Information processing device and information processing method

Abstract

To prevent subsequent illegal accesses by performing appropriate function restriction in detecting an illegal access to an information processing device using unknown vulnerability.SOLUTION: An information processing device collects logs of operation of a system or a program, and detects an illegal access on the basis of an attach scenario defined by a combination the logs of operation and a function that is not normally executed. When the illegal access is detected, a function to be restricted is specified and the specified function is restricted on the basis of the attach scenario used during detection.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present invention relates to an information processing device and method, which, when unauthorized access to the information processing device is detected, minimizes the damage caused by intrusions that exploit unknown vulnerabilities by identifying and disabling functions based on the attack scenario used to detect the unauthorized access. [Background technology]

[0002] In recent years, damage caused by cyberattacks targeting information processing devices has been increasing. Various security measures have been implemented in response to this trend. However, the increasing sophistication of cyberattacks has made it difficult to counter these attacks using traditional security measures such as malware detection and firewalls. Zero-day attacks, which exploit unknown vulnerabilities, are particularly difficult to defend against. For example, there have been many cases in which attackers have infiltrated information processing devices using zero-day attacks and then exploited the systems to cause damage to individuals and businesses. To combat these sophisticated attacks, in addition to traditional defenses at the network perimeter, security measures that monitor system behavior and detect attempts to exploit the system have become widespread. This security measure is implemented using the well-known technology of Endpoint Detection and Response (EDR) and is widely used for personal computers (PCs). When EDR detects attacker behavior, it is common to isolate the target device from the network and protect other devices, servers, and other assets.

[0003] In Patent Document 1, an incident that occurs in a vehicle is detected, an attack scenario database is referenced, and a function having a vulnerability related to the detected incident is stopped.

[0004] If an incident is detected even after all identified vulnerabilities have been disabled, it will be determined that there is an unknown vulnerability and the functionality will be degraded. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent No. 6968722 Summary of the Invention [Problem to be solved by the invention]

[0006] However, the technology disclosed in Patent Document 1 primarily addresses known vulnerabilities. Therefore, the technology does not provide detailed information on functionality degradation in response to attacks using unknown vulnerabilities whose causes cannot be identified, because it is not possible to identify the functions to be disabled. As a result, it is not possible to disable functions in anticipation of attacks after an intrusion exploiting an unknown vulnerability. Furthermore, while countermeasures such as EDR are widely used on PCs and other devices, they require a certain amount of resources, making them unrealistic to implement in resource-limited IoT devices. The present invention was developed in consideration of the above-mentioned issues, and aims to prevent subsequent unauthorized access by appropriately restricting functions when unauthorized access to an information processing device exploiting an unknown vulnerability is detected. [Means for solving the problem]

[0007] The present invention is an information processing device characterized by comprising: a log collection means for collecting logs of system or program operation on the information processing device; an unauthorized access detection means for detecting unauthorized access based on the operation logs collected by the log collection means and an attack scenario defined by a combination of functions that are not normally executed on the information processing device; a restricted function identification means for identifying functions to be restricted based on the attack scenario used when detecting the unauthorized access; and a function restriction means for restricting the functions identified by the restricted function identification means. [Effects of the Invention]

[0008] According to the present invention, when unauthorized access to an information processing device that exploits an unknown vulnerability is detected, subsequent unauthorized access can be prevented by appropriately restricting functions. [Brief explanation of the drawings]

[0009] [Figure 1] A block diagram showing the connection between the MFP and peripheral devices according to the present invention. [Figure 2] Internal configuration diagram of the controller unit of the MFP related to the present invention [Figure 3] A block diagram of the software executed in the controller of the MFP 100 according to the present invention. [Figure 4] Attack scenario in the first embodiment [Figure 5] Flowchart for carrying out the processing of the first embodiment [Figure 6] Attack scenarios in the first and second modifications of the first embodiment DETAILED DESCRIPTION OF THE INVENTION

[0010] An information processing device according to an embodiment of the present invention will be described in detail below with reference to the drawings. In this embodiment, a process for preventing damage from spreading while maintaining the functionality of the information processing device by restricting only the functions used by an attacker when unauthorized access to the information processing device is detected will be described. In this embodiment, a multi-functional peripheral (MFP), which is an image forming device, will be described as an example of an information processing device, but the present invention is a technology that can also be applied to information processing devices other than MFPs.

[0011] (First embodiment) (Device configuration of the first embodiment) The connection configuration of the MFP and peripheral devices according to the present invention will be explained using the block diagram of FIG.

