Image forming apparatus and method for controlling image forming apparatus

Abstract

To provide an image forming apparatus and a method for controlling an image forming apparatus that can appropriately determine whether an error at the start-up of the image forming apparatus is an error due to alteration of a program to prevent execution of unnecessary handling processing.SOLUTION: When an image forming apparatus 1 is started up, a detection processing unit 112 detects an error in a predetermined program stored in the image forming apparatus 1. When the error in the program is detected, an acquisition processing unit 113 acquires information on the history of jobs executed during the previous operation of the image forming apparatus 1. A determination processing unit 114 determines whether the error is an error due to alteration of the program on the basis of the history information. A handling processing unit 115 executes handling processing on the error on the basis of a result of the determination made by the determination processing unit.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a technique for detecting an error during startup of an image forming apparatus. [Background technology]

[0002] Conventionally, there are known techniques for issuing a warning to a user or repairing a program when tampering with a program (firmware, etc.) of an information device in an office is detected (see, for example, Patent Documents 1 and 2). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2011-218630 ​​A [Patent Document 2] JP 2020-57040 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, in conventional technologies, various techniques such as signature verification and checksum are used as a means for detecting tampering, but all of them can only determine whether the program is correct or not, and when it is determined that the program is incorrect, it always assumes that it has been tampered with and executes a countermeasure. For this reason, even if an error at startup is a read error caused by noise and can be recovered by simply restarting the program, it is determined that the program has been tampered with and unnecessary countermeasures are executed, which is a problem.

[0005] An object of the present invention is to provide an image forming apparatus and a control method for an image forming apparatus that are capable of suppressing the execution of unnecessary countermeasures by appropriately determining whether an error occurring at startup of the image forming apparatus is a program tampering error. [Means for solving the problem]

[0006] An image forming apparatus according to one aspect of the present invention includes a detection processing unit, an acquisition processing unit, a determination processing unit, and a handling processing unit. When the image forming apparatus is started, the detection processing unit detects an error in a predetermined program stored in the image forming apparatus. When an error in the program is detected, the acquisition processing unit acquires history information of a job executed during a previous operation of the image forming apparatus. The determination processing unit determines whether the error is a tampering error in the program based on the history information. The handling processing unit executes handling processing for the error based on a determination result of the determination processing unit.

[0007] A control method for an image forming apparatus according to another aspect of the present invention includes a detection step, an acquisition step, a determination step, and a handling step. In the detection step, when the image forming apparatus is started, an error in a predetermined program stored in the image forming apparatus is detected. In the acquisition step, if an error in the program is detected, history information of a job executed during a previous operation of the image forming apparatus is acquired. In the determination step, it is determined based on the history information whether the error is a tampering error in the program. In the handling step, a handling process for the error is executed based on a determination result of the determination step. The control method may be a method in which one or more processors execute the processing of each step. Effect of the Invention

[0008] According to the present invention, it is possible to provide an image forming apparatus and a control method for an image forming apparatus that are capable of suppressing the execution of unnecessary countermeasure processing by appropriately determining whether an error occurring at the start-up of the image forming apparatus is a program tampering error. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a block diagram showing a configuration of an image forming apparatus according to an embodiment of the present invention. [Diagram 2]FIG. 2 is a diagram showing an example of determination information according to the embodiment of the present invention. [Diagram 3] FIG. 3 is a diagram showing an example of warning information according to the embodiment of the present invention. [Figure 4] FIG. 4 is a diagram showing another example of the warning information according to the embodiment of the present invention. [Diagram 5] FIG. 5 is a flowchart showing an example of a procedure of a job execution process executed in the image forming apparatus according to the embodiment of the present invention. [Figure 6] FIG. 6 is a flowchart showing an example of a procedure of an error check process executed in the image forming apparatus according to the embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, an embodiment of the present invention will be described with reference to the accompanying drawings to facilitate understanding of the present invention. Note that the following embodiment is an example of the present invention and does not limit the technical scope of the present invention.

[0011] [Image forming device 1] 1, the image forming apparatus 1 includes a control unit 11, an operation display unit 12, an ADF (Auto Document Feeder) 13, an image reading unit 14, an image forming unit 15, a communication I / F 16, a storage unit 17, etc. Specifically, the image forming apparatus 1 is a multifunction machine having a printer function, a scanner function, a copy function, a facsimile function, etc. Note that the image forming apparatus of the present invention is not limited to a multifunction machine, and can be applied to any image forming apparatus such as a copy machine, a printer, or a facsimile machine.

