographic engine I / F 71 that the BSAFE 4-2 is used as the cryptographic engine 4.

  In step S37, the DESS I / F 2 transmits a command ENC_Update (1) to the command analysis unit 69. In step S38, the command analysis unit 69 transmits the received command ENC_Update (1) to the cryptographic engine I / F 71. In step S39, the cryptographic engine I / F 71 converts ENC_Update (1), which is a common I / F, into OpenSSL_Update (), and transmits it as the cryptographic engine 4 to the OpenSSL 4-1.

  In step S 40, the DESS I / F 2 transmits a command ENC_Final (1) to the command analysis unit 69. In step S41, the command analysis unit 69 transmits the received command ENC_Final (1) to the cryptographic engine I / F 71.

  In step S42, the cryptographic engine I / F 71 converts ENC_Final (1), which is a common I / F, into OpenSSL_Final () and transmits it as the cryptographic engine 4 to the OpenSSL 4-1.

  In step S43, the DESS I / F 2 is requested to end encryption from httpd as an example of the daemon 1 included in the NCS 51. In step S44, the DESS I / F 2 requests the session management unit 70 in the DESS 3 to delete the session (1).

  In step S45, the DESS I / F 2 is requested to perform encryption processing from httpd as an example of the daemon 1. In step S46, the DESS I / F 2 transmits a command ENC_Init (2) to the command analysis unit 69. In step S47, the command analysis unit 69 transmits the received command ENC_Init (2) to the cryptographic engine I / F 71.

  In steps S48 and S49, the encryption engine I / F 71 converts ENC_Init (2), which is a common I / F, into BSAFE_CTX () and BSAFE_Init () and transmits the converted encryption engine 4 to the BSAFE4-2.

  In step S50, the DESS I / F 2 transmits a command ENC_Update (2) to the command analysis unit 69. In step S51, the command analysis unit 69 transmits the received command ENC_Update (2) to the cryptographic engine I / F 71.

  In step S52, the cryptographic engine I / F 71 converts ENC_Update (2), which is a common I / F, into BSAFE_Update (), and transmits it to the BSAFE4-2 as the cryptographic engine 4.

  In step S 53, the DESS I / F 2 transmits the command ENC_Final (2) to the command analysis unit 69. In step S54, the command analysis unit 69 transmits the received command ENC_Final (2) to the cryptographic engine I / F 71.

  In step S55, the cryptographic engine I / F 71 converts ENC_Final (2), which is a common I / F, into BSAFE_Final (), and transmits it to the BSAFE4-2 as the cryptographic engine 4.

  In step S56, the DESS I / F 2 is requested to end encryption from httpd as an example of the daemon 1 included in the NCS 51. In step S57, the DESS I / F 2 requests the session management unit 70 in the DESS 3 to delete the session (2).

  Thus, even when the encryption engine I / F 71 selects OpenSSL4-1 and BSAFE4-2 as the plurality of encryption engines 4 at the same time, ENC_Init () which is a common I / F independent of the encryption engine 4 , ENC_Update () and ENC_Final (), the difference between the cryptographic engines 4 can be absorbed by calling the I / F corresponding to the cryptographic engine 4.

  FIG. 12 is a sequence diagram showing an example of the processing procedure of DESS I / F and DESS. The sequence diagram of FIG. 12 represents an example in which the cryptographic engine 4 is selected simultaneously from a plurality of daemons. Note that the sequence diagram of FIG. 12 includes the same parts as those of the sequence diagram of FIG.

  In step S61, the DESS I / F 2 is requested to start encryption from httpd1-1 as an example of the daemon 1. In step S62, the DESS I / F 2 requests the session management unit 70 in the DESS 3 for session registration. In step S23, the DESS I / F 2 is notified of the session identifier (1) from the session management unit 70.

  In step S64, the DESS I / F 2 is requested to use OpenSSL as the cryptographic engine 4 from httpd1-1 as an example of the daemon 1. In step S65, the DESS I / F 2 requests the command analysis unit 69 to use OpenSSL as the cryptographic engine 4. In step S66, the command analysis unit 69 notifies the cryptographic engine I / F 71 that OpenSSL is used as the cryptographic engine 4.

  In step S67, the DESS I / F 2 is requested to perform cryptographic processing from httpd1-1 as an example of the daemon 1. In step S68, the DESS I / F 2 transmits a command ENC_Init (1) to the command analysis unit 69. In step S69, the command analysis unit 69 transmits the received command ENC_Init (1) to the cryptographic engine I / F 71.

  In step S70, the cryptographic engine I / F 71 converts ENC_Init (1), which is a common I / F, into OpenSSL_Init (), and transmits it to the OpenSSL as the cryptographic engine 4.

