External network access control method and device, image forming apparatus, and storage medium

Abstract

The application provides an external network access control method and device, an image forming device and a storage medium. The method comprises: acquiring connection information between the image forming device and a preset external network server; a trusted computing supervision module determines whether the connection state between the image forming device and the preset external network server is in a preset abnormal connection state according to the connection information; the trusted computing supervision module is included in the image forming device; when the connection state between the image forming device and the preset external network server is in the preset abnormal connection state, the image forming device is controlled to prohibit access to the preset external network server; the connection state between the image forming device and the external network server is determined by the trusted computing supervision module, so as to determine whether the external network server is trusted, thereby effectively avoiding the problem of leakage of confidential data in the image forming device caused by the external server being mistakenly considered as trusted due to a false server address.

Description

Technical Field

[0001] This application relates to the field of image forming technology, and in particular to an external network access control method, apparatus, image forming apparatus, and storage medium. Background Technology

[0002] With the continuous development of the internet, it has become an indispensable tool for people's daily life and work. People's dependence on the internet is becoming increasingly serious. Internet hackers and computer viruses often pose a great threat to the network security of enterprises and people's lives. Image forming devices are vulnerable to hacker attacks. For example, laser printers with scanning and / or faxing functions may carry users' confidential data in the scanned or faxed data.

[0003] Therefore, printer security management is necessary. Existing technologies determine whether the external server accessed by the printer is trustworthy by comparing the server's domain name or IP address, and then take appropriate measures.

[0004] However, if fake server domain names and IP addresses exist in the network environment, using the method of comparing server domain names or IP addresses to determine whether the server accessed by the printer is a trustworthy server may lead to misjudgment, mistakenly assuming that the external server is trustworthy, thereby resulting in data leakage. Summary of the Invention

[0005] This application provides an external network access control method, apparatus, image forming apparatus, and storage medium to solve the problem that existing methods are prone to misjudgment when determining whether an external server accessed by a printer is trustworthy, thereby causing leakage of confidential data in the image forming apparatus.

[0006] Firstly, this application provides an external network access control method, including:

[0007] Obtain connection information between the image forming apparatus and a preset external network server;

[0008] The trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the connection information; the trusted computing monitoring module is included in the image forming device.

[0009] When the connection between the image forming apparatus and the preset external network server is in a preset abnormal connection state, the image forming apparatus is controlled to prohibit access to the preset external network server.

[0010] Optionally, the connection information includes a response request from a preset external network server, and the connection information between the image forming apparatus and the preset external network server is obtained, including:

[0011] Initiate a connection request to a preset external network server;

[0012] Receive response requests from a pre-defined external network server.

[0013] Optionally, a connection request is initiated to a preset external network server, including:

[0014] Obtain the preset external network server address;

[0015] Initiate multiple connection requests to the preset external network server based on the preset external network server address.

[0016] Optionally, the trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the connection information, including:

[0017] The trusted computing monitoring module obtains the number of responses corresponding to response requests from a preset external network server within a preset time period;

[0018] The trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the number of responses corresponding to the response request and the preset number of responses.

[0019] Optionally, the trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the number of responses corresponding to the response request and the preset number of responses, including:

[0020] If the number of responses is greater than or equal to the preset number of responses, it is determined that the connection between the image forming apparatus and the preset external network server is in an abnormal connection state.

[0021] If the number of responses is less than the preset number of responses, it is determined that the connection status between the image forming apparatus and the preset external network server is not in the preset abnormal connection status.

[0022] Optionally, the trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the connection information, including:

[0023] The trusted computing monitoring module acquires data traffic related to connection information within a preset time period;

[0024] The trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the data traffic and preset data traffic.

[0025] Optionally, the trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the data traffic and preset data traffic, including:

[0026] If the data traffic is greater than or equal to the preset data traffic, it is determined that the connection between the image forming apparatus and the preset external network server is in an abnormal connection state.

[0027] If the data traffic is less than the preset data traffic, it is determined that the connection between the image forming apparatus and the preset external network server is not in an abnormal connection state.

[0028] Optionally, the trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the connection information, including:

[0029] The trusted computing monitoring module determines whether the connection information contains sensitive data.

[0030] When the connection information contains sensitive data, it is determined that the connection between the image forming apparatus and the preset external network server is in an abnormal connection state.

[0031] Optionally, the image forming apparatus is controlled to prevent access to a preset external network server, including:

[0032] Disconnect the network connection service corresponding to the image forming apparatus so that the image forming apparatus cannot access the preset external network server.