[0012] The MFP 100 and the client PC 110 are connected via a LAN 120 .

[0013] The MFP 100 has an operation unit 102 that inputs and outputs data to and from the user. A printer unit 103 outputs electronic data to paper media. A scanner unit 104 reads paper media and converts it into electronic data. The operation unit 102, printer unit 103, and scanner unit 104 are connected to a controller unit 101, and function as an MFP under the control of the controller unit 101.

[0014] FIG. 2 is a block diagram showing the physical configuration of the controller unit 101 of the MFP 100. The CPU 201 performs the main arithmetic processing within the controller. The CPU 201 is connected to a DRAM 202 via a bus. The DRAM 202 is used by the CPU 201 as a working memory for temporarily storing program data representing arithmetic instructions and data to be processed during the CPU 201's calculations. The CPU 201 is connected to an I / O controller 203 via a bus. The I / O controller 203 performs input and output to various devices in accordance with instructions from the CPU 201. A network I / F 204 is connected to the I / O controller 203. A wired LAN device 210 is connected to the network I / F 204. The CPU 201 controls the wired LAN device 210 via the network I / F 204 to realize communication on the LAN 120. A SATA (Serial Advanced Technology Attachment) I / F 205 is connected to the I / O controller 203, and a storage device memory 211 and a secure memory 212 are connected to the SATA I / F 205. The CPU 201 uses a storage device 211 to permanently store programs for implementing the MFP's functions and document files. The CPU 201 also uses a secure memory 212 to store data that is important for security. The secure memory 212 is encrypted and can only be accessed by specific modules through access control. This protects confidential information from leaks and unauthorized rewriting. The panel I / F 206 is connected to the I / O controller 203 and converts a user's physical operations input to the operation unit 102 into electronic data and transmits it to the CPU 201, thereby realizing user operations. The printer I / F 207 is connected to the I / O controller 203, and the CPU 201 performs output processing on paper media using the printer unit 103 via the printer I / F 207. The scanner I / F 208 is connected to the I / O controller 203, and the CPU 201 performs document reading processing using the scanner unit 104 via the scanner I / F 208. The USB I / F 209 is connected to the I / O controller 203 and controls any device connected to the USB I / F 209 .

[0015] When the copy function is to be performed, the CPU 201 loads program data from the storage device 211 into the DRAM 202 via the SATA I / F 205. The CPU 201 detects a copy instruction from the user via the panel I / F 206 on the operation unit 102 in accordance with the program loaded into the DRAM 202. When the CPU 201 detects a copy instruction, it receives an original as electronic data from the scanner unit 104 via the scanner I / F 208 and stores it in the DRAM 202. The CPU 201 performs color conversion processing suitable for output on the image data stored in the DRAM 202. The CPU 201 transfers the image data stored in the DRAM 202 to the printer unit 103 via the printer I / F 207, and performs output processing onto paper media. As described above, the copy function can be realized by combining the print function and the scan function.

[0016] When PDL printing is performed, the client PC 110 issues a print instruction via the LAN 120. The CPU 201 loads program data from the storage device 211 into the DRAM 202 via the SATA I / F 205 and detects a print instruction via the network I / F 204 in accordance with the module loaded into the DRAM 202. When the CPU 201 detects a PDL transmission instruction, it receives print data via the network I / F 204 and saves the print data in the storage device 211 via the SATA I / F 205. After saving the print data, the CPU 201 develops the print data saved in the storage device 211 into the DRAM 202 as image data. The CPU 201 performs color conversion processing suitable for output on the image data stored in the DRAM 202. The CPU 201 transfers the image data stored in the DRAM 202 to the printer unit 103 via the printer I / F 207 and performs output processing onto paper media.

[0017] The functional configuration and processing flow of this embodiment will be described below.

[0018] (Functional configuration of the first embodiment) An example of the functional configuration realized by software executed in the controller unit 101 of the MFP 100 of the first embodiment will be described with reference to the block diagram of FIG.

[0019] The operation control unit 301 displays a screen image for the user on the operation unit 102, detects a touch operation by the user, and executes processing associated with screen components such as buttons displayed on the screen.

[0020] In response to a request from another control unit, the data storage unit 302 stores and reads data in the storage device 211. For example, if a user wants to change some device setting, the operation control unit 301 detects the content input by the user to the operation unit 102, and in response to a request from the operation control unit 301, the data storage unit 302 saves the content as a setting value in the storage device 211.

[0021] A job control unit 303 controls job execution in accordance with instructions from other control units.

