Terminal device, communication system, communication method, and program

Abstract

To solve a security risk for an electronic apparatus.SOLUTION: A communication processing unit executes processing for executing communication with an electronic apparatus subjected to tamper detection. A command transmission unit transmits command information in which a command that the electronic apparatus should execute is expressed to the electronic apparatus. An execution result acquisition unit acquires first information expressing an execution result of the command information executed by the electronic apparatus from the electronic apparatus. A tamper determination unit determines whether the electronic apparatus has been tampered based on second information prestored corresponding to the execution result of the command information executed by the electronic apparatus in a non-tampered state and first information.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to a terminal device, a communication system, a communication method, and a program. [Background technology]

[0002] Patent Document 1 discloses a system that includes a computer used by a user, multiple printers that perform printing processing, and an information management server that manages printer information. Patent Document 1 also discloses that when a user installs a printer driver on their computer, the information management server presents a list of printers. Patent Document 1 also discloses that the system obtains the IP (Internet Protocol) address required for installing the printer that will print out, selected from the presented printer list. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2000-330742 Summary of the Invention [Problem to be solved by the invention]

[0004] In the technology disclosed in Patent Document 1, a computer is connected to multiple printers via a network, and the computer can obtain the IP addresses of the printers from an information management server. However, Patent Document 1 does not disclose any security measures in the event that a printer is tampered with by a third party. Therefore, the technology disclosed in Patent Document 1 poses security issues regarding communications with electronic devices such as printers. [Means for solving the problem]

[0005] The terminal device according to the present disclosure includes a communication processing unit that performs processing for communicating with an electronic device that is the target of tamper detection; a command sending unit that sends command information indicating a command to be executed by the electronic device to the electronic device; an execution result acquisition unit that acquires first information from the electronic device that indicates an execution result of the command information being executed by the electronic device; and a tampering determination unit that determines whether the electronic device has been tampered with based on second information that is pre-stored and corresponds to the execution result of the command information being executed by the electronic device in an untampered state, and the first information.

[0006] The communication system according to the present disclosure includes an electronic device that is the target of tamper detection, and a terminal device that is communicatively connected to the electronic device, and the terminal device includes a communication processing unit that performs processing for communicating with the electronic device, a command sending unit that sends to the electronic device command information indicating a command to be executed by the electronic device, an execution result acquisition unit that acquires from the electronic device first information indicating an execution result of the electronic device executing the command information, and a tampering determination unit that determines whether the electronic device has been tampered with based on second information that is pre-stored corresponding to the execution result of the electronic device executing the command information in an untampered state, and the first information.

[0007] The communication method disclosed herein performs processing to communicate with an electronic device that is the target of tamper detection, transmits command information indicating a command to be executed by the electronic device to the electronic device, obtains first information from the electronic device indicating the execution result of the command information executed by the electronic device, and determines whether the electronic device has been tampered with based on second information that is pre-stored and corresponds to the execution result of the command information executed by the electronic device in an untampered state, and the first information.

[0008] The program disclosed herein causes a computer to execute the following steps: performing processing to communicate with an electronic device that is the target of tamper detection; transmitting command information to the electronic device that indicates a command to be executed by the electronic device; obtaining first information from the electronic device that indicates the execution result of the command information executed by the electronic device; and determining whether the electronic device has been tampered with based on the first information and second information that is pre-stored and corresponds to the execution result of the command information executed by the electronic device in an untampered state. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating a communication system according to a first embodiment. [Figure 2] FIG. 2 is a diagram illustrating a configuration of a terminal device according to the first embodiment. [Figure 3] FIG. 1 is a diagram illustrating a configuration of an electronic device according to a first embodiment. [Figure 4] FIG. 1 is a diagram illustrating a configuration of an information processing device according to a first embodiment. [Figure 5] 4 is a flowchart showing a communication method executed in the communication system according to the first embodiment. [Figure 6] FIG. 10 is a diagram showing a specific example of command information according to the first embodiment. [Figure 7] FIG. 2 is a diagram illustrating a specific example of processing performed by the communication system according to the first embodiment. [Figure 8] FIG. 10 is a diagram illustrating a configuration of a terminal device according to a second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] (Embodiment 1) Hereinafter, embodiments will be described with reference to the drawings. For clarity of explanation, the following description and drawings have been omitted and simplified as appropriate. In addition, the same elements in each drawing are designated by the same reference numerals, and duplicate explanations have been omitted as necessary.

[0011] 1 is a diagram illustrating a communication system 1 according to a first embodiment. The communication system 1 includes an information processing device 10, a terminal device 100, and at least one electronic device 200. The terminal device 100 is communicably connected to the information processing device 10 and the electronic device 200 via a wired or wireless network.

[0012] The information processing device 10 is, for example, a computer such as a server. The information processing device 10 may also be a server that manages the electronic device 200. The terminal device 100 is, for example, a computer terminal of an administrator of the electronic device 200. The electronic device 200 is, for example, a device such as a printer or a PC (Personal Computer). The electronic device 200 operates by firmware or software such as an OS (Operating System). In the following description, an example will be described where appropriate in which the electronic device 200 is a printer and operates by firmware.

[0013] The terminal device 100 communicates with the electronic device 200 using Transport Layer Security (TLS) with a self-signed certificate. Generally, communication using a self-signed certificate may not guarantee security. For example, even if the electronic device 200 has been tampered with, communication using a self-signed certificate may allow communication using the electronic device 200. In other words, communication using a self-signed certificate may allow spoofing of the electronic device 200. Therefore, the terminal device 100 determines whether the electronic device 200 has been tampered with, and if the electronic device 200 has been tampered with, detects the tampering. Therefore, the electronic device 200 is a device that is subject to tampering detection. Here, the "state in which the electronic device has been tampered" may refer to, for example, a state in which the firmware of the electronic device 200 has been forged to be different from that provided by the manufacturer of the electronic device 200.

