Information processing device, method for controlling information processing device, and program

Abstract

To detect unauthorized use of a process during execution of the process on an information processing device.SOLUTION: An information processing device for detecting unauthorized execution of a process comprises: monitoring means for monitoring physical input to the information processing device; identification means for identifying execution conditions of the process; and detection means for detecting unauthorized execution of the process on the basis of the physical input monitored by the monitoring means and the execution conditions identified by the identification means.SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] The present invention relates to an information processing device, a control method for an information processing device, and a program. [Background technology]

[0002] In recent years, damage caused by cyber attacks targeting information processing equipment has been increasing. Various security measures have been implemented in response to this trend, but the increasing sophistication of cyber attacks has made it difficult to counter them with traditional security measures such as malware detection and firewalls. Zero-day attacks, which exploit unknown vulnerabilities, are particularly difficult to defend against, and there have been many cases where attackers who have infiltrated information processing equipment systems through zero-day attacks have exploited the systems to cause damage to individuals and businesses. To combat these sophisticated attacks, in addition to traditional defenses at the network perimeter, it is necessary to implement security measures that monitor system behavior and detect attacks that attempt to exploit the system.

[0003] Patent Document 1 discloses that a monitoring monitor is installed for each module executed on an information processing device, and attacks that exploit processes are detected by comparing the execution information of the modules executed by the monitor with the execution conditions of the modules stored in advance. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 4995170 Summary of the Invention [Problem to be solved by the invention]

[0005] However, the technology described in Patent Document 1 has a problem in that it cannot detect attacks that exploit normal processes as they are. In Patent Document 1, a monitoring monitor installed in a module monitors whether the arguments and sequences of APIs and system calls called by the module are behaving correctly. Therefore, attacks in which an attacker exploits the processes of an information processing device as they are cannot be detected. For example, there is a DoS (Denial of Service) attack that aims to consume resources and disrupt business operations by illegally executing the printing process of an MFP (Multi-Function Peripheral) and causing a large number of prints. In this DoS attack, the attacker succeeds by calling a large number of legitimate printing processes. Therefore, the monitoring monitor recognizes the behavior of the module itself as correct, and the technology described in Patent Document 1 cannot detect the attack.

[0006] The present invention has been made in view of the above-mentioned problems, and has an object to provide a technique for detecting unauthorized use of a process when the process is executed by an information processing device. [Means for solving the problem]

[0007] To achieve the above object, an information processing device according to one aspect of the present invention comprises: An information processing device that detects unauthorized execution of a process, a monitoring means for monitoring a physical input to the information processing device; An identification means for identifying an execution condition of the process; a detection means for detecting unauthorized execution of the process based on the physical input monitored by the monitoring means and the execution condition identified by the identification means; The present invention is characterized by comprising: [Effects of the Invention]

[0008] According to the present invention, unauthorized use of a process can be detected when the process is executed by an information processing device. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram showing an example of the configuration of a system including an MFP and a peripheral device according to an embodiment. [Figure 2] FIG. 2 is a hardware configuration diagram of a controller unit of the MFP according to an embodiment. [Figure 3] FIG. 2 is a software configuration diagram of a controller unit of the MFP according to an embodiment. [Figure 4] 10 is a physical input record table according to an embodiment. [Figure 5] 1 is a table of process and physical inputs according to one embodiment. [Figure 6] 1 is a flowchart showing a processing procedure according to an embodiment. [Figure 7] 10 is a flowchart showing a processing procedure according to Modification 1. [Figure 8] 10 is a table of processes and preparatory operations according to Modification 2. [Figure 9] 10 is a flowchart showing the procedure of processing in Modification 2. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. Note that the following embodiments do not limit the scope of the claimed invention. Although multiple features are described in the embodiments, not all of these multiple features are necessarily essential to the invention, and multiple features may be combined arbitrarily. Furthermore, in the accompanying drawings, the same reference numerals are used to designate the same or similar components, and redundant explanations will be omitted.

[0011] (Embodiment) In this embodiment, a process is compared between a process that an information processing device is attempting to execute and a physical input state by a user. If an inconsistency in the process execution conditions is detected, the process is determined to be an attack on the system and security measures are implemented. The process here refers to a process for executing functions possessed by an MFP, such as printing, scanning, and changing MFP settings. In this embodiment, an MFP, which is an image forming device, is described as an example of an information processing device, but this embodiment is a technology that can also be applied to information processing devices other than MFPs.

[0012] <System configuration> An example of the configuration of a system including an MFP and peripheral devices according to one embodiment will be described with reference to the block diagram of FIG. 1. An MFP (information processing device) 100, a PC (personal computer) 110, and a management server 120 are connected via a LAN 140. The PC 110 performs processes such as sending and receiving print jobs and scan jobs to the MFP 100. The management server 120 manages the MFP 100, and if the MFP 100 is integrated into an organization's authentication system, authenticates and authorizes users who access the MFP 100. When the MFP 100 or management server 120 connects to the Internet, the connection is made via a firewall 130. A PC 150 is connected to the MFP 100 and management server 120 via the Internet, and can access the MFP 100.

