Information processing system and program

Abstract

To enable an information processing system that is normally operated under a mode with security guaranteed to be temporarily used by a terminal device for which security may not be guaranteed.SOLUTION: A multifunction peripheral 10 operates in a zero trust mode with security guaranteed, as a normal operation mode, or a guest mode in which an external portable terminal device 8 is directly connected to the multifunction peripheral so as to be temporarily available. The multifunction peripheral 10 includes: a setting processing unit 12 which generates transition setting information by allowing an administrator to set processing to be executed during mode transition by selecting whether to backup / restore the settings of the multifunction peripheral 10 during the mode transition or cancelling the job under execution; and a mode switching processing unit 13 which stops Internet connection based on the transition setting information according to an instruction from a user, and activates near field communication to enter the guest mode, or starts Internet connection and deactivates the near field communication to enter the zero trust mode.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to an information processing system and a program. [Background technology]

[0002] Recently, in order to protect their internal networks built using LANs, etc. from security threats, companies are shifting from a perimeter defense model using firewalls to a zero-trust defense model that does not use LANs or firewalls. This is because, in recent years, as working styles have diversified due to telecommuting and shared offices, it is becoming difficult to protect corporate assets with the perimeter defense model.

[0003] Solutions for achieving zero trust security based on the idea of ​​"zero trust," which means not trusting anything without authentication, include SASE (Secure Access Service Edge) and EDR (Endpoint Detection and Response). "SASE" is a new security framework concept that integrates security functions and network functions in IT environments into a single cloud service. "EDR" is an endpoint security solution that collects and analyzes log data from endpoints connected to an organization's internal network from the cloud to detect suspicious behavior and cyber attacks and notify administrators.

[0004] In a ZTNA (Zero Trust Network Access) environment built on the idea of ​​zero trust, an increasing number of companies are using cloud services such as SASE and EDR. In addition, to make MFPs installed in a company's on-premise environment compatible with the ZTNA environment, SASE and EDR agents are installed on the MFPs.

[0005] Incidentally, Patent Document 1 proposes a technology in which one of the functions of a multifunction printer is to accept only data from an external device whose safety has been guaranteed in advance by an SSL (TLS) certificate, the multifunction printer is forced to enter a zero trust mode in which one or more network ports are blocked, and after authenticating the user, the external device, and the multifunction printer in response to a user authentication request from the external device, the multifunction printer executes printing in response to a print request received via a network port that is not blocked in the zero trust mode. With this conventional technology, if the external device is a trustworthy device, various authentications can be performed to allow the multifunction printer to be used temporarily. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] JP 2022-132074 A Summary of the Invention [Problem to be solved by the invention]

[0007] However, a terminal device brought in by an outsider is not necessarily set to ensure security. Therefore, it is usually not possible to allow a terminal device brought in from outside to use an information processing system that is normally operated in a mode in which security is guaranteed. However, there are cases where it would be convenient if it were possible to allow a terminal device whose security may not be guaranteed to use the information processing system even temporarily. For example, this would be the case when a joint developer wants to share data related to joint development that is stored in a terminal device brought in by the joint developer.

[0008] To provide an information processing system that is normally operated in a mode in which security is guaranteed, capable of being temporarily used by a terminal device in which security may not be guaranteed. [Means for solving the problem]

[0009] The information processing system of the present invention is characterized in that it comprises a processor which, in response to instructions from a user, switches between a normal use mode in which security is guaranteed by using a specified security service via the Internet, and a temporary use mode in which communication in a directly connected state is permitted when communication via the Internet is not possible, and which permits the use of an external terminal device only when operating in the temporary use mode.

[0010] The processor may back up settings of the information processing system when the information processing system is operating in the normal use mode, and then transition to the temporary use mode.

[0011] The processor is also characterized in that, when transitioning from the temporary use mode to the normal use mode, it processes so that changes to the settings implemented in the temporary use mode are not reflected in the normal use mode.

[0012] Furthermore, when transitioning from the temporary use mode to the normal use mode, the processor restores the backed up setting contents to the information processing system before starting operation in the normal use mode.

[0013] The processor is further characterized in that, when transitioning from the temporary use mode to the normal use mode, if the setting contents of the information processing system when operating in the temporary use mode differ from the backed-up setting contents, the processor executes a specified process.

[0014] The predetermined process is also characterized by notifying an administrator.

[0015] The predetermined process is characterized in that the process stops the transition to the normal use mode.

[0016] The processor is also characterized in that, if there is a job being executed when transitioning from the normal use mode to the temporary use mode, the processor controls the job so that it is not executed in both the normal use mode and the temporary use mode.

[0017] The processor may perform control to transition to the temporary use mode after waiting for the completion of the job being executed or the completion of processing via the Internet in that job.

[0018] The processor may also control the device to stop transitioning to the temporary use mode.

[0019] The processor may also forcibly terminate the job being executed.

[0020] The processor may also delete data generated during operation in the temporary use mode when transitioning from the temporary use mode to the normal use mode.

[0021] The program of the present invention enables a computer to realize the following functions: in response to instructions from a user, switching between a normal use mode, in which security is guaranteed by using a specified security service via the Internet, and a temporary use mode, in which communication in a directly connected state is permitted when communication via the Internet is not possible, and allowing the use of an external terminal device only when operating in the temporary use mode. Effect of the Invention

[0022] According to the invention described in claim 1, an information processing system that is normally operated in a mode in which security is guaranteed can be temporarily used by a terminal device whose security may not be guaranteed.