  In step S71, the DESS I / F 2 is requested to start encryption from the ncsd1-2 as an example of the daemon 1. In step S72, the DESS I / F 2 requests the session management unit 70 in the DESS 3 for session registration. In step S73, the DESS I / F 2 notifies the session management unit 70 of the session identifier (2) registered in the session management unit 70.

  In step S74, the DESS I / F 2 is requested to use OpenSSL as the cryptographic engine 4 from the ncsd1-2 as an example of the daemon 1. In step S75, the DESS I / F 2 requests the command analysis unit 69 to use OpenSSL as the encryption engine 4.

  In step S76, the DESS I / F 2 transmits a command ENC_Update (1) to the command analysis unit 69. In step S77, the command analysis unit 69 transmits the received command ENC_Update (1) to the cryptographic engine I / F 71. In step S78, the cryptographic engine I / F 71 converts ENC_Update (1), which is a common I / F, into OpenSSL_Update (), and transmits it to the OpenSSL as the cryptographic engine 4.

  In step S79, the DESS I / F 2 transmits a command ENC_Final (1) to the command analysis unit 69. In step S80, the command analysis unit 69 transmits the received command ENC_Final (1) to the cryptographic engine I / F 71.

  In step S81, the cryptographic engine I / F 71 converts ENC_Final (1), which is a common I / F, into OpenSSL_Final (), and transmits the same to the OpenSSL as the cryptographic engine 4.

  In step S82, the DESS I / F 2 is requested to end encryption from httpd1-1 as an example of the daemon 1 included in the NCS 51. In step S83, the DESS I / F 2 requests the session management unit 70 in the DESS 3 to delete the session (1).

  In step S84, the DESS I / F 2 is requested to perform encryption processing from the ncsd1-2 as an example of the daemon 1. In step S85, the DESS I / F 2 transmits a command ENC_Init (2) to the command analysis unit 69. In step S86, the command analysis unit 69 transmits the received command ENC_Init (2) to the cryptographic engine I / F 71.

  In step S87, the cryptographic engine I / F 71 converts ENC_Init (2), which is a common I / F, into OpenSSL_Init (), and transmits the same to the OpenSSL as the cryptographic engine 4.

  In step S88, the DESS I / F 2 transmits a command ENC_Update (2) to the command analysis unit 69. In step S89, the command analysis unit 69 transmits the received command ENC_Update (2) to the cryptographic engine I / F 71. In step S90, the cryptographic engine I / F 71 converts ENC_Update (2), which is a common I / F, into OpenSSL_Update (), and transmits it to the OpenSSL as the cryptographic engine 4.

  In step S91, the DESS I / F 2 transmits a command ENC_Final (2) to the command analysis unit 69. In step S92, the command analysis unit 69 transmits the received command ENC_Final (2) to the cryptographic engine I / F 71.

  In step S93, the cryptographic engine I / F 71 converts ENC_Final (2), which is a common I / F, into OpenSSL_Final (), and transmits it to the OpenSSL as the cryptographic engine 4.

  In step S94, the DESS I / F 2 is requested to end the encryption from ncsd1-2 as an example of the daemon 1 included in the NCS 51. In step S95, the DESS I / F 2 requests the session management unit 70 in the DESS 3 to delete the session (2).

  As described above, the cryptographic engine I / F 71 is a common I / F that does not depend on the cryptographic engine 4 even when the cryptographic engine 4 is simultaneously selected from httpd1-1 and ncsd1-2 as a plurality of daemons. Differences between the cryptographic engines 4 can be absorbed by calling an I / F corresponding to the cryptographic engine 4 based on ENC_Init (), ENC_Update (), and ENC_Final ().

  FIG. 13 is a sequence diagram showing an example of the processing procedure of DESS I / F and DESS. The sequence diagram of FIG. 13 represents an example in which the cryptographic engine 4 is automatically selected according to the function used. Note that the sequence diagram of FIG. 13 includes the same parts as the sequence diagram of FIG.

  In step S101, the DESS I / F 2 is requested to start SSL from httpd as an example of the daemon 1. In step S102, the DESS I / F 2 requests session registration from the session management unit 70 in the DESS 3. In step S 103, the DESS I / F 2 is notified of the session identifier (1) registered in the session management unit 70 from the session management unit 70.

  In step S104, the DESS I / F 2 requests the command analysis unit 69 to use SSL. In step S105, the command analysis unit 69 notifies the cryptographic engine I / F 71 that the OpenSSL 4-1 as the cryptographic engine 4 is used based on the SSL.

  In step S106, the DESS I / F 2 is requested to perform an SSL process from httpd as an example of the daemon 1. In step S107, the DESS I / F 2 transmits a command ENC_Init (1) to the command analysis unit 69. In step S108, the command analysis unit 69 transmits the received command ENC_Init (1) to the cryptographic engine I / F 71.