[0013] The MFP 100 includes a controller unit 101, a panel operation unit 102, a button operation unit 103, a card reader unit 104, a printer unit 105, and a scanner unit 106.

[0014] The controller unit 101 controls various operations of the MFP 100. The panel operation unit 102 is made up of an electronic panel for input and output with the user, and the user can operate the MFP 100 by performing touch input. The button operation unit 103 is made up of physical buttons for input and output with the user, and the user can operate the MFP 100 by pressing the physical buttons.

[0015] The card reader unit 104 can read card information and authenticate the user when the user holds an IC (Integrated Circuit) card over it. The printer unit 105 outputs electronic data to paper media. The scanner unit 106 reads paper media and converts it into electronic data. The scanner unit 106 also uses a sensor to recognize whether the cover of the scanner body is open or closed, and notifies the user of the open or closed state of the cover by turning on an LED (Light-Emitting Diode). The panel operation unit 102, button operation unit 103, card reader unit 104, printer unit 105, and scanner unit 106 are connected to the controller unit 101, and function as a multifunction peripheral under the control of the controller unit 101.

[0016] <Hardware configuration> 2 is a block diagram showing the hardware configuration of the controller unit 101 of the MFP 100 according to one embodiment. The CPU 201 performs the main arithmetic processing within the controller unit 101. The CPU 201 is connected to the DRAM 202 via a bus. The DRAM 202 is used by the CPU 201 as a working memory for temporarily storing program data representing arithmetic instructions during the calculation process performed by the CPU 201 and data to be processed. The CPU 201 is further connected to the I / O controller 203 via the bus. The I / O controller 203 performs input and output to and from various devices according to instructions from the CPU 201.

[0017] A network I / F 204 is connected to the I / O controller 203. A wired LAN device 220 is connected to the network I / F 204. The CPU 201 controls the wired LAN device 220 via the network I / F 204 to realize communication on the LAN 140.

[0018] A SATA (Serial Advanced Technology Attachment) I / F 205 is also connected to the I / O controller 203. A flash memory 221 and a secure memory 222 are connected to the SATA I / F 205. The CPU 201 uses the flash memory 221 to permanently store programs for implementing the functions of the MFP 100 and document files. The CPU 201 also uses the secure memory 222 to store data that is important from a security standpoint. The secure memory 222 is encrypted and can only be accessed by specific modules through access control. This protects confidential information from leakage and unauthorized rewriting. The secure memory 222 stores information that requires confidentiality and integrity, such as user authentication information, encryption keys, and a physical input record table 401 shown in FIG. 4 (described later).

[0019] A panel I / F 206 is also connected to the I / O controller 203. The panel I / F 206 converts a user's physical operation input to the panel operation unit 102 into electronic data and transmits the data to the CPU 201, thereby realizing the user's operation. A button I / F 207 is also connected to the I / O controller 203. The button I / F 207 converts a user's physical operation input to the button operation unit 103 into electronic data and transmits the data to the CPU 201, thereby realizing the user's operation.

[0020] A card reader I / F 208 is also connected to the I / O controller 203. The card reader I / F 208 converts information read from an IC card input to the card reader unit 104 into electronic data and transmits the data to the CPU 201, thereby realizing authentication operations and the like. A printer I / F 209 is also connected to the I / O controller 203. The CPU 201 realizes output processing of paper media using the printer unit 105 via the printer I / F 209.

[0021] A scanner I / F 210 is also connected to the I / O controller 203. The CPU 201 performs document reading processing using the scanner unit 106 via the scanner I / F 210. The scanner I / F 210 also notifies the CPU 201 of the open / close state of the scanner cover. A USB I / F 211 is also connected to the I / O controller 203. The USB I / F 211 controls any device connected to the USB I / F 211.

[0022] To execute the copy function, the CPU 201 loads a program from the flash memory 221 into the DRAM 202 via the SATA I / F 205. The CPU 201 detects a copy instruction from the user via the panel I / F 206 and the button I / F 207 to the panel operation unit 102 and the button operation unit 103 in accordance with the program loaded into the DRAM 202. Upon detecting the copy instruction, the CPU 201 receives an original document as electronic data from the scanner unit 106 via the scanner I / F 209 and stores it in the DRAM 202. The CPU 201 performs color conversion processing appropriate for output on the image data stored in the DRAM 202. The CPU 201 transfers the image data stored in the DRAM 202 to the printer unit 105 via the printer I / F 209 and performs output processing onto paper media. As described above, the copy function can be realized by combining the print function and the scan function. The CPU 201 and other modules are configured independently of each other, and data input and output is performed via the I / O controller 203; therefore, the CPU 201 cannot directly control other modules.