[0023] According to the invention as recited in claim 2, it is possible to prevent problems that may occur when the settings are changed during operation in the temporary use mode.

[0024] According to the invention as recited in claim 3, even if fraud is committed in the temporary use mode, it is possible to deal with the fraud so as not to be affected in the normal use mode.

[0025] According to the invention as recited in claim 4, even if the setting contents are changed during operation in the temporary use mode, the original setting contents can be restored.

[0026] According to the invention recited in claim 5, if there is a possibility that the settings have been illegally changed while operating in the temporary use mode, some kind of action can be taken.

[0027] According to the invention recited in claim 6, it is possible to notify the administrator that the setting contents may have been illegally changed.

[0028] According to the invention as set forth in claim 7, it is possible to prevent the device from being unable to operate normally in the normal use mode.

[0029] According to the invention as recited in claim 8, it is possible to prevent problems that may occur when a job being executed is executed in the temporary use mode.

[0030] According to the invention as recited in claim 9, it is possible to wait for the end of the job being executed before transitioning to the temporary use mode.

[0031] According to the invention as recited in claim 10, a job being executed during operation in the normal use mode can be terminated.

[0032] According to the invention as recited in claim 11, it is possible to give priority to switching to the temporary use mode.

[0033] According to the invention as set forth in claim 12, data that may adversely affect operation in the normal use mode can be deleted in advance.

[0034] According to the invention described in claim 13, an information processing system that is normally operated in a mode in which security is guaranteed can be temporarily used by a terminal device whose security may not be guaranteed. [Brief description of the drawings]

[0035] [Figure 1] 1 is an overall configuration diagram showing a network system according to an embodiment of the present invention; [Diagram 2] FIG. 11 is a diagram showing, in a table format, the differences between the zero trust mode and the guest mode in this embodiment. [Diagram 3] 1 is a block diagram showing a configuration of a multifunction peripheral according to an embodiment of the present invention; [Figure 4] FIG. 13 is a diagram showing an example of a guest mode transition process setting screen in the present embodiment. [Diagram 5] FIG. 13 is a diagram showing an example of a zero trust mode transition process setting screen in the present embodiment. [Figure 6] 5 is a flowchart showing a mode switching process in the present embodiment. [Figure 7] FIG. 13 is a diagram showing an example of a guest mode transition instruction screen in the present embodiment. [Figure 8] FIG. 13 is a diagram showing an example of a zero trust mode transition instruction screen in the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0036] Hereinafter, preferred embodiments of the present invention will be described with reference to the drawings.

[0037] Fig. 1 is an overall configuration diagram showing a network system 1 in this embodiment. Fig. 1 shows a configuration in which a cloud 2 and an on-premise environment 3 are connected via the Internet 4. The cloud 2 provides cloud services 5 such as SASE and EDR that support the construction of a zero trust environment to companies and the like that aim to build a ZTNA environment (hereinafter referred to as a "zero trust environment") based on the idea of ​​not trusting anything without authentication, i.e., "zero trust."

[0038] The on-premise environment 3 is an internal system environment of a certain company. In the on-premise environment 3, a PC 6 used individually by a user such as an employee and a multifunction device 10 shared by users are installed. Although one PC 6 and one multifunction device 10 are illustrated in FIG. 1, the number of installed devices is not limited to this example and may be one or more. In the on-premise environment 3 in this embodiment, a firewall is not installed as shown in FIG. 1 in order to conform to a zero trust environment. Furthermore, a LAN is not permanently installed to the extent possible. The PC 6 and the multifunction device 10 are individually connected to the Internet 4 via a SWG (Secure Web Gateway) 7. The SWG 7 is a proxy for safely accessing external communications such as the Internet 4. The SWG 7 plays a role in protecting the user from threats on the Internet 4 not only when the user is in the on-premise environment 3 but also when the user is using a PC or the like outside the on-premise environment 3 such as at home or in a shared office.

[0039] For example, a mobile data communication technology may be used for connection to the Internet 4. In addition, a SASE agent or an EDR agent for using a cloud service 5 such as SASE or EDR is installed in the information processing device such as the PC 6 or the multifunction device 10 installed in the on-premise environment 3, and the information processing device is adapted to the zero trust environment.

[0040] The PC 6 may be realized by a general-purpose hardware configuration that has existed in the past. That is, the PC 6 includes a storage unit such as a ROM, a RAM, and a HDD, a user interface such as a mouse, a keyboard, or a touch panel, a network interface for performing data communication via the Internet 4, and a wireless communication unit for performing short-range communication with other PCs 6 and the multifunction peripherals 10 that exist in the same on-premise environment 3 using WiFi (registered trademark), BLE, or the like.

[0041] The multifunction device 10 is a form of an image forming device equipped with various functions such as a printing function, a copying function, a scanning function, etc., and has a built-in computer. The multifunction device 10 in this embodiment may be realized by a general-purpose hardware configuration that has existed in the past. That is, the multifunction device 10 includes storage means such as a ROM, a RAM, a HDD, etc., a user interface such as an operation panel, a scanner or a printer that realizes the various functions described above, a network interface for performing data communication via the Internet 4, and wireless communication means for performing short-range communication with a PC 6 or another multifunction device 10 that exists in the same on-premise environment 3 by WiFi, BLE, etc.

