White Paper - Device Security - Ricoh

1 Device Security White Paper Copyright 2011 Ricoh Americas Corporation. All rights reserved. Page 1 of 92 Visit our Knowledgebase at: 6/2/2011 DDeevviiccee SSeeccuurriittyy WWhhiittee PPaappeerr:: PRODUCT CODE COMPANY Ricoh SAVIN GESTETNER LANIER D086 aficio MP C3001 C9130 MP C3001 MP C3001/ LD630C D087 aficio MP C3501 C9135 MP C3501 MP C3501/ LD635C D088 aficio MP C4501(A) C9145(A) MP C4501(A) MP C4501(A)/ LD645C(A) D089 aficio MP C5501(A) C9155(A) MP C5501(A) MP C5501(A)/ LD655C(A) M075 aficio SP c320dn SP c320dn SP c320dn SP c320dn D094 aficio MP W 3601 3406W D N/a LW 426 D081 aficio MP C6501 C9065 MP C6501 LD365c D082 aficio MP C7501 C9075 MP C7501 LD375c M065 aficio SP C430DN CLP 37DN N/A LP 137CN M066 aficio SP C431DN CLP 42DN N/A LP 142CN M022 aficio MP C300 C 230 MP C300 MP C300/LD130C M024 aficio MP C300 SR C 230SR MP C300SR MP C300SR/LD130 CSR M026 aficio MP C400 C240 MP C400 MP C400/ LD140C M028 aficio MP C400SR C240 SR

2 MP C400SR MP C400SR/LD140 CSR M020 SP 5100DN SP 5100DN N/A SP 5100DN M021 SP 5210DN SP 5210DN N/A SP 5210DN M052 SP 520S SP 520S N/A SP 520S M053 SP 5200f SP 5200f N/A SP 5200f M054 SP 5200SR SP 5200SR N/A SP 5200SR D104 aficio MP C2051 C9120 DSe720 LD620C D106 aficio MP C2551 C9125 DSe725 LD625C Ricoh Company, Ltd. March 23, 2011 Device Security White Paper Page 2 of 92 TABLE OF CONTENTS 1.

3 Internal System Configuration .. 8 11--11 HHaarrddwwaarree CCoonnffiigguurraattiioonn .. 8 1-1-1 MFP .. 8 1-1-2 LP .. 10 11--22 SSooffttwwaarree 12 1-2-1 Shared Service 12 1-2-2 Principal Machine Functions .. 13 11--33 DDaattaa SSeeccuurriittyy .. 15 1-3-1 External I/F .. 15 1-3-2 Protection of Program Data from Illegal Access via an External Device .. 15 11--44 PPrrootteeccttiioonn ooff MMFFPP//LLPP FFiirrmmwwaarree .. 18 1-4-1 Firmware Installation/Update .. 18 1-4-2 Verification of Firmware/Program Validity .. 22 11--55 AAuutthheennttiiccaattiioonn,, AAcccceessss CCoonnttrrooll.

4 23 1-5-1 Authentication .. 23 1-5-2 IC Card Authentication .. 27 1-5-3 Access Control .. 29 11--66 AAddmmiinniissttrraattoorr SSeettttiinnggss .. 30 11--77 DDaattaa PPrrootteeccttiioonn .. 31 1-7-1 Data Erase/Overwrite .. 31 1-7-2 Encryption of Stored Data .. 33 1-7-3 Protection of Address Book Data .. 36 1-7-4 Document Server Documents (MFP models only) .. 37 11--88 JJoobb//AAcccceessss LLooggss .. 39 11--99 CCaappttuurree ((MMFFPP MMooddeellss OOnnllyy)) .. 43 1-9-1 Overview of Capture Operations .. 43 1-9-2 Operations that Generate Captured Images .. 43 Device Security White Paper Page 3 of 92 1-9-3 Capture Settings.