[0023] Furthermore, when the PDL printing function is to be performed, the client PC 110 issues a print instruction via the LAN 140. The CPU 201 loads a program from the flash memory 221 into the DRAM 202 via the SATA I / F 205, and detects a print instruction via the network I / F 204 according to the module loaded into the DRAM 202. When the CPU 201 detects a PDL transmission instruction, it receives print data via the network I / F 204 and stores the print data in the flash memory 221 via the SATA I / F 205. When the CPU 201 has completed storing the print data, it develops the print data stored in the flash memory 221 as image data in the DRAM 202. The CPU 201 performs color conversion processing suitable for output on the image data stored in the DRAM 202. The CPU 201 transfers the image data stored in the DRAM 202 to the printer unit 105 via the printer I / F 209, and performs output processing onto paper media.

[0024] <Software configuration> Next, with reference to the block diagram of FIG. 3, an example of the functional configuration realized by software executed in the controller unit of the MFP according to this embodiment will be described.

[0025] The panel operation control unit 301 displays a screen image for the user on the panel operation unit 102, detects touch operations by the user, and executes processes linked to screen components such as buttons displayed on the screen. A capacitive touch panel is used to detect touch operations. This method detects the touch position by capturing a change in capacitance when the user's finger touches the panel. The panel operation control unit 301 converts the change in capacitance into digital data and transmits the data to other control units. Although a capacitive touch panel is exemplified here, other methods for detecting the user's touch position may also be used.

[0026] The button operation control unit 302 executes a process associated with a button when the user presses a button arranged on the button operation unit 103. When a button is operated, the button operation control unit 302 converts a change in voltage caused by pressing the button into digital data and transmits the data to other control units.

[0027] The card reader control unit 303 executes processing according to the information read by the reader located in the card reader unit 104 when the user holds up the IC card. A contactless reader is used to read the IC card. The card reader reads information by using the electromotive force of electromagnetic induction generated when the IC card passes through the reader's magnetic field when it approaches. The card reader control unit 303 converts the change in the electromotive force into digital data and transmits the data to other control units. Although a contactless IC card reader is shown here as an example, other types of card readers may also be used.

[0028] The physical input storage unit 304 records the results of physical inputs input via the panel operation control unit 301, the button operation control unit 302, and the card reader control unit 303. The physical input storage unit 304 writes the change in physical quantity caused by the operation of any of the operation control units and the time when the change occurred to a physical input record table 401 in the secure memory 222.

[0029] As shown in Fig. 4, the physical input record table 401 records the type of physical operation and the time when the operation occurred. The occurrence time information is recorded in the format of year / month / day / time. Here, the date and time are exemplified as the time information, but other information representing time, such as system time, may also be used. Writing operations to the physical input record table 401 can only be performed from the physical input storage unit 304, but reading operations can be performed from other modules.

[0030] Furthermore, the physical input storage unit 304 only performs the functions of reading physical inputs from each operation control unit and writing the results, and does not accept commands from other control units. Therefore, it is not possible to perform operations such as unauthorized use of the physical input storage unit 304 to write arbitrary input records. Here, secure memory 222 is exemplified as a storage that protects the physical input record table 401, but other storage that can protect the confidentiality and integrity of stored information, such as a TPM (Trusted Platform Module), may also be used. Note that time information is synchronized using a reliable NTP (Network Time Protocol) server to ensure the correct time. Here, the use of an NTP server is exemplified as a method for ensuring time information, but other methods may also be used to protect time information.

[0031] In response to requests from other control units, data storage unit 305 stores data in flash memory 221 and reads data from flash memory 221. For example, when a user wants to change some device setting, panel operation control unit 301 detects the content entered by the user into panel operation unit 102, and in response to a request from panel operation control unit 301, data storage unit 304 saves the changed setting value in flash memory 221.

[0032] A job control unit 306 controls job execution in accordance with instructions from other control units. An image processing unit 307 processes image data into a format suitable for each purpose in accordance with instructions from the job control unit 306. A print processing unit 308 prints and outputs an image on paper media via a printer I / F 209 in accordance with instructions from the job control unit 306.

[0033] The reading processing unit 309 reads a placed document via the scanner I / F 210 in accordance with instructions from the job control unit 306. The reading processing unit 309 also performs operations such as turning on an LED depending on the cover open / close state detected by the scanner I / F 210. The network control unit 310 performs network settings such as an IP address on the TCP / IP control unit 311 at system startup or when a setting change is detected, in accordance with setting values ​​stored in the data storage unit 305.

[0034] The TCP / IP control unit 311 performs transmission and reception processing of network packets via the network I / F 204 in accordance with instructions from other control units. The USB control unit 312 controls the USB I / F 211 and controls any device connected via USB. The communication port control unit 313 controls the port used by the TCP / IP control unit 311 when transmitting and receiving packets.

