Image forming apparatus, control method, and program

Abstract

To enhance security in an image forming apparatus.SOLUTION: An image forming apparatus including an operation unit for accepting operation from a user, and a main body part that operates on the basis of a request from the operation unit includes a management unit for checking vulnerability of software in the operation unit, and a limitation unit for limiting communication to the operation unit according to an attack risk due to the vulnerability when determined that there is the vulnerability.SELECTED DRAWING: Figure 9

Description

[Technical Field]

[0001] The present invention relates to an image forming apparatus, a control method, and a program. [Background technology]

[0002] There are known image forming apparatuses in which the operation unit and the main body unit are each equipped with a separate operating system (OS) and each operates independently. There are also known techniques for ensuring security in such image forming apparatuses.

[0003] Specifically, in an information processing system having an operation unit that accepts operations from a user and a main unit that operates based on a request from the operation unit, a process for verifying the validity and integrity of firmware required to start up the operation unit is executed based on a request from the main unit. Techniques for ensuring security in this way are known (for example, see Patent Document 1, etc.). Summary of the Invention [Problem to be solved by the invention]

[0004] Conventional techniques have a problem in dealing with security vulnerabilities in software that runs after startup in image forming apparatuses.

[0005] SUMMARY OF THE INVENTION In view of the above problems, an object of the present invention is to strengthen security in an image forming apparatus. [Means for solving the problem]

[0006] In order to solve the above-mentioned problems and achieve the object, an image forming apparatus is an image forming apparatus having an operation unit that receives operations from a user and a main body unit that operates based on a request from the operation unit, a management unit that checks for software vulnerabilities in the operation unit; a restriction unit that restricts communication with the operation unit according to an attack risk due to the vulnerability when the vulnerability is determined to exist; Equipped with. [Effects of the Invention]

[0007] According to the present invention, security in an image forming apparatus can be strengthened. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 illustrates an example of an image forming apparatus. [Figure 2] FIG. 2 is a diagram illustrating an example of communication in an image forming apparatus. [Figure 3] FIG. 10 is a diagram illustrating an example of communication restrictions. [Figure 4] FIG. 10 is a diagram illustrating an example of overall processing. [Figure 5] FIG. 10 illustrates an example of a process for checking vulnerability. [Figure 6] FIG. 10 illustrates an example of a process for restricting communication. [Figure 7] FIG. 10 is a diagram showing an example of a screen display showing a separation mode. [Figure 8] FIG. 10 is a diagram illustrating an example of settings for permitting communication. [Figure 9] FIG. 2 is a diagram illustrating an example of a functional configuration. DETAILED DESCRIPTION OF THE INVENTION

[0009] Specific examples will be described below with reference to the accompanying drawings, but the embodiments are not limited to the specific examples described below.

[0010] [Example of image forming device] 1 is a diagram illustrating an example of an image forming apparatus 200. For example, the image forming apparatus 200 is entirely controlled by a controller 100.

[0011] The controller 100 has a central processing unit (hereinafter referred to as "CPU 101"), an application specific integrated circuit (hereinafter referred to as "ASIC 102"), dynamic random access memory (hereinafter referred to as "DRAM 103"), a solid state drive (hereinafter referred to as "SSD 104"), non-volatile RAM (hereinafter referred to as "NVRAM 105"), an SD card interface (hereinafter referred to as "SD card I / F 107"), a universal serial bus (USB) interface (hereinafter referred to as "USB I / F 106"), and a hard disk drive (hereinafter referred to as "HDD 112"). The controller 100 also has a communication device 113.

[0012] An SD card 109 is attached to the SD card I / F 107. Similarly, a USB memory 108 is attached to the USB I / F 106.

[0013] To the controller 100, for example, an operation device 110 and an engine 111 are connected via a serial interface such as a USB cable.

[0014] The operation device 110 has an input device, such as a touch panel or a keyboard, and an output device, and displays an operation screen and the like, and accepts operations by the user.

[0015] The engine 111 includes, for example, a print engine, a scanner engine, or a FAX engine, and performs processes such as image formation.