[0012] The operation display unit 12 includes a display unit such as a liquid crystal display that displays information, and an operation unit such as a touch panel and operation buttons that accept user operations.

[0013] The ADF 13 is an automatic document feeder that includes a document setting section, a transport roller, a document holder, and a paper discharge section, and transports documents to be read by the image reading section 14 .

[0014] The image reading unit 14 includes a document table, a light source, a mirror, an optical lens, and a CCD (Charge Coupled Device), and is capable of reading an image of a document and outputting the image as image data.

[0015] The image forming unit 15 is capable of performing a print process based on image data by an electrophotographic method or an inkjet method, and forms an image on a sheet based on the image data. For example, when the image forming unit 15 is an electrophotographic image forming unit, the image forming unit 15 includes a photoconductor drum, a charger, an exposure device, a developing device, a transfer device, and a fixing device.

[0016] The communication I / F 16 is a communication interface capable of performing wired or wireless data communication with an external device. For example, the communication I / F 16 performs data communication with an external device via a network. The external device includes an operation terminal (personal computer, mobile terminal, smartphone, etc.) operated by a user, a storage device (external storage, USB device, etc.) that stores data, and the like.

[0017] The storage unit 17 is a non-volatile storage unit such as a flash memory, a hard disk, or an EEPROM (registered trademark). The storage unit 17 stores various control programs executed by the control unit 11, various data, and the like. The control programs executed by the control unit 11 include a job execution program for causing the control unit 11 to execute a job execution process (see FIG. 5) described below, an error check program for causing the control unit 11 to execute an error check process (see FIG. 6), and the like.

[0018] Furthermore, the storage unit 17 stores various software programs executed in the image forming apparatus 1. The software programs include software (firmware) that operates the image forming apparatus 1, and the like.

[0019] The memory unit 17 also stores determination information D1 that stores a job execution history (history information) and a tampering possibility level indicating the possibility that firmware (an example of a program of the present invention) may be tampered with in association with each other. FIG. 2 shows an example of the determination information D1. The determination information D1 includes information such as a job ID, a job name, a tampering possibility level, and a job occurrence date and time. The job ID is job identification information, and is an arbitrary identification number that is assigned according to the execution order of the job. The job name is information that indicates the type of job (print, copy, scan, etc.). The job occurrence date and time is the date and time when the job was acquired, the date and time when the job was executed, etc.

[0020] The job name "Print (External Storage)" indicates a job of connecting a storage device that stores image data to the image forming apparatus 1 and printing the image data. The job name "Print (Network)" indicates a job of printing image data input from an operation terminal (user terminal) to the image forming apparatus 1 via a network. The job name "Print (USB Device)" indicates a job of connecting a USB device that stores image data to the image forming apparatus 1 and printing the image data. The job name "Copy" indicates a job of a user setting an original on the image forming apparatus 1 and copying (image formation instruction). The job name "Scan to Send (Panel Operation)" indicates a job of a user setting an original on the image forming apparatus 1 and scanning (scan instruction) and sending the scanned data to a user terminal or the like. The job name "Print (Air Print)" indicates a job of printing image data input from an operation terminal (user terminal) to the image forming apparatus 1 via Wi-Fi (registered trademark). The job name "Change Device Setting" indicates a job of changing the setting content of the image forming apparatus 1. The job content shown in FIG. 2 is an example, and other jobs may be included.

[0021] The tampering possibility level is information indicating the possibility that the firmware will be tampered with, and the higher the level, the higher the possibility that the firmware will be tampered with. The control unit 11 sets the tampering possibility level in advance according to the type of job.

[0022] For example, when printing image data input to the image forming apparatus 1 via a network, the risk of firmware tampering is higher than when printing image data stored in a USB device inserted in the image forming apparatus 1, so the control unit 11 sets a high level (for example, "7") for "printing (external storage)". That is, the control unit 11 sets the tampering possibility level higher as the risk of firmware tampering increases according to the type of job, and sets the tampering possibility level lower as the risk of firmware tampering decreases. The control unit 11 may set the tampering possibility level based on a setting operation (a selection operation of the tampering possibility level) by the administrator of the image forming apparatus 1. The control unit 11 may also update the tampering possibility level as appropriate based on the tampering history of the firmware. The determination information D1 may be provided outside the image forming apparatus 1 (a server).