[0035] The process execution request receiving unit 320 receives a process execution request from the CPU 201. Examples of processes include printing, scanning, setting changes, and administrator authentication, which require physical input from the user to the MFP. These process execution requests are generated by operations input by the user via the panel operation unit 102 or button operation unit 103.

[0036] The process execution condition identification unit 321 identifies the physical input that is a prerequisite for the execution of the process execution request received by the process execution request reception unit 320. To identify the physical input that is a prerequisite for the execution, a process-physical input correspondence table 501 shown in Fig. 5 is used. The process-physical input correspondence table 501 lists the process to be executed on the MFP and the physical input that is a prerequisite for the execution of the process.

[0037] For example, in the case of a print process, the print process is started and printing is performed when the user presses a button on the MFP or inputs information on the touch panel when printing. In the case of a scan process, scanning is performed by opening and closing the cover to read the object to be scanned, or by pressing a button or inputting information on the touch panel in the same way as in the print process.

[0038] In the case of an administrator setting change process, administrator authentication is performed when the MFP is configured. Administrator authentication is performed by entering an administrator ID and password by operating the MFP panel buttons, or by user authentication using an IC card. After receiving a process execution request, the process execution condition identification unit 321 identifies the physical input that is a prerequisite for process execution by referring to the process-physical input correspondence table 501, and instructs the physical input reference unit 322 to obtain the corresponding physical input status.

[0039] The physical input reference unit 322 acquires the occurrence time of a physical input that is a prerequisite for executing a process requested for execution by the process execution condition specification unit 321. When referring to a physical input, a physical input record table 401 shown in Fig. 4 is used. The physical input record table 401 lists the module where the physical input is performed and the time when the physical input occurred.

[0040] For example, suppose a request to execute a print process is generated by a user operating the electronic panel. The panel operation control unit 301 detects the execution of the electronic panel operation, and the time of occurrence is recorded in the physical input record table 401. As with the electronic panel operation, a button press operation is recorded as the operation time of the button control unit 302, an IC card reading operation is recorded as the operation time of the card reader control unit 303, and a cover opening / closing operation during scanning is recorded as the operation time of the reading processing unit 309. Regarding the time of occurrence of physical input to be recorded, it is not necessary to record the time of occurrence in the history; only the most recent time of occurrence needs to be recorded. The physical input reference unit 322 obtains the time of occurrence of the process specified by the process execution condition identification unit 321 from the physical input record table 401, and passes it to the process unauthorized execution determination unit 323.

[0041] The unauthorized process execution determination unit 323 determines whether a process execution request received by the process execution request reception unit 320 is unauthorized. The unauthorized process execution determination unit 323 compares the time information at which the process execution request reception unit 320 received the process execution request with the time of occurrence of the physical input that is a prerequisite for the process and that is acquired by the physical input reference unit 322.

[0042] For example, suppose a print process execution request occurs at "2023 / 06 / 01 / 06:00:00." The print process is assumed to be a panel operation or button operation from the process-physical input table 501, and the process unauthorized execution determination unit 323 receives the occurrence time of the physical input related to the panel operation or button operation from the physical input reference unit 322. The occurrence times of the physical input acquired by the physical input reference unit 322 are assumed to be panel operation "2023 / 05 / 31 / 13:41:05" and button operation "2023 / 05 / 31 / 13:41:32."

[0043] In this case, the time of the physical input is clearly different from the time of the process execution request. In this way, if the time of the process execution request and the time of the physical input that is the prerequisite for process execution are not simultaneous or within a predetermined time range, it can be determined that the process is being executed fraudulently.

[0044] For example, if a user presses a button to execute a print function, the time from detecting the button press to executing the process will not take more than one second assuming that the device is an embedded device. In other words, even if there is a difference of more than a few seconds between the occurrence of the previous physical input and the execution of the process, it can be determined to be an abnormality.

[0045] It is also difficult for an attacker to observe user behavior and execute a fake process within a predetermined time period in accordance with the user's actions. Here, unauthorized process execution refers to an attacker infiltrating the MFP system and executing a process without following the normal procedure. The attacker exploits MFP vulnerabilities or other factors to gain unauthorized access to the MFP system. This unauthorized access allows the attacker to unauthorizedly invoke MFP functions, enabling attacks such as a DoS attack that wastes resources by printing large amounts of paper, or the unauthorized transfer of data stored in the MFP via fax or email. If such unauthorized process execution is determined to have occurred, the security countermeasures unit 324 implements countermeasures. If there is no discrepancy between the time the process occurred and the time the underlying physical input occurred, the request is considered to be a legitimate process execution request and the requested process is executed.

[0046] The security countermeasure unit 324 implements security countermeasures when the unauthorized process execution determination unit 323 detects unauthorized execution of a process. Since unauthorized execution of a process is assumed to mean that an attacker has illegally infiltrated the system, the security countermeasure unit 324 shuts off access by the attacker by restarting the system. At that time, the security countermeasure unit 324 notifies the administrator that an attack on the system has occurred and urges the administrator to take countermeasures.