[0016] The operation device 110 includes an embedded Multi Media Card (hereinafter referred to as “eMMC 120 ”), an arithmetic and control device 130 , and a storage device 140 .

[0017] The eMMC 120 stores an operating system (OS), firmware, and applications (hereinafter referred to as "apps") of the operation device 110. Similarly, the HDD 112 stores an operating system and firmware of the controller 100.

[0018] The arithmetic and control device 130 is a device that performs arithmetic and control, and is, for example, a CPU or the like.

[0019] The storage device 140 stores data and the like in the processing performed by the arithmetic and control device 130. For example, the storage device 140 is a memory or the like.

[0020] In this way, firmware for the operation device 110 and the controller 100 runs on different operating systems. Therefore, the operation device 110 and the controller 100 are independent devices. For example, the operation device 110 can display an operation screen or accept operations from the user independently of the controller 100.

[0021] The reason why the HDD 112 is mounted on the controller 100 side is that it serves as a data storage for print data and the like, and therefore the HDD 112 is preferably one that has both capacity and fault tolerance.

[0022] On the other hand, since the operation device 110 mainly functions as a user interface, an eMMC 120 with excellent read / write speed is desirable to ensure operability. However, an SSD or eMMC may be installed in the controller 100. Similarly, an SSD or HDD may be installed in the operation device 110.

[0023] The hardware configuration is not limited to the above. For example, the operation device 110 or the controller 100 may include an internal or external arithmetic unit, a control unit, a storage device, an input device, an output device, or an auxiliary device other than those described above. Furthermore, the image forming device 200 may include a pre-processing unit or a post-processing unit.

[0024] The operation device 110 and the controller 100 are connected via, for example, a USB I / F, and communicate with each other based on a communication protocol such as Transmission Control Protocol (TCP, IPv4, IPv6, or the like) or User Datagram Protocol (UDP).

[0025] The communication device 113 performs communication via, for example, a LAN or the like. The communication is performed wirelessly or via a wire. Therefore, the communication device 113 is an integrated circuit (IC) for communication, a connector, and the like.

[0026] [Communication example] 2 is a diagram showing an example of communication in the image forming apparatus 200. For example, in the image forming apparatus 200, the following first to fourth communications are performed between the operation device 110 and the controller 100.

[0027] Software is pre-installed on the operation device 110. The operation device 110 implements an application 201, a framework 202, a kernel 203, and a first operation system 204 by using the software thus installed.

[0028] The applications 201 are various functions that are configured by installing application software, etc. Therefore, the applications 201, that is, the functions that the image forming apparatus 200 can execute, can be changed by installing application software.

[0029] The framework 202 realizes communication using, for example, a communication module.

[0030] The kernel 203 implements, for example, vulnerability management.

[0031] The first operation system 204 is positioned between the application software and the hardware, and provides an interface to the user and the application software, and realizes resource management and the like.

[0032] Similarly, software is pre-installed on the controller 100. The software thus installed enables the controller 100 to implement a service layer 205 and a second operation system 206.

[0033] The first operation system 204 and the second operation system 206 are, for example, open source software (OSS).

[0034] For example, the application 201 realizes the functions of a web server 2021, a scanner 2022, a web browser 2023, and a vulnerability manager 2024.

[0035] The web server 2021 is a function that accepts access from the external device 300 to the operation device 110 via the controller 100.

[0036] The scanner 2022 is a function that instructs the image forming apparatus 200 to perform a scan process.

[0037] The web browser 2023 is a function for accessing the outside, such as the Internet 401 , from the operation device 110 via the controller 100 .

[0038] The vulnerability management unit 2024 is a function for checking vulnerabilities. In order to realize the vulnerability management unit 2024, the operation device 110 performs communication to access the vulnerability management server 400 and the like.

[0039] The vulnerability management server 400 has, for example, a database that indicates vulnerabilities. Specifically, when the vulnerability management server 400 is accessed, it can be checked against the database to see what vulnerabilities have occurred. This check identifies the risk of attack.

[0040] Hereinafter, communication via the web browser 2023 will be referred to as "first communication 11," communication via the web server 2021 as "second communication 12," communication accessing the controller 100 as "third communication 13," and communication via which the controller 100 accesses the outside world as "fourth communication 14."

