Server, first communication device, computer program for server, and computer program for first communication device

Abstract

To provide a novel technology that can appropriately cope with an attack from an external device.SOLUTION: A server may include: a memory which stores vulnerability identification information and countermeasure information in association with each other; a receiving unit which receives attack detection information from a first communication device, where the attack detection information contains an IP address of an external device, a destination port number contained in a packet of the specific attack, and specific vulnerability identification information for identifying specific vulnerability to a specific attack; and a first transmission unit which transmits attack countermeasure information to a second communication device when the attack detection information is received from the first communication device, where the attack countermeasure information contains an IP address contained in the attack detection information, a destination port number contained in the attack detection information, and the specific countermeasure information stored in the memory in association with the specific vulnerability identification information contained in the attack detection information.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] This specification discloses a technique for dealing with attacks on a communication device from an external device. [Background technology]

[0002] Patent Document 1 discloses a communication system including a server, a management device, and multiple IP routers. The management device receives attack detection information from the IP router that detects an attack, and determines the type of attack according to the number of attacks detected in the entire network. The management device identifies a bit pattern related to the type of attack (destination IP address, source IP address, source port number, destination port number, protocol, etc. of the IP packet), and notifies other IP routers to defend against flows that match the bit pattern. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2006-067078 A [Patent Document 2] JP 2008-244726 A Summary of the Invention [Problem to be solved by the invention]

[0004] This specification provides a technique that can appropriately deal with attacks from external devices by using a method different from the conventional one. [Means for solving the problem]

[0005] This specification discloses a server. The server may include: a memory that stores vulnerability identification information for identifying a vulnerability of a communication device and handling information indicating a handling method for the vulnerability in association with each other for each of a plurality of types of vulnerabilities of the communication device; a receiving unit that receives, from a first communication device, attack detection information indicating that a specific attack from an external device has been detected, the attack detection information including an IP address of the external device, a destination port number included in a packet of the specific attack, and specific vulnerability identification information for identifying a specific vulnerability corresponding to the specific attack; and a first transmitting unit that transmits the attack handling information to a second communication device different from the first communication device when the attack detection information is received from the first communication device, the attack handling information including the IP address included in the attack detection information, the destination port number included in the attack detection information, and specific handling information stored in the memory in association with the specific vulnerability identification information included in the attack detection information.

[0006] According to the above configuration, the server includes a memory that stores vulnerability identification information and handling information for each of a plurality of types of vulnerabilities in association with each other. For this reason, the server can transmit specific handling information associated with specific vulnerability identification information included in the attack detection information to the second communication device. Therefore, the second communication device can appropriately handle a specific attack according to the specific handling information.

[0007] This specification also discloses the following first communication device: The first communication device may include a memory that stores, for each of a plurality of types of vulnerabilities of the communication device, a vulnerability and handling information indicating a handling method for the vulnerability in association with each other, a detection unit that detects a specific attack from an external device, and a first transmission unit that transmits attack handling information to a second communication device when the specific attack is detected, the attack handling information including an IP address of the external device, a destination port number included in a packet of the specific attack, and specific handling information stored in the memory in association with a specific vulnerability corresponding to the specific attack.

[0008] According to the above configuration, the first communication device includes a memory that stores countermeasure information indicating a countermeasure method for each of a plurality of types of vulnerabilities of the communication device. For this reason, the first communication device can transmit specific countermeasure information indicating a countermeasure method for a specific vulnerability corresponding to a specific attack from an external device to the second communication device. Therefore, the second communication device can appropriately counter the specific attack according to the specific countermeasure information.

[0009] A computer program for implementing the above-mentioned server, a computer-readable storage medium storing the computer program, and a method executed by the server are also novel and useful. A computer program for implementing the above-mentioned first communication device, a computer-readable storage medium storing the computer program, and a method executed by the first communication device are also novel and useful. A communication system including the above-mentioned server and the first communication device is also novel and useful. [Brief description of the drawings]

[0010] [Figure 1] 1 shows the configuration of a communication system. [Diagram 2] An example of each list is shown below. [Diagram 3] 1 shows a sequence diagram of a first embodiment. [Figure 4] The sequence diagram continues from Figure 3. [Diagram 5] 13 shows a sequence diagram of the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] (First Example) (Configuration of communication system 2; Figure 1) 1, the communication system 2 includes a plurality of printers 10, 200, a terminal 50, a management server 100, and an external terminal 60. The printers 10, 200 and the terminal 50 are connected to a LAN (abbreviation of Local Area Network) 6, and can communicate with each other via the LAN 6. The LAN 6 may be either a wired LAN or a wireless LAN. The LAN 6 is connected to the Internet 4. The devices 10, 50, 60, 100, 200 can communicate with each other via the Internet 4.

[0012] (10,200 printers) Each of the printers 10, 200 is a peripheral device (for example, a peripheral device of the terminal 50) capable of executing a printing function. The printer 10 has a device ID "DV1". The printer 10 includes an operation unit 12, a display unit 14, a communication interface 16, a print execution unit 18, and a control unit 30. In the following, the interface is referred to as "I / F".