[0047] <Processing> Next, the procedure for detecting unauthorized process execution based on the state of a physical input that is a prerequisite for process execution according to this embodiment will be described with reference to the flowchart in Figure 6. In S601, the process execution request unit 320 accepts a process execution request. In S602, the process execution condition identification unit 321 identifies a physical input that is a prerequisite for the process requested to be executed. In S603, the physical input reference unit 322 references the occurrence time of the prerequisite physical input identified by the process execution condition identification unit 321.

[0048] In S604, the unauthorized process execution determination unit 323 compares the time when the process execution request was made with the time when the physical input was made. If the difference between the time when the process execution request was made and the time when the physical input was made exceeds a threshold (or is equal to or greater than the threshold), the process proceeds to S605. On the other hand, if the difference is equal to or less than the threshold (or is less than the threshold), the process proceeds to S606.

[0049] In S605, the security countermeasure unit 324 determines that the process is being executed fraudulently and implements security countermeasures. In S605, the security countermeasure unit 324 executes the process as is without implementing security countermeasures.

[0050] As described above, in this embodiment, unauthorized execution of a process that requires physical input can be detected based on the time at which a process execution request is made and the time at which a physical input by a user is made.

[0051] [Variation 1] In the above embodiment, unauthorized execution of a process that requires physical input is detected, but in this modification, unauthorized changes to administrator settings of the MFP are detected.

[0052] When an attacker infiltrates an MFP system, they may disable security settings in order to destroy evidence of the attack or to cause further damage. Changing these security settings requires administrator privileges, but attackers may illegally obtain administrator privileges by exploiting MFP vulnerabilities and change security settings.

[0053] This modified example detects unauthorized changes to administrator settings, which are security settings that require administrator privileges. When changing administrator settings, MFP administrator authentication is required. Administrator authentication is performed using an ID and password or an IC card. When using an ID and password, authentication information is entered using the panel operation unit 102 or button operation unit 103 of the MFP. When using an IC card, authentication is performed by holding the IC card over the card reader unit 104.

[0054] These authentication methods require physical input to the MFP, and by checking for the presence or absence of this physical input, unauthorized changes to the administrator settings can be detected. For example, when a request to change the administrator settings is made, the physical input reference unit 322 acquires information about the time at which the physical input related to the change to the administrator settings occurred. The process-physical input table 501 indicates that changes to the administrator settings require panel operation / button operation (ID / password authentication) and card reader operation (IC card authentication). The physical input reference unit 322 acquires the time at which these physical inputs occurred, and the unauthorized process execution determination unit 323 compares the time at which the request to change the administrator settings was received with the time at which the acquired physical input occurred, thereby detecting unauthorized changes to the administrator settings. If an unauthorized change is detected, the requested setting change is not permitted, the attacker's access is blocked by restarting the MFP, and the administrator is notified.

[0055] <Processing> The process for detecting unauthorized changes to administrator settings according to this modification will be described with reference to the flowchart in Fig. 7. In S701, the process execution request receiving unit 320 receives a request to change administrator settings. In S702, the physical input reference unit 322 references the occurrence time of a physical input related to administrator authentication.

[0056] In S703, the unauthorized process execution determination unit 323 compares the time at which the process execution request was made with the time at which the physical input was made. If the difference between the time at which the process execution request was made and the time at which the physical input was made exceeds the threshold (or is equal to or greater than the threshold), the process proceeds to S704. On the other hand, if the difference is equal to or less than the threshold (or is less than the threshold), the process proceeds to S705. In S704, the security countermeasure unit 324 determines that the process is being made unauthorized and implements security countermeasures. In S705, the security countermeasure unit 324 executes the process as is without implementing security countermeasures.

[0057] As described above, according to this modification, unauthorized changes to administrator settings can be detected.

[0058] [Variation 2] In the above embodiment, unauthorized execution of a process is detected by checking whether or not there is a physical input that is a prerequisite for process execution. However, in this modified example, unauthorized execution of a process is detected based on a preparatory action during process execution.

[0059] When an MFP process is executed, some preparatory actions always occur. For example, when a scan process is performed on the MFP, the cover must be opened and closed to set the object to be scanned. A sensor is installed on the cover, and when the sensor detects that the cover has been opened or closed, it lights up an LED and issues a notification on the UI. In this way, certain MFP processes always have preparatory actions that occur when the process is executed, and the MFP also has sensors to detect these preparatory actions.

[0060] Therefore, if the sensor cannot detect the execution of a preparatory operation during process execution, it is possible to detect that the process has been executed improperly, since the process does not match the use case of the MFP. For example, when the process execution request receiving unit 320 receives a process execution request, the process execution condition identifying unit 321 determines whether or not there is a preparatory operation related to the process by referring to the process-preparatory operation table 801 shown in FIG. 8. The process-preparatory operation table 801 lists whether or not there is a preparatory operation related to the process to be executed. For example, for a scan process, the cover opening and closing operation when setting the target for scanning is listed as a preparatory operation.