[0042] The multifunction peripheral 10 in the present embodiment has two operating modes: a "zero trust mode" for normal operation, and a "guest mode" for temporarily allowing a mobile terminal device brought into the on-premise environment 3 from outside to be connected to the multifunction peripheral 10 and used. Of course, other operating modes may be provided.

[0043] The "zero trust mode" corresponds to a security mode in which security is guaranteed. In the multifunction device 10 of the present embodiment, the zero trust mode corresponds to an operation mode during normal operation, that is, a normal use mode. In the zero trust mode, in order to guarantee security, a cloud service 5 such as SASE or EDR can be used as a predetermined security service used via the Internet 4.

[0044] Devices having a network communication function, such as the PC 6 and the multifunction device 10 shown in FIG. 1, generally have one or more network ports and perform data communication with other devices through a specified network port. However, in a zero trust environment that does not use a firewall, if a network port is left open, there is a possibility of being attacked from the outside. For this reason, in the zero trust mode, the opening of network ports is controlled to be limited to the minimum necessary, such as only the network port used for using the cloud service 5. In other words, network ports other than the minimum necessary are controlled to be forcibly blocked. In this way, in the zero trust mode, limiting the opening of network ports is a requirement for ensuring security. Other requirements for ensuring security include the installation of a SASE or EDR agent.

[0045] As described above, the "guest mode" is an operation mode in which a mobile terminal device brought into the on-premise environment 3 from outside is connected to the multifunction device 10 and made temporarily available. The guest mode corresponds to a temporary use mode that allows communication in a directly connected state in a state in which communication via the Internet 4 is not possible. Since the guest mode allows the use of a mobile terminal device brought in from outside, it cannot be said that the guest mode provides a higher level of security assurance than the zero trust mode, but various measures are taken in the environment settings to maintain security to the extent possible in a zero trust environment.

[0046] Here, the operation modes of the zero trust mode and the guest mode are compared. The differences between the operation modes are shown in Fig. 2. In this embodiment, "stop", "disable", "prohibit", etc. are states in which the function cannot be exercised, and all of them mean a "cannot" state. On the other hand, "start", "enable", "allow", etc. are states in which the function can be exercised, and all of them mean a "can" state.

[0047] First, in regard to connection to the Internet 4, in the zero trust mode, it is necessary to use a cloud service 5 such as SASE or EDR or an IdP (ID provider) to guarantee security, so connection to the Internet 4 is possible. On the other hand, in the guest mode, connection to the Internet 4 is not possible in order to prevent information leakage to the outside during use of a mobile terminal device brought in by a third party.

[0048] Concerning short-distance communication, in the zero trust mode, short-distance communication is disabled in order to more reliably guarantee security. In this embodiment, short-distance communication is assumed to be wireless communication by a wireless LAN connection using WiFi Direct (registered trademark) (hereinafter, simply referred to as "WiFi connection") or short-distance wireless communication by BLE (Bluetooth (registered trademark) Low Energy). Of course, if the multifunction device 10 can use other wireless communication functions, those functions are also included. On the other hand, in the guest mode, short-distance communication is enabled in order to realize a connection with a mobile terminal device brought in by a third party.

[0049] The zero trust agent function is enabled in the zero trust mode to ensure security, but is disabled in the guest mode because the cloud service 5 cannot be used via the Internet 4.

[0050] Regarding network ports, zero trust mode and guest mode open only the minimum network ports necessary for data communication and block other network ports.

[0051] Regarding accessing users, in the zero trust mode, it is possible to identify which user accessed what, since it is possible to use the IdP via the Internet 4. On the other hand, in the guest mode, it is not possible to use the cloud service 5 via the Internet 4, so it is basically not possible to identify who accessed what.

[0052] Incidentally, the comparison of the above operation modes corresponds to the technology for constructing the current zero trust environment, and may change with future technological developments. For example, as the functions of SASE and EDR agents improve, it may become possible to use the zero trust agent function even in guest mode. Also, security may improve and short-distance communication may be permitted in zero trust mode. Thus, the differences in the settings of each item in each operation mode are not limited to the above description. Also, FIG. 2 shows items related to the description of this embodiment, and other items not shown in FIG. 2 are not considered to be the same.

[0053] 3 is a block diagram showing a multifunction device 10 according to the present embodiment. The multifunction device 10 has a user interface (UI) unit 11, a setting processing unit 12, a mode switching processing unit 13, an Internet communication control unit 14, a short-range communication control unit 15, a job execution control unit 16, a control unit 17, a transition setting information storage unit 21, a job information storage unit 22, and a backup storage unit 23. Note that components not used in the description of the present embodiment are omitted from the figure.