[0022] The image processing unit 304 processes the image data into a format suitable for each purpose in accordance with instructions from the job control unit 303 .

[0023] A print processing unit 305 prints and outputs an image on a paper medium via a printer I / F 207 in accordance with an instruction from the job control unit 303 .

[0024] The reading processing unit 306 reads the placed original document via the scanner I / F 208 in accordance with an instruction from the job control unit 303 .

[0025] The network control unit 307 performs network settings such as IP address settings in the TCP / IP control unit 308 according to the setting values ​​stored in the data storage unit 302 when the system is started or when a setting change is detected.

[0026] The TCP / IP control unit 308 performs transmission and reception processing of network packets via the network I / F 204 in accordance with instructions from other controls.

[0027] The USB control unit 309 controls the USB I / F 209 and controls any device connected via USB.

[0028] The communication port control unit 310 controls the ports used when the TCP / IP control unit 308 transmits and receives packets.

[0029] The log information collection unit 311 collects various behaviors of the MFP as log data to detect unauthorized access, and records the log data in the storage device 211. Typical log data includes an event log, a system log, a network log, and a security log, and specific examples are shown below.

[0030] The event log includes the following data related to MFP events: "MFP start / stop and the time," "user / administrator login / logout times," "program and service start / stop and the time," etc. It also includes "user operations such as printing, scanning, copying (operation details, operation time)," and "operation of system setting values ​​such as passwords and other account information, time, access control lists, networks, and certificates (operation details, operation time)."

[0031] The system log includes the following data about the MFP system: "kernel messages and debug information," "disk and file system errors and warnings," "hardware events such as temperature and power supply status," etc. It also includes "CPU usage, memory usage, storage usage," "network traffic and bandwidth," and "application response time."

[0032] The network log includes the following data related to the MFP's network: "sender / receiver destination address (IP address)," "sender / receiver time," "sender / receiver interval," "sender / receiver data size," and "sender / receiver data payload."

[0033] The security log includes the following data related to MFP security: "failed login attempts," "account lock / unlock," "permit / deny access control to administrator functions, files, and directories (boxes)," and "firewall control and denial."

[0034] This log data can be collected using a system log service (e.g., syslog) or an audit daemon (e.g., Auditd).

[0035] The unauthorized access detection unit 312 detects unauthorized access to the MFP. Attackers may exploit unknown vulnerabilities in the MFP to gain unauthorized access to the MFP. If unauthorized access is achieved, the attacker may use the MFP's shell to execute various commands or unauthorized use of functions. Therefore, the unauthorized access detection unit 312 detects unauthorized access when an MFP behaves in a way that it does not normally do. For example, an attacker may tamper with MFP programs or settings by launching an editor using the MFP's shell or by executing a search command to find the program they are targeting. The MFP is equipped with commands that perform the above-mentioned processes, but these are not executed in normal use cases. When the unauthorized access detection unit 312 detects typical attacker behavior that would not occur in such MFP use cases, it can determine that unauthorized access has occurred. Detection is performed based on the log data collected by the log information collection unit 311 and the attack scenario shown in Figure 4. The attack scenario defines an operation sequence that the MFP does not normally perform and how to deal with it. The attack scenario is stored in the storage device 211 and is read from the storage device 211 when in use. Here, an example is shown of detecting unauthorized access based on a command that is not executed in the use case of the MFP. Alternatively, detection may be based on system behavior such as unusual process behavior or library loading, or unusual behavior may be detected using AI. When the unauthorized access detection unit 312 detects unauthorized access, it instructs the startup control unit 313 to control restart.

[0036] The startup control unit 313 controls the startup and restart of the MFP. The startup control unit 313 determines whether to restart the MFP according to the countermeasures described in the attack scenario, and restarts the MFP. If an unintended change to a configuration file occurs, restarting is an effective countermeasure. This is because restarting involves recovery of the recovery processing unit 317, making it possible to return to the initial state. Considering the case where an attack program is not installed in the storage device 211 at the time of intrusion but is resident in the DRAM 202, and traces of intrusion remain only in the DRAM 202, the countermeasure may be to simply restrict functionality. In this case, no restart is performed.

[0037] The restricted function identification unit 314 identifies the functions to be restricted based on the attack scenario and log data used in the unauthorized access detection 312. Specifically, among the functions defined in the operation sequence of the attack scenario, the functions that were used at the time of detection are determined to be the functions to be restricted.