[0023] As another embodiment, the job execution history (history information) and the tampering possibility level may be registered in different databases. For example, the image forming apparatus 1 may be provided with a job history database in which a job ID, a job name, and a job occurrence date and time are associated with each other, and a tampering possibility level database in which all job names executable by the image forming apparatus 1 are associated with the tampering possibility level corresponding to each job name. The job history database and the tampering possibility level database may be provided outside the image forming apparatus 1 (on a server).

[0024] The control unit 11 includes control devices such as a CPU, a ROM, and a RAM. The CPU is a processor that executes various arithmetic operations. The ROM is a non-volatile storage unit in which information such as a control program for causing the CPU to execute various processes is stored in advance. The RAM is a volatile or non-volatile storage unit used as a temporary storage memory (work area) for various processes executed by the CPU.

[0025] Specifically, the control unit 11 includes a reception processing unit 111, a detection processing unit 112, an acquisition processing unit 113, a determination processing unit 114, and a handling processing unit 115. The control unit 11 functions as each of these processing units by executing various processes according to the control program. The control unit 11 may also include an electronic circuit that realizes a part or a plurality of processing functions of each of these processing units.

[0026] The reception processing unit 111 receives various operations from a user. Specifically, when a user performs an operation such as a print instruction, a scan instruction, or a setting change instruction on an operation screen displayed on the operation display unit 12 or an operation terminal (user terminal), the reception processing unit 111 receives the operation.

[0027] For example, when a user performs an operation to instruct printing of image data stored in an external storage connected to the image forming apparatus 1, the reception processing unit 111 receives the operation. When the reception processing unit 111 receives the operation of the print instruction, the control unit 11 executes the print process. Furthermore, when the control unit 11 executes a job, it registers job history information including the job ID, job name, and job occurrence date and time in the storage unit 17 (e.g., determination information D1 (see FIG. 2)). For example, the control unit 11 accumulates jobs executed from when the image forming apparatus 1 is powered on (power ON) until the power is cut off (power OFF) in the determination information D1.

[0028] When the image forming apparatus 1 is started, the detection processing unit 112 detects an error in a predetermined program (here, firmware) stored in the image forming apparatus 1. For example, when the image forming apparatus 1 is started, the detection processing unit 112 executes a well-known boot program (secure boot) to check for errors in the firmware. A well-known method can be used to check for errors. For example, the detection processing unit 112 checks the signature of the firmware to determine whether or not there is an error. The detection processing unit 112 determines that there is no error if the firmware signature is appropriate (trustworthy), and determines that there is an error if the firmware signature is inappropriate (incorrect signature).

[0029] When a firmware error is detected by the detection processing unit 112, the acquisition processing unit 113 acquires history information of jobs executed during the previous operation of the image forming apparatus 1. Specifically, when a firmware error is detected at the start-up (or restart) of the image processing apparatus 1, the acquisition processing unit 113 acquires history information of jobs executed by the image forming apparatus 1 from the previous start-up (power ON) to the shut-down (power OFF) from the determination information D1 (see FIG. 2).

[0030] The determination processing unit 114 determines whether or not the firmware error is a firmware tampering error based on the history information acquired by the acquisition processing unit 113. Specifically, the determination processing unit 114 refers to the determination information D1 (see FIG. 2) and determines that the error is a firmware tampering error when the tampering possibility level of the previously executed job is equal to or higher than a threshold. For example, the determination processing unit 114 determines that the error is a firmware tampering error when the determination information D1 includes a job whose tampering possibility level is equal to or higher than a threshold (e.g., "5").

[0031] Since the judgment information D1 shown in the example of Figure 2 contains jobs with a tampering possibility level of "5" or higher, the judgment processing unit 114 determines that there is a high possibility that the firmware has been tampered with during the previous operation, and determines that the error at the current startup is a firmware tampering error.

[0032] Furthermore, if the determination information D1 does not contain a job whose tampering possibility level is equal to or higher than the threshold (here, "5"), the determination processing unit 114 determines that the possibility that the firmware has been tampered with during the previous operation is low, and determines that the error at the current startup is not a firmware tampering error. In this case, the determination processing unit 114 may determine that the error is a temporary firmware malfunction or equipment damage.