  In step S109, the cryptographic engine I / F 71 converts ENC_Init (1), which is a common I / F, into OpenSSL_Init (), and transmits it as the cryptographic engine 4 to the OpenSSL 4-1.

  In step S110, the DESS I / F 2 transmits a command ENC_Update (1) to the command analysis unit 69. In step S111, the command analysis unit 69 transmits the received command ENC_Update (1) to the cryptographic engine I / F 71.

  In step S112, the cryptographic engine I / F 71 converts ENC_Update (1), which is a common I / F, into OpenSSL_Update (), and transmits it as the cryptographic engine 4 to the OpenSSL 4-1.

  In step S113, the DESS I / F 2 transmits a command ENC_Final (1) to the command analysis unit 69. In step S114, the command analysis unit 69 transmits the received command ENC_Final (1) to the cryptographic engine I / F 71.

  In step S115, the cryptographic engine I / F 71 converts ENC_Final (1), which is a common I / F, into OpenSSL_Final () and transmits it as the cryptographic engine 4 to the OpenSSL 4-1.

  In step S116, the DESS I / F 2 is requested to end SSL from httpd as an example of the daemon 1 included in the NCS 51. In step S117, the DESS I / F 2 requests the session management unit 70 in the DESS 3 to delete the session (1).

  In step S118, the DESS I / F 2 is requested to start encryption by httpd as an example of the daemon 1. In step S119, the DESS I / F 2 requests session registration from the session management unit 70 in the DESS 3. In step S120, the DESS I / F 2 notifies the session management unit 70 of the session identifier (2) registered in the session management unit 70.

  In step S121, the DESS I / F 2 requests the command analysis unit 69 to use encryption. In step S122, the command analysis unit 69 notifies the cryptographic engine I / F 71 that the BSAFE4-2 as the cryptographic engine 4 is to be used based on the BSAFE.

  In step S123, the DESS I / F 2 is requested to perform encryption processing from httpd as an example of the daemon 1. In step S124, the DESS I / F 2 transmits a command ENC_Init (2) to the command analysis unit 69. In step S125, the command analysis unit 69 transmits the received command ENC_Init (2) to the cryptographic engine I / F 71.

  Proceeding to steps S126 and S127, the cryptographic engine I / F 71 converts ENC_Init (2), which is a common I / F, into BSAFE_CTX () and BSAFE_Init (), and transmits the converted cryptographic engine 4 to the BSAFE4-2.

  In step S128, the DESS I / F 2 transmits a command ENC_Update (2) to the command analysis unit 69. In step S129, the command analysis unit 69 transmits the received command ENC_Update (2) to the cryptographic engine I / F 71.

  In step S130, the cryptographic engine I / F 71 converts ENC_Update (2), which is a common I / F, into BSAFE_Update (), and transmits it to the BSAFE4-2 as the cryptographic engine 4.

  In step S131, the DESS I / F 2 transmits a command ENC_Final (2) to the command analysis unit 69. In step S132, the command analysis unit 69 transmits the received command ENC_Final (2) to the cryptographic engine I / F 71.

  In step S133, the cryptographic engine I / F 71 converts ENC_Final (2), which is a common I / F, into BSAFE_Final (), and transmits it to the BSAFE4-2 as the cryptographic engine 4.

  In step S134, the DESS I / F 2 is requested to end the encryption from httpd as an example of the daemon 1 included in the NCS 51. In step S135, the DESS I / F 2 requests the session management unit 70 in the DESS 3 to delete the session (2).

  Thus, even when the cryptographic engine I / F 71 automatically selects the cryptographic engine 4 according to the function used, ENC_Init () and ENC_Update (), which are common I / Fs that do not depend on the cryptographic engine 4. And by calling the I / F corresponding to the cryptographic engine 4 based on ENC_Final (), the difference between the cryptographic engines 4 can be absorbed.

  The present invention is not limited to the specifically disclosed embodiments, and various modifications and changes can be made without departing from the scope of the claims.

It is a block diagram for demonstrating the principle of this invention. 1 is a hardware configuration diagram of an embodiment of a multifunction machine according to the present invention. FIG. FIG. 3 is a software configuration diagram of an embodiment of a multifunction machine according to the present invention. It is a functional block diagram of one Example of a cryptographic processing module and a cryptographic processing module interface. It is a block diagram of an example of DESS made into the structure which reads a cryptographic engine. It is a block diagram of an example of DESS made into the structure which reads a cryptographic engine. It is a block diagram of an example of DESS when it is set as the structure which reads a some encryption engine simultaneously. It is a block diagram of an example of DESS which discards the read cryptographic engine when the read cryptographic engine becomes unnecessary. It is explanatory drawing explaining the mechanism in which the encryption engine I / F absorbs the difference of each encryption engine by the difference in the calling method. It is a sequence diagram showing the processing procedure of DESS I / F and DESS. It is a sequence diagram showing the processing procedure of DESS I / F and DESS. It is a sequence diagram showing the processing procedure of DESS I / F and DESS. It is a sequence diagram showing the processing procedure of DESS I / F and DESS.