[0041] It should be noted that the communications are not limited to the first to fourth communications, and other communications may also be performed.

[0042] [Example of communication restrictions] Fig. 3 is a diagram showing an example of communication restrictions. Compared to Fig. 2, Fig. 3 differs in that part of the communication is restricted. The following description will focus on the differences, and redundant explanations will be omitted.

[0043] For example, if it is determined that the first operation system 204 has a vulnerability, communication is restricted as follows according to the attack risk.

[0044] Specifically, if it is determined that the first operation system 204 has a vulnerability, the first communication 11 and the second communication 12 are restricted. By restricting the communication in this manner, the operation device 110 disconnects itself from the network.

[0045] Hereinafter, a mode in which the operation device 110 is isolated from the network in response to an attack risk is referred to as a "isolated mode." On the other hand, a mode in which the operation device 110 is released from isolation from the network is referred to as a "normal mode." There may be three or more modes. In the following example, it is assumed that the operation device 110 switches to the isolated mode when it is determined that there is a vulnerability.

[0046] In the disconnected mode, the kernel 203 blocks the first communication 11, that is, the communication in the web browser 2023 that accesses the Internet 401 or the like from the operation device 110.

[0047] However, communication to a preset access destination may be excluded from the restriction on the first communication 11. Therefore, even in the separated mode, communication to a preset access destination may be permitted.

[0048] In the isolated mode, the kernel 203 blocks the second communication 12, that is, the communication through which the Web server 2021 accesses the operation device 110 from the outside.

[0049] However, in the restriction on the second communication 12, communication accessed from a pre-registered external device 300 (hereinafter referred to as a "registered device") may be exempt from the restriction. Therefore, even in the separated mode, communication with the registered device may be permitted.

[0050] On the other hand, even in the detached mode, the third communication 13 and the fourth communication 14 are permitted. Specifically, the third communication 13, i.e., communication in which the operating device 110 accesses the controller 100, is permitted even in the detached mode. Similarly, the fourth communication 14, i.e., communication in which the external device 300 accesses the controller 100, is permitted even in the detached mode.

[0051] As described above, when it is determined that the software in the operation device 110 has a vulnerability, the operation device 110 transitions to a disconnected mode, that is, communication is restricted by the kernel 203 or the like.

[0052] The operation device 110 has a vulnerability, that is, a high risk of attack due to the vulnerability, and may be attacked from the outside due to the vulnerability. Therefore, in order to deal with attacks on the operation device 110, communication is restricted and the operation device 110 is separated from the network. In this way, attacks such as intrusion into the operation device 110 via the network can be prevented.

[0053] On the other hand, even in the separation mode, communication between the controller 100 and the operation device 110 is permitted. Therefore, even in the separation mode, a user can use basic functions such as copying or scanning using the image forming apparatus 200. In this way, if the configuration allows communication using the basic functions of the image forming apparatus 200 even in the separation mode, it is possible to prevent data transmission and reception from being blocked more than necessary.

[0054] After a countermeasure such as applying a patch to the vulnerability has been taken, the operation device 110 transitions from the isolated mode to the normal mode, and the operation device 110 cancels the isolation of the operation device 110 from the network.

[0055] [Overall processing example] FIG. 4 is a diagram illustrating an example of the overall processing.

[0056] In step S41, the image forming apparatus 200 checks for vulnerability. For example, step S41 is the following process.

[0057] 5 is a diagram showing an example of a process for checking for vulnerabilities. For example, step S41 is executed periodically, such as once a day.

[0058] In step S51, the operation device 110 acquires the version. For example, the version of the web browser 2023 is acquired from the web browser 2023.

[0059] In step S52, the operation device 110 acquires vulnerability information from the vulnerability management server 400.

[0060] In step S53, the operation device 110 determines vulnerability.

[0061] For example, a database indicating versions with vulnerabilities is previously constructed in the vulnerability management server 400. Therefore, the operation device 110 acquires the current version and checks whether the same version exists in the database of the vulnerability management server 400.

[0062] It should be noted that the vulnerability may be determined to exist if the version is not the latest (if the current version is old).