[0013] The operation unit 12 is an interface for inputting various information to the printer 10, and includes buttons, a touch screen, etc. The display unit 14 is a display or panel for displaying various information. The communication I / F 16 is an interface for executing communication with other devices. The communication I / F 16 is connected to the LAN 6. The communication I / F 16 may be a wired I / F or a wireless I / F. The print execution unit 18 has an electrophotographic, inkjet, or thermal print engine.

[0014] The control unit 30 includes a CPU 32 and a memory 34. The memory 34 includes a main storage device and an auxiliary storage device, not shown. The CPU 32 executes various processes according to a program 40 stored in the auxiliary storage device of the memory 34. Specifically, the CPU 32 executes the above-mentioned various processes by loading the program 40 from the auxiliary storage device to the main storage device and executing the program 40. The main storage device is, for example, a RAM and a cache memory. The auxiliary storage device may be, for example, a flash memory, an SSD (short for Solid State Drive), or a ROM, or a combination thereof. The memory 34 further stores a detection list 42.

[0015] The printer 200 has a device ID "DV2". The printer 200 includes an operation unit 212, a display unit 214, a communication I / F 216, a print execution unit 218, and a control unit 230. The control unit 230 includes a CPU 232 and a memory 234. The units 212 to 234 are similar to the units 12 to 34 of the printer 10. The memory 234 stores a program 240, and stores a blacklist 242 instead of the detection list 42.

[0016] (Configuration of Management Server 100) The management server 100 is installed on the Internet 4 by the vendor of the printers 10 and 200. In a modified example, the management server 100 may be installed on the Internet 4 by a business entity other than the vendor. In another modified example, the vendor of the printers 10 and 200 may not prepare the hardware for the management server 100 by itself, but may use an environment provided by an external cloud computing service. In this case, the vendor of the printers 10 and 200 may prepare a program (i.e., software) for the management server 100 and implement the program in the above-mentioned environment to realize the management server 100.

[0017] The management server 100 includes a network I / F 116 and a control unit 130. The network I / F 116 is connected to the Internet 4. The control unit 130 includes a CPU 132 and a memory 134. The CPU 132 executes various processes in accordance with a program 140 stored in the memory 134. The memory 134 is composed of a volatile memory, a non-volatile memory, and the like. The memory 134 further stores a blacklist 142, a device list 144, and a VID list 146.

[0018] (Configuration of terminal 50 and external terminal 60) The terminal 50 is an administrator terminal used by an administrator of the printers 10 and 200. The external terminal 60 is a third party terminal capable of attacking the printers 10 and 200 via the Internet 4. The external terminal 60 has a device ID "DV3". The terminal 50 and the external terminal 60 are, for example, portable terminal devices such as mobile phones, smartphones, PDAs, notebook PCs, and tablet PCs. In a modified example, the terminal 50 and the external terminal 60 may be stationary terminal devices such as desktop PCs.

[0019] Types of attacks that the printer 10, 200 may receive from an external device (e.g., the external terminal 60) via the Internet 4, i.e., types of vulnerabilities of the printer 10, 200, include, for example, SQL injection, cross-site scripting, CSRF (cross-site request forgery), directory traversal, OS command injection, improper session management, HTTP header injection, and unauthorized mail relay.

[0020] (Composition of each list; Figure 2) Next, the printers 10 and 200, and the detection list 42, blacklist 242, blacklist 142, device list 144, and VID list 146 in the management server 100 will be described with reference to FIG.

[0021] In the detection list 42 of the printer 10, an IP address (e.g., "IP3"), a port number (e.g., "PN1"), a VID (short for Vulnerability ID) (e.g., "VID1"), and a date and time (e.g., "T1") are stored in association with each other. Each piece of information in the detection list 42 is information that is stored when the printer 10 detects an attack from an external device (e.g., the external terminal 60) with which the printer 10 can communicate via the Internet 4. The IP address is the IP address of the external device that is the source of the attack. The port number is the destination port number included in the attack packet. The VID is information that identifies the vulnerability of the printer 10 corresponding to the attack. The date and time is the date and time when the attack was detected.

[0022] In the blacklist 142 of the management server 100, an IP address (e.g., "IP3"), a port number (e.g., "PN1"), a VID (e.g., "VID1"), a device ID (e.g., "DV1"), and a date and time (e.g., "T2") are stored in association with one another. The blacklist 142 is information that is stored when the management server 100 receives, from the printer 10, attack detection information indicating that an attack from an external device has been detected. The IP address, port number, and VID of the blacklist 142 are the same as the IP address, port number, and VID of the detection list 42 of the printer 10. The device ID is the device ID of the printer that sent the attack detection information. The date and time is information indicating the date and time when the attack detection information was received.

[0023] In the device list 144, the printer model name (e.g., "M1", "M2"), the printer firmware version (e.g., "V1", "V2"), the device ID (e.g., "DV1"), the owner ID (e.g., "OW1"), and the owner email address (e.g., "MA1") are stored in association with each other. The device list 144 is information showing a list of the printers managed by the management server 100, and is stored, for example, by the owner of each printer accessing the management server 100. The owner ID is user identification information designated by the user of the printer (e.g., the administrator of the terminal 50). The owner email address is the email address of the user (i.e., the administrator of the terminal 50).