[0033] Optionally, the method further includes:

[0034] When the connection between the image forming apparatus and the preset external network server is determined to be in a preset abnormal connection state, an external network access prompt message is issued.

[0035] Optionally, after issuing the external network access notification message, the message may also include:

[0036] Generate and store external network alarm logs.

[0037] Secondly, this application provides an external network access control device, comprising:

[0038] The acquisition module is configured to acquire connection information between the image forming apparatus and a preset external network server;

[0039] The trusted computing monitoring module is configured to determine whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the connection information, wherein the trusted computing monitoring module is included in the image forming device.

[0040] The control module controls the image forming apparatus to prohibit access to the preset external network server when the connection between the image forming apparatus and the preset external network server is in a preset abnormal connection state.

[0041] Optionally, the acquisition module includes:

[0042] The sending unit is configured to initiate a connection request to a preset external network server;

[0043] The receiving unit is configured to receive response requests from a preset external network server.

[0044] Optionally, the sending unit is configured to obtain a preset external network server address and initiate multiple connection requests to a preset external network device based on the preset external network server address.

[0045] Optionally, the trusted computing monitoring module is configured to obtain the number of responses corresponding to response requests from a preset external network server within a preset time period; and determine whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the number of responses corresponding to the response requests and the preset number of responses.

[0046] Optionally, the trusted computing monitoring module is configured to acquire data traffic of connection information within a preset time period; the trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the data traffic and the preset data traffic.

[0047] Optionally, the trusted computing monitoring module is configured to determine that the connection between the image forming apparatus and a preset external network server is not in an abnormal connection state if the connection information contains sensitive data.

[0048] Optionally, the control module is configured to disconnect the network connection service corresponding to the image forming apparatus when the connection status between the image forming apparatus and the preset external network server is in a preset abnormal connection state, so that the image forming apparatus cannot access the preset external network server.

[0049] Optionally, the control module is also configured to issue an external network access prompt when it determines that the connection between the image forming apparatus and the preset external network server is in a preset abnormal connection state.

[0050] Thirdly, embodiments of the present invention provide an image forming apparatus, including: a processor, a memory, and a transceiver;

[0051] Interconnection of processor, memory, and transceiver circuits;

[0052] A transceiver is used to send and receive data and requests.

[0053] The memory stores instructions that the computer executes;

[0054] The processor executes computer execution instructions stored in memory, causing the processor to perform the method as described in the first aspect.

[0055] Fourthly, the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method as described in the first aspect.

[0056] Fifthly, the present invention provides a computer program product, including a computer program that, when executed by a processor, implements the method of the first aspect.

[0057] This application provides an external network access control method, apparatus, image forming apparatus, and storage medium. It obtains connection information between the image forming apparatus and a preset external network server. A trusted computing monitoring module determines whether the connection status between the image forming apparatus and the preset external network server is in a preset abnormal connection state based on the connection information. The trusted computing monitoring module is included in the image forming apparatus. When the connection status between the image forming apparatus and the preset external network server is in a preset abnormal connection state, the image forming apparatus is controlled to prohibit access to the preset external network server. By determining the connection status between the image forming apparatus and the external network server through the trusted computing monitoring module, the trustworthiness of the external network server is determined. This effectively avoids the problem of data leakage caused by the image forming apparatus connecting to the external server and then sending confidential data stored in the image forming apparatus outward due to the false server address leading to the external server being mistakenly considered trustworthy. Attached Figure Description

[0058] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0059] Figure 1 This is a schematic diagram of the network architecture of the external network access control method provided by the present invention;

[0060] Figure 2 This is a flowchart illustrating the external network access control method provided in Embodiment 1 of the present invention;

[0061] Figure 3 This is a flowchart illustrating the external network access control method provided in Embodiment 2 of the present invention;

[0062] Figure 4 This is a flowchart illustrating the external network access control method provided in Embodiment 3 of the present invention;

[0063] Figure 5This is a flowchart illustrating the external network access control method provided in Embodiment 4 of the present invention;

[0064] Figure 6 This is a flowchart illustrating the external network access control method provided in Embodiment 5 of the present invention;

[0065] Figure 7 This is a flowchart illustrating the external network access control method provided in Embodiment Six of the present invention.

[0066] Figure 8 This is a schematic diagram of the external network access control device provided in an embodiment of the present invention;

[0067] Figure 9 It is an image forming apparatus used to implement the external network access control method of the embodiments of the present invention.