[0054] The user interface unit 11 accepts user input from an operation panel and displays it on the operation panel. The setting processing unit 12 sets the process to be executed when each operation mode is switched in response to an instruction from a user such as an administrator. The contents set by the setting processing unit 12 are stored in the transition setting information storage unit 21 as transition setting information. The mode switching processing unit 13 switches the operation mode of the multifunction device 10 in response to an instruction from a user who uses the multifunction device 10. In the case of this embodiment, it switches between a zero trust mode and a guest mode. The Internet communication control unit 14 performs communication control such as switching between enabling / disabling data communication via the Internet 4. The short-range communication control unit 15 performs communication control such as switching between enabling / disabling data communication using a short-range wireless communication means. The short-range communication control unit 15 in this embodiment assumes communication control that is executed by connecting to a mobile terminal device 8 brought in by an outsider via WiFi.

[0055] The job execution control unit 16 controls the execution of jobs sent to the multifunction device 10. The job information storage unit 22 stores sent jobs, job logs, etc. The control unit 17 controls the operations of the above components 11 to 16. The backup storage unit 23 stores backup files generated when switching to the guest mode.

[0056] Each of the components 11 to 17 in the multifunction device 10 is realized by the cooperative operation of a computer installed in the multifunction device 10 and a program running on a CPU installed in the computer. Also, each of the storage units 21 to 23 is realized by a HDD installed in the multifunction device 10. Alternatively, a RAM or, if possible, an external storage means may be used via a network.

[0057] Furthermore, the programs used in the present embodiment can be provided not only by communication means, but also by being stored in a computer-readable recording medium such as a USB memory. The programs provided from the communication means or recording medium are installed in a computer, and various processes are realized by the computer's CPU sequentially executing the programs.

[0058] Further, while it is assumed that the "information processing system" in the present embodiment is configured by one multifunction device 10, for example, it may be configured by a plurality of devices.

[0059] Next, the operation of this embodiment will be described.

[0060] In this embodiment, the operation mode of the multifunction peripheral 10 is set to either the zero trust mode or the guest mode depending on the purpose of use, and the operation mode is switched in response to an operation instruction from the user.

[0061] Incidentally, in this embodiment in which two types of operating modes are prepared, “switching” the operating mode to the zero trust mode or the guest mode is synonymous with “transitioning” the operating mode to the other operating mode, i.e., from the zero trust mode to the guest mode, or “transitioning” from the guest mode to the zero trust mode.

[0062] In this embodiment, the process to be executed when the operation mode is changed to another operation mode is set in advance by an administrator or the like.

[0063] 4 is a diagram showing an example of a guest mode transition processing setting screen in this embodiment. The setting processing unit 12 displays the guest mode transition processing setting screen on the operation panel in response to a predetermined operation by the administrator. Strictly speaking, the user interface unit 11 accepts an operation on the operation panel by the administrator, acquires a guest mode transition processing setting screen to be displayed in response to the operation from the setting processing unit 12, and displays it on the operation panel, but in this embodiment, for convenience of explanation, the operation of the user interface unit 11 is omitted.

[0064] In the guest mode transition process setting screen shown in FIG. 4, the processes executed in the process of transitioning from the zero trust mode to the guest mode are displayed in the order of execution of each process. Among the processes to be executed, "internet connection stop", "agent stop" and "close distance communication activation" corresponding to the black circle 42 are essential processes that are always executed when transitioning to the guest mode. On the other hand, "security setting backup" and "running job cancellation" displayed in association with the check box 44 are additional processes. In this embodiment, the administrator selects and executes the processes by checking the check box 44. In the guest mode transition process setting screen shown in FIG. 4, referring to the check box 44, a case where "security setting backup" is selected and "running job cancellation" is not selected is illustrated. Note that a detailed explanation of the processes will be given together with an explanation of the operations.

[0065] When the administrator sets the process to be executed from the guest mode transition process setting screen, he / she selects the OK button 46. In response to the selection of the OK button 46, the setting processing unit 12 stores the contents set from the guest mode transition process setting screen in the transition setting information storage unit 21 as guest mode transition setting information.

[0066] 5 is a diagram showing an example of a zero trust mode transition processing setting screen in the present embodiment. The setting processing unit 12 displays a zero trust mode transition processing setting screen on an operation panel in response to a predetermined operation by an administrator.

[0067] In the zero trust mode transition process setting screen shown in FIG. 5, the processes executed in the process of transitioning from the guest mode to the zero trust mode are displayed in the order of execution of each process. Among the processes executed, "stop short distance communication", "delete job related data", "activate agent", and "start Internet connection" corresponding to the black circle 42 are essential processes that are always executed when transitioning to the zero trust mode. On the other hand, "check security settings modification" and "restore security settings" displayed in association with the check box 44 are additional processes. In the zero trust mode transition process setting screen shown in FIG. 5, referring to the check box 44, a case where "restore security settings" is selected by the administrator and "check security settings modification" is not selected by the administrator is illustrated. Note that a detailed explanation of the process will be given together with an explanation of the operation.

[0068] In this embodiment, some processes are associated with check boxes 44 so that the administrator can select the process to be executed when switching between operating modes, but the process does not necessarily have to be selected and may be executed automatically, such as the process corresponding to the black circle 42.

[0069] When the administrator sets the process to be executed from the zero trust mode transition process setting screen, he / she selects the OK button 48. In response to the selection of the OK button 48, the setting processing unit 12 stores the content set from the zero trust mode transition process setting screen in the transition setting information storage unit 21 as zero trust mode transition setting information.