[0033] In this way, in image forming apparatus 1, for example, a first level is set in storage unit 17 for a copy job or a scan job executed in image forming apparatus 1, and a second level higher than the first level is set for a print job of data input via a network or external storage. Then, determination processing unit 114 determines that the error is a firmware tampering error when a second level job exists in the job history information.

[0034] For example, if during the previous operation, (a) a job (printing, sending, etc.) involving input of data or instructions from outside via a network or a USB device was executed, (b) an instruction to change settings of the device was executed from outside via a network or a USB device, (c) a job using data stored in a removable medium such as a USB device (storage) was executed, or (d) a debug port for development that is not normally used was used, the determination processing unit 114 determines that the error is a firmware tampering error. Also, if no job shown in (a) to (d) was executed during the previous operation, the determination processing unit 114 determines that the error is not firmware tampering but a temporary firmware malfunction or damage to the device.

[0035] In another embodiment, the judgment processing unit 114 may refer to the access history of the non-volatile memory in which the firmware is stored, and if there is writing to the firmware area, determine that the error is a firmware tampering error, and if there is no writing to the firmware area, determine that the error is not a firmware tampering error.

[0036] The handling processing unit 115 executes handling processing for the error based on the determination result of the determination processing unit 114. Specifically, when the determination processing unit 114 determines that the firmware error is a firmware tampering error, the handling processing unit 115 issues warning information indicating that the firmware has been tampered with, and cuts off the network of the image forming apparatus 1. For example, as shown in FIG. 3, the handling processing unit 115 causes the operation display unit 12 to display information (warning information) indicating that the firmware has been tampered with and that the network has been cut off. The handling processing unit 115 may notify the user terminal of the warning information. The handling processing unit 115 also cuts off the network of the image forming apparatus 1 from the outside for a certain period of time.

[0037] Furthermore, when the determination processing unit 114 determines that the error is not a firmware tampering error, the handling processing unit 115 notifies warning information indicating that the firmware is corrupted. For example, the handling processing unit 115 causes the operation display unit 12 to display information (warning information) indicating that the firmware is corrupted, as shown in FIG. 4. The handling processing unit 115 may notify the warning information to a user terminal. Note that, here, the handling processing unit 115 does not execute processing to shut off the network of the image forming apparatus 1. Furthermore, when the determination processing unit 114 determines that the error is not a firmware tampering error, the handling processing unit 115 deletes history information of the job at the time of the previous operation. For example, the handling processing unit 115 deletes (resets) each piece of information registered in the determination information D1.

[0038] Furthermore, when the determination processing unit 114 determines that the error is not a firmware tampering error, the corrective action processing unit 115 may restart the firmware, since restarting the firmware may resolve the error.

[0039] In addition, when the judgment processing unit 114 judges that the error is a firmware tampering error, the countermeasure processing unit 115 may delete (reset) the job history information from the previous operation, provided that the tampering error has been resolved.

[0040] In this way, the image forming device 1 stores the judgment conditions (judgment information D1) including the job execution history during operation before rebooting, and when an error is detected in the error check by the secure boot at rebooting, if it is judged based on the judgment information D1 that the error is unlikely to be caused by firmware tampering, the image forming device 1 is configured not to execute the countermeasure processing that would be executed if a tampering error is detected. This makes it possible to suppress unnecessary countermeasure processing (warning, network disconnection, etc.) and recovery work.

[0041] In addition, the control unit 11 controls each unit such as the ADF 13, the image reading unit 14, the image forming unit 15, and the like, thereby performing overall control of the image forming apparatus 1.

[0042] [Job execution processing] Next, an example of the procedure of a job execution process executed by the control unit 11 of the image forming apparatus 1 will be described with reference to Fig. 5. Here, steps S1, S2, ... represent the numbers of the processing procedures (steps) executed by the control unit 11. The job execution process is started when the image forming apparatus 1 is powered on (power ON). The present invention can be understood as an invention of a job execution method (corresponding to the control method of the present invention) that executes one or more steps included in the job execution process.