[0024] In the VID list 146, the printer model name (e.g., "M2"), the printer firmware version (e.g., "V2"), the VID "VID1", and a workaround (e.g., "WA1", "WA2", "WA3") are stored in association with each other. The VID list 146 is information stored by the printer vendor, and for printers having specific vulnerabilities, the model name, firmware version, VID, and workaround are associated with each other. The workaround is information indicating how to deal with the vulnerability.

[0025] In the blacklist 242 of the printer 200, an IP address (e.g., "IP3"), a port number (e.g., "PN1"), a workaround (e.g., "WA1", "WA2", "WA3"), and a date and time (e.g., "T3") are stored in association with each other. The blacklist 242 is information that is stored when the printer 200 receives attack response information from the management server 100. The workaround is information indicating a method of dealing with a vulnerability and includes a priority order. In the example of FIG. 2, WA1, which is located on the far left, has the highest priority order, and WA3, which is located on the far right, has the lowest priority order. The date and time are the date and time when the attack response information was received.

[0026] (First embodiment; Figures 3 and 4) 3 and 4, a process for dealing with an attack on the printers 10, 200 from the external terminal 60 will be described. A program for implementing a proper method for dealing with an external attack is stored in advance in the printer 10 by the vendor of the printer 10. The printer 200 does not store a program for implementing a proper method for dealing with an external attack.

[0027] In the following, for ease of understanding, the processes executed by each CPU of each device (e.g., CPU 32 of printer 10) will be described as being mainly about each device itself (e.g., printer 10) rather than each CPU. Also, communication executed by each device is executed via the communication I / F of each device (e.g., communication I / F 16 of printer 10). Therefore, in the following, when describing processes related to communication via a communication I / F, the phrase "via a communication I / F" will be omitted.

[0028] At T10, the external terminal 60 executes an attack on the printer 10. The attack packet includes the IP address "IP3" of the external terminal 60 and the destination port number "PN1."

[0029] When the printer 10 receives an attack packet from the external terminal 60 at T10, the printer 10 detects the attack at T12. When the printer 10 detects that the packet is an external attack, it does not execute the process according to the command contained in the packet. The printer 10 identifies the type of attack at T14 and executes a normal countermeasure against the attack. As an example, if the type of attack corresponds to a directory traversal vulnerability of the printer 10, the printer 10 prohibits the specification of a path having a specified directory structure as a normal countermeasure.

[0030] Next, at T16, the printer 10 identifies the VID "VID1" that identifies the vulnerability corresponding to the attack detected at T12, and at T18 associates the IP address "IP3" of the external terminal 60, the destination port number "PN1" included in the attack packet, the identified VID "VID1", and the reception date and time "T1" of the attack packet, and stores them in the detection list 42. Next, at T20, the printer 10 transmits attack detection information including the IP address "IP3", the port number "PN1", the VID "VID1", and the device ID "DV1" of the printer 10 to the management server 100.

[0031] When the management server 100 receives the attack detection information from the printer 10 in T20, in T22, the management server 100 associates the IP address "IP3", the port number "PN1", the VID "VID1", and the device ID "DV1" of the printer 10 included in the received attack detection information with the reception date and time "T2" of the attack detection information in the blacklist 142. Next, in T24, the management server 100 identifies the owner ID "OW1" associated with the received device ID "DV1" from the device list 144. Then, in T26, the management server 100 identifies the device ID "DV2" associated with the identified owner ID "OW1" from the device list 144, which is different from the received device ID "DV1". This allows the management server 100 to identify the printer (i.e., the printer 200 in this case) to which the attack response information described below is to be sent.

[0032] Next, in T28, the management server 100 identifies the model "M2" and version "V1" associated with the received VID "VID1" from the VID list 146. Then, in T30, the management server 100 identifies the model "M2" and version "V2" associated with the identified device ID "DV2" (see T26) from the device list 144.

[0033] 4, the management server 100 determines whether the model "M2" and version "V1" identified in T28 match the model "M2" and version "V2" identified in T30. If the management server 100 determines that they match (YES in T32), the process proceeds to T34. On the other hand, if the management server 100 determines that they do not match (NO in T32), the process proceeds to T50.

[0034] In T34, the management server 100 performs name resolution using a DNS server to identify the IP address "IP2" of the printer identified by the identified device ID "DV2". Next, in T36, the management server 100 identifies from the VID list 146 a plurality of workarounds "WA1", "WA2", and "WA3" associated with the model "M2", the version "V2", and the VID "VID1".

[0035] The management server 100 assigns priorities to the multiple identified workarounds "WA1", "WA2", and "WA3" and stores them. In this case, the higher the VID list, the higher the priority. Therefore, "WA1" has the highest priority, and "WA3" has the lowest priority. The priority is information for determining which workaround the printer should execute when there are two or more workarounds for one VID (e.g., "VID1").

[0036] In T40, the management server 100 transmits attack response information including the IP address "IP3" already received in T20, the port number "PN1" already received in T20, the VID "VID1" already received in T20, and multiple workarounds "1-WA1", "2-WA2", and "3-WA3" with priorities assigned. The IP address "IP2" already identified in T34 is specified as the destination IP address of the attack response information. Therefore, the management server 100 can transmit the attack response information to the printer 200.

