Image processing device and authentication processing program

Abstract

To improve lockout effectiveness to a malicious third person.SOLUTION: A control part 210 of a compound machine 200 uses user information acquired in S104, S114, S124, S134, S144, S154, S164, S174, S184, S194 to count the cumulative number N of failure times in S110, S120, S140, S160, S180, S200 each time authentication is failed in S106, S116, S126, S136, S146, S156, S166, S176, S186, S196, limits success of authentication in S300 when a prescribed threshold or more is accomplished. In the case that authentication is newly succeeded in a state in which the cumulative number N of failure times being less than a threshold is counted, the cumulative number N of failure times is reset in S151 if a specific condition is not established, and is the cumulative number N of failure times is maintained without resetting in S131, S171, S191 if the success is accomplished.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present invention relates to an image processing apparatus having a function for authenticating user information when accessed from an external device, and an authentication processing program. [Background technology]

[0002] Conventionally, as described in Patent Document 1, for example, an information processing system has been known that performs user authentication and has a lockout function that denies authentication of a user if the number of times authentication of the user fails exceeds a predetermined number. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2015-72527 Summary of the Invention [Problem to be solved by the invention]

[0004] In the case of a method of locking out a user when the number of authentication failures reaches a predetermined number, as in the above-described conventional technology, if a user with valid access succeeds in authentication before the predetermined number of attempts is reached, the count of the number of authentication failures is usually reset.

[0005] However, if successful authentication occurs at short intervals due to access from a terminal, such as when polling is performed from the terminal of a legitimate user, the count is reset each time. As a result, even if a malicious third party attempts a brute force password attack, the lockout function may not function properly, reducing the effectiveness of the lockout.

[0006] An object of the present invention is to provide an image processing device that can improve the effectiveness of a function that limits the success of authentication. [Means for solving the problem]

[0007] In order to achieve the above object, the present invention provides an image processing device comprising an image processing unit and a control unit, wherein the control unit executes an information acquisition process for acquiring first user information, an authentication process for performing authentication using the first user information acquired in the information acquisition process, a count process for counting the number of authentication failures each time authentication fails in the authentication process, a restriction process for restricting success of the authentication when the number of authentication failures counted in the count process reaches a predetermined threshold or more, and a count control process for resetting the number of authentication failures if a predetermined specific condition is not met and maintaining the number of authentication failures if the predetermined specific condition is met when authentication in the authentication process using the first user information newly acquired by the information acquisition process is successful when the number of authentication failures counted by the count process is less than the threshold.

[0008] In the present invention, a control unit of an image processing device executes an information acquisition process to acquire first user information. The control unit executes an authentication process to perform authentication using the acquired first user information. If authentication fails, the control unit executes a count process to count the number of authentication failures. If authentication failures occur repeatedly, the count of the number of authentication failures continues, and when the counted number of authentication failures reaches a predetermined threshold, the control unit executes a restriction process to restrict successful authentication.

[0009] When the number of authentication failures counted is less than the threshold, that is, when authentication has failed but authentication success has not yet been restricted, and authentication is successful using the acquired first user information, the control unit performs different processing depending on whether a predetermined specific condition is met. If the specific condition is not met, the control unit resets the count of authentication failures counted as described above in the count control process, as in the conventional method. If the specific condition is met, the control unit maintains the count of authentication failures counted as described above without resetting it, as in the conventional method.

[0010] In the present invention, by appropriately setting specific conditions, it is possible to prevent the number of authentication failures from being reset even if authentication is successful due to access by a legitimate user immediately before an attack by a malicious third party. When an attack is carried out by a malicious third party, authentication failures are likely to be repeated and the number of authentication failures is likely to reach a threshold value, so the control unit can execute a restriction process to limit the number of authentication successes. According to the present invention, the effectiveness of the function of limiting the success of authentication can be improved. [Effects of the Invention]

[0011] According to the present invention, the effectiveness of the function of limiting the success of authentication can be improved. [Brief explanation of the drawings]

[0012] [Figure 1] 1 is a block diagram illustrating an example of the overall configuration of a print management system including a multifunction peripheral according to an embodiment of the present invention. [Figure 2] FIG. 2 is a block diagram illustrating an example of a configuration of an operation terminal. [Figure 3] FIG. 1 is an explanatory diagram illustrating an example of information transmission and reception behavior in a print management system. [Figure 4] 10 is a sequence chart illustrating an example of a control procedure executed by an operation terminal of an authorized user, an operation terminal of an unauthorized user, and a multifunction peripheral in a comparative example. [Figure 5] 10 is a sequence chart illustrating an example of a control procedure executed by an operation terminal of an authorized user, an operation terminal of an unauthorized user, and a multifunction peripheral according to an embodiment of the present invention. [Figure 6] 10 is a sequence chart illustrating an example of a control procedure executed by an operation terminal of an authorized user, an operation terminal of an unauthorized user, and a multifunction peripheral according to an embodiment of the present invention. [Figure 7] 10 is a sequence chart illustrating an example of a control procedure executed by an operation terminal of an authorized user, an operation terminal of an unauthorized user, and a multifunction peripheral according to an embodiment of the present invention. [Figure 8] 5 is a diagram illustrating an example of a data configuration of a print job transmitted from an operation terminal to a multifunction peripheral. FIG. [Figure 9] 10 is a diagram illustrating an example of the contents of a memory table of a multifunction peripheral that stores user IDs and passwords in association with each other. FIG. DETAILED DESCRIPTION OF THE INVENTION