5 45 1-9-4 Security Considerations .. 46 1-9-5 Captured Documents and Log Data .. 46 11--1100 AAddddiittiioonnaall MMeetthhooddss ffoorr IInnccrreeaasseedd SSeeccuurriittyy .. 46 2. Principal Machine Functions .. 47 22--11 CCooppiieerr ((MMFFPP MMooddeellss OOnnllyy)) .. 47 2-1-1 Overview of Copier Operations .. 47 2-1-2 Data Security Considerations .. 47 2-1-3 Protection of Copy Jobs in Progress .. 47 2-1-4 Protection of Document Server Documents .. 47 2-1-5 Protection of Copier/Document Server Features .. 48 2-1-6 Restricting the Available Functions for Each Individual User .. 48 2-1-7 Job/Access Log Data Collection.

6 48 2-1-8 Print Backup .. 48 22--22 PPrriinntteerr .. 50 2-2-1 Overview of Printer Operations .. 50 2-2-2 Data Flow .. 50 2-2-3 Data Security Considerations .. 53 22--33 SSccaannnneerr ((MMFFPP MMooddeellss OOnnllyy)) .. 58 2-3-1 Overview of Scanner Operations .. 58 2-3-2 Data Flow Security Considerations .. 58 2-3-3 Protection of Data when Performing Scanning and Sending Operations .. 59 2-3-4 Protection of Document Server Documents .. 61 2-3-5 Protection of Sending Results and Status Information .. 61 2-3-6 Protection of the Scanner Features Settings .. 62 2-3-7 Data Stored in the Job Log.

7 62 2-3-8 Terminology .. 63 22--44 FFAAXX ((MMFFPP MMooddeellss OOnnllyy)) .. 64 2-4-1 Overview of FAX operations .. 64 Device Security White Paper Page 4 of 92 2-4-2 Data Security Considerations .. 65 2-4-3 Protection of the Journal and Documents in Document Server Storage .. 67 2-4-4 Protection of FAX Transmission Operations .. 67 2-4-5 Protection of FAX Features Settings .. 67 2-4-6 The Extended Security Feature .. 68 2-4-7 Job Log .. 68 2-4-8 Protection of Internet FAX Transmissions using S/MIME .. 68 2-4-9 Preventing FAX Transmission to Unintended Destination(s) .. 69 22--55 NNeettFFiillee ((GGWWWWSS)).

8 70 2-5-1 Overview of NetFile Operations .. 70 2-5-2 Data Flow .. 71 2-5-3 Supplementary .. 71 2-5-4 Data Security Considerations .. 73 22--66 WWeebb AApppplliiccaattiioonnss .. 75 2-6-1 Web Server Framework .. 75 2-6-2 WebDocBox (MFP models only) .. 76 3. Optional 78 33--11 @@RReemmoottee .. 78 3-1-1 Overview of @Remote Operations .. 78 3-1-2 Data Security Considerations .. 78 33--22 TThhee CCooppyy DDaattaa SSeeccuurriittyy FFeeaattuurree .. 79 3-2-1 Overview of Copy Data Security Operations .. 79 3-2-2 Data Flow .. 81 4. Device SDK Applications (DSDK) .. 82 4-1 Overview of 82 4-1-1 Installation.

9 83 4-1-2 Overview of SDK Application Functions .. 85 4-2 Data Flow .. 86 4-2-1 Scanning Functions: Sending Data Over the Network with the Copier and Scanner Device Security White Paper Page 5 of 92 (MFP models only) .. 86 4-2-2 FAX Functions (MFP models only).. 86 4-2-3 Network Functions .. 87 4-2-4 Printer Functions .. 87 4-2-5 Machine Administrative Functions (MFP models only) .. 87 4-2-6 Authentication Functions .. 88 4-3 Data Security Considerations .. 88 4-3-1 Preventing the Installation of Illegal Applications .. 88 4-3-2 Authentication of SDK Applications at Installation .. 89 4-3-3 Prevention of Access to Address Book Data and Machine Management Data.

10 90 4-3-4 Protection Against Attacks on Principal MFP/LP Functions, Prevention of Damage to the System .. 91 4-3-5 Protection Against Attacks from External Sources .. 91 4-3-6 Certification of the SDK Application .. 92 Device Security White Paper Page 6 of 92 OOvveerrvviieeww This document describes the structural layout and functional operations of the hardware and software for the multi-functional products and laser printers listed below (herein referred to as the MFP and LP , respectively), which were designed and developed by Ricoh Co. Ltd. (herein referred to as Ricoh ), as well as the information Security of image data and other information handled internally by Ricoh MFP/LPs.