[0068] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0069] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0070] With the continuous development of the internet, it has become an indispensable tool in people's daily lives and work. People's reliance on the internet is increasing, and network hackers and computer viruses frequently pose a significant threat to the network security of businesses and individuals. Image forming devices are vulnerable to hacker attacks; for example, laser printers with scanning and / or faxing functions may carry confidential user data in scanned or faxed files. Once this data is leaked, it can cause users a lot of unnecessary trouble. Therefore, printer security management is necessary. Current technology determines whether an external server accessed by the printer is trustworthy by comparing the server's domain name or IP address. However, if fake server domain names and IP addresses exist in the network environment, using this method to determine the trustworthiness of the external server accessed by the printer may lead to misjudgment, mistakenly assuming the external server is trustworthy, thus resulting in data leakage.

[0071] Therefore, addressing the issue of misjudgment in existing technologies when determining whether a printer might be vulnerable to external network attacks, the inventors discovered that a trusted computing monitoring module in the image forming apparatus, upon determining from a response request that the connection information between the image forming apparatus and a preset external network server is in a preset abnormal connection state, prohibits the image forming apparatus from accessing the preset external network server. By using the trusted computing monitoring module to determine the connection status between the image forming apparatus and the external network server, and thus whether the external network server is trustworthy, this effectively avoids the problem of data leakage caused by the image forming apparatus connecting to an external server and mistakenly being considered trustworthy due to a fake server address, which could lead to the externalizing of confidential data stored in the image forming apparatus.

[0072] Therefore, based on the above-mentioned inventive discovery, the inventors proposed the technical solution of the embodiments of the present invention. The network architecture and application scenarios of the external network access control method provided by the embodiments of the present invention will be introduced below.

[0073] like Figure 1 As shown, the network architecture corresponding to the external network access control method provided in this embodiment of the invention includes: an image forming apparatus 1A and an external network server, wherein the image forming apparatus includes a trusted computing monitoring module. The image forming apparatus 1A initiates a connection request to a preset external network server 2A; receives a response request from the preset external network server 2A; the trusted computing monitoring module of the image forming apparatus 1A determines, based on the response request, whether the connection status between the image forming apparatus 1A and the external network server 2A is in a preset abnormal connection state; if so, it prohibits the image forming apparatus from accessing the preset external network server. By determining whether the connection status between the image forming apparatus and the external network server is in an abnormal connection state, and if the connection status is in a preset abnormal connection state, the preset external network server is prohibited from accessing the image forming apparatus. The trusted computing monitoring module determines the connection status between the image forming apparatus and the external network server, thereby determining whether the external network server is trustworthy. This effectively avoids the problem of data leakage caused by the image forming apparatus connecting to the external server and then sending confidential data stored in the image forming apparatus outward due to the external server being mistakenly considered trustworthy because of a fake server address.

[0074] The technical solutions of the present invention and how they solve the above-mentioned technical problems will be described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. Unless otherwise specified, the external network access control method provided in the following embodiments can be executed by an external network access control device installed in an image forming apparatus, an application program installed in an image forming apparatus, or a trusted monitoring module installed in an image forming apparatus. The embodiments of the present invention will now be described with reference to the accompanying drawings.

[0075] Example 1

[0076] Figure 2 This is a flowchart illustrating the external network access control method provided in Embodiment 1 of the present invention, as follows: Figure 2 As shown, the external network access control method provided in this embodiment includes the following steps:

[0077] Step 1: Obtain connection information between the image forming apparatus and a preset external network server;

[0078] Step 2: The trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the connection information.

[0079] Step 3: When the connection between the image forming apparatus and the preset external network server is in a preset abnormal connection state, control the image forming apparatus to prohibit access to the preset external network server.

[0080] In this embodiment, the Trusted Computing (TC) in the Trusted Computing Supervision Module is designed for behavioral security and is widely used in computer and communication systems to improve overall system security. Information security includes four aspects: device security, data security, content security, and behavioral security. To further enhance the behavioral security characteristics of the image forming apparatus, this embodiment introduces a Trusted Computing function. The Trusted Computing Supervision Module mentioned in this embodiment may include, but is not limited to, the following functions: program (or module) startup / run monitoring function (e.g., whitelist policy), registration function, access control function, malicious code protection function, self-protection function, terminal upgrade function, auditing function, monitoring function, etc. The specific implementation of the Trusted Computing Supervision Module 30 can be hardware (e.g., a security chip), software (e.g., program code with the above functions), or a combination of hardware and software (e.g., a security chip combined with security code). Taking the program code implementation as an example: the trusted computing monitoring module includes a driver-layer monitoring program and an application-layer monitoring program; the driver-layer monitoring program is responsible for monitoring the driver-layer module of the image forming device's operating system (e.g., Linux system), and the application-layer monitoring program is responsible for monitoring the application-layer programs of the image forming device. The trusted computing monitoring program only allows the execution of drivers and programs within the whitelist; drivers and programs outside the whitelist are not allowed to run; the trusted computing monitoring program records or reports security events that occur on the image forming device; in this way, the trusted computing monitoring program provides comprehensive monitoring of the driver layer and application layer of the image forming device, which can effectively prevent unsafe behaviors of application programs and device drivers.

