Specifications

Print Controller Design Guide for Information Security:
Page 89 of 92
SDK Authentication (Types 1 and 2)
• Once the development of the SDK application has been completed, and Ricoh has authorized its
installation on the MFP/LP model(s) in question, Ricoh provides the Vendor with: 1) a file containing
the unique product ID mentioned above in its raw form, and 2) a “key file,” which contains two hash
values generated from the product ID and SDK application object code, which are then embedded
inside randomly-generated data. The locations of these hash values inside the key file are not
disclosed to the Vendor.
• Using a special tool, Ricoh generates a unique key file for every SDK application that is approved.
Among the entire group of specialists at Ricoh engaged in SDK application-related activities, only a
select number of engineers have been granted the access rights to use and manage this special
tool.
• When the SD card is inserted in the MFP/LP slot, the SAS reads the raw form of the product ID
contained in the product ID file, as well as the hash value for the ID contained in the key file. The
SAS then applies a unique hash function to the raw form of the product ID, and compares the
resulting value with the hash value read from the key file.
• If these two values match, the SAS then reads the raw form of the SDK application object code
stored in the SD card, as well as the hash value for the code contained in the key file. The SAS
applies a unique hash function to the entire code, and then compares the resulting value with the
hash value read from the keyfile. If these two values match, the name of the SDK application
appears on the installation screen and the application can be installed on the MFP/LP.
• As demonstrated above, it is not possible to install an SDK application on the MFP/LP unless both
of the following conditions have been satisfied:
 The SD card contains the key file and raw form of the product ID provided by Ricoh, as well as the
raw form of the application object code developed by the Vendor, AND
 The two hash values generated by the MFP/LP for the product ID and application object code
match those contained in the key file on the SD card.
Digital Authentication (Type 2 only)
• For Type 2 applications, Ricoh embeds a digital signature inside the JAR files received from the
Vendor, assigns an appropriate access level, and then returns the files to the Vendor. This allows
the MFP/LP to authenticate the application as well as restrict its operations once installed.