[0037] When the printer 200 receives attack response information from the management server 100 at T40, at T42, the printer 200 associates the IP address "IP3", the port number "PN1", the multiple workarounds "1-WA1", "2-WA2", and "3-WA3", and the date and time "T3" of receipt of the attack response information contained in the received attack response information and stores them in the blacklist 242.

[0038] In T50, the management server 100 notifies the administrator identified by the owner ID "OW1" identified in T24 of a warning. Specifically, the device list 144 stores an email address "MA1" in association with the owner ID "OW1". The management server 100 sends a warning email indicating that an attack has occurred on the printer 10, with the email address "MA1" as the destination address. This allows the terminal 50 to receive and display the warning email. The administrator of the printer 10, 200 can learn that an attack has occurred on the printer by viewing the warning email.

[0039] After that, at T60, the external terminal 60 executes an attack on the printer 200. The attack packet includes the IP address "IP3" of the external terminal 60 and the destination port number "PN1."

[0040] When the printer 200 receives an attack packet from the external terminal 60 in T60, the printer 200 detects the attack in T62. The printer 200 identifies a plurality of workarounds "1-WA1", "2-WA2", and "3-WA3" associated with the IP address "IP3" and the port number "PN1" from the blacklist 242. Next, the printer 200 identifies the workaround that is executable by the printer 200 and has the highest priority from the plurality of workarounds. In this case, the printer 200 identifies the workaround "WA1". Then, the printer 200 uses the workaround "WA1" to deal with the attack in T64. In this way, the printer 200 can use the workaround with the highest priority from among the plurality of workarounds.

[0041] A workaround is information indicating a temporary method of dealing with a vulnerability. As an example, in the present embodiment, in T10 in Fig. 3, if the type of attack that the printer 10 receives from the external terminal 60 corresponds to a vulnerability of directory traversal, and in T64 in Fig. 4, if the printer 200 receives a similar attack from the external terminal 60, the printer 200 blocks access to the protected assets, i.e., a part of the memory, as a workaround. This method of dealing with a vulnerability corresponds to, for example, workaround WA1.

[0042] As another example, a workaround may be to prohibit all access to a specific destination port number. For example, in the above embodiment, all access to port number "PN1" is prohibited in T64. This countermeasure corresponds to, for example, workaround WA2. In this way, even in a situation where the printer 10 is unable to execute a normal countermeasure against an attack, the printer 200 can appropriately deal with the attack by executing a workaround.

[0043] As another example, a certain workaround may be to transmit header information included in a packet from an external terminal to the management server 100. For example, in the above embodiment, in T64, the printer 200 transmits header information included in an attack packet to the management server 100. The management server 100 verifies the received header information and transmits the verification result to the printer 200. The verification includes, for example, judging whether the header information includes information indicating an attack (for example, an IP address of a device known as an attacking terminal). The verification result includes, for example, information indicating a countermeasure against the attack. The printer 200 counters the attack from the external terminal 60 according to the received verification result. In this way, the printer 200 can appropriately counter the attack by executing a workaround even in a situation where the printer 10 cannot execute a regular countermeasure against the attack received. The workaround is, for example, a provisional countermeasure against the vulnerability of HTTP header injection.

[0044] As another example, a workaround may be to block access to a database, e.g., as a temporary measure to address a SQL injection vulnerability.

[0045] As another example, a workaround may be to block script execution, e.g., as a temporary measure to address a cross-site scripting vulnerability.

[0046] As another example, a workaround may be to block OS commands, e.g., as a temporary measure to address an OS command injection vulnerability.

[0047] As another example, a workaround may be to use another means for generating a session ID, which is, for example, a temporary measure to address the vulnerability of improper session management.

[0048] As another example, a workaround may be to block email relaying, for example, as a temporary measure to address an email relay vulnerability.

[0049] As another example, a workaround may be to block connections to the IP address of the external terminal 60 and the destination port number included in the attack packet.

[0050] Although not shown in the figure, if the management server 100 does not receive attack detection information including the IP address "IP3", destination port number "PN1", and VID "VID1" of the external terminal 60 from another communication device (e.g., printer 10) for a predetermined time after transmitting attack response information to the printer 200 at T40, the management server 100 transmits attack end information including the IP address "IP3" and destination port number "PN1" to the printer 200. When the printer 200 receives the attack end information, it erases all information stored in the blacklist 242 in association with the received IP address "IP3" and destination port number "PN1". This makes it possible to manage the blacklist 242 without putting pressure on the capacity of the memory 234 of the printer 200.

[0051] (Effects of this embodiment) According to the above configuration, the management server 100 includes a VID list 146 that stores a VID and a workaround in association with each other for each of a plurality of types of vulnerabilities. For this reason, the management server 100 can transmit the workarounds "WA1", "WA2", and "WA3" associated with the VID "VID1" included in the attack detection information to the printer 200 (T40 in FIG. 4). Therefore, even in a situation where the printer 10 is unable to execute a normal method of dealing with an attack that has been received by the printer 10, the printer 200 can appropriately deal with the attack according to the workarounds "WA1", "WA2", and "WA3" (T64 in FIG. 4).