[0063] If the version corresponds to the database of the vulnerability management server 400, it is determined that there is a vulnerability. On the other hand, if the version does not correspond to the database of the vulnerability management server 400, it is determined that there is no vulnerability.

[0064] Furthermore, the database may include not only the presence or absence of vulnerabilities but also vulnerability scores, etc. Based on these scores, it may be further determined whether or not the vulnerability is a high level vulnerability above a certain level.

[0065] Note that vulnerability may be determined based on information other than the version, such as a patch history or the state of various software.

[0066] In step S42, image forming apparatus 200 determines whether or not there is a vulnerability. If it is determined that there is a vulnerability (YES in step S42), image forming apparatus 200 proceeds to step S43. On the other hand, if it is determined that there is no vulnerability (NO in step S42), image forming apparatus 200 ends the entire process.

[0067] If it is determined that there is no vulnerability (NO in step S42), image forming apparatus 200 does not restrict communication in step S43, that is, image forming apparatus 200 maintains the normal mode without switching modes.

[0068] In step S43, the image forming apparatus 200 restricts communication. For example, step S43 is the following process.

[0069] FIG. 6 is a diagram illustrating an example of a process for restricting communication.

[0070] In step S61, the image forming apparatus 200 shifts to the separation mode. Specifically, in the normal mode, the image forming apparatus 200 allows the first communication 11 to the fourth communication 12, as shown in Fig. 2. On the other hand, in the separation mode, the image forming apparatus 200 restricts the first communication 11 and the like, as shown in Fig. 3.

[0071] In addition, during the separation mode, that is, in a state in which communication is restricted, the following processing may be executed.

[0072] In step S62, image forming apparatus 200 determines whether the communication is with a registered apparatus. If it is determined that the communication is with a registered apparatus (YES in step S62), image forming apparatus 200 proceeds to step S63. On the other hand, if it is determined that the communication is not with a registered apparatus (NO in step S62), image forming apparatus 200 proceeds to step S64.

[0073] In step S63, the image forming apparatus 200 permits communication with the registered apparatus.

[0074] In step S64, image forming apparatus 200 determines whether the communication is with controller 100. If it is determined that the communication is with controller 100 (YES in step S64), image forming apparatus 200 proceeds to step S63. On the other hand, if it is determined that the communication is with controller 100 (NO in step S64), image forming apparatus 200 ends the entire process while maintaining the separation mode.

[0075] As described above, even in the separation mode, the image forming apparatus 200 allows communication with the controller 100 and the registration apparatus. On the other hand, the image forming apparatus 200 restricts communication with any apparatus other than the controller 100 and the registration apparatus.

[0076] 7A and 7B are diagrams showing examples of screen displays indicating the separation mode. For example, image forming apparatus 200 notifies the user of the mode by outputting a screen such as display screen 500 shown in FIG. 7A or 7B on the display. The contents of display screen 500 may be notified to an external device or the like via Internet 401.

[0077] The separation mode and the like may be displayed on a screen other than the display screen 500 as an image or as text. The separation mode and the like may also be notified to the user by sound, light, vibration, or notification by e-mail, for example. For example, notification by e-mail is sent using the SMTP protocol. Alternatively, notification to the external device 300 and the like is sent using the TCP / IP protocol.

[0078] [Example of settings to allow communication] 8 is a diagram showing an example of settings for permitting communication. For example, connection destinations for which communication is permitted even in the separated mode are set on a setting screen 510 such as shown below.

[0079] Specifically, on the setting screen 510, if the user inputs "permission details," "connection destination information," and "port number" for four connection destinations, the communication will be permitted even in separation mode.

[0080] "Permission content" is a setting item that allows either "send," "receive," or "send and receive" even in the separate mode.

[0081] "Connection destination information" is a setting item that specifies the connection destination by, for example, an IP address. Note that the connection destination may be specified by a device name, physical address, or the like, other than an IP address. Also, the IP address may be IPv6 instead of IPv4.

[0082] "Port number" is a setting item that specifies the port for which communication is permitted.