[0070] As can be seen by referring to the setting screens shown in Figures 4 and 5, the processes executed in the zero trust mode transition process are basically paired with the processes executed in the guest mode transition process, and are in a relationship of restoring the settings that are enabled / disabled or started / stopped in the guest mode transition process. In addition, the order of the processes executed in the zero trust mode transition process is basically the opposite to the order of the processes executed in the guest mode transition process.

[0071] The configuration of the process executed at the time of the mode transition described above is merely an example and does not need to be limited to this. For example, it may be configured according to the settings when building a zero trust environment in the future.

[0072] Next, the mode switching process in this embodiment will be described with reference to the flowchart shown in FIG.

[0073] The mode switching process in this embodiment is started when the multifunction device 10 is started, and is in a state of being constantly executed while the multifunction device 10 is in operation. In addition, the multifunction device 10 in this embodiment operates and is operated in zero trust mode during normal operation (step S101). That is, the multifunction device 10 is in a state in which security is guaranteed. Specifically, the SASE or EDR agent installed in the multifunction device 10 operates effectively, and performs health management of the multifunction device 10 in a state in which the SASE or EDR cloud service 5 can be used via the Internet 4. In addition, the multifunction device 10 can perform user authentication using an IdP accessible via the Internet 4. Furthermore, security can be maintained because the SASE or EDR agent is installed in an information processing device that can use the multifunction device 10 via the Internet 4. In a zero trust environment in which such unauthorized access is prevented and can be detected, the multifunction device 10 is in a state in which it can execute a job sent to it. On the other hand, the multifunction device 10 disables a short-range communication function and prohibits communication with a device directly connected to the multifunction device 10.

[0074] The operation in the above-mentioned zero trust mode continues until a mode switching instruction is given by the user (N in step S102).

[0075] Here, when a user who has brought the mobile terminal device 8 wants to use the multifunction device 10, he or she operates the operation panel to display a guest mode transition instruction screen. It is assumed that the mobile terminal device 8 does not have a SASE or EDR agent installed.

[0076] 7 is a diagram showing an example of a guest mode transition instruction screen in the present embodiment. By referring to the guest mode transition instruction screen, the user can confirm that the multifunction device 10 is currently operating in the zero trust mode, and select the execute button 50 if he or she wishes to transition from the zero trust mode to the guest mode.

[0077] The user interface unit 11 accepts the selection of the execute button 50 from the guest mode transition instruction screen as a mode switching instruction. In this way, when there is a mode switching instruction from the user (Y in step S102), the mode switching processing unit 13 executes the guest mode transition process shown below (step S103). That is, the mode switching processing unit 13 reads out the guest mode transition setting information stored in the transition setting information storage unit 21, and executes the guest mode transition process according to the read guest mode transition setting information.

[0078] 4 as guest mode transition setting information, the mode switching processing unit 13 first backs up the security settings selected as options. That is, the mode switching processing unit 13 obtains the security-related information currently set in the multifunction device 10, generates a backup file, and stores it in the backup storage unit 23.

[0079] In this embodiment, the settings to be backed up in multifunction device 10 are limited to information related to security in order to maintain security assurance, but without such limitation, information related to attributes other than security may be included, or all settings for multifunction device 10 may be backed up.

[0080] Next, the mode switching processing unit 13 cuts off the connection to the Internet 4, thereby stopping data communication via the Internet 4. This makes it impossible for the multifunction device 10 to use the cloud service 5 that uses the SASE or EDR agent. Therefore, the mode switching processing unit 13 then stops the agent. Finally, the mode switching processing unit 13 enables short-range communication, which is currently disabled.

[0081] When the execution of the guest mode transition process in the mode switching processing unit 13 ends, the multifunction device 10 transitions to the guest mode, and operation in the guest mode begins (step S104).

[0082] Incidentally, the zero trust mode is transitioned to the guest mode by completing the execution of the above guest mode transition process, but after the transition process, the device may be rebooted as necessary. The current operation mode may be managed using flag data or the like. In this case, when the mode switching processing unit 13 completes the execution of the last process, the control unit 17 may update the setting of flag information for mode management to notify other functions of the multifunction device 10 and other devices that the current operation mode is the guest mode.

[0083] According to the guest mode transition process setting screen exemplified in FIG. 4, the "cancel active job" is not executed in the guest mode transition process. However, a case where the "cancel active job" is selected will be described.

[0084] The multifunction device 10 executes a job received during operation in the zero trust mode, but if a job is being executed when a mode switching instruction is received, the multifunction device 10 can be set to handle the job being executed. That is, if "cancel job being executed" is selected, the mode switching processing unit 13 forcibly causes the job execution control unit 16 to cancel the job if there is a job being executed. This controls the job being executed so that it is not executed in both the zero trust mode and the guest mode. If a job executed during operation in the zero trust mode is executed across the guest mode, there is a possibility that the job being executed may be maliciously tampered with during operation in the guest mode, but by preventing such fraudulent acts in advance, it is possible to prevent information held by the multifunction device 10 from leaking out.

[0085] On the other hand, if "Cancel running job" is not selected, when a running job exists, the control unit 17 waits for the job execution to finish without forcibly causing the job execution control unit 16 to cancel the job, and after confirming that the job execution has finished, transitions the operation mode from the zero trust mode to the guest mode. Alternatively, the control unit 17 may control transition to the guest mode after waiting for the processing via the Internet 4 for the job to finish, rather than the completion of the running job. This is because there are cases where the processing via the Internet 4 cannot be cancelled midway, and it is conceivable that the correct job execution result will not be obtained if the processing via the Internet 4 is cancelled midway.