[0014] Specifically, the terminal device 100 transmits to the electronic device 200 command information indicating a command to be executed by the electronic device 200. The firmware of the electronic device 200 executes the command according to the command information and transmits first information indicating the execution result to the terminal device 100. As a result, the terminal device 100 acquires the first information. Note that the terminal device 100 may store command information of multiple patterns #1, #2, . . . , #N in advance. When transmitting command information to the electronic device 200, the terminal device 100 may randomly select a pattern of command information to be transmitted to the electronic device 200 from the multiple patterns of command information. The command information will be described later.

[0015] The information processing device 10 also pre-stores second information corresponding to the execution result as reference information. Here, the reference information, i.e., the second information, is pre-stored information corresponding to the execution result of command information executed by the electronic device 200 in an untampered state. The reference information can be obtained, for example, by having the electronic device 200 execute the command information before operation, such as before shipping the electronic device 200. Since the reference information corresponds to the execution result by the untampered electronic device 200, it can be said to be a correct execution result, i.e., a normal value. Here, the information processing device 10 stores reference information for each of the command information of the above-mentioned multiple patterns #1, #2, ..., #N. Furthermore, if device information such as the model and firmware version of the electronic device 200 is different, even if the electronic device 200 executes command information of the same pattern, the execution result may differ. Therefore, the information processing device 10 may store different reference information for each pattern of command information, depending on the device information such as the model and firmware version of the electronic device 200.

[0016] The terminal device 100 acquires, from the information processing device 10, second information corresponding to the pattern of the command information transmitted to the electronic device 200. Then, the terminal device 100 compares the first information acquired from the electronic device 200 with the second information acquired from the information processing device 10. Then, if the first information and the second information match, the terminal device 100 determines that the electronic device 200 has not been tampered with, that is, the electronic device 200 is in a normal state. On the other hand, if the first information and the second information do not match, the terminal device 100 determines that the electronic device 200 has been tampered with. In this case, the terminal device 100 may disconnect communication with the electronic device 200.

[0017] With this configuration, the terminal device 100 according to the first embodiment can appropriately determine whether the electronic device 200 has been tampered with. Therefore, the communication system 1 according to the first embodiment can ensure the security of communication between the terminal device 100 and the electronic device 200 even when communication is performed using a self-signed certificate.

[0018] Furthermore, if there are only a few patterns of command information to be transmitted to the electronic device 200, there is a risk that a tamper can easily predict the command information to be transmitted to the electronic device 200 if the electronic device 200 has been tampered with. In this case, there is a risk that the tamper can easily prepare information that is the same as the reference information corresponding to the command information. Therefore, the terminal device 100 may transmit to the electronic device 200 command information of a pattern arbitrarily selected from a large number of patterns of command information. This makes it difficult for a tamper to predict the command information to be transmitted to the electronic device 200. Therefore, it is possible to more reliably ensure the security of communication between the terminal device 100 and the electronic device 200.

[0019] 2 is a diagram illustrating a configuration of the terminal device 100 according to the first embodiment. The terminal device 100 according to the first embodiment has, as its main hardware components, a processing unit 102, a storage unit 104, a communication unit 106, and an interface unit 108 (IF: Interface). The processing unit 102, the storage unit 104, the communication unit 106, and the interface unit 108 may be connected to each other via a data bus or the like.

[0020] The processing unit 102 is a processor such as a CPU (Central Processing Unit). The processing unit 102 may have multiple processors. The processing unit 102 functions as a calculation device that performs control processing, calculation processing, etc. The processing unit 102 controls the storage unit 104, the communication unit 106, and the interface unit 108.

[0021] The storage unit 104 is a storage device such as a memory or a hard disk. The storage unit 104 is, for example, a read-only memory (ROM) or a random access memory (RAM). The storage unit 104 may have multiple memories. The storage unit 104 has a function for storing control programs, calculation programs, etc. executed by the processing unit 102. The storage unit 104 also has a function for temporarily storing processing data, etc. The storage unit 104 may include a database.

[0022] The communication unit 106 performs processing necessary for the terminal device 100 to communicate with other devices via a network. The communication unit 106 may include a communication port, a router, a firewall, etc. The communication unit 106 performs processing for the terminal device 100 to communicate with the electronic device 200 and the information processing device 10. The communication unit 106 may also perform processing for performing TLS communication with the electronic device 200 using a self-signed certificate.

[0023] The interface unit 108 is, for example, a user interface. The interface unit 108 has an input device such as a keyboard, a touch panel, or a mouse, and an output device such as a display or a speaker. The interface unit 108 may be configured such that the input device and the output device are integrated, for example, as in a touch screen or a touch panel. The interface unit 108 accepts data input operations by the user of the terminal device 100, and outputs information to the user.

[0024] The terminal device 100 according to the first embodiment includes, as its components, a communication processing unit 110 and tampering detection software 120. The tampering detection software 120 includes, as its components, a command information storage unit 122 and a device information acquisition unit 124. The tampering detection software 120 also includes, as its components, a selection unit 126, a command transmission unit 128, an execution result acquisition unit 130, a reference information acquisition unit 132, a tampering determination unit 134, and a tampering notification unit 136.

[0025] Each of the above-described components can be realized, for example, by executing a program under the control of the processing unit 102. More specifically, each component can be realized by the processing unit 102 executing a program stored in the storage unit 104. Alternatively, each component may be realized by recording the necessary program on an arbitrary non-volatile recording medium and installing it as needed. This also applies to other embodiments described later.

[0026] Furthermore, each component is not limited to being realized by software programs, but may be realized by any combination of hardware, firmware, and software. Each component may also be realized using a user-programmable integrated circuit, such as an FPGA (field-programmable gate array) or a microcomputer. In this case, this integrated circuit may be used to realize a program consisting of each of the above-described components. The same applies to other embodiments described below.