[0061] When it is determined by referring to the process-preparatory action table 801 that a preparatory action exists during process execution, unauthorized execution is detected by checking whether or not a preparatory action has occurred. Whether or not a preparatory action has occurred can be checked by the physical input reference unit 322 by referring to the time of occurrence of the corresponding physical input from the physical input record table 401. If the difference between the time of occurrence of the preparatory action and the time of occurrence of the process execution is not equal to or less than a threshold, unauthorized execution of the process can be determined.

[0062] <Processing> The process of detecting fraudulent execution based on the presence or absence of a preparatory movement according to this modified example will be described with reference to the flowchart of Fig. 9. In S901, the process execution request 320 receives a process execution request from the CPU 201.

[0063] In S902, the process execution condition identification unit 321 determines whether or not there is a preparatory operation for the process for which execution has been requested. If the process does not require a preparatory operation, the process proceeds to S903. On the other hand, if the process requires a preparatory operation, the process proceeds to S904. In S903, the process executes a process to confirm the physical input that is a prerequisite for process execution, as shown in the flowchart of FIG.

[0064] In S904, the physical input reference unit 322 references the time at which the preparatory operation occurred. In S905, the unauthorized process execution determination unit 323 compares the time at which the process execution request occurred with the time at which the preparatory operation occurred. If the difference between the time at which the process execution request occurred and the time at which the preparatory operation occurred exceeds a threshold (or is equal to or greater than the threshold), the process proceeds to S906. On the other hand, if the difference is equal to or less than the threshold (or is less than the threshold), the process proceeds to S903. In S906, the security countermeasure unit 324 determines that the process has been executed unauthorizedly and implements security countermeasures.

[0065] As described above, according to this modification, unauthorized execution of a process can be detected by using the preparatory operation of the process.

[0066] [Variation 3] In the above embodiment, unauthorized process execution detection was performed based on physical input. However, in this modified example, unauthorized process execution detection is performed taking into account the status of the remote user interface (RUI) function. Processes such as printing and scanning on an MFP are executed by input from an electronic panel or physical buttons installed on the MFP itself, but some MFP models have a function for remote process execution using an RUI. When using an RUI, a user sends a process execution command from a PC or smartphone using a communication protocol such as HTTP, and the MFP that receives the command executes the process. Therefore, an MFP with an RUI function may not be able to detect unauthorized process execution using physical input.

[0067] In this variation, if the process to be executed can issue an execution command using the RUI, the status of the RUI function is checked to determine whether physical input is a prerequisite for process execution. To use the RUI function, it is necessary to enable the RUI function in the MFP settings, and a communication port must also be open.

[0068] In this modification, whether or not physical input is required is determined by checking the RUI setting and the communication port status. If the RUI setting is disabled or the communication port used for the RUI is disabled, the user must operate the electronic panel or physical buttons on the MFP body to execute the process. Therefore, if it is confirmed that the RUI function is disabled, unauthorized execution detection of processes that require physical input according to the embodiment can be performed. By disabling the RUI setting, the user can use the unauthorized execution detection function for processes that require physical input.

[0069] As described above, according to this modification, by disabling the RUI function, it is possible to detect unauthorized execution of a process that requires physical input.

[0070] [Variation 4] In the above embodiment, unauthorized process execution was detected by checking the physical input required for process execution, but in this modified example, unauthorized process execution is detected using a human presence sensor. Some MFPs are equipped with a human presence sensor, and these models can perform operations such as waking up the device when a person approaches. An attacker can remotely execute unauthorized operations by infiltrating the MFP system from the network, thereby unauthorized execution of processes that actually require user operation. However, if the human presence sensor cannot detect a user during or immediately before the execution of a process, it can be determined that the process was executed without the user being near the MFP.

[0071] Therefore, if a process that requires physical input from the MFP is executed despite the absence of a reaction from the human sensor, this can be detected as unauthorized execution of the process.

[0072] As described above, according to this modification, a human presence sensor is used to further monitor whether a user is present near the information processing device, and if a process that requires physical input is executed despite no reaction from the human presence sensor, unauthorized execution of the process is detected. In this way, unauthorized execution of a process that requires physical input can be detected using the human presence sensor.

[0073] [Variation 5] In the above embodiment, unauthorized execution of a process is detected by checking the physical input required for process execution, but in this modification, unauthorized execution of a process is detected based on the billing status.

[0074] Some MFPs require payment when using certain functions, and these models allow users to print or scan by inserting coins into a charging device installed on the MFP. If an attacker infiltrates the MFP system from the network, they can use the MFP's functions without being charged by manipulating the system illegally. MFPs are equipped with sensors to identify inserted coins, so they can determine whether or not a coin has actually been inserted. Therefore, if an MFP function is used even though the sensor is unable to identify the coin, it can be detected as fraudulent execution.

