White Paper - Smart Operation Panel ver. 2 - Ricoh

1 Smart Operation Panel Security White Paper ver. Copyright 2016 Ricoh Americas Corporation. All rights reserved. Page 1 of 53 Visit our Knowledgebase at: 8/10/2016 Technical Information: Smart Operation Panel ver Security White Paper Document Version Smart Operation Panel Security White Paper ver. Page 2 of 53 NOTICE: This document may not be reproduced or distributed in whole or in part, for any purpose or in any fashion without the prior written consent of Ricoh Company limited. Ricoh Company limited retains the sole discretion to grant or deny consent to any person or party. Copyright 2016 by Ricoh Company Ltd. All product names, domain names or product illustrations, including desktop images, used in this document are trademarks, registered trademarks or the property of their respective companies.

2 They are used throughout this book in an informational or editorial fashion only. Ricoh Company, Ltd. Does not grant or intend to grant hereby any right to such trademarks or property to any third parties. The use of any trade name or web site is not intended to convey endorsement or any other affiliation with Ricoh products. The content of this document, and the appearance, features and specifications of Ricoh products are subject to change from time to time without notice. While care has been taken to ensure the accuracy of this information, Ricoh makes no representation or warranties about the accuracy, completeness or adequacy of the information contained herein, and shall not be liable for any errors or omissions in these materials.

3 The only warranties for Ricoh products and services are as set forth in the express warranty statements accompanying them. Nothing herein shall be construed as constituting an additional warranty. Ricoh does not provide legal, accounting or auditing advice, or represent or warrant that our products or services will ensure that you are in compliance with any law. Customer is responsible for making the final selection of solution and technical architectures, and for ensuring its own compliance with various laws such as the Gramm-Leach-Bliley Act, the Sarbanes-Oxley Act and the Health Insurance Portability and Accountability Act (HIPAA). Smart Operation Panel Security White Paper ver. Page 3 of 53 Version History: Version Issue Date Revisions July 26, 2013 Initial release Dec.

4 2015 Revised points 1. Revised some appearance 2. Revised some chapter setting 3. Add the Table 3: Correspondence table for port number between WiFi and main unit system 4. Add the description on the Table 2: Software configuration and countermeasures for Android vulnerabilities July 2016 Target Readers: 1. End users: The information contained in the document can be distributed to end users. Before distributing this document to end users, region specific information including model names must be modified. 2. The regional support and marketing staff of each regional company 3. The support and marketing staff of Ricoh Sales companies including Ricoh family group companies and their subsidiaries.

5 Smart Operation Panel Security White Paper ver. Page 4 of 53 TABLE OF CONTENTS: 1. Introduction .. 7 1. Executive Summary .. 8 2. Hardware Configuration/Software Configuration .. 9 2-1. Hardware Configuration .. 10 2-2. Software 12 3. Data Security for external I/F .. 15 4. Remote Access .. 16 4-1. Network connection functions by SOP .. 16 4-1-1. SOP s functions to use the network .. 17 4-1-2. Wireless LAN specifications .. 17 4-1-3. Main MFP unit network connection specifications .. 17 4-1-4. Wireless Direct connection function .. 18 4-1-5. Connection functions from a wireless terminal to the main MFP unit .. 18 4-2. Bluetooth .. 19 5. Authentication/Access Control .. 19 5-1. Authentication.

6 19 5-1-1. Authentication settings .. 19 5-1-2. Authentication .. 20 5-1-3. Service privilege login .. 21 5-1-4. Remote 21 5-2. Access control .. 22 6. Administrator Settings .. 22 7. Persistent Data on the SOP .. 23 7-1. Persistent data on the SOP .. 23 7-1-1. Security log (job log/access log) .. 23 7-1-2. Other data .. 23 7-2. Using the HDD of the main MFP 24 8. Applications .. 25 Smart Operation Panel Security White Paper ver. Page 5 of 53 8-1. The basic policy of pre-installation applications .. 25 8-2. Quick Copy/Quick Scanner/Quick Fax applications .. 25 8-2-1. Specifications .. 25 8-2-2. Data flow .. 25 8-2-3. Data flow security .. 25 8-2-4. Log .. 25 8-3. Printer/Quick Print Release/Copy/Scanner/Fax applications.

7 26 8-3-1. Functional specifications .. 26 8-3-2. Data flow .. 26 8-3-3. Data flow security .. 26 8-3-4. Log .. 26 8-4. Web browser .. 26 8-4-1. Web browser functions .. 27 8-4-2. Bookmark functions .. 27 8-4-3. History functions .. 27 8-4-4. Web contents print functions .. 27 8-4-5. Functions to view or store PDF files .. 27 8-4-6. Administration 28 8-4-7. Encrypted communication .. 29 8-4-8. Displaying URLs .. 30 8-4-9. Displaying a web site certificate .. 30 8-4-10. Temporarily stored data .. 30 8-4-11. Browser security .. 30 8-5. Print/Scan (Memory Storage Device) .. 30 8-5-1. Specification .. 30 8-5-2. Data flow .. 31 8-5-3. Data flow security .. 31 8-5-4. Log .. 31 8-6. Check Status application.

8 32 Smart Operation Panel Security White Paper ver. Page 6 of 53 8-6-1. Functional specifications .. 32 8-6-2. Data flow .. 32 8-6-3. Data flow security .. 32 8-7. Quick Card Authentication .. 32 8-7-1. Functional specifications .. 32 8-7-2. Data flow .. 32 8-7-3. Data flow security .. 33 8-7-4. Log .. 33 9. Security Policy for Installation/Updates of Installable Applications .. 33 9-1. Installation/Update of Installable Applications .. 33 9-2. Installation/Update from Application Site .. 34 9-2-1. Configuring Application Site .. 34 9-2-2. Installing/updating/deleting applications .. 35 9-2-3. Communication protocols .. 37 9-2-4. Encrypting communication paths .. 38 9-2-5. Using Application Site under a proxy environment.

9 38 10. Data Protection .. 38 10-1. Protection of data within the main unit system .. 38 10-2. Protection of data within the SOP .. 38 11. Security Considerations .. 41 11-1. Protection of user information .. 41 11-2. Countermeasures for Android vulnerabilities .. 41 11-3. Security for the wireless connection when it is enabled .. 42 11-3-1. Security of connection to installable applications .. 42 11-3-2. Connection security to the main unit system .. 42 11-4. Internet access of the application .. 43 12. Term dictionary .. 43 13. Appendix .. 43 Smart Operation Panel Security White Paper ver. Page 7 of 53 1. Introduction Smart Operation Panel is an exciting new technology from Ricoh .

10 The Smart Operation Panel or SOP was designed by listening to our customers / dealers across the globe to provide a new and improved user interface to our MFP s and printers. With the advent of tablets and mobile phones users demand a more intuitive way to use their business technology. Ricoh , as an industry leader in the document solutions industry needed to push the usability envelop and create an entirely new user experience. We came up with the Smart Operation Panel or SOP. Along with this new and innovative user interface, we have a full compatibility mode with our existing technology, Hardware, Software, and applications. We want to ensure a seamless transition from current technology to new technology.