[0027] The communication processing unit 110 can be realized by the communication unit 106 described above. The communication processing unit 110 performs processing for communicating with the electronic device 200. Specifically, the communication processing unit 110 performs processing for establishing TLS communication with the electronic device 200 using a self-signed certificate. The tampering detection software 120 described below may transmit and receive information to and from the electronic device 200 through the TLS communication established by the communication processing unit 110. Furthermore, when the tampering detection software 120 described below detects tampering of the electronic device 200, the communication processing unit 110 performs processing for terminating communication with the electronic device 200. On the other hand, when tampering of the electronic device 200 is not detected, the communication processing unit 110 continues communication with the electronic device 200.

[0028] As described above, the tampering detection software 120 is software that determines whether the electronic device 200 has been tampered with. In other words, if the electronic device 200 has been tampered with, the tampering detection software 120 detects the tampering. Note that the tampering detection software 120 may send and receive encrypted information in communication with the electronic device 200.

[0029] The command information storage unit 122 stores the above-described command information. Here, the command information storage unit 122 stores a plurality of patterns of command information. That is, the command information storage unit 122 stores a plurality of pieces of command information that are different from one another. The plurality of patterns of command information may be prepared in advance before the communication system 1 is put into operation. Alternatively, the command information may be generated as needed at any timing after the communication system 1 is put into operation. The command information may be generated by a user, such as an administrator of the communication system 1. Note that the command information may include a process that uses a value that is changed from before the tampering when the electronic device 200 is tampered with. Furthermore, the command information may include a process that uses a value that remains unchanged unless the electronic device 200 is tampered with, but that is changed if the electronic device 200 is tampered with.

[0030] The command information may include a process for acquiring the above-described values. For example, if the firmware of the electronic device 200 is tampered with, the size of the ROM storing the firmware will change. Therefore, the processing command included in the command information may be a process for acquiring the size of the ROM storing the firmware of the electronic device 200, i.e., the value of the used capacity of the ROM. Furthermore, if there is a specific file that remains unchanged unless the firmware of the electronic device 200 is tampered with but changes if the firmware is tampered with, the command information may include a process using information on this specific file. For example, the processing command included in the command information may be a process for acquiring a value indicating the size of a specific file stored in a storage area of ​​the electronic device 200. Furthermore, for example, the processing command included in the command information may be a process for acquiring a value indicating the creation date and time of a specific file. Furthermore, for example, the processing command included in the command information may be a process for acquiring a value indicating a specific portion of a specific file. Furthermore, the command information may be a combination of the above-described processing commands.

[0031] The command information may also include a process for processing the acquired value. For example, the processing command included in the command information may be a process for acquiring a predetermined portion of the acquired value. For example, the command information may include a process for acquiring the most significant k bits of the acquired value. The command information may also include a process for acquiring an m-bit value starting from the nth bit of the acquired value, where n and m are predetermined integer values. The processing command included in the command information may also be a process for acquiring the result of performing a shift operation on the acquired value. The processing command included in the command information may also be a process for acquiring an encrypted value of the acquired value. The processing command included in the command information may also be a process for acquiring a hash value of the acquired value.

[0032] For example, the command information may include a processing command such as "obtain a value indicating the size of a ROM, and obtain a hash value of the obtained value." The command information may also include a processing command such as "obtain a value indicating the size of a specific file, and obtain the result of performing a shift operation on the obtained value." The command information may also include a processing command such as "obtain a value indicating the size of a ROM, obtain a value indicating a specific part of a specific file, and obtain a hash value of the value obtained by adding the obtained values." The command information storage unit 122 stores multiple patterns of command information including such processing commands. From the viewpoint of security, it is preferable that the command information storage unit 122 stores as many patterns of command information as possible.

[0033] The device information acquisition unit 124 acquires device information related to the electronic device 200 from the electronic device 200. The device information acquisition unit 124 transmits a device information request signal requesting the electronic device 200 to transmit the device information. Upon receiving the device information request signal, the electronic device 200 transmits device information related to itself to the terminal device 100. In this way, the device information acquisition unit 124 acquires the device information of the electronic device 200.

[0034] The device information may include, for example, information indicating the make or model name of the electronic device 200. The device information may also include information indicating the firmware version of the electronic device 200. Here, if the information indicated by the device information is different, the execution result may be different even if the electronic device 200 executes a processing command indicated by the same command information. For example, if the firmware version is different, the firmware size will be different, and therefore the size of the ROM that stores the firmware will also be different. Therefore, if the electronic device 200 executes command information that includes processing that uses the ROM size, the execution result will also be different if the firmware version is different.

[0035] The selection unit 126 selects a pattern of command information to be transmitted to the electronic device 200. It is preferable that the selection unit 126 selects the pattern of command information in a manner that prevents a person who tampers with the electronic device 200 from predicting the pattern of command information to be transmitted to the electronic device 200. For example, the selection unit 126 may randomly select the pattern of command information to be transmitted to the electronic device 200.

[0036] The command transmitting unit 128 transmits command information of the pattern selected by the selecting unit 126 to the electronic device 200. That is, the command transmitting unit 128 transmits command information of the pattern selected from a plurality of patterns to the electronic device 200. As will be described later, the electronic device 200 executes the processing command indicated in the transmitted command information and transmits the execution result to the terminal device 100. The execution result acquiring unit 130 acquires, from the electronic device 200, first information indicating the execution result of the electronic device 200 executing the command information.