[0043] Also, one or more steps included in the job execution process described here may be omitted as appropriate. Also, the steps in the job execution process may be executed in a different order as long as the same action and effect is achieved. Furthermore, although an example is described here in which the control unit 11 executes each step in the job execution process, in other embodiments, one processor may execute each step in the job execution process, or multiple processors may distribute and execute each step in the job execution process.

[0044] <Step S1> First, in step S1, the control unit 11 starts up the image forming apparatus 1. Specifically, the control unit 11 executes a start-up process when the image forming apparatus 1 is powered on (power ON). Here, it is assumed that no error is detected in the firmware in the image forming apparatus 1 and the image forming apparatus 1 starts up normally.

[0045] <Step S2> Next, in step S2, the control unit 11 determines whether or not a job has been acquired. Specifically, the control unit 11 acquires a job such as printing, copying, scanning, or changing settings. If the control unit 11 acquires a job (S2: Yes), the control unit 11 shifts the process to step S3. If the control unit 11 does not acquire a job (S2: No), the control unit 11 shifts the process to step S5.

[0046] <Step S3> In step S3, the control unit 11 executes the job. For example, the control unit 11 executes a printing process, a copying process, a scanning process, a setting change process, or the like, in accordance with the acquired job.

[0047] <Step S4> Next, in step S4, the control unit 11 registers the execution history of the job. Specifically, when the control unit 11 executes a job, the control unit 11 registers history information in which the job ID, the job name, and the job occurrence date and time are associated with each other in the storage unit 17 (for example, the determination information D1).

[0048] <Step S5> Next, in step S5, the control unit 11 determines whether the power of the image forming apparatus 1 has been turned off. When the power of the image forming apparatus 1 is turned off, the control unit 11 ends the job execution process. The control unit 11 repeatedly executes the processes of steps S2 to S4 until the power of the image forming apparatus 1 is turned off (while the power is ON) (S5: No). That is, while the image forming apparatus 1 is operating, the control unit 11 executes each job every time it acquires it, and accumulates the job execution history in the determination information D1 (see FIG. 2).

[0049] [Error checking process] Next, an example of the procedure of the error check process executed by the control unit 11 of the image forming apparatus 1 will be described with reference to Fig. 6. The error check process is started when the image forming apparatus 1 is powered on (power ON). The present invention can be understood as an invention of an error check method (corresponding to the control method of the present invention) that executes one or more steps included in the error check process.

[0050] Also, one or more steps included in the error check process described here may be omitted as appropriate. Also, the steps in the error check process may be executed in a different order as long as the same action and effect is achieved. Furthermore, although an example is described here in which the control unit 11 executes each step in the error check process, in other embodiments, one processor may execute each step in the error check process, or multiple processors may execute each step in the error check process in a distributed manner. The error check process may be included in step S1 of the job execution process (see FIG. 5).

[0051] <Step S11> First, in step S11, the control unit 11 starts up the image forming apparatus 1 and executes an error check program (secure boot).

[0052] <Step S12> Next, in step S12, the control unit 11 determines whether or not there is an error in a predetermined program (here, firmware) stored in the image forming apparatus 1. For example, the control unit 11 checks the signature of the firmware to determine whether or not there is an error in the firmware. The control unit 11 determines that there is no error if the firmware signature is appropriate (trusted), and determines that there is an error if the firmware signature is inappropriate (incorrect signature). If the control unit 11 detects a firmware error (S21: Yes), it shifts the process to step S13. On the other hand, if the control unit 11 does not detect a firmware error (S12: No), it shifts the process to step S21.

[0053] <Step S13> In step S13, the control unit 11 acquires the job execution history from the previous operation. Specifically, the control unit 11 acquires the history information of the jobs that were executed by the image forming apparatus 1 from the time it was started (powered ON) until it was shut down (powered OFF) last time and that were registered (see step S4 in FIG. 5) in the determination information D1 (see FIG. 2).

[0054] <Step S14> Next, in step S14, the control unit 11 determines whether or not the acquired job history information includes a job whose tampering possibility level is equal to or higher than a threshold value (here, "5"). If the history information includes a job whose tampering possibility level is equal to or higher than "5", the control unit 11 determines that the firmware is highly likely to have been tampered with, and shifts the process to step S15. On the other hand, if the history information does not include a job whose tampering possibility level is equal to or higher than "5", the control unit 11 determines that the firmware is low likely to have been tampered with, and shifts the process to step S41.