[0081] The image forming apparatus includes a system-on-a-chip (SOC) and a trusted computing monitoring module. The SOC is connected to the trusted computing monitoring module. The SOC receives connection information between the image forming apparatus and a preset external network server and feeds it back to the trusted monitoring module. This connection information includes connection requests and response requests. This connection information can be actively acquired by the SOC or passively received, and it is used to characterize the connection status between the image forming apparatus and the preset external network server. The trusted computing monitoring module determines whether the connection status between the image forming apparatus and the preset external network server is in a preset abnormal connection state based on the connection information. When the image forming apparatus and the preset external network server maintain a communication connection for a long time or conduct data exchange with a large data volume, it can be considered that there is a possibility of confidential data being sent out. When the trusted computing monitoring module determines that it is in a preset abnormal connection state, it controls the image forming apparatus to prohibit access to the preset external network server. The step of controlling access prohibition can be executed by the trusted computing monitoring module or by the SOC; it is not limited here. Furthermore, when it is determined that the connection status is in a preset abnormal connection state, the image forming apparatus outputs an external network access prompt message to notify the user. Furthermore, after issuing an external network access notification, an external network alarm log is generated and stored.

[0082] Determining whether the image forming apparatus is in a pre-defined abnormal connection state based on the connection information between it and a pre-set external network server can prevent the theft and leakage of confidential data due to abnormal connection status. Since the trusted computing monitoring module itself is verified and trustworthy, its determination of the trustworthiness of the external server to which the image forming apparatus intends to connect effectively prevents external servers from being mistakenly identified as trustworthy due to fake server addresses, further enhancing the security of the image forming apparatus. Furthermore, issuing external network access alerts can inform users of network connection anomalies and generate and store external network alarm logs, facilitating user investigation of potential anomalies.

[0083] Example 2

[0084] Figure 3 This is a flowchart illustrating the external network access control method provided in Embodiment 2 of the present invention, as follows: Figure 3 As shown, based on the external network access control method provided in Embodiment 1 of the present invention, step 1 has been further refined, including the following steps:

[0085] Step 101: Initiate a connection request to a preset external network server.

[0086] In this embodiment, the image forming apparatus incorporates a trusted computing monitoring module and a system-level SOC. The trusted computing monitoring module is connected to the SOC, and the image forming apparatus stores the address information of a preset external network server, which may be a resident public network server. In one implementation, when the image forming apparatus is connected to a power supply, the trusted computing monitoring module is activated, trusted services are enabled, and the address information of the preset external network server stored in the image forming apparatus is obtained. In another implementation, the system-level SOC initiates a connection request to the preset external network server based on its access address. Further, the access address information of the preset external network server may be stored in the trusted computing monitoring module or in other storage units within the image forming apparatus; this is not limited here.

[0087] Step 102: Receive the response request from the preset external network server.

[0088] In this embodiment, the system-level SOC receives a response request from a preset network server. This response request is sent back by a preset external network device after receiving a connection request. It should be noted that the image forming apparatus is equipped with a network interface card (NIC) for communication with the external network server.

[0089] In this embodiment, a request is sent to the corresponding preset external network server based on the preset external network server address. If the external network server responds to the request, it is assumed that the image forming apparatus has an interactive external network environment. In this case, there is a possibility of confidential data being leaked, so the image forming apparatus is controlled to prohibit access to the preset external network server. This prevents the leakage of confidential data from the source.