[0086] As described above, the control unit 17 controls the system so that a job in progress is not executed in both the zero trust mode and the guest mode, by forcibly terminating the job in progress or by transitioning to the guest mode after the job execution is completed.

[0087] Alternatively, the control unit 17 may control the transition to the guest mode to be stopped if a job is being executed, instead of controlling the execution of the job being executed as described above. Note that if no job is being executed, the control unit 17 does not need to perform special control regarding jobs.

[0088] When the operation mode of the multifunction device 10 is switched to the guest mode in the above manner, the multifunction device 10 is unable to perform data communication via the Internet 4, and is therefore unable to use the cloud services 5 of SASE and EDR. On the other hand, the short-range communication function is enabled. Then, the user performs a predetermined operation on the mobile terminal device 8 to connect the mobile terminal device 8 to the multifunction device 10 via WiFi. This connection method may be the same as before. By directly connecting the mobile terminal device 8 to the multifunction device 10, the user is able to use the multifunction device 10. For example, the user can send a job such as printing from the mobile terminal device 8 to the multifunction device 10 and have it executed. Operation in the guest mode continues until a mode switching instruction is given by the user (N in step S105).

[0089] When a user such as an outsider who brought in the mobile terminal device 8 finishes using the multifunction device 10, the user operates the operation panel to display a zero trust mode transition instruction screen.

[0090] 8 is a diagram showing an example of a zero trust mode transition instruction screen in the present embodiment. By referring to the zero trust mode transition instruction screen, the user can confirm that the multifunction device 10 is currently operating in the guest mode, and select the execute button 52 if he or she wishes to transition from the guest mode to the zero trust mode.

[0091] The user interface unit 11 accepts the selection of the execute button 52 from the zero trust mode transition instruction screen as a mode switching instruction. In this way, when there is a mode switching instruction from the user (Y in step S105), the mode switching processing unit 13 executes the zero trust mode transition process shown below (step S106). That is, the mode switching processing unit 13 reads out the zero trust mode transition setting information stored in the transition setting information storage unit 21, and executes the zero trust mode transition process according to the read out zero trust mode transition setting information.

[0092] When referring to the setting example based on the display contents of the zero trust mode transition processing setting screen shown in Figure 5 as zero trust mode transition setting information, the mode switching processing unit 13 first stops the currently enabled short-range communication so that it is no longer possible.

[0093] Next, the mode switching processing unit 13 deletes jobs generated during operation in the guest mode and data generated by executing the jobs as job-related data. This is to prevent information held by the multifunction device 10 from being destroyed or information from leaking via the Internet 4 connected after transition to the zero trust mode in the case where the data left in the multifunction device 10 is an unauthorized application. Note that logs and the like generated by legitimately using the functions of the multifunction device 10 do not need to be subject to deletion.

[0094] In this embodiment, the data to be deleted is limited to data related to the job, but without such a limitation, it is also possible to delete all data generated during operation in guest mode, i.e., after transitioning from zero trust mode to guest mode and before transitioning back to zero trust mode.

[0095] Next, the mode switching processing unit 13 restores the security settings selected as options. That is, the mode switching processing unit 13 retrieves and restores the backup file generated at the time of transition to the guest mode and stored in the backup storage unit 23. As a result, even if the information related to security is rewritten during operation in the guest mode, the rewritten content can be returned to the settings before transition to the guest mode, that is, the settings during operation in the immediately preceding zero trust mode, without reflecting the rewritten content in the operation in the zero trust mode after transition. This makes it possible to avoid being affected by the content changed in the settings during operation in the guest mode. Since the backup file contains at least information related to security from the viewpoint of maintaining the guarantee of security, when transitioning to operation in the zero trust mode, at least a state in which security is guaranteed is guaranteed.

[0096] Next, the mode switching processing unit 13 activates the agent. Finally, the mode switching processing unit 13 starts a connection to the Internet 4, thereby enabling data communication via the Internet 4. This allows the MFP 10 to use the cloud service 5 that uses the activated SASE or EDR agent, and returns to a state in which security is guaranteed.

[0097] When the mode switching processing unit 13 finishes executing the zero trust mode transition process, the multifunction device 10 transitions to the zero trust mode and starts operating under the zero trust mode (step S101). When the mode switching processing unit 13 finishes executing the final process, the control unit 17 may update the setting of the flag information for mode management described above to notify other functions and other devices of the multifunction device 10 that the current operation mode is the zero trust mode.

[0098] According to the zero trust mode transition process setting screen illustrated in FIG. 5, the “security setting modification check” is not executed in the zero trust mode transition process, but a case where the “security setting modification check” is selected will be described.

[0099] The "security setting modification check", like the above-mentioned "security setting restore", is a process for preventing changes to the settings implemented during operation in guest mode from being reflected in operation in zero trust mode after transition. Also, like the above-mentioned "security setting restore", this process requires the backup file generated during the guest mode transition process. In other words, unless "security setting backup" is selected from the guest mode transition process setting screen, the "security setting modification check" and "security setting restore" cannot be executed.