[0052] (Correspondence) The management server 100, the printer 10, the external terminal 60, and the printer 200 are examples of a "server", a "first communication device", an "external device", and a "second communication device", respectively. The VID and VID1 are examples of "vulnerability identification information" and "specific vulnerability identification information", respectively. The workaround and the workarounds "WA1", "WA2", and "WA3" are examples of "handling information" and "specific handling information", respectively. The device ID "DV1" of the printer 10 is an example of "first attribute-related information", "device identification information", and "first device identification information". The owner ID "OW1" is an example of "second attribute-related information". The device ID "DV2" of the printer 200 is an example of "second device identification information". The model and firmware version are examples of "device type information". In T28 of FIG. 3, the model "M1" and firmware version "V1" identified from "VDI1" are examples of "first device type information". In T30 in FIG. 3, the model "M1" and firmware version "V1" identified from "DV2" are an example of "second device type information."

[0053] T20 in FIG. 3 is an example of a process executed by a "receiving unit". T40 in FIG. 4 is an example of a process executed by a "first transmitting unit". In paragraph 0043, a process in which the management server 100 transmits a verification result to the printer 200 is an example of a process executed by a "second transmitting unit". In paragraph 0050, a process in which the management server 100 transmits attack end information to the printer 200 is an example of a process executed by a "third transmitting unit". T50 in FIG. 4 is an example of a process executed by a "notifying unit".

[0054] (Second embodiment: Figure 5) Next, a second embodiment will be described. This embodiment differs from the first embodiment in that the printer 10 includes a workaround list 44 and a detection list 46 instead of the detection list 42, and in that the management server 100 does not exist.

[0055] 2, in the workaround list 44, for each of a plurality of types of attacks (i.e., a plurality of types of vulnerabilities), the attack (i.e., vulnerability) (e.g., "A1") and a workaround (e.g., "WA4", "WA5") are stored in association with each other. The workaround list 44 is information indicating a workaround that is a method of dealing with an attack from an external terminal 60. In the detection list 46, an IP address (e.g., "IP3"), a port number (e.g., "PN1"), a workaround (e.g., "WA4", "WA5"), and a date and time (e.g., "T4") are stored in association with each other. The date and time is the date and time when the attack was detected.

[0056] In T100, the printer 10 transmits a search signal to the LAN 6 by broadcast. The search signal is a signal for inquiring about the IP addresses of devices belonging to the LAN 6. The search signal includes the IP address of the printer 10, "IP1", as the source IP address. In T102, the printer 10 receives a response signal from the printer 200. The response signal includes the IP address of the printer 200, "IP2", as the source IP address. In T104, the printer 10 stores the received IP address, "IP2", in the memory 34. The search signal is transmitted, for example, when the printer 10 is started. This allows the printer 10 to manage the IP addresses of the devices belonging to the LAN 6 while periodically updating them.

[0057] T110 to T114 are the same as T10 to T14 in FIG. 3. In T116, the printer 10 identifies the workarounds "WA4" and "WA5" stored in association with the attack A1 from the workaround list 44, and in T118, associates the IP address "IP3" of the external terminal 60, the destination port number "PN1" included in the attack packet, the identified workarounds "WA4" and "WA5", and the time "T4" at which the attack packet was received, and stores them in the detection list 46. Next, in T120, the printer 10 transmits attack detection information including the IP address "IP3", the port number "PN1", and the workarounds "WA4" and "WA5" to the printer 200. The attack detection information specifies the IP address "IP2" already acquired in T102 as the destination IP address. At this time, the workarounds "WA4" and "WA5" are given priority.

[0058] When printer 200 receives attack detection information from printer 10 at T120, printer 200 associates the IP address "IP3", port number "PN1", and multiple workarounds "1-WA4", "2-WA5", and the date and time of receipt of the attack detection information "T5" contained in the received attack detection information and stores them in blacklist 242 at T122.

[0059] T130 to T134 are similar to T60 to T64 in FIG. 4, except that T130 to T134 are addressed by WA4 instead of WA1.

[0060] (Effects of this embodiment) According to the above configuration, the printer 10 has a workaround list 44 that stores, for each of a plurality of types of attacks (i.e., a plurality of types of vulnerabilities), a vulnerability and a workaround indicating a method of dealing with the vulnerability in association with each other. For this reason, the printer 10 can transmit the workarounds "WA4" and "WA5" indicating a method of dealing with the vulnerability corresponding to the attack "A1" from the external terminal 60 to the printer 200 (T120). Therefore, even in a situation where the printer 10 is unable to execute a normal method of dealing with the attack it has received, the printer 200 can appropriately deal with the attack according to the workaround "WA4" (T134).

[0061] When the printer 200 detects an attack in T132, the printer 200 identifies from the blacklist 242 a plurality of workarounds "1-WA4" and "2-WA5" that are associated with the IP address "IP3" and the port number "PN1". Next, the printer 200 identifies, from the plurality of workarounds, the workaround that is executable by the printer 200 and has the highest priority. In this case, the printer 200 identifies the workaround "WA4". Then, in T134, the printer 200 uses the workaround "WA4" to deal with the attack. In this way, the printer 200 can use the workaround with the highest priority among the plurality of workarounds.