[0037] The reference information acquisition unit 132 acquires second information corresponding to the command information transmitted to the electronic device 200. In other words, the reference information acquisition unit 132 acquires reference information corresponding to the execution result of the command information, acquired from the electronic device 200. Specifically, the reference information acquisition unit 132 acquires reference information from the information processing device 10. Here, the reference information acquisition unit 132 acquires second information, which is reference information corresponding to the device information of the electronic device 200, of the command information transmitted to the electronic device 200. In other words, the reference information acquisition unit 132 acquires reference information corresponding to the command information of the pattern selected by the selection unit 126 and corresponding to the device information of the electronic device 200. The reference information acquisition unit 132 transmits a reference information request signal to the information processing device 10, requesting that the information processing device 10 transmit reference information. Note that the reference information request signal includes identification information of the command information transmitted to the electronic device 200 and the device information of the electronic device 200. Upon receiving the reference information request signal, the information processing device 10 transmits reference information corresponding to the identification information of the command information and the device information to the terminal device 100. As a result, the reference information acquisition unit 132 acquires the second information, which is the reference information.

[0038] The tampering determination unit 134 determines whether the electronic device 200 has been tampered with based on the first information and the second information. Specifically, the tampering determination unit 134 compares the first information with the second information and determines whether the first information and the second information match. If the first information and the second information match, the tampering determination unit 134 determines that the electronic device 200 has not been tampered with. On the other hand, if the first information and the second information do not match, the tampering determination unit 134 determines that the electronic device 200 has been tampered with.

[0039] When it is determined that the electronic device 200 has been tampered with, the tampering notification unit 136 outputs a notification indicating that the electronic device 200 has been tampered with. For example, the tampering notification unit 136 may cause the interface unit 108 to display a message indicating that the electronic device 200 has been tampered with. Furthermore, for example, the tampering notification unit 136 may cause the interface unit 108 to output a sound indicating that the electronic device 200 has been tampered with.

[0040] 3 is a diagram showing the configuration of the electronic device 200 according to the first embodiment. The electronic device 200 has, as its main hardware components, a processing unit 202, a storage unit 204, a communication unit 206, an interface unit 208, and an operation unit 210. The processing unit 202, the storage unit 204, the communication unit 206, the interface unit 208, and the operation unit 210 may be connected to each other via a data bus or the like.

[0041] The processing unit 202 is, for example, a processor such as a CPU. The processing unit 202 may have multiple processors. The processing unit 202 functions as a calculation device that performs control processing, calculation processing, etc. The processing unit 202 controls the storage unit 204, the communication unit 206, the interface unit 208, and the operation unit 210.

[0042] The storage unit 204 is a storage device such as a memory or a hard disk. The storage unit 204 is a ROM or a RAM. The storage unit 204 has a function for storing control programs, calculation programs, etc. executed by the processing unit 202. The storage unit 204 also has a function for temporarily storing processing data, etc. The storage unit 204 may include a database.

[0043] The communication unit 206 performs processing necessary for the electronic device 200 to communicate with other devices via a network. The communication unit 206 may include a communication port, a router, a firewall, etc. The communication unit 206 performs processing for the electronic device 200 to communicate with the terminal device 100. The communication unit 206 may also perform processing for performing TLS communication with the terminal device 100 using a self-signed certificate.

[0044] The interface unit 208 has an input device such as a button, keyboard, touch panel, or mouse, and an output device such as a display or speaker. The interface unit 208 may be configured with an input device and an output device integrated together. The interface unit 208 accepts data input operations by the user and outputs information to the user. The interface unit 208 includes an operation panel.

[0045] The operating unit 210 is an operating component that realizes the functions of the electronic device 200. If the electronic device 200 is a printer, the operating unit 210 functions as a printing unit. In this case, the operating unit 210 has a printing function for forming an image on paper, i.e., a print medium. In this case, the operating unit 210 also includes a print engine. The print engine is a mechanical configuration that prints an image on a print medium. The print engine may have, for example, a mechanism for printing using toner using an electrophotographic method. Alternatively, the print engine may have, for example, a mechanism for printing using an inkjet method. The print engine may also have a transport mechanism for transporting the print medium.

[0046] The electronic device 200 according to the first embodiment includes, as its components, firmware 230, a device information transmitting unit 232, a command receiving unit 234, and an execution result transmitting unit 236. Each of the above-described components can be realized, for example, by executing a program under the control of the processing unit 202. More specifically, each of the components can be realized by the processing unit 202 executing a program stored in the storage unit 204. Each of the components may be realized by recording a necessary program on an arbitrary non-volatile recording medium and installing it as needed.

[0047] Furthermore, each component may not necessarily be realized by software programs, but may be realized by any combination of hardware, firmware, and software. Each component may also be realized using a user-programmable integrated circuit, such as an FPGA or a microcomputer. In this case, a program consisting of each of the above components may be realized using this integrated circuit.

[0048] The firmware 230 performs processing for the operation of the electronic device 200. The firmware 230 is stored in the ROM 220. The ROM 220 is included in the storage unit 204. The firmware 230 may also have the functions of a device information transmission unit 232, a command reception unit 234, and an execution result transmission unit 236. In other words, the firmware 230 may perform the processing of the device information transmission unit 232, the command reception unit 234, and the execution result transmission unit 236, which will be described later.

[0049] In response to a request from the terminal device 100, the device information transmission unit 232 transmits device information of the electronic device 200 to the terminal device 100. Specifically, when the device information transmission unit 232 receives a device information request signal from the terminal device 100, it transmits the device information of the electronic device 200 to the terminal device 100. Note that the device information may be stored in the storage unit 204, such as the ROM 220.

[0050] The command receiving unit 234 receives command information from the terminal device 100. The firmware 230 executes the received command information. That is, the firmware 230 executes the processing command described in the command information. The firmware 230 then acquires the execution result. The execution result sending unit 236 sends the execution result, that is, the first information, to the terminal device 100.

[0051] 4 is a diagram showing the configuration of the information processing device 10 according to the first embodiment. The information processing device 10 according to the first embodiment has, as its main hardware components, a processing unit 12, a storage unit 14, a communication unit 16, and an interface unit 18. The processing unit 12, the storage unit 14, the communication unit 16, and the interface unit 18 may be connected to each other via a data bus or the like.