[0090] Example 3

[0091] Figure 4 This is a flowchart illustrating the external network access control method provided in Embodiment 3 of the present invention, as follows: Figure 4 As shown, based on the external network access control method provided in Embodiment 2 of the present invention, step 101 has been further refined, including the following steps:

[0092] Step 1011: Obtain the preset external network server address;

[0093] In one implementation of this embodiment, the preset external network server address can be directly stored in the system-level SOC of the image forming apparatus, or in other storage units built into the image forming apparatus, or in the trusted computing monitoring module built into the image forming apparatus. In another implementation, the preset external network server address can be directly received by the user through the operation panel of the image forming apparatus. Of course, the preset external network server address can also be obtained through communication with computer devices connected to the image forming apparatus. These computer devices can be configured with the driver program corresponding to the image forming apparatus, or a browser program used to browse the webpage user interface of the image forming apparatus, which is not limited here.

[0094] Step 1012: Initiate multiple connection requests to the preset external network server corresponding to the image forming apparatus according to the preset external network server address.

[0095] In this embodiment, multiple connection requests are sent to the corresponding preset external network server based on the preset external network server address, and the preset external network device sends a response request after receiving the connection request. This avoids the problem of inaccurate connection status judgment caused by packet loss during data transmission.

[0096] Example 4

[0097] Figure 5 This is a flowchart illustrating the external network access control method provided in Embodiment 4 of the present invention, as follows: Figure 5 As shown, based on the external network access control method provided in Embodiment 3 of the present invention, step 2 has been further refined, including the following steps:

[0098] Step 201a: The trusted computing monitoring module obtains the number of responses corresponding to the response requests fed back by a preset external network server within a preset time period;

[0099] Step 202b: The trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the number of responses corresponding to the response request and the preset number of responses.

[0100] Specifically, after obtaining the address of a preset external network server, the system-level SOC initiates multiple connection requests to the corresponding preset external network server. Upon receiving response requests from the preset external network server, it forwards them to the trusted computing monitoring module. The trusted computing monitoring module compares the number of responses to the response requests within a preset time period with a preset number of responses. If the number of responses is greater than or equal to the preset number of responses, it determines that the connection between the image forming apparatus and the preset external network server is in an abnormal connection state. In this case, it is considered that the image forming apparatus and the preset external network server have maintained a communication connection for a long time, or that the external network server has made too many information requests, which may indicate that the server is maliciously obtaining confidential data from within the device, suggesting a potential data leak. Therefore, the image forming apparatus is controlled to prohibit access to the preset external network server to prevent data leakage. If the number of responses is less than the preset number of responses, it determines that the connection between the image forming apparatus and the preset external network server is not in an abnormal connection state, and it continues to initiate connection requests to the external network server to monitor the external network environment of the image forming apparatus.

[0101] Example 5

[0102] Figure 6 This is a flowchart illustrating the external network access control method provided in Embodiment 5 of the present invention, as follows: Figure 6 As shown, based on the external network access control method provided in Embodiment 1 of the present invention, step 2 has been further refined, including the following steps:

[0103] Step 201b: The trusted computing monitoring module acquires the data traffic of connection information within a preset time period;

[0104] Step 202b: The trusted computing monitoring module determines whether the connection status between the image forming apparatus and the preset external network server is in a preset abnormal connection state based on the data traffic and preset data traffic. Specifically, after obtaining the address of the external network server, the system-level SOC initiates multiple connection requests to the corresponding preset external network server. After receiving the response requests from the preset external network server, it forwards them to the trusted computing monitoring module. The trusted computing monitoring module compares the data traffic of the connection information within a preset time with the preset data traffic. The preset data traffic can be set to send 128KB of data per second, or it can be set according to actual conditions; no further restrictions are imposed here. When the data traffic is greater than or equal to the preset data traffic, it is considered that the information transmitted by the server to the image forming apparatus may contain malicious requests to obtain the device's confidential data, or the information transmitted by the image forming apparatus to the server may contain confidential data. At this time, the connection status between the image forming apparatus and the preset external network server is considered to be an abnormal connection state, and therefore the image forming apparatus is controlled to prohibit access to the preset external network server. By monitoring the connection information traffic between the image forming apparatus and the preset external network server, confidential data is prevented from being leaked.

[0105] Example 6

[0106] Figure 7 This is a flowchart illustrating the external network access control method provided in Embodiment Six of the present invention. Based on the external network access control method provided in Embodiment One of the present invention, step 2 is further refined and includes the following steps:

[0107] Step 201c: The trusted computing supervision module determines whether the connection information contains sensitive data;

[0108] Step 202c: When the connection information contains sensitive data, determine that the connection status between the image forming device and the preset external network server is in an abnormal connection state.