[0062] As an example, a workaround may be to prohibit all access to a specific destination port number. For example, in the above embodiment, all access to port number "PN1" is prohibited in T134. In this way, even in a situation where the printer 10 is unable to execute a normal method of dealing with an attack, the printer 200 can appropriately deal with the attack by executing a workaround.

[0063] (Correspondence) 5 are examples of the processing realized by a "first transmission unit" and a "second transmission unit", respectively. T102 is an example of the processing realized by a "reception unit".

[0064] Although specific examples of the technology disclosed in this specification have been described in detail above, these are merely examples and do not limit the scope of the claims. The technology described in the claims includes various modifications and variations of the specific examples exemplified above. Modifications of the above embodiments are listed below.

[0065] (Variation 1) In T20 of FIG. 3, the attack detection information does not need to include the device ID "DV1". In this case, the processes of T24 of FIG. 3 to T36 of FIG. 5 are not executed. Instead of these processes, the management server 100 may identify the workarounds "WA1", "WA2", and "WA3" stored in association with the received VID "VID1", and transmit the attack response information to all devices. Generally speaking, the "attack detection information" does not need to include the "first attribute related information".

[0066] (Variation 2) The "first attribute-related information" does not have to be a device ID, and may be, for example, an owner ID. In this case, the process of T24 in FIG. 3 is not executed. The "first attribute-related information" may also be a group ID for identifying a group of printers 10. In this case, the processes of T24 and T26 are not executed. Instead of these processes, the management server 100 may identify the device name "DV2" of a device having the same group ID from the group ID that has already been received.

[0067] (Variation 3) The process of T50 in Fig. 4 does not have to be executed. In this modification, the "notification unit" can be omitted.

[0068] (Variation 4) When a predetermined time has passed since the date and time "T1" when the printer 10 detected an attack from the external terminal 60 without receiving an attack from the external terminal 60, the printer 10 may erase from the detection list 42 all information stored in association with the IP address "IP3" of the external terminal 60 and the destination port number "PN1". Similarly, when a predetermined time has passed since the date and time "T3" when the printer 200 received attack response information from the management server 100 without receiving an attack from the external terminal 60, the printer 10 may erase from the blacklist 242 all information stored in association with the IP address "IP3" of the external terminal 60 and the destination port number "PN1". In this modified example, the "third transmission unit" can be omitted.

[0069] (Variation 5) The attack countermeasure information does not have to include multiple workarounds "WA1", "WA2", and "WA3", and may include only one workaround.

[0070] The technical elements described in this specification or drawings have technical utility either alone or in various combinations, and are not limited to the combinations described in the claims at the time of filing. In addition, the technologies illustrated in this specification or drawings can achieve multiple objectives simultaneously, and achieving one of these objectives is itself technically useful.