[0100] The mode switching processing unit 13 backs up the security settings in the current guest mode, in other words, before the transition to the zero trust mode, in the same way as backing up the security settings during the guest mode transition process. The mode switching processing unit 13 then compares the backup file acquired here with the backup file stored in the backup storage unit 23. If the settings of the multifunction device 10 are different before and after the operation in the guest mode, in other words, if there is inconsistent information, the mode switching processing unit 13 executes a predetermined process. As the predetermined process, the mode switching processing unit 13 extracts the inconsistent information, for example, and displays it in a list on the operation panel. Alternatively, it may be written and saved in a log file. In this way, the administrator is notified that the settings of the multifunction device 10 are different before and after the operation in the guest mode. The administrator can check the items whose setting values ​​have been changed by referring to the operation panel or the log file. If the setting values ​​have been changed fraudulently, the administrator can recognize the fraud. Alternatively, the mode switching processing unit 13 may stop the transition to the zero trust mode as the predetermined process. This makes it possible to prevent the device from being unable to operate normally even after transitioning to the zero trust mode. In this case, administrators will need to take some action to move into zero trust mode.

[0101] When operating in guest mode, the multifunction peripheral 10 cannot use cloud services 5 such as SASE, and therefore does not fall under the zero trust environment, so it is difficult to say that security is fully guaranteed. However, it is not subject to attacks via the Internet 4. And since it only accepts access from the mobile terminal device 8, if fraud is detected, it can be assumed that the fraud is committed using the mobile terminal device 8.

[0102] When an administrator selects "Security Settings Restore," the settings will be unconditionally restored to the state they were in when operating in Zero Trust mode immediately before switching to Guest mode. Therefore, even if the settings are modified while operating in Guest mode, there will be no impact based on the modification, but since the modification of the settings is not detected while operating in Guest mode, it is not possible to detect whether the settings have been modified.

[0103] On the other hand, if the administrator selects "Security setting modification check", it is possible to detect that the settings have been modified during operation in guest mode, and to check the modification contents, i.e., the setting values ​​before and after the modification. However, whether the modified settings are reflected when operating in zero trust mode, or the settings are restored to the original settings without being reflected, some kind of action must be taken before switching to zero trust mode.

[0104] According to this embodiment, by allowing the MFP 10 to operate in the guest mode, even an outsider can temporarily use the MFP 10. In the guest mode, only jobs from the mobile terminal device 8 directly connected to the MFP 10 are accepted and executed, and security is maintained as much as possible by, for example, stopping the connection to the Internet 4. However, as described above, the on-premise environment 3 is not a zero-trust environment when operating in the guest mode. For this reason, it is not necessarily possible to reliably protect against fraudulent acts performed by the user of the mobile terminal device 8.

[0105] Therefore, in this embodiment, before switching from the guest mode to the zero trust mode, a function for deleting data generated during operation in the guest mode, a function for returning to the original settings by restoring a backup file generated during operation in the zero trust mode, and a function for detecting that the settings in the multifunction device 10 have been altered are provided, so that information generated during operation in the guest mode and changed settings can be prevented from being reflected in the zero trust mode. This makes it possible to maintain a state in which security is guaranteed in the zero trust mode.

[0106] In the above embodiments, the term "processor" refers to a processor in a broad sense, including general-purpose processors (e.g., CPU: Central Processing Unit, etc.) and dedicated processors (e.g., GPU: Graphics Processing Unit, ASIC: Application Specific Integrated Circuit, FPGA: Field Programmable Gate Array, programmable logic device, etc.).

[0107] In addition, the operations of the processor in the above embodiments may be performed not only by one processor, but also by multiple processors located at physically separate locations working together. The order of the operations of the processor is not limited to the order described in the above embodiments, and may be changed as appropriate.

[0108] (Additional Note) (((1))) A processor is provided. The processor, In response to an instruction from a user, switching is performed between a normal use mode in which security is guaranteed by using a predetermined security service via the Internet and a temporary use mode in which communication in a directly connected state is permitted when communication via the Internet is not possible; The use of an external terminal device is permitted only when the device is operating in the temporary use mode. An information processing system comprising: (((2))) The information processing system described in (((1))) is characterized in that the processor backs up the settings of the information processing system when operating in the normal use mode and then transitions to the temporary use mode. (((3))) The information processing system described in ((1))) or (((2))) is characterized in that, when transitioning from the temporary use mode to the normal use mode, the processor processes the information so that changes to the settings implemented in the temporary use mode are not reflected in the normal use mode. (((4))) The information processing system described in (((3))) is characterized in that, when transitioning from the temporary use mode to the normal use mode, the processor restores the backed up setting contents to the information processing system and then starts operation in the normal use mode. (((5))) The information processing system described in (((3))) is characterized in that when transitioning from the temporary use mode to the normal use mode, if the setting contents of the information processing system when operating in the temporary use mode differ from the backed-up setting contents, the processor executes a specified process. (((6))) The information processing system according to (((5))), wherein the predetermined process is a process of notifying an administrator. (((7))) The information processing system according to ((5))), wherein the predetermined process is a process of canceling the transition to the normal use mode. (((8))) The information processing system described in any one of ((1)) to (((7))) is characterized in that if there is a job being executed when transitioning from the normal use mode to the temporary use mode, the processor controls the job so that it is not executed in both the normal use mode and the temporary use mode. (((9))) The information processing system described in (((8))) is characterized in that the processor controls the transition to the temporary use mode after waiting for the completion of the job being executed or the completion of processing via the Internet for that job. (((10))) The information processing system according to ((8))), wherein the processor controls to stop the transition to the temporary use mode. (((11))) The information processing system according to (((8))), wherein the processor forcibly terminates the job being executed. (((12))) The information processing system of any one of ((1))) to (((11))), characterized in that when transitioning from the temporary use mode to the normal use mode, the processor deletes data generated during operation in the temporary use mode. (((13))) On the computer, A function for switching between a normal use mode, in which security is guaranteed by using a predetermined security service via the Internet, and a temporary use mode, in which communication in a direct connection state is permitted when communication via the Internet is not possible, in response to a user's instruction; A function of permitting the use of an external terminal device only when the device is operating in the temporary use mode; A program to achieve this.