[0055] <Step S15> In step S15, the control unit 11 displays information indicating that the firmware has been tampered with. Specifically, as shown in Fig. 3, the control unit 11 determines that the firmware is highly likely to have been tampered with during the previous operation, and displays warning information indicating that the firmware has been tampered with. After step S15, the control unit 11 shifts the process to step S16.

[0056] <Step S16> In step S16, the control unit 11 disconnects the image forming apparatus 1 from the outside of the network. As shown in Fig. 3, the control unit 11 may cause the operation display unit 12 to display information indicating that the network has been disconnected. After disconnecting the network, the control unit 11 executes a repair process to remove, for example, a firmware error. When the firmware has been repaired, the control unit 11 may start the image processing apparatus 1 normally to accept a job (see steps S1 and S2 in Fig. 5).

[0057] <Step S41> In response to this, in step S41, the control unit 11 displays information indicating that the firmware is corrupted. Specifically, the control unit 11 determines that the firmware is unlikely to have been tampered with during the previous operation, and displays warning information indicating that the firmware is corrupted, as shown in Fig. 4. The control unit 11 may also display information indicating that a temporary malfunction of the firmware or damage to the device has occurred.

[0058] After steps S16 and S41, the control unit 11 ends the error check process.

[0059] <Step S21> If the control unit 11 does not detect a firmware error (S12: No), in step S21, the control unit 11 deletes the job execution history from the previous operation. For example, the control unit 11 deletes each piece of information registered in the determination information D1 (see FIG. 2). After step S21, the control unit 11 ends the error check process.

[0060] In this way, the control unit 11 executes the error check process each time the image forming apparatus 1 is started, and if an error is detected, it determines whether or not there is a possibility of firmware tampering based on the history information of the previous job, and executes countermeasure processing based on the determination result.

[0061] As described above, the image forming apparatus 1 according to this embodiment includes a processing unit that detects an error in a predetermined program (e.g., firmware) stored in the image forming apparatus 1 when the image forming apparatus 1 is started, a processing unit that acquires history information of a job executed during the previous operation of the image forming apparatus 1 when an error in the program is detected, a processing unit that determines whether the error is a tampering error in the program based on the history information, and a processing unit that executes a process to deal with the error based on the determination result.

[0062] For example, when the image forming apparatus 1 determines that the error is a program tampering error, it issues warning information indicating that the program has been tampered with and cuts off the network of the image forming apparatus 1. On the other hand, when the image forming apparatus 1 determines that the error is not a program tampering error, it issues warning information indicating that the program is corrupted.

[0063] According to the above configuration, even if an error in the program is detected, if it can be determined from job history information that the program is unlikely to have been tampered with, it is possible to omit the process to be executed when the program has been tampered with. For example, if it can be determined that the program is unlikely to have been tampered with, there is a possibility that the program can be restored simply by restarting it, so there is no need to determine that the program has been tampered with and execute unnecessary countermeasures. Therefore, it is possible to suppress the execution of unnecessary countermeasures by appropriately determining whether an error at the time of startup of the image forming apparatus 1 is a program tampering error.

[0064] [Disclosure Note] The following will provide an overview of the disclosure extracted from the above-described embodiment. Note that the configurations and processing functions described in the following supplementary notes can be selected and combined as desired.

[0065] <Appendix 1> a detection processing unit that detects an error in a predetermined program stored in the image forming apparatus when the image forming apparatus is started; an acquisition processing unit that acquires history information of a job executed during a previous operation of the image forming apparatus when an error in the program is detected; a determination processing unit that determines whether or not the error is a tampering error of the program based on the history information; a processing unit that executes a processing for the error based on a determination result of the determination unit; An image forming apparatus comprising:

[0066] <Appendix 2> the handling processing unit issues a warning indicating that the program has been tampered with and cuts off a network of the image forming apparatus when the determination processing unit determines that the error is a program tampering error. 2. The image forming apparatus according to claim 1.

[0067] <Appendix 3> the handling processing unit issues warning information indicating that the program is corrupted when the determination processing unit determines that the error is not a tampering error of the program. 3. The image forming apparatus according to claim 1 or 2.