[0052] The processing unit 12 is, for example, a processor such as a CPU. The processing unit 12 may have multiple processors. The processing unit 12 functions as a calculation device that performs control processing, calculation processing, etc. The processing unit 12 controls the storage unit 14, the communication unit 16, and the interface unit 18.

[0053] The storage unit 14 is a storage device such as a memory or a hard disk. The storage unit 14 is, for example, a ROM or a RAM. The storage unit 14 may have multiple memories. The storage unit 14 has a function for storing control programs, calculation programs, etc. executed by the processing unit 12. The storage unit 14 also has a function for temporarily storing processing data, etc. The storage unit 14 may include a database.

[0054] The communication unit 16 performs processing necessary for the information processing device 10 to communicate with other devices via a network. The communication unit 16 may include a communication port, a router, a firewall, etc. The communication unit 16 performs processing for the information processing device 10 to communicate with the terminal device 100.

[0055] The interface unit 18 is, for example, a user interface. The interface unit 18 has an input device such as a keyboard, a touch panel, or a mouse, and an output device such as a display or a speaker. The interface unit 18 may be configured such that the input device and the output device are integrated, for example, as in a touch screen or a touch panel. The interface unit 18 accepts data input operations by the user of the information processing device 10, and outputs information to the user.

[0056] The information processing device 10 according to the first embodiment includes, as its components, a reference information storage unit 20, a reference information transmission unit 22, a ROM information registration unit 30, and a reference information generation unit 32. Each of the above-described components can be realized, for example, by executing a program under the control of the processing unit 12. More specifically, each component can be realized by the processing unit 12 executing a program stored in the storage unit 14. Each component may also be realized by recording a necessary program on an arbitrary non-volatile recording medium and installing it as needed.

[0057] Furthermore, each component may not necessarily be realized by software programs, but may be realized by any combination of hardware, firmware, and software. Each component may also be realized using a user-programmable integrated circuit, such as an FPGA or a microcomputer. In this case, a program consisting of each of the above components may be realized using this integrated circuit.

[0058] The reference information storage unit 20 stores the above-mentioned reference information. The reference information storage unit 20 stores the reference information for each of a plurality of patterns of command information, for device information of the electronic device 200, that is, for each model and firmware version of the electronic device 200. The reference information stored in the reference information storage unit 20 may be acquired every time a new version of firmware for the electronic device 200 is released by having the new version of firmware execute all patterns of command information.

[0059] The reference information transmitting unit 22 transmits reference information to the terminal device 100 in response to a request from the terminal device 100. Specifically, when the information processing device 10 receives a reference information request signal from the terminal device 100, the reference information transmitting unit 22 extracts the pattern of command information, the model of the electronic device 200, and the firmware version of the electronic device 200, which are indicated in the reference information request signal. Then, the reference information transmitting unit 22 extracts reference information corresponding to the pattern of command information, the model of the electronic device 200, and the firmware version of the electronic device 200 from the reference information storage unit 20, and transmits the reference information to the terminal device 100.

[0060] The ROM information registration unit 30 stores information about the ROM 220 in which the firmware of the electronic device 200 is stored in an unaltered state. The ROM information registration unit 30 may store a copy of the ROM 220 in an unaltered state. In this case, the ROM information registration unit 30 may store a copy of the ROM 220 in which each version of firmware is stored. Alternatively, the ROM information registration unit 30 may store values ​​that can be used in command information for the ROM 220 in which each version of firmware is stored. For example, the ROM information registration unit 30 may store information about the size of the ROM 220 and the folders and files in the ROM 220. The information about the folders and files in the ROM 220 may include the size and creation date and time of each of these folders and files.

[0061] The reference information generation unit 32 generates reference information corresponding to each pattern of the command information using ROM information registered in the ROM information registration unit 30. Specifically, the reference information generation unit 32 generates reference information by virtually realizing the processing of the electronic device 200 in an untampered state and executing the command information. More specifically, the reference information generation unit 32 receives each pattern of command information from the terminal device 100. For each pattern of the received command information, the reference information generation unit 32 virtually executes the processing of the firmware 230 of each model and version of the electronic device 200 in an untampered state. As a result, the reference information generation unit 32 generates reference information corresponding to each pattern of the command information for each model and version of the firmware of the electronic device 200. The generated reference information is stored in the reference information storage unit 20. Note that the reference information does not have to be generated by the information processing device 10. The reference information may also be generated by the manufacturer of the electronic device 200 by operating the electronic device 200 before it is put into operation.

[0062] Fig. 5 is a flowchart showing a communication method executed in the communication system 1 according to the first embodiment. Fig. 5 mainly shows the processing of the terminal device 100 and the electronic device 200. The terminal device 100 starts communication with the electronic device 200 (step S102). Specifically, the communication processing unit 110 establishes communication with the electronic device 200 using a self-signed certificate, as described above.

[0063] The terminal device 100 requests device information from the electronic device 200 (step S104). Specifically, the device information acquisition unit 124 transmits a device information request signal to the electronic device 200, as described above. In response to the request for device information from the terminal device 100, the electronic device 200 transmits the device information to the terminal device 100 (step S106). Specifically, as described above, upon receiving the device information request signal, the device information transmission unit 232 transmits device information indicating the model and firmware version of the electronic device 200 to the terminal device 100. The device information acquisition unit 124 of the terminal device 100 acquires the device information (step S108).