[0109] According to the invention described in (((1))), it is possible to temporarily allow an information processing system that is normally operated in a mode in which security is guaranteed to be used by a terminal device whose security may not be guaranteed. According to the invention described in (((2))), it is possible to prevent problems that may occur when settings are changed during operation in the temporary use mode. According to the invention described in (((3))), even if fraud is committed in the temporary use mode, it is possible to deal with the fraud so as not to be affected in the normal use mode. According to the invention described in (((4))), even if the settings are changed during operation in the temporary use mode, the settings can be restored to their original state. According to the invention described in (((5))), if there is a possibility that the settings have been illegally changed while operating in the temporary use mode, some kind of action can be taken. According to the invention described in (((6))), it is possible to notify the administrator that the settings may have been illegally changed. According to the invention described in (((7))), it is possible to prevent a situation in which the device is unable to operate normally in the normal use mode. According to the invention described in (((8))), problems that may occur when a job in progress is executed in the temporary use mode can be prevented in advance. According to the invention described in (((9))), it is possible to wait for the completion of the job being executed before switching to the temporary use mode. According to the invention described in (((10))), a job being executed can be terminated during operation in the normal use mode. According to the invention described in (((11))), it is possible to prioritize transition to the temporary use mode. According to the invention described in (((12))), data that may adversely affect operation in normal use mode can be deleted in advance. According to the invention described in (((13))), it is possible to temporarily allow an information processing system that is normally operated in a mode in which security is guaranteed to be used by a terminal device whose security may not be guaranteed. [Explanation of symbols]

[0110] 1 network system, 2 cloud, 3 on-premise environment, 4 internet, 5 cloud service, 8 mobile terminal device, 10 multifunction device, 11 user interface (UI) unit, 12 setting processing unit, 13 mode switching processing unit, 14 internet communication control unit, 15 short-range communication control unit, 16 job execution control unit, 17 control unit, 21 migration setting information storage unit, 22 job information storage unit, 23 backup storage unit.

Claims

1. A processor is provided. The processor, In response to an instruction from a user, switching is performed between a normal use mode in which security is guaranteed by using a predetermined security service via the Internet and a temporary use mode in which communication in a directly connected state is permitted when communication via the Internet is not possible; The use of an external terminal device is permitted only when the device is operating in the temporary use mode. An information processing system comprising:

2. 2. The information processing system according to claim 1, wherein the processor backs up settings of the information processing system when the information processing system is operating in the normal use mode, and then transitions to the temporary use mode.

3. The information processing system according to claim 2, characterized in that, when transitioning from the temporary use mode to the normal use mode, the processor processes so as not to reflect changes to the settings implemented in the temporary use mode in the normal use mode.

4. The information processing system according to claim 3, characterized in that, when transitioning from the temporary use mode to the normal use mode, the processor restores backed-up setting contents to the information processing system before starting operation in the normal use mode.

5. The information processing system according to claim 3, characterized in that when transitioning from the temporary use mode to the normal use mode, the processor executes a specified process if the setting contents of the information processing system when operating in the temporary use mode differ from the backed-up setting contents.

6. 6. The information processing system according to claim 5, wherein the predetermined process is a process of notifying an administrator.

7. 6. The information processing system according to claim 5, wherein the predetermined process is a process of canceling the transition to the normal use mode.

8. The information processing system according to claim 1, characterized in that, if there is a job being executed when transitioning from the normal use mode to the temporary use mode, the processor controls the job so that it is not executed in both the normal use mode and the temporary use mode.

9. 9. The information processing system according to claim 8, wherein the processor performs control so as to transition to the temporary use mode after waiting for the end of the job being executed or the end of processing via the Internet in the job.

10. 9. The information processing system according to claim 8, wherein the processor controls to stop the transition to the temporary use mode.

11. 9. The information processing system according to claim 8, wherein the processor forcibly terminates the job being executed.

12. 2 . The information processing system according to claim 1 , wherein, when the processor transitions from the temporary use mode to the normal use mode, the processor deletes data generated during operation in the temporary use mode.

13. On the computer, A function for switching between a normal use mode, in which security is guaranteed by using a predetermined security service via the Internet, and a temporary use mode, in which communication in a direct connection state is permitted when communication via the Internet is not possible, in response to a user's instruction; A function of permitting the use of an external terminal device only when the device is operating in the temporary use mode; A program to achieve this.

Images