[0071] In the scope of the claims at the time of filing of this patent application, even if each claim is dependent on only some of the claims, it is not limited to the fact that each claim can be dependent on only those some of the claims. Each claim can also be dependent on other claims that are not dependent on it at the time of filing to the extent that there is no technical contradiction. In other words, the technology of each claim can be combined in various ways as follows: (Item 1) A server, a memory that stores vulnerability identification information for identifying each of a plurality of types of vulnerabilities of a communication device and countermeasure information indicating a countermeasure method for the vulnerability in association with each other; a receiving unit that receives, from a first communication device, attack detection information indicating that a specific attack from an external device has been detected, the attack detection information including an IP address of the external device, a destination port number included in a packet of the specific attack, and specific vulnerability identification information that identifies a specific vulnerability corresponding to the specific attack; a first transmission unit that transmits attack response information to a second communication device different from the first communication device when the attack detection information is received from the first communication device, the attack response information including the IP address included in the attack detection information, the destination port number included in the attack detection information, and specific response information stored in the memory in association with the specific vulnerability identification information included in the attack detection information; A server comprising: (Item 2) 2. The server according to item 1, wherein the countermeasure indicated by the specific countermeasure information is to prohibit all access to the destination port number. (Item 3) the handling method indicated by the specific handling information is to transmit header information included in a packet from the external device to the server, The server further comprises: 2. The server according to claim 1, further comprising: a second transmitting unit that, when the header information is received from the second communication device, verifies the header information and transmits a verification result to the second communication device. (Item 4) The attack detection information further includes first attribute-related information related to an attribute of the first communication device; The first transmission unit is Using the first attribute-related information included in the attack detection information, the second communication device having an attribute matching an attribute of the first communication device is identified; 4. The server according to any one of items 1 to 3, wherein the server determines the identified second communication device as a communication device to which the attack response information is to be transmitted. (Item 5) The memory further stores, for each of the plurality of communication devices, device identification information for identifying the communication device and second attribute-related information related to an attribute of the communication device in association with each other; the first attribute-related information is first device identification information that identifies the first communication device; The first transmission unit is Identifying the second attribute-related information stored in the memory in association with the first device identification information, which is the first attribute-related information included in the attack detection information; identifying second device identification information stored in the memory in association with the second attribute-related information; 5. The server according to item 4, which determines the second communication device identified by the specified second device identification information as a communication device to which the attack response information is to be transmitted. (Item 6) The memory includes: storing, for each of the plurality of types of vulnerabilities, the vulnerability identification information for identifying the vulnerability, the countermeasure information indicating a countermeasure method for the vulnerability, and device type information, which is at least one of a model name and a firmware version of a communication device having the vulnerability, in association with each other; storing, for each of the plurality of communication devices, device identification information for identifying the communication device, second attribute-related information relating to an attribute of the communication device, and device type information, which is at least one of a model name and a firmware version of the communication device, in association with each other; The first transmission unit further includes: identifying first device type information stored in the memory in association with the specific vulnerability identification information included in the attack detection information; Identifying second device type information stored in the memory in association with the identified second device identification information; Item 6. The server according to item 5, wherein when the identified first device type information and the identified second device type information match, the server determines the second communication device identified by the identified second device identification information as the communication device to which the attack response information is to be sent. (Item 7) The attack detection information further includes first attribute-related information related to an attribute of the first communication device; The server further comprises: 7. The server according to any one of items 1 to 6, further comprising a notification unit that uses the first attribute-related information included in the attack detection information to notify an administrator corresponding to an attribute of the first communication device of warning information. (Item 8) The server further comprises: 8. The server according to any one of claims 1 to 7, further comprising a third transmission unit that transmits attack end information including the IP address and the destination port number of the external device to the second communication device when a predetermined time has elapsed after the attack handling information is transmitted to the second communication device without other attack detection information including the IP address, the destination port number, and the specific vulnerability identification information of the external device being received. (Item 9) the memory stores the specific vulnerability identification information in association with a plurality of pieces of specific countermeasure information indicating a plurality of countermeasure methods for the specific vulnerability; A priority order is determined for the plurality of specific handling information, 9. The server according to any one of items 1 to 8, wherein the attack response information includes the plurality of specific response information in a manner that allows the second communication device to recognize priority. (Item 10) A first communication device, a memory that stores, for each of a plurality of types of vulnerabilities of a communication device, the vulnerability and countermeasure information indicating a countermeasure method for the vulnerability in association with each other; A detection unit that detects a specific attack from an external device; a first transmission unit that transmits attack response information to a second communication device when the specific attack is detected, the attack response information including an IP address of the external device, a destination port number included in a packet of the specific attack, and specific response information stored in the memory in association with a specific vulnerability corresponding to the specific attack; A first communication device comprising: (Item 11) Item 11. The first communication device according to item 10, wherein the countermeasure indicated by the specific countermeasure information is to prohibit all access to the destination port number. (Item 12) The first communication device further comprises: a second transmitting unit configured to transmit a search signal to a communication network to which the first communication device belongs; a receiving unit that receives a response signal from the second communication device by using the communication network in response to the transmission of the search signal; Item 11. The first communication device according to item 10, wherein the first transmission unit transmits the attack response information to an IP address of the second communication device included in the already received response signal as a destination. (Item 13) the memory stores a specific vulnerability corresponding to the specific attack and a plurality of pieces of specific countermeasure information indicating a plurality of countermeasure methods for the specific vulnerability in association with each other; A priority order is determined for the plurality of specific handling information, 12. The first communication device according to item 10 or 11, wherein the attack response information includes the plurality of specific response information in a manner that allows the second communication device to recognize priority. [Explanation of symbols]

[0072] 2: communication system, 4: Internet, 6: LAN, 10: printer, 12: operation unit, 14: display unit, 16: communication I / F, 18: print execution unit, 20: control unit, 32: CPU, 34: memory, 40: OS program, 42: detection list, 44: workaround list, 46: detection list, 50: terminal, 60: external terminal, 100: management server, 116: network I / F, 130: control unit, 132: CPU, 134: memory, 140: program, 142: blacklist, 144: device list, 146: VID list, 200: printer, 234: memory, 242: blacklist, A1: attack

Claims

1. A server, a memory that stores vulnerability identification information for identifying each of a plurality of types of vulnerabilities of a communication device and countermeasure information indicating a countermeasure method for the vulnerability in association with each other; a receiving unit that receives, from a first communication device, attack detection information indicating that a specific attack from an external device has been detected, the attack detection information including an IP address of the external device, a destination port number included in a packet of the specific attack, and specific vulnerability identification information that identifies a specific vulnerability corresponding to the specific attack; a first transmission unit that transmits attack response information to a second communication device different from the first communication device when the attack detection information is received from the first communication device, the attack response information including the IP address included in the attack detection information, the destination port number included in the attack detection information, and specific response information stored in the memory in association with the specific vulnerability identification information included in the attack detection information; A server comprising:

2. 2. The server according to claim 1, wherein the countermeasure indicated by the specific countermeasure information is to prohibit all access to the destination port number.

3. the handling method indicated by the specific handling information is to transmit header information included in a packet from the external device to the server, The server further comprises: The server according to claim 1 , further comprising: a second transmission unit configured to, when the header information is received from the second communication device, verify the header information and transmit a verification result to the second communication device.

4. The attack detection information further includes first attribute-related information related to an attribute of the first communication device; The first transmission unit is Using the first attribute-related information included in the attack detection information, the second communication device having an attribute matching an attribute of the first communication device is identified; The server according to claim 1 , further comprising: a determining unit configured to determine the second communication device as a communication device to which the attack response information is to be transmitted.