[0064] The terminal device 100 selects a pattern of command information (step S110). Specifically, the selection unit 126 randomly selects a pattern of command information to be transmitted to the electronic device 200 from a plurality of patterns of command information, as described above. The command transmission unit 128 of the terminal device 100 transmits the command information of the selected pattern to the electronic device 200, as described above (step S112). The electronic device 200 executes processing in accordance with the command information and transmits the execution result to the terminal device 100 (step S114). Specifically, the command reception unit 234 receives the command information from the terminal device 100. The firmware 230 executes the processing command indicated in the received command information. The execution result transmission unit 236 transmits the execution result of the command information executed by the firmware 230 to the terminal device 100 as first information. As a result, the execution result acquisition unit 130 of the terminal device 100 acquires the first information, which is the execution result (step S116). As described above, communication between the terminal device 100 and the electronic device 200 may be encrypted. Therefore, command information transmitted from the terminal device 100 to the electronic device 200 may be encrypted. Then, the command receiving unit 234 of the electronic device 200 may decrypt the encrypted command information. This prevents the command information from being leaked to the outside.

[0065] The terminal device 100 acquires reference information corresponding to the command information of the pattern selected in S110 (step S118). Specifically, the reference information acquisition unit 132 acquires, as second information, from the information processing device 10, reference information corresponding to the execution result of the command information acquired from the electronic device 200, as described above. The terminal device 100 determines whether the execution result matches the reference information (step S120). Specifically, the tampering determination unit 134 determines whether the first information indicating the execution result matches the second information, which is reference information, as described above.

[0066] If the execution result matches the reference information (YES in S120), the communication processing unit 110 continues communication with the electronic device 200 (step S122). As a result, the terminal device 100 executes the intended communication process with the electronic device 200. On the other hand, if the execution result does not match the reference information (NO in S120), the tampering notification unit 136 notifies the electronic device 200 that it has been tampered with (step S124). Then, the communication processing unit 110 cuts off communication with the electronic device 200 (step S126).

[0067] Fig. 6 is a diagram showing a specific example of command information according to the first embodiment. Fig. 6 shows examples of command information of pattern #1 and command information of pattern #2. Note that the command information pattern may be any pattern other than the one shown in Fig. 6.

[0068] The firmware 230 of the electronic device 200 executes the following processing commands in accordance with the command information of pattern #1. That is, the firmware 230 acquires a value indicating the size of the ROM in which the firmware 230 is stored. The firmware 230 acquires a value indicating the size of folder A. The firmware 230 acquires 40 bytes of data starting from the 40th byte of file XX. The firmware 230 acquires a value indicating the creation date and time of file YY. Note that the "ROM size," "folder A size," "file XX," and "creation date and time of file YY" acquired above are unchanging unless the firmware 230 is tampered with, but are values ​​that can be changed if the firmware 230 is tampered with.

[0069] The firmware 230 also performs a 3-bit shift operation on each of the acquired data. Furthermore, the firmware 230 generates a hash value for the acquired data. Specifically, the firmware 230 may generate a hash value by concatenating the respective data strings resulting from the 3-bit shift operation on the acquired data and inputting the concatenated data into a predetermined hash function. Alternatively, the firmware 230 may generate a hash value by adding the respective values ​​resulting from the 3-bit shift operation on the acquired data and inputting the resulting value into a predetermined hash function. The same applies to the "hash value generation" process of Pattern #2 below. In this way, the firmware 230 generates an execution result for the command information of Pattern #1.

[0070] Furthermore, the firmware 230 of the electronic device 200 executes the following processing commands in accordance with the command information of pattern #2. That is, the firmware 230 acquires a value indicating the creation date and time of the folder "admin." The firmware 230 acquires the number of files contained in the folder "deko." The firmware 230 acquires a value indicating the size of the ROM in which the firmware 230 is stored. The firmware 230 acquires all of the data contained in the folder QQ. Note that the "creation date and time of the folder "admin," "number of files contained in the folder "deko," "ROM size," and "all of the data contained in the folder QQ" acquired above remain unchanged unless the firmware 230 is tampered with, but may be changed if the firmware 230 is tampered with.

[0071] The firmware 230 also encrypts each of the above acquired data using the password "leikly." Furthermore, the firmware 230 generates a hash value of the acquired data as described above. As a result, the firmware 230 generates an execution result for the command information of pattern #2.

[0072] FIG. 7 is a diagram illustrating a specific example of processing of the communication system 1 according to the first embodiment. In the example of FIG. 7, it is assumed that the electronic device 200A has not been tampered with, and the electronic device 200B has been tampered with. Furthermore, it is assumed that the models of the electronic device 200A and the electronic device 200B are "Model A." It is also assumed that the firmware version of the electronic device 200A is "1." It is also assumed that the firmware version "1" of the electronic device 200B has been tampered with. Therefore, the size of the ROM in which the firmware of the electronic device 200B is stored is different from the size of the ROM in which the firmware of the electronic device 200A is stored.

[0073] A case will be described in which the tampering detection software 120 of the terminal device 100 determines whether the electronic device 200A has been tampered with. The tampering detection software 120 transmits command information of pattern #1 to the electronic device 200A. The firmware 230 of the electronic device 200A executes a processing command in accordance with the command information and obtains an execution result indicating the character string "fdeagead". The electronic device 200A transmits the execution result "fdeagead" to the terminal device 100.

[0074] The tampering detection software 120 requests reference information corresponding to the command information of pattern #1 from the information processing device 10. Here, the model of the electronic device 200A is "Model A," and the version of the firmware 230 of the electronic device 200A is "1." Therefore, the information processing device 10 transmits reference information indicating the character string "fdeagead" to the terminal device 100 as reference information corresponding to the command information of pattern #1 for the model "Model A" and firmware version "1." The tampering detection software 120 determines that the electronic device 200A has not been tampered with, because the execution result "fdeagead" acquired from the electronic device 200A matches the reference information "fdeagead."

[0075] Next, a case will be described in which the tampering detection software 120 of the terminal device 100 determines whether the electronic device 200B has been tampered with. The tampering detection software 120 transmits command information of pattern #2 to the electronic device 200B. The firmware 230 of the electronic device 200B executes a processing command in accordance with the command information and obtains an execution result indicating the character string "kogikeojkl". The electronic device 200B transmits the execution result "kogikeojkl" to the terminal device 100.