[0109] After obtaining the connection information between the image forming apparatus and the preset external network server, the connection information is parsed and read to determine whether it contains sensitive data. If sensitive data is found, the connection between the image forming apparatus and the preset external network server is determined to be in an abnormal connection state. Sensitive data may include office equipment IP addresses, MAC addresses, hostnames, file paths, etc.

[0110] This embodiment monitors the data sent by the parsing device. When the data contains sensitive data, it controls the image forming device to prohibit access to a preset external network server, thereby preventing the leakage of confidential information of the device by monitoring the output information.

[0111] Example 7

[0112] Based on the external network access control method provided in Embodiment 1 of the present invention, the step of prohibiting the image forming device from accessing the preset external network server in step 3 is further refined, including the following steps:

[0113] Step 301: Disconnect the network connection service corresponding to the image forming apparatus so that the image forming apparatus cannot access the preset external network server.

[0114] In this embodiment, disconnecting the network connection service corresponding to the image forming apparatus can be done by directly powering the network card in the image forming apparatus and / or directly disabling the network connection function of the image forming apparatus.

[0115] In this embodiment, the network connection service corresponding to the image forming apparatus is disconnected, and communication between the image forming apparatus and the preset external network service is cut off, preventing the image forming apparatus from accessing the preset external network server. This effectively avoids the problem of data leakage caused by the image forming apparatus connecting to the external server and sending confidential data stored in the image forming apparatus out of trust due to a fake server address being mistakenly identified as trustworthy.

[0116] Example 8

[0117] Based on the external network access control method provided in Embodiment 1 of the present invention, the method further includes the following steps:

[0118] Step 4: If the connection between the image forming apparatus and the preset external network server is in a preset abnormal connection state, an external network access prompt message will be issued.

[0119] In this embodiment, if the connection between the image forming apparatus and a preset external network server is in a preset abnormal connection state, the image forming apparatus issues an external network access prompt message. This external network access prompt message triggers the image forming apparatus to display an alarm message on its display panel, triggers an alarm on its status indicator light, plays a voice alarm, sends an alarm message to a user terminal, or sends an alarm message to a computer device. Specifically, the image forming apparatus issues the external network access prompt message to an application process. This application refers to an application installed on the image forming apparatus that starts when the image forming apparatus is connected to a power source. The external network access prompt message triggers the image forming apparatus to display an alarm message on its display panel, and also triggers an alarm on its status indicator light to indicate to the user that the image forming apparatus is disconnected from the network. The external network access prompt message also triggers the image forming apparatus to play a voice alarm to indicate to the user that the image forming apparatus is disconnected from the network. The external network access notification message is also used to trigger the image forming apparatus to send an alarm notification message to the user terminal, where the user terminal is communicatively connected to the image forming apparatus to promptly notify the user that the image forming apparatus has lost network access. The external network access notification message is also used to trigger the image forming apparatus to send an alarm notification message to the computer device to notify the user that the image forming apparatus has lost network access. Restoring the network connection service of the image forming apparatus requires the user to trigger a recovery request, for example, by clicking the recovery button on the image forming apparatus to restore the network connection service.

[0120] In this embodiment, when the connection between the image forming apparatus and the preset external network server is in a preset abnormal connection state, an external network access prompt message is issued to promptly notify the user that the network connection of the image forming apparatus has been disconnected.

[0121] Example 9

[0122] Based on the external network access control method provided in Embodiment 8 of the present invention, after step 4, the method further includes:

[0123] Step 5: Generate and store external network alarm logs.

[0124] In this embodiment, after issuing an external network access prompt message, an external network alarm log is generated and stored in the storage device of the image forming apparatus so that users, especially administrators, can view the external network alarm log.

[0125] Figure 8 This is a schematic diagram of the external network access control device provided in an embodiment of the present invention, as shown below. Figure 8As shown, the external network access control device 200 provided in this embodiment includes an acquisition module 201, a trusted computing supervision module 202, and a control module 203.

[0126] The image forming apparatus includes an acquisition module 201, which acquires connection information between the image forming apparatus and a preset external network server. A trusted computing monitoring module 202, which is included within the image forming apparatus, determines whether the connection between the image forming apparatus and the preset external network server is in a preset abnormal connection state based on the connection information. A control module 203, which prevents the image forming apparatus from accessing the preset external network server when the connection between the image forming apparatus and the preset external network server is in a preset abnormal connection state.

[0127] Specifically, the control module can be located in the trusted computing monitoring module or in the image forming apparatus.