[0075] As described above, according to this modification, whether or not a user has performed a billing operation for executing a process using a billing device associated with the information processing device is further monitored. If a process is executed even though a billing operation has not been performed, unauthorized execution of the process is detected. This makes it possible to detect unauthorized execution of a process based on the billing status.

[0076] [Other variations] In the above embodiment, measures such as restarting the system and notifying the administrator are taken as security measures when fraudulent execution is detected, but in this modified example, security settings are strengthened after the system is restarted.

[0077] When a forced reboot is performed as a security measure, it is possible to temporarily shut out an attacker who has invaded the system. However, if no measures are taken to prevent the intrusion method, the attacker will be allowed to invade again. Therefore, in this modification, security is strengthened after the reboot to prevent the attacker from re-invading. For example, the firewall function of the MFP is enabled and connections from outside the network to which the MFP belongs are blocked, thereby preventing intrusion from outside. By implementing such security measures, it is possible to prevent the attacker from re-invading. The security measures to be implemented may be measures predetermined by the system, or security measures determined by the user.

[0078] The physical input described in the above embodiment may include various inputs such as pressing a button, operating a touch panel, holding an IC card (voltage change), a human sensor, detecting coins when charging, etc. The process described in the above embodiment may include various processes such as copying, scanning, faxing, administrator authentication (using an IC card), sleeve release, and charging.

[0079] As described above, according to the present invention, when an information processing device executes a process, the state of the physical input that is a condition for executing the process is monitored, and by checking whether the physical input that is a condition for executing the process has been implemented when the process is executed, unauthorized execution of the process can be detected.

[0080] The disclosure of this specification includes the following information processing device, control method for an information processing device, and program.

[0081] (Item 1) An information processing device that detects unauthorized execution of a process, a monitoring means for monitoring a physical input to the information processing device; An identification means for identifying an execution condition of the process; a detection means for detecting unauthorized execution of the process based on the physical input monitored by the monitoring means and the execution condition identified by the identification means; An information processing device comprising:

[0082] (Item 2) 2. The information processing device according to item 1, wherein the process is executed via the physical input made by a user of the information processing device.

[0083] (Item 3) 3. The information processing device according to item 1 or 2, wherein the monitoring means monitors a change in a physical quantity that occurs when a user of the information processing device operates the information processing device.

[0084] (Item 4) 4. The information processing device according to item 3, wherein the physical quantity is a voltage.

[0085] (Item 5) 5. The information processing device according to any one of items 1 to 4, wherein the monitoring means records the occurrence time of the physical input performed by the user of the information processing device.

[0086] (Item 6) 6. The information processing device according to any one of items 1 to 5, wherein the specifying means specifies a physical input that is a prerequisite for the execution of the process as the execution condition.

[0087] (Item 7) The information processing device described in any one of items 1 to 6, characterized in that the detection means detects unauthorized execution of the process when there is a difference of a threshold or more between the time of occurrence of a request to execute the process that the information processing device is attempting to execute and the time of occurrence of the physical input that is a prerequisite for execution of the process recorded by the monitoring means.

[0088] (Item 8) The information processing device described in any one of items 1 to 7, further comprising a security countermeasure means for restarting the information processing device and notifying an administrator when unauthorized execution of the process is detected by the detection means.

[0089] (Item 9) The information processing device described in any one of items 1 to 8, characterized in that the detection means detects an unauthorized change to the administrator settings when there is a difference of a threshold or more between the time when a request to change the administrator settings of the information processing device was made and the time when a physical input related to the change to the administrator settings recorded by the monitoring means was made.

[0090] (Item 10) The information processing device described in any one of items 1 to 9, characterized in that the detection means detects unauthorized execution of the process when there is a difference of a threshold or more between the time of occurrence of a request to execute the process that the information processing device is attempting to execute and the time of occurrence of a physical input related to a preparatory operation for executing the process recorded by the monitoring means.

[0091] (Item 11) The process includes a scanning process; Item 11. The information processing device according to item 10, wherein the preparatory operation includes opening and closing a cover for scanning.

[0092] (Item 12) The information processing device described in any one of items 1 to 11, characterized in that the detection means detects unauthorized execution of the process after disabling a remote user interface (RUI) function for executing the process by remote control.

[0093] (Item 13) The monitoring means further monitors whether or not a user is present near the information processing device using a human presence sensor; The information processing device described in any one of items 1 to 12, characterized in that the detection means detects unauthorized execution of the process when a process that requires the physical input is executed even though the human sensor does not react.

[0094] (Item 14) the monitoring means further monitors whether or not a user has performed a charging operation for the execution of a process using a charging device associated with the information processing device; 14. The information processing device according to any one of items 1 to 13, wherein the detection means detects fraudulent execution of the process when the process is executed even though the charging operation has not been performed.