[0076] The tampering detection software 120 requests reference information corresponding to the command information of pattern #2 from the information processing device 10. Here, the model of the electronic device 200B is "Model A," and the version of the firmware 230 of the electronic device 200B is "1." Therefore, the information processing device 10 transmits reference information indicating the character string "lfijl;ijgoi;e" to the terminal device 100 as reference information corresponding to the command information of pattern #2 for the model "Model A" and firmware version "1." The tampering detection software 120 determines that the electronic device 200B has been tampered with because the execution result "kogikeojkl" acquired from the electronic device 200B does not match the reference information "lfijl;ijgoi;e."

[0077] Here, a tamper such as a hacker may be able to recognize that the firmware has a tampering detection function, such as executing command information and transmitting the execution result, by analyzing the firmware through reverse engineering or the like. However, it is extremely difficult for the tamper to recognize what command information is being transmitted. Furthermore, the command information includes processing using values ​​that will be changed if the firmware is tampered with. Therefore, it is extremely difficult for the tamper to replace the tampering detection function with some other function when tampering with the firmware. In other words, it is extremely difficult for the tamper to add a function that returns reference information corresponding to command information transmitted from the tampering detection software 120 to the tampering detection software 120 without using the tampering detection function. Therefore, the communication system 1 according to the first embodiment can appropriately detect the tampering even if the electronic device 200 is tampered, thereby improving the security of communication with the electronic device 200.

[0078] Furthermore, when the first information and the second information do not match, the terminal device 100 according to the first embodiment determines that the electronic device 200 has been tampered with, and performs processing to terminate communication with the electronic device 200. This prevents communication with the tampered electronic device 200, further improving security in communication with the electronic device 200.

[0079] Furthermore, in the first embodiment, the command information may include processing that uses a value that is changed when the electronic device 200 is tampered with, such as the size of the ROM. This increases the possibility that the execution result when the tampered electronic device 200 executes the command information will not match the reference information. This makes it possible to more appropriately detect tampering of the electronic device 200. This further improves the security of communication with the electronic device 200.

[0080] Furthermore, the terminal device 100 according to the first embodiment may transmit command information of a pattern selected from a plurality of patterns of command information to the electronic device 200. This makes it extremely difficult for a person who tampers with the electronic device 200 to predict the pattern of command information to be transmitted to the electronic device 200. Therefore, it becomes extremely difficult for the tampered electronic device 200 to transmit reference information corresponding to the command information to the terminal device 100. This makes it possible to more appropriately detect tampering with the electronic device 200. Therefore, security in communication with the electronic device 200 is further improved.

[0081] Furthermore, the information processing device 10 according to the first embodiment may generate the reference information by virtually realizing the processing of the electronic device 200 in an untampered state and executing the command information. That is, in the first embodiment, the reference information, i.e., the second information, may be generated by virtually realizing the processing of the electronic device 200 in an untampered state and executing the command information. This makes it possible to generate reference information corresponding to the execution result when the electronic device 200 executes the command information, even in a situation where the electronic device 200 may have been tampered with after being put into operation. That is, even if new command information is generated after the electronic device 200 is put into operation, the reference information can be generated. Therefore, it is possible to generate new patterns of command information even after the electronic device 200 has started operating.

[0082] (Embodiment 2) Next, a second embodiment will be described. For clarity of explanation, the following description and drawings have been omitted and simplified as appropriate. Furthermore, in each drawing, the same elements are given the same reference numerals, and duplicate explanations are omitted as necessary. Therefore, the following description will mainly focus on differences from the first embodiment described above. In the second embodiment, the function of the reference information generation unit 32 according to the first embodiment is provided in the terminal device 100. Therefore, the information processing device 10 according to the second embodiment does not need to have the reference information generation unit 32.

[0083] FIG. 8 is a diagram illustrating a configuration of a terminal device 100 according to the second embodiment. As in the case of the first embodiment described above, the terminal device 100 according to the second embodiment includes, as its main hardware components, a processing unit 102, a storage unit 104, a communication unit 106, and an interface unit 108. As in the case of the first embodiment described above, the terminal device 100 according to the second embodiment also includes, as its components, a communication processing unit 110 and tampering detection software 120. The tampering detection software 120 according to the second embodiment also includes, as its components, a command information storage unit 122 and a device information acquisition unit 124. The tampering detection software 120 according to the second embodiment also includes, as its components, a selection unit 126, a command transmission unit 128, an execution result acquisition unit 130, a reference information acquisition unit 132, a tampering determination unit 134, and a tampering notification unit 136. The tampering detection software 120 according to the second embodiment also includes, as its components, a reference information generation unit 140.

[0084] The reference information generating unit 140 generates reference information. Specifically, the reference information generating unit 140 acquires, from the information processing device 10, information about the ROM used in command information corresponding to the reference information to be generated for each firmware version of each model of the electronic device 200. For example, when generating reference information corresponding to the command information of pattern #1 in the example of FIG. 6, the reference information generating unit 140 acquires the "ROM size," "folder A size," "file XX," and "creation date and time of file YY" from the information processing device 10.

[0085] The reference information generation unit 140 transmits a ROM information request signal to the information processing device 10, requesting acquisition of information about the ROM used in the command information. Upon receiving the ROM information request signal, the information processing device 10 reads information about the ROM used in the command information indicated in the ROM information request signal from the ROM information registration unit 30 and transmits the information to the terminal device 100. As a result, the reference information generation unit 140 acquires the information about the ROM used in the command information. Then, similar to the reference information generation unit 32 according to the first embodiment, the reference information generation unit 140 generates reference information by virtually realizing the processing of the electronic device 200 in an untampered state and executing the command information. As a result, the reference information generation unit 140 generates reference information corresponding to each pattern of the command information for each model of the electronic device 200 and each version of firmware. The reference information generation unit 140 transmits the generated reference information to the information processing device 10. As a result, the generated reference information is stored in the reference information storage unit 20 of the information processing device 10.