[0128] Optionally, the acquisition module includes a sending unit and a receiving unit; the sending unit is further configured to initiate a connection request to a preset external network server; and further configured to acquire the address of the preset external network server; and initiate multiple connection requests to the preset external network server corresponding to the image forming apparatus according to the preset external network server address. The receiving unit is further configured to receive response requests from the preset external network server.

[0129] Optionally, the trusted computing monitoring module is further configured to obtain the number of responses corresponding to response requests from a preset external network server within a preset time period and a preset number of responses; and to determine whether the connection status between the image forming apparatus and the preset external network server is in a preset abnormal connection state based on the number of responses corresponding to the response requests and the preset number of responses. Specifically, if the number of responses corresponding to the response requests is greater than or equal to the preset number of responses, then the connection status between the image forming apparatus and the preset external network server is determined to be in a preset abnormal connection state; if the number of responses corresponding to the response requests is less than the preset number of responses, then the connection status between the image forming apparatus and the preset external network server is determined not to be in a preset abnormal connection state.

[0130] Alternatively, the trusted computing monitoring module is also used to acquire the data traffic of connection information within a preset time period; and to determine whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the data traffic and the preset data traffic. Specifically, if the data traffic is greater than or equal to the preset data traffic, it is determined that the connection status between the image forming device and the preset external network server is in an abnormal connection state; if the data traffic is less than the preset data traffic, it is determined that the connection status between the image forming device and the preset external network server is not in an abnormal connection state.

[0131] Optionally, the trusted computing monitoring module is also used to determine whether the acquired connection information contains sensitive data. If sensitive data is contained, it determines that the connection status between the image forming device and the preset external network server is in an abnormal connection state.

[0132] Optionally, the control module is also used to disconnect the network connection service corresponding to the image forming apparatus so that the image forming apparatus cannot access the preset external network server.

[0133] Optionally, the device further includes: a prompting module;

[0134] The prompt module is used to issue an external network access prompt message if the connection between the image forming apparatus and the preset external network server is in a preset abnormal connection state.

[0135] Optionally, the processing unit is also used to generate and store external network alarm logs.

[0136] Figure 9 This is a block diagram of an image forming apparatus used to implement the external network access control method of the present invention, such as... Figure 9 As shown, the image forming apparatus 300 includes a memory 301, a processor 302, and a transceiver 303.

[0137] The processor 302, memory 301, and transceiver 303 are interconnected;

[0138] Transceiver 303 is used for sending and receiving data and requests;

[0139] Memory 301 stores computer-executed instructions;

[0140] The processor 302 executes computer execution instructions stored in the memory 301, causing the processor to perform the method provided in any of the above embodiments.

[0141] Memory can be, but is not limited to, Random Access Memory (RAM), Read-Only Memory (ROM), Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Flash Memory, etc. Memory also stores programs, which the processor executes after receiving execution instructions.

[0142] The processor may be an integrated circuit chip with signal processing capabilities. The aforementioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc. It can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor.

[0143] Those skilled in the art will understand that the image forming apparatus of this application includes a memory and a processor. The memory stores program instruction code, and the processor executes the program instruction code to implement the external network access control method applied to the image forming apparatus in the above embodiments. Embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, embodiments of this application can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0144] This application also provides a computer-readable storage medium storing computer-executable instructions, which are executed by a processor using the methods described in any of the above embodiments.

[0145] This application also provides a computer program product, including a computer program that is executed by a processor using the methods described in any of the above embodiments.

[0146] This application describes embodiments of methods, apparatus (systems), and computer program products according to embodiments of this application with reference to flowchart illustrations and / or block diagrams. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0147] The above are merely preferred embodiments of this application and are not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for controlling external network access, characterized in that, The method includes: The connection information between the image forming apparatus and a preset external network server is obtained; the connection information includes the response request returned by the preset external network server after the image forming apparatus initiates a connection request to the preset external network server; The trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the connection information; the preset abnormal connection state is used to indicate that the preset external network server has abnormal interaction behavior; wherein the trusted computing monitoring module is included in the image forming device. When the connection between the image forming apparatus and the preset external network server is in a preset abnormal connection state, the image forming apparatus is controlled to prohibit access to the preset external network server.

2. The method according to claim 1, characterized in that, The connection information also includes a connection request, and the acquisition of connection information between the image forming apparatus and the preset external network server includes: Initiate a connection request to the preset external network server; Receive the response request from the preset external network server.

3. The method according to claim 2, characterized in that, The step of initiating a connection request to the preset external network server includes: Obtain the preset external network server address; Initiate multiple connection requests to the preset external network server based on the preset external network server address.