[0038] The function restriction unit 315 restricts the functions identified by the restricted function identification unit 314. Specifically, it monitors the start-up of modules and does not allow them to operate.

[0039] The tampering detection processor 316 detects tampering with the MFP settings and programs. To detect tampering, it uses a hash value calculated from the tampering detection target. The hash value calculated from the settings and programs is recorded as the correct value in the MFP's secure memory 212, and the tampering detection processor 316 verifies whether tampering has occurred by checking whether the hash value calculated from the tampering detection target matches this correct value. If the tampering detection process finds no tampered areas, the device starts up as is. If tampering has been found, it instructs the recovery processor 317 to perform recovery processing.

[0040] The recovery processing unit 317 recovers settings and programs for which tampering has been detected by the tampering detection processing unit 316. The recovery processing is realized by overwriting the tampered parts with settings and programs in a normal state (golden copy) that have been stored in advance in the secure memory 212 or storage device 211 of the MFP.

[0041] (Processing flow of the first embodiment) The flow of restrictions on functions that an attacker may exploit when unauthorized access is detected and countermeasures taken in this embodiment will be described with reference to the flowchart of FIG.

[0042] The unauthorized access detection unit 312 detects unauthorized access to the MFP based on the log data collected by the log information collection unit 311 and stored in the storage device 211 and the attack scenario (S501). If the log data indicates that a function corresponding to the operation sequence described in the attack scenario has been activated, it is determined to be unauthorized access. Next, the startup control unit 313 determines whether to restart the MFP (S502). If the countermeasure method for the detected operation sequence in the attack scenario is "restart and function restriction," the result is Yes, and the process proceeds to step S503. If the countermeasure method is "function restriction," the result is No, and the process proceeds to step S504. In step S503, the startup control unit 313 performs a restart, and if the tampering detection processing unit 316 detects file tampering, the recovery processing unit 317 performs recovery. In step S504, the restricted function identification unit 314 stops the function corresponding to the operation sequence described in the attack scenario detected in step S501. Next, the administrator is notified that the function has been stopped (S505). Possible notification methods include sending an e-mail to a pre-registered e-mail address for the administrator, or displaying the notification on the operation unit 102. After identifying and blocking the route of intrusion into the network and eliminating the root cause of the unauthorized access, if the administrator decides to lift the function restriction (Yes in S506), the function restriction is lifted (S507). If the function restriction is not to be lifted (No in S506), the process returns to S506 and continues to wait for the administrator to lift the function restriction.

[0043] (Modification 1 of the first embodiment) In the first embodiment, functions of operation sequences that are not executed in normal use cases described in an attack scenario are identified as functions to be restricted and stopped. In this first modification, the operation sequence of an attack scenario is treated as a series of operations, and functions are stopped in stages according to the number of attacks. By doing so, functions are stopped in stages according to the number of attacks while maintaining the functionality of the MFP as much as possible. For this purpose, a detection count counter that records the number of detections for each attack scenario is provided in the secure memory 212.

[0044] Figure 6 shows the attack scenario of this modification. There are two differences from Figure 4. First, the operation sequence is a series of operations rather than a single operation. Second, it is possible to identify related attack scenarios. Related attack scenarios are used in modification 2.

[0045] The flow of this modification will be described with reference to the flowchart in Fig. 5. Since the steps other than the unauthorized access detection in S501 and the function shutdown in S504 are the same as those in the first embodiment, their description will be omitted.

[0046] In S501, unauthorized access is determined to have occurred when an operation with the number of steps obtained by subtracting the value of the detection count counter from the number of steps in each attack scenario in Figure 6 is detected. In other words, if the detection count counter is 0, unauthorized access is determined to have occurred if operation sequences 1 to 4 appear in the log data. If the detection count counter is 1, unauthorized access is determined to have occurred if operation sequences 1 to 3 appear in the log data. When unauthorized access is detected, the detection count counter for the corresponding attack scenario is incremented. If multiple attack scenarios apply, it is determined that unauthorized access has occurred for the attack scenario with the larger detection count counter value, and the corresponding detection count counter is incremented. If the detection count counter values ​​are the same, it is determined that unauthorized access has occurred for the attack scenario with the most recent increment in the detection count counter value.

[0047] In S504, the attack scenario is referenced and the functions to be stopped are determined based on the number of detections. For example, if attack scenario 4 is detected, and the detection count counter is 1, "4. Launch ssh" is prohibited. If the detection count counter is 2, "4. Launch ssh" has already been disabled and operation sequences 1 to 3 have been detected, so "3. Run nmap" is prohibited. The same applies below.