[0086] The terminal device 100 according to the second embodiment generates reference information, i.e., second information, by virtually realizing the processing of the electronic device 200 in an untampered state and executing command information. As a result, even in a situation where the electronic device 200 may have been tampered with after operation, it is possible to generate reference information corresponding to the execution result when the electronic device 200 executes the command information. In other words, it is possible to generate reference information even when new command information is generated after the electronic device 200 is operated. Therefore, in the second embodiment as well, it is possible to generate command information of a new pattern even after operation of the electronic device 200 has begun.

[0087] (Variation) The present invention is not limited to the above-described embodiment, and can be appropriately modified without departing from the spirit of the present invention. For example, the order of the processes in the above-described flowchart can be appropriately changed. Furthermore, one or more of the processes in the above-described flowchart can be omitted.

[0088] Furthermore, in the above-described embodiment, the reference information (second information) is stored in the information processing device 10, which is a device separate from the terminal device 100. However, the present invention is not limited to this configuration. The reference information may be stored in any location other than the electronic device 200, which may be subject to tampering. For example, the reference information may be stored in a predetermined storage area of ​​the storage unit 104 of the terminal device 100. In this case, the reference information acquisition unit 132 acquires the reference information from the storage area of ​​the terminal device 100 where the reference information is stored. In other words, regardless of whether the reference information is stored in the information processing device 10 or the terminal device 100, the reference information acquisition unit 132 acquires the reference information, i.e., the second information, from a storage location where the reference information is previously stored.

[0089] In the above examples, the program includes instructions (or software code) that, when loaded into a computer, cause the computer to perform one or more functions described in the embodiments. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, computer-readable medium or tangible storage medium includes random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technology, CD-ROM, digital versatile disk (DVD), Blu-ray® disc or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device. The program may also be transmitted on a transitory computer-readable medium or communication medium. By way of example and not limitation, transitory computer-readable medium or communication medium includes electrical, optical, acoustic, or other forms of propagated signals. The program may also be included in a program product. [Explanation of symbols]

[0090] 1...communication system, 10...information processing device, 12...processing unit, 14...storage unit, 16...communication unit, 18...interface unit, 20...reference information storage unit, 22...reference information transmission unit, 30...ROM information registration unit, 32...reference information generation unit, 100...terminal device, 102...processing unit, 104...storage unit, 106...communication unit, 108...interface unit, 110...communication processing unit, 120...tampering detection software, 122...command information storage unit, 124...device information acquisition unit, 126...selection Selection unit, 128...command transmission unit, 130...execution result acquisition unit, 132...reference information acquisition unit, 134...tampering determination unit, 136...tampering notification unit, 140...reference information generation unit, 200...electronic device, 200A...electronic device, 200B...electronic device, 202...processing unit, 204...storage unit, 206...communication unit, 208...interface unit, 210...operation unit, 220...ROM, 230...firmware, 232...device information transmission unit, 234...command reception unit, 236...execution result transmission unit

Claims

1. a communication processing unit that performs processing for communicating with an electronic device that is a target of tamper detection; a command transmission unit that transmits command information indicating a command to be executed by the electronic device to the electronic device; an execution result acquisition unit that acquires, from the electronic device, first information indicating an execution result of the electronic device executing the command information; a tampering determination unit that determines whether the electronic device has been tampered with based on second information that is pre-stored corresponding to an execution result of the command information being executed by the electronic device in an untampered state and the first information; A terminal device having the above configuration.

2. the tampering determination unit determines that the electronic device has not been tampered with when the first information and the second information match. The terminal device according to claim 1 .

3. When the first information and the second information do not match, the communication processing unit performs a process to terminate communication with the electronic device. The terminal device according to claim 2 .

4. the command information includes a process using a value that is changed when the electronic device is tampered with; The terminal device according to claim 1 .

5. The command information includes a process using the size of a ROM of the electronic device. The terminal device according to claim 4.

6. There are a plurality of patterns of the command information, a selection unit that selects a pattern of the command information to be transmitted to the electronic device from a plurality of patterns of the command information; and the command transmission unit transmits the command information of a pattern selected from a plurality of patterns to the electronic device; The terminal device according to claim 1 .

7. the second information is generated by virtually realizing the processing of the electronic device in an untampered state and executing the command information; The terminal device according to claim 1 .

8. An electronic device that is subject to tamper detection; a terminal device communicably connected to the electronic device; and The terminal device a communication processing unit that performs processing for communicating with the electronic device; a command transmission unit that transmits command information indicating a command to be executed by the electronic device to the electronic device; an execution result acquisition unit that acquires, from the electronic device, first information indicating an execution result of the electronic device executing the command information; a tampering determination unit that determines whether the electronic device has been tampered with based on second information that is pre-stored corresponding to an execution result of the command information being executed by the electronic device in an untampered state and the first information; having Communication system.

9. Performs processing to communicate with electronic devices that are subject to tamper detection, transmitting command information indicating a command to be executed by the electronic device to the electronic device; acquiring, from the electronic device, first information indicating an execution result of the command information executed by the electronic device; determining whether the electronic device has been tampered with based on second information that corresponds to an execution result of the command information executed by the electronic device in an untampered state and that is stored in advance, and the first information; Communication method.

10. performing a process for communicating with an electronic device that is a target for tamper detection; transmitting command information indicating a command to be executed by the electronic device to the electronic device; acquiring, from the electronic device, first information indicating an execution result of the command information executed by the electronic device; determining whether the electronic device has been tampered with based on second information stored in advance corresponding to an execution result of the command information executed by the electronic device in an untampered state and the first information; A program that causes a computer to execute the following.

Images