5. The memory further stores, for each of the plurality of communication devices, device identification information for identifying the communication device and second attribute-related information related to an attribute of the communication device in association with each other; the first attribute-related information is first device identification information that identifies the first communication device; The first transmission unit is Identifying the second attribute-related information stored in the memory in association with the first device identification information, which is the first attribute-related information included in the attack detection information; identifying second device identification information stored in the memory in association with the second attribute-related information; The server according to claim 4 , further comprising: determining the second communication device identified by the specified second device identification information as a communication device to which the attack response information is to be transmitted.

6. The memory includes: storing, for each of the plurality of types of vulnerabilities, the vulnerability identification information for identifying the vulnerability, the countermeasure information indicating a countermeasure method for the vulnerability, and device type information, which is at least one of a model name and a firmware version of a communication device having the vulnerability, in association with each other; storing, for each of the plurality of communication devices, device identification information for identifying the communication device, second attribute-related information relating to an attribute of the communication device, and device type information, which is at least one of a model name and a firmware version of the communication device, in association with each other; The first transmission unit further includes: Identifying first device type information stored in the memory in association with the specific vulnerability identification information included in the attack detection information; Identifying second device type information stored in the memory in association with the identified second device identification information; A server as described in claim 5, which determines the second communication device identified by the identified second device identification information as the communication device to which the attack response information is to be sent when the identified first device type information and the identified second device type information match.

7. The attack detection information further includes first attribute-related information related to an attribute of the first communication device; The server further comprises: The server according to claim 1 , further comprising a notification unit that notifies an administrator corresponding to an attribute of the first communication device of warning information by using the first attribute-related information included in the attack detection information.

8. The server further comprises: The server of claim 1, further comprising a third transmitting unit that transmits attack termination information including the IP address and destination port number of the external device to the second communication device when a predetermined time has elapsed after the attack response information is transmitted to the second communication device without other attack detection information including the IP address, destination port number, and the specific vulnerability identification information of the external device being received.

9. the memory stores the specific vulnerability identification information in association with a plurality of pieces of specific countermeasure information indicating a plurality of countermeasure methods for the specific vulnerability; A priority order is determined for the plurality of specific handling information, The server according to claim 1 , wherein the attack response information includes the plurality of specific response information in a manner that allows the second communication device to recognize priority.

10. A first communication device, a memory that stores, for each of a plurality of types of vulnerabilities of a communication device, the vulnerability and countermeasure information indicating a countermeasure method for the vulnerability in association with each other; A detection unit that detects a specific attack from an external device; a first transmission unit that transmits attack response information to a second communication device when the specific attack is detected, the attack response information including an IP address of the external device, a destination port number included in a packet of the specific attack, and specific response information stored in the memory in association with a specific vulnerability corresponding to the specific attack; A first communication device comprising:

11. The first communication device according to claim 10 , wherein the countermeasure indicated by the specific countermeasure information is to prohibit all access to the destination port number.

12. The first communication device further comprises: a second transmitting unit configured to transmit a search signal to a communication network to which the first communication device belongs; a receiving unit that receives a response signal from the second communication device by using the communication network in response to the transmission of the search signal; The first communication device according to claim 10 , wherein the first transmission unit transmits the attack response information to an IP address of the second communication device included in the already received response signal as a destination.

13. the memory stores a specific vulnerability corresponding to the specific attack and a plurality of pieces of specific countermeasure information indicating a plurality of countermeasure methods for the specific vulnerability in association with each other; A priority order is determined for the plurality of specific handling information, The first communication device according to claim 10 , wherein the attack response information includes the plurality of specific response information in a manner that allows the second communication device to recognize priority.

14. A computer program for a server, comprising: The server, a memory that stores vulnerability identification information for identifying each of a plurality of types of vulnerabilities of a communication device and countermeasure information indicating a countermeasure method for the vulnerability in association with each other; The server computer is composed of the following parts: a receiving unit that receives, from a first communication device, attack detection information indicating that a specific attack from an external device has been detected, the attack detection information including an IP address of the external device, a destination port number included in a packet of the specific attack, and specific vulnerability identification information that identifies a specific vulnerability corresponding to the specific attack; a first transmission unit that transmits attack response information to a second communication device different from the first communication device when the attack detection information is received from the first communication device, the attack response information including the IP address included in the attack detection information, the destination port number included in the attack detection information, and specific response information stored in the memory in association with the specific vulnerability identification information included in the attack detection information; A computer program that functions as a

15. A computer program for a first communication device, comprising: The first communication device is a memory that stores, for each of a plurality of types of vulnerabilities of a communication device, the vulnerability and countermeasure information indicating a countermeasure method for the vulnerability in association with each other; The computer of the first communication device comprises the following units: A detection unit that detects a specific attack from an external device; a first transmission unit that transmits attack response information to a second communication device when the specific attack is detected, the attack response information including an IP address of the external device, a destination port number included in a packet of the specific attack, and specific response information stored in the memory in association with a specific vulnerability corresponding to the specific attack; A computer program that functions as a

Images