[0095] (Item 15) 15. The information processing device according to any one of items 1 to 14, further comprising a setting change means for strengthening security settings of the information processing device when unauthorized execution of the process is detected by the detection means.

[0096] (Item 16) 16. The information processing device according to any one of items 1 to 15, wherein the information processing device is an image forming device.

[0097] (Item 17) A control method for an information processing device that detects unauthorized execution of a process, comprising: a monitoring step of monitoring a physical input to the information processing device; a specifying step of specifying execution conditions for the process; a detection step of detecting unauthorized execution of the process based on the physical input monitored in the monitoring step and the execution condition identified in the identification step; 1. A method for controlling an information processing device, comprising:

[0098] (Item 18) A program for causing a computer to function as the information processing device according to any one of items 1 to 16.

[0099] (Other embodiments) The present invention can also be realized by supplying a program that realizes one or more functions of the above-described embodiments to a system or device via a network or a storage medium, and having one or more processors in the computer of the system or device read and execute the program.The present invention can also be realized by a circuit (e.g., ASIC) that realizes one or more functions.

[0100] The invention is not limited to the above-described embodiments, and various changes and modifications can be made without departing from the spirit and scope of the invention. Accordingly, the following claims are appended to apprise the public of the scope of the invention. [Explanation of symbols]

[0101] 321: Process execution condition identification unit, 322: Physical input reference unit, 323: Process unauthorized execution determination unit, 324: Security countermeasure unit

Claims

1. An information processing device that detects unauthorized execution of a process, a monitoring means for monitoring a physical input to the information processing device; An identification means for identifying an execution condition of the process; a detection means for detecting unauthorized execution of the process based on the physical input monitored by the monitoring means and the execution condition identified by the identification means; An information processing device comprising:

2. 2. The information processing device of claim 1, wherein the process is executed via the physical input made by a user of the information processing device.

3. 2. The information processing apparatus according to claim 1, wherein said monitoring means monitors a change in a physical quantity caused by a user of said information processing apparatus operating said information processing apparatus.

4. 4. The information processing apparatus according to claim 3, wherein the physical quantity is a voltage.

5. 2. The information processing apparatus according to claim 1, wherein said monitoring means records the time when said physical input is made by a user of said information processing apparatus.

6. 2. The information processing apparatus according to claim 1, wherein said specifying means specifies, as said execution condition, a physical input that is a prerequisite for execution of said process.

7. The information processing device according to claim 1, characterized in that the detection means detects unauthorized execution of the process when there is a difference of a threshold or more between the time of occurrence of a request to execute the process that the information processing device is attempting to execute and the time of occurrence of the physical input that is a prerequisite for execution of the process recorded by the monitoring means.

8. 2. The information processing apparatus according to claim 1, further comprising a security countermeasure unit that restarts the information processing apparatus and notifies an administrator when the detection unit detects unauthorized execution of the process.

9. The information processing device according to claim 1, characterized in that the detection means detects an unauthorized change of the administrator settings when there is a difference of a threshold or more between the time when a request to change the administrator settings of the information processing device was made and the time when a physical input related to the change of the administrator settings recorded by the monitoring means was made.

10. The information processing device according to claim 1, characterized in that the detection means detects unauthorized execution of the process when there is a difference of a threshold or more between the time of occurrence of a request to execute the process that the information processing device is attempting to execute and the time of occurrence of a physical input related to a preparatory operation for executing the process recorded by the monitoring means.

11. The process includes a scanning process; The information processing apparatus according to claim 10 , wherein the preparatory operation includes opening and closing a cover for scanning.

12. 2. The information processing apparatus according to claim 1, wherein the detection means detects unauthorized execution of a process after disabling a remote user interface (RUI) function for executing the process by remote control.

13. The monitoring means further monitors whether or not a user is present near the information processing device using a human presence sensor; 2. The information processing apparatus according to claim 1, wherein the detection means detects unauthorized execution of the process when a process that requires the physical input is executed despite no reaction from the human sensor.

14. the monitoring means further monitors whether or not a user has performed a charging operation for the execution of a process using a charging device associated with the information processing device; 2. The information processing apparatus according to claim 1, wherein the detection means detects the unauthorized execution of the process when the process is executed even though the charging operation has not been performed.

15. 2. The information processing apparatus according to claim 1, further comprising a setting change unit that strengthens security settings of the information processing apparatus when the detection unit detects unauthorized execution of the process.

16. 2. The information processing apparatus according to claim 1, wherein the information processing apparatus is an image forming apparatus.

17. A control method for an information processing device that detects unauthorized execution of a process, comprising: a monitoring step of monitoring a physical input to the information processing device; a specifying step of specifying execution conditions for the process; a detection step of detecting unauthorized execution of the process based on the physical input monitored in the monitoring step and the execution condition identified in the identification step; 1. A method for controlling an information processing device, comprising:

18. A program for causing a computer to function as the information processing device according to any one of claims 1 to 16.

Images