Explanation of symbols

1 daemon 2 cryptographic processing module interface (DESS I / F)
3 Cryptographic processing module (DESS)
4 Cryptographic engine 10 MFP 11 Controller 12 Operation panel 13 FCU
14 Engine part 21 CPU
22 System memory 23 North Bridge (NB)
24 South Bridge (SB)
25 ASIC
26 Local memory 27 HDD
28 Network Interface Card (NIC)
29 Centronics 30, 32 PCI bus 31 AGP (Accelerated Graphics Port)
41 Application 42 API (Application Program Interface)
43 Service Layer 44 IPC (Interprocess Communication) Unit 45 Thread Control Unit (pthread)
46 OS (Operating System)
51 NCS
61, 66 Command transmission unit 62, 65 Command reception unit 63, 68 Data transmission unit 64, 67 Data reception unit 69 Command analysis unit 70 Session management unit 71 Cryptographic engine I / F

Claims (12)

An information processing apparatus that performs cryptographic processing of data using a cryptographic engine,
One or more application means;
Network control means for distributing data received by each protocol from the network side to the application means, and transmitting data received from the application means to the network side;
Cryptographic processing means for performing cryptographic processing on the data;
Cryptographic processing interface means for transmitting and receiving commands related to cryptographic processing and data to be cryptographically processed between the plurality of other processing means corresponding to the protocol included in the network control means and the cryptographic processing means;
Have
The cryptographic processing means includes
Between said other processing means, and receiving means for the data, transmitted and received through the encryption processing interface unit which is the subject of the command and the encryption processing related cryptographic processing,
A cryptographic engine that performs cryptographic processing on the data;
Cryptographic engine interface means for transmitting and receiving the data between the transmitting / receiving means and the cryptographic engine;
An information processing apparatus comprising: a command analysis unit that analyzes the command and performs a cryptographic process according to the command using the cryptographic engine and a cryptographic engine interface unit.   The information processing apparatus according to claim 1, wherein the cryptographic engine interface unit absorbs a difference due to a difference between the cryptographic engines when the cryptographic engine is used.   2. The information according to claim 1, wherein the command analysis means performs encryption processing, decryption processing execution, and selection of the cryptographic engine in accordance with the command using the cryptographic engine and cryptographic engine interface means. Processing equipment. The cryptographic processing unit further includes a session management unit that counts the number of sessions established between the other processing units and manages the number of sessions so as to be within a range of sessions that can be concurrently processed. The information processing apparatus according to claim 1. Pre Symbol encryption processing unit reads when necessary the encryption engine, the encryption when the engine is no longer needed, the information processing apparatus according to claim 1, wherein the discarding the encryption engine read. The information processing apparatus, a plotter unit and an information processing apparatus according to claim 1 to 5 any one of claims, characterized in that an image processing apparatus having a scanner unit. An information processing apparatus that performs cryptographic processing of data using a cryptographic engine,
One or more application means,
Network control means for distributing data received from the network side according to each protocol to the application means, and transmitting data received from the application means to the network side;
Cryptographic processing means for performing cryptographic processing on the data;
Cryptographic processing interface means for transmitting and receiving commands relating to cryptographic processing and data to be cryptographically processed between a plurality of other processing means corresponding to the protocol included in the network control means and the cryptographic processing means
Function as
The cryptographic processing means includes
Between said other processing means, and receiving means for the data, transmitted and received through the encryption processing interface unit which is the subject of the command and the encryption processing related cryptographic processing,
A cryptographic engine that performs cryptographic processing on the data;
Cryptographic engine interface means for transmitting and receiving the data between the transmitting / receiving means and the cryptographic engine;
Command analysis means for analyzing the command and performing cryptographic processing according to the command using the cryptographic engine and the cryptographic engine interface means;
A cryptographic processing program. 8. The cryptographic processing program according to claim 7, wherein the cryptographic engine interface means absorbs a difference due to a difference between the cryptographic engines when the cryptographic engine is used. 8. The encryption according to claim 7 , wherein the command analysis means performs encryption processing, decryption processing execution, and selection of the encryption engine according to the command using the encryption engine and encryption engine interface means. Processing program. It said encryption processing means counts the number of tensioned session between said other processing means, further have the session management means the number of sessions to be managed to be within a range parallelism possible number of sessions at the same time The encryption processing program according to claim 7 . Pre Symbol encryption processing unit reads when necessary the encryption engine, when said encryption engine is no longer needed, read claim 7, wherein the cryptographic processing program, characterized by discarding the encryption engine. The information processing apparatus, a plotter unit and claims 7 to 11 any one of claims cryptographic processing program is characterized in that an image processing apparatus having a scanner unit.

Images