[0048] The above describes Modification 1. This makes it possible to maintain as many functions as possible of the MFP while gradually degrading functions according to the number of attacks.

[0049] (Modification 2 of the first embodiment) In this second variation, when a function is disabled, the relationships between attack scenarios are used to prevent similar attacks, and the sequence is traced back, starting from common functions, and functions related to other attack scenarios are also disabled. The related attack scenarios in Figure 6 show the IDs of the attack scenarios related to each attack scenario.

[0050] The flow of this modified example will be described with reference to the flowchart in Fig. 5. Since the steps other than the function stop in S504 are the same as those in the first embodiment, their explanation will be omitted.

[0051] In S504, not only the operation sequence of the attack scenario ID of the unauthorized access detected in S501 but also the function of the operation sequence of the related attack scenario is stopped.

[0052] For example, if attack scenario 4 is detected, in addition to prohibiting "4. ssh launch", it will also prohibit "4. telnet launch" of attack scenario 3, which is identical up to nmap.

[0053] As in the first modification, a detection count counter can be provided to gradually disable the function depending on the number of times it is detected.

[0054] (Other embodiments) The present invention can also be realized by executing the following process: software (programs) that realize the functions of the above-described embodiments are supplied to a system or device via a network or various storage media, and the computer (or CPU, MPU, etc.) of the system or device reads and executes the programs.

Claims

1. An information processing device, a log collection means for collecting a log of the operation of a system or a program in the information processing device; an unauthorized access detection means for detecting unauthorized access based on the operation log collected by the log collection means and an attack scenario defined by a combination of functions that are not normally executed by the information processing device; a restricted function specifying means for specifying a function to be restricted based on the attack scenario used when detecting the unauthorized access; a function restriction means for restricting the functions identified by the restriction function identification means; An information processing device comprising:

2. 2. The information processing apparatus according to claim 1, further comprising an image forming function.

3. 2. The information processing apparatus according to claim 1, wherein when the restricted function specifying means determines that the information processing apparatus should be restarted, the information processing apparatus is restarted.

4. The information processing device according to claim 3, characterized in that when the restricted function identification means determines that the information processing device should be restarted, the information processing device is restarted, tampering detection is performed on the information processing device, and if tampering is detected, recovery is performed from a golden copy that has been stored in advance.

5. 2. The information processing apparatus according to claim 1, wherein the function restriction means notifies an administrator when the function is restricted, and releases the restriction in response to an operation by the administrator.

6. the attack scenario is defined by a plurality of functions that are not normally executed by the information processing device; 2. The information processing apparatus according to claim 1, wherein the function restriction means restricts functions of the attack scenario in order from the most recent function according to the number of times unauthorized access has been detected.

7. 2. The information processing apparatus according to claim 1, wherein the unauthorized access detection means determines that an unauthorized access has occurred if a function different from a function that has already been restricted is detected among the plurality of functions included in the attack scenario.

8. The information processing device according to claim 1, characterized in that, when the unauthorized access detection means detects the activation of a function corresponding to multiple attack scenarios, it determines that an unauthorized access corresponding to the attack scenario with the greatest number of unauthorized accesses has occurred.

9. The attack scenario is defined by the execution of a plurality of functions that are not normally executed by the information processing device, and attack scenarios that have similar execution of functions are defined as related attack scenarios; The information processing apparatus according to claim 1 , wherein the function restricting means also restricts the functions of the related attack scenario.

10. An information processing method for an information processing device, a log collection step in which a log collection means collects a log of the operation of a system or a program in the information processing device; an unauthorized access detection step in which unauthorized access detection means detects unauthorized access based on the operation log collected in the log collection step and an attack scenario defined by a combination of functions that are not normally executed by the information processing device; a restriction function specifying step in which a restriction function specifying means specifies a function to be restricted based on the attack scenario used when detecting the unauthorized access; a function limiting step in which a function limiting means limits the function identified by the restricted function identifying step; An information processing method comprising:

11. Computer, An information processing device, a log collection means for collecting a log of the operation of a system or a program in the information processing device; an unauthorized access detection means for detecting unauthorized access based on the operation log collected by the log collection means and an attack scenario defined by a combination of functions that are not normally executed by the information processing device; a restricted function specifying means for specifying a function to be restricted based on the attack scenario used when detecting the unauthorized access; a function restriction means for restricting the functions identified by the restriction function identification means; A computer program for causing a computer to function as an information processing device, comprising:

Images