4. The method according to claim 3, characterized in that, The trusted computing monitoring module determines, based on the connection information, whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state, including: The trusted computing monitoring module obtains the number of response requests corresponding to the response requests fed back by the preset external network server within a preset time period; The trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the number of responses corresponding to the response request and the preset number of responses.

5. The method according to claim 4, characterized in that, The trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the number of responses corresponding to the response request and a preset number of responses, including: If the number of responses is greater than or equal to the preset number of responses, then the connection between the image forming device and the preset external network server is determined to be in an abnormal connection state. If the number of responses is less than the preset number of responses, it is determined that the connection between the image forming device and the preset external network server is not in a preset abnormal connection state.

6. The method according to claim 1, characterized in that, The trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the connection information, including: The trusted computing monitoring module acquires the data traffic of the connection information within a preset time period; The trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the data traffic and the preset data traffic.

7. The method according to claim 6, characterized in that, The trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the data traffic and preset data traffic, including: If the data traffic is greater than or equal to the preset data traffic, then the connection between the image forming device and the preset external network server is determined to be in an abnormal connection state. If the data traffic is less than the preset data traffic, it is determined that the connection between the image forming apparatus and the preset external network server is not in an abnormal connection state.

8. The method according to claim 1, characterized in that, The trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the connection information, including: The trusted computing monitoring module determines whether the connection information contains sensitive data. When the connection information contains sensitive data, it is determined that the connection between the image forming device and the preset external network server is in an abnormal connection state.

9. The method according to any one of claims 1-8, characterized in that, Controlling the image forming apparatus to prevent access to the preset external network server includes: Disconnect the network connection service corresponding to the image forming apparatus so that the image forming apparatus cannot access the preset external network server.

10. The method according to any one of claims 1-8, characterized in that, The method further includes: When it is determined that the connection between the image forming apparatus and the preset external network server is in a preset abnormal connection state, an external network access prompt message is issued.

11. An external network access control device, characterized in that, The device includes: The acquisition module is configured to acquire connection information between the image forming apparatus and a preset external network server; the connection information includes the response request returned by the preset external network server after the image forming apparatus initiates a connection request to the preset external network server; A trusted computing monitoring module is configured to determine, based on the connection information, whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state; the preset abnormal connection state is used to characterize that the preset external network server has abnormal interactive behavior; wherein the trusted computing monitoring module is included in the image forming device. The control module controls the image forming apparatus to prohibit access to the preset external network server when the connection between the image forming apparatus and the preset external network server is in a preset abnormal connection state.

12. The apparatus according to claim 11, characterized in that, The connection information also includes a connection request, and the device further includes: The sending unit is configured to initiate a connection request to the preset external network server; The receiving unit is configured to receive response requests from the preset external network server.

13. The apparatus according to claim 12, characterized in that, in: The sending unit is configured to obtain a preset external network server address and initiate multiple connection requests to the preset external network server based on the preset external network server address.

14. The apparatus according to claim 13, characterized in that, in: The trusted computing monitoring module is configured to obtain the number of responses corresponding to the response requests fed back by the preset external network server within a preset time period; The connection status between the image forming device and the preset external network server is determined based on the number of responses corresponding to the response request and the preset number of responses.

15. The apparatus according to claim 11, characterized in that, in: The trusted computing monitoring module is configured to acquire the data traffic of the connection information within a preset time period; the trusted computing monitoring module determines whether the connection status between the image forming device and the preset external network server is in a preset abnormal connection state based on the data traffic and the preset data traffic.

16. The apparatus according to claim 11, characterized in that, in: The trusted computing monitoring module is configured to determine that the connection between the image forming device and the preset external network server is in an abnormal connection state if the connection information contains sensitive data.

17. The apparatus according to any one of claims 11-16, characterized in that, in: The control module is configured to disconnect the network connection service corresponding to the image forming apparatus when the connection between the image forming apparatus and the preset external network server is in a preset abnormal connection state, so that the image forming apparatus cannot access the preset external network server.

18. The apparatus according to any one of claims 11-16, characterized in that, in: The control module is also configured to issue an external network access prompt when it determines that the connection between the image forming apparatus and the preset external network server is in a preset abnormal connection state.

19. An image forming apparatus, comprising: Processor, memory, and transceiver; Interconnection of processor, memory, and transceiver circuits; A transceiver is used to send and receive data and requests. The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 10.

20. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 10.

Images