[0068] <Appendix 4> the determination processing unit refers to a storage unit that stores the execution history of the job in association with a level indicating a possibility that the program may be tampered with, and determines that the error is a tampering error of the program when the level associated with the job is equal to or greater than a threshold value. 4. The image forming apparatus according to claim 1.

[0069] <Appendix 5> the determination processing unit determines that the error is a program tampering error when the job having the level equal to or higher than the threshold exists in the storage unit; 5. The image forming apparatus according to claim 4.

[0070] <Appendix 6> In the storage unit, a first level is set for a copy job or a scan job executed in the image forming apparatus, and a second level higher than the first level is set for a print job of data input via a network or an external storage, the determination processing unit determines that the error is a program tampering error when the job of the second level exists in the storage unit; 6. The image forming apparatus according to claim 5.

[0071] <Appendix 7> the determination processing unit refers to an access history for a non-volatile memory in which the program is stored, and determines that the error is a tampering error of the program when there is writing to a program area, and determines that the error is not a tampering error of the program when there is no writing to the program area. 7. The image forming apparatus according to claim 1.

[0072] <Appendix 8> Detecting an error in a predetermined program stored in the image forming apparatus when the image forming apparatus is started; When an error in the program is detected, acquiring history information of a job executed during a previous operation of the image forming apparatus; determining whether the error is a tampering error of the program based on the history information; Executing a process to deal with the error based on a result of the determination; and The control method for an image forming apparatus is executed by one or more processors.

[0073] <Appendix 9> Detecting an error in a predetermined program stored in the image forming apparatus when the image forming apparatus is started; When an error in the program is detected, acquiring history information of a job executed during a previous operation of the image forming apparatus; determining whether the error is a tampering error of the program based on the history information; Executing a process to deal with the error based on a result of the determination; and A control program for an image forming apparatus for causing one or more processors to execute the above. [Explanation of symbols]

[0074] 1: Image forming device 11: Control section 12: Operation display section 14: Image reading unit 15: Image forming section 16: Communication I / F 17: Storage section 111: Reception department 112: Detection processing unit 113: Acquisition processing unit 114: Judgment processing unit 115: Handling processing unit D1: Judgment information

Claims

1. a detection processing unit that detects an error in a predetermined program stored in the image forming apparatus when the image forming apparatus is started; an acquisition processing unit that acquires history information of a job executed during a previous operation of the image forming apparatus when an error in the program is detected; a determination processing unit that determines whether or not the error is a tampering error of the program based on the history information; a processing unit that executes a processing for the error based on a determination result of the determination unit; An image forming apparatus comprising:

2. the handling processing unit issues a warning indicating that the program has been tampered with and cuts off a network of the image forming apparatus when the determination processing unit determines that the error is a program tampering error. The image forming apparatus according to claim 1 .

3. the handling processing unit issues warning information indicating that the program is corrupted when the determination processing unit determines that the error is not a tampering error of the program. The image forming apparatus according to claim 1 .

4. the determination processing unit refers to a storage unit that stores the execution history of the job in association with a level indicating a possibility that the program may be tampered with, and determines that the error is a tampering error of the program when the level associated with the job is equal to or greater than a threshold value.

4. The image forming apparatus according to claim 1.

5. the determination processing unit determines that the error is a program tampering error when the job having the level equal to or higher than the threshold exists in the storage unit; The image forming apparatus according to claim 4 .

6. In the storage unit, a first level is set for a copy job or a scan job executed in the image forming apparatus, and a second level higher than the first level is set for a print job of data input via a network or an external storage, the determination processing unit determines that the error is a program tampering error when the job of the second level exists in the storage unit; The image forming apparatus according to claim 5 .

7. the determination processing unit refers to an access history for a non-volatile memory in which the program is stored, and determines that the error is a tampering error of the program when there is writing to a program area, and determines that the error is not a tampering error of the program when there is no writing to the program area.

4. The image forming apparatus according to claim 1.

8. a detection step of detecting an error in a predetermined program stored in the image forming apparatus when the image forming apparatus is started; an acquiring step of acquiring history information of a job executed during a previous operation of the image forming apparatus when an error in the program is detected; a determining step of determining whether the error is a tampering error of the program based on the history information; a countermeasure step of executing a countermeasure process for the error based on a result of the determination step; A method for controlling an image forming apparatus comprising the steps of:

Images