[0083] When a connection destination is registered in advance on the setting screen 510 as described above, the registered connection destination becomes a registered device with which communication is permitted even in the separated mode.

[0084] As shown in the setting screen 510, even in communication with a registered device, either transmission or reception may be restricted. Also, as shown in the setting screen 510, even in communication with a registered device, communication may be restricted depending on the port.

[0085] [Example of functional configuration] 9 is a diagram showing an example of a functional configuration. For example, the image forming apparatus 200 has an operation unit 501 and a main body unit 502. The operation unit 501 includes a management unit 200F1 and a restriction unit 200F2.

[0086] The management unit 200F1 performs a management procedure to check for software vulnerabilities in the operation unit 501. For example, the management unit 200F1 is realized by the arithmetic and control device 130 or the like. Note that the management unit 200F1 may also be realized by the CPU 101 or the like.

[0087] If it is determined that there is a vulnerability, the restriction unit 200F2 performs a restriction procedure to restrict communication with the operation unit 501 in accordance with the risk of an attack due to the vulnerability. For example, the restriction unit 200F2 is realized by the arithmetic and control device 130 or the like. Note that the restriction unit 200F2 may also be realized by the CPU 101 or the like.

[0088] With the above configuration, when a user operates the operation unit 501, the main body unit 502 performs operations such as image formation based on a request from the operation unit 501.

[0089] In this way, the operation unit 501 and the main body unit 502 are configured to be able to operate independently using different operating systems, since they are each equipped with a separate operating system.

[0090] If the operation unit 501 has a vulnerability, the operation device 110 can be separated from the main body 502 to restrict communication, so that communication can be restricted to only the operation unit 501. When the vulnerable part is separated from the network, attacks that exploit the vulnerability can be prevented. This allows the security of the image forming apparatus 200 to be strengthened.

[0091] On the other hand, since only the operation unit 501 and the network are separated, communication using the basic functions of the image forming apparatus 200 can be permitted. In this way, it is possible to prevent data transmission and reception from being blocked more than necessary.

[0092] [Other embodiments] Note that communication restrictions may vary depending on the type of attack risk. For example, there are cases where the vulnerability is not related to communication. In such cases, restricting communication often does not significantly reduce the risk of attack. Therefore, in cases where the vulnerability is not related to communication, communication may not be restricted. In this way, restricting communication depending on the attack risk can prevent situations where communication is restricted even when the attack risk is low.

[0093] The above control method may be realized by a program, that is, the above control method may be executed by an information processing device having a computing device and a storage device that operate in cooperation with each other based on the program.

[0094] The control method may be executed by an information processing system. Therefore, the information processing system may process or store the process related to the control method in a distributed, parallel, or redundant manner.

[0095] For example, aspects of the present invention are as follows.

[0096] <1> An image forming apparatus having an operation unit that receives operations from a user and a main body unit that operates based on a request from the operation unit, a management unit that checks for software vulnerabilities in the operation unit; a restriction unit that restricts communication with the operation unit according to an attack risk due to the vulnerability when the vulnerability is determined to exist; The image forming apparatus includes:

[0097] <2> The management unit Check the operating system installed in the operation unit the above <1> 2. The image forming apparatus according to claim 1, wherein:

[0098] <3> The limiting portion is When the attack risk occurs in the operating system, the operation unit is disconnected from the network. the above <2> 2. The image forming apparatus according to claim 1, wherein:

[0099] <4> The limiting portion is When the risk of attack occurring in the operating system is resolved, the disconnection of the operation unit from the network is canceled. the above <3> 2. The image forming apparatus according to claim 1, wherein:

[0100] <5> The limiting portion is When the risk of attack occurs in the operating system, the operating unit is switched to a disconnection mode in which the operating unit is disconnected from the network; In the separation mode, communication between the controller mounted on the main body and the operation unit is permitted, and communication with other units than the controller is blocked. the above <2> ~ <4> The image forming apparatus according to any one of the above aspects is provided.

[0101] <6> The limiting portion is When the risk of attack occurs in the operating system, the operating unit is switched to a disconnection mode in which the operating unit is disconnected from the network; In the separation mode, communication between a pre-registered registered device and the operation unit is permitted, and communication with devices other than the registered device is blocked. the above <2> ~ <4> The image forming apparatus according to any one of the above aspects is provided.

[0102] <7> The limiting portion is When the risk of attack occurs in the operating system, the operating unit is switched to a disconnection mode in which the operating unit is disconnected from the network; The screen will display that you are in separation mode. the above <2> ~ <4> The image forming apparatus according to any one of the above aspects is provided.

[0103] <8> The operation unit and the main body unit include: It operates independently under different operating systems, The management unit Checking for vulnerabilities using the operating system version the above <1> ~ <7> 10. The image forming apparatus according to claim 9, wherein the first and second electrodes are arranged parallel to each other.

[0104] The present invention is not limited to the above-described exemplary embodiments. Therefore, the present invention may be modified or added to without departing from the technical gist of the present invention. Therefore, all technical matters included in the technical concept described in the claims are subject to the present invention. The above-described exemplary embodiments are preferred examples. Those skilled in the art will be able to realize various modifications from the disclosed content, and such modifications are included in the technical scope described in the claims. [Explanation of symbols]

[0105] 11: First Communication 12: Second Communication 13: Third Communication 14: 4th Communication 100: Controller 110: Operating device 200: Image forming device 200F1: Management Department 200F2: Restricted section 201: Application 202: Framework 203: Kernel 204: First Operation System 205: Service Layer 206: Second operating system 300: External device 400: Vulnerability Management Server 401: Internet 500:Display screen 501:Operation unit 502: Main body 510: Settings screen [Prior art documents] [Patent documents]

[0106] [Patent Document 1] Japanese Patent Application Laid-Open No. 2014-238709

Claims

1. An image forming apparatus having an operation unit that receives operations from a user and a main body unit that operates based on a request from the operation unit, a management unit that checks for software vulnerabilities in the operation unit; a restriction unit that restricts communication with the operation unit according to an attack risk due to the vulnerability when the vulnerability is determined to exist; An image forming apparatus comprising:

2. The management unit Check the operating system installed in the operation unit The image forming apparatus according to claim 1 .

3. The limiting portion is When the attack risk occurs in the operating system, the operation unit is disconnected from the network. The image forming apparatus according to claim 2 .

4. The limiting portion is When the risk of attack occurring in the operating system is resolved, the disconnection of the operation unit from the network is canceled. The image forming apparatus according to claim 3 .

5. The limiting portion is When the risk of attack occurs in the operating system, the operating unit is switched to a disconnection mode in which the operating unit is disconnected from the network; In the separation mode, communication between the controller mounted on the main body and the operation unit is permitted, and communication with other units than the controller is blocked. The image forming apparatus according to claim 2 .

6. The limiting portion is When the risk of attack occurs in the operating system, the operating unit is switched to a disconnection mode in which the operating unit is disconnected from the network; In the separation mode, communication between a pre-registered registered device and the operation unit is permitted, and communication with devices other than the registered device is blocked. The image forming apparatus according to claim 2 .

7. The limiting portion is When the risk of attack occurs in the operating system, the operating unit is switched to a disconnection mode in which the operating unit is disconnected from the network; The screen will display that you are in separation mode. The image forming apparatus according to claim 2 .

8. The operation unit and the main body unit include: It operates independently under different operating systems, The management unit Checking for vulnerabilities using the operating system version The image forming apparatus according to claim 1 .

9. 1. A control method performed by an image forming apparatus having an operation unit that accepts operations from a user and a main body unit that operates based on a request from the operation unit, comprising: a management procedure for checking software vulnerabilities in the operation unit; If it is determined that the vulnerability exists, a restriction procedure is performed to restrict communication with the operation unit in accordance with the risk of an attack due to the vulnerability. A control method comprising:

10. A program for executing a control method performed by an image forming apparatus having an operation unit that accepts operations from a user and a main body unit that operates based on a request from the operation unit, a management procedure for checking software vulnerabilities in the operation unit; If it is determined that the vulnerability exists, a restriction procedure is performed to restrict communication with the operation unit in accordance with the risk of an attack due to the vulnerability. A program to execute.

Images