[0013] An embodiment of the present invention will be described with reference to the drawings. In this embodiment, a multifunction peripheral that prints out an image based on print data will be described as an example of an image output device that outputs an image. However, the image output device is not limited to a multifunction peripheral.

[0014] <Overall configuration of the printing management system> Fig. 1 shows an example of the overall configuration of a print management system 1 according to an embodiment. As shown in Fig. 1, the print management system 1 has a multifunction peripheral 200 and at least one operation terminal, in this example, two operation terminals 300A and 300B. Hereinafter, when there is no need to distinguish between the operation terminals 300A and 300B, they will be collectively referred to simply as operation terminal 300. The multifunction device 200 and the operation terminal 300 can communicate with each other via an appropriate network NT. The operation terminal 300 and the multifunction device 200 can also communicate with each other via local communication such as a LAN without using the network NT. The authentication server 400 connected to the network NT will be described later.

[0015] <Multifunction device> The multifunction peripheral 200 is owned by, for example, a user, in this example, a legitimate user who has legitimate authority to execute printing, and executes printing of an image based on print data and also executes scanning of a scanning target to generate a corresponding image. The multifunction peripheral 200 is an example of an image processing device. The multifunction peripheral 200 includes a control unit 210, a storage unit 215, a display unit 240, an operation unit 250, a communication unit 260, a printing unit 270, a scanning unit 275, etc. The printing unit 270 is an example of an image forming unit and also an example of an image processing unit. The scanning unit 275 is also an example of an image processing unit. The control unit 210, the storage unit 215, the display unit 240, the operation unit 250, the communication unit 260, and the printing unit 270 are connected via a bus 205 so as to be able to transmit and receive information.

[0016] The storage unit 215 stores various programs 220 and various data 230. The various programs 220 include, for example, an authentication processing program that executes the control content of the multifunction peripheral 200 according to the sequence charts shown in Figs. 5 to 7 described below. The various data 230 include, for example, a memory table (see Fig. 9) described below, image data to be printed, etc.

[0017] The control unit 210 is a device that performs data processing, and is, for example, a processor such as a CPU. The control unit 210 executes various programs stored in the storage unit 215. The control unit 210 is an example of a calculation unit. The display unit 240 is, for example, a liquid crystal display, and is capable of displaying various types of information. The operation unit 250 is, for example, a keyboard, buttons, and the like, and accepts input operations by the user. The user can input various instructions to the multifunction peripheral 200 by operating the operation unit 250. The communication unit 260 is connected to the network NT, and communicates with the operation terminals 300A and 300B. The printing unit 270 prints an image on the printing paper by, for example, an inkjet method or a laser method while transporting the printing paper by a transport mechanism (not shown). The printing paper is an example of a print medium.

[0018] <Operation terminal> 2 shows an example of the configuration of the operation terminals 300A and 300B. The operation terminals 300A and 300B are each a terminal device for operating the multifunction peripheral 200. The operation terminals 300A and 300B are, for example, mobile terminals such as smartphones owned by users, and are connected to the network NT via, for example, wireless communication. As shown in FIG. 2, the operation terminals 300A and 300B each include a CPU 310, a memory 320, a communication control unit 330 for connecting to the network NT via wireless communication, a touch panel 340, and a mass storage device 350.

[0019] The mass storage device 350 is, for example, a flash memory, and stores various programs 351 and various data 352. The CPU 310 executes the various programs 351 stored in the mass storage device 350. The CPU 310 executes various processes including data communication with the multifunction peripheral 200 connected to the network NT.

[0020] The operation terminal 300 displays various information and accepts various operations by the user on a touch panel 340 that integrally combines a liquid crystal display and a touch pad. The user can input various instructions to the operation terminal 300 by operating the touch panel 340.

[0021] As the operation terminal 300, instead of a mobile terminal, other information terminals such as a tablet computer, a notebook PC, or a desktop PC may be used.

[0022] <User authentication on multifunction devices> As described above, in a system in which the multifunction peripheral 200 can be accessed from a plurality of operation terminals 300, from the viewpoint of ensuring security, the multifunction peripheral 200 may authenticate the user associated with the operation terminal 300 that has accessed the multifunction peripheral 200. If the authentication is successful, the multifunction peripheral 200 executes appropriate image processing in response to the command from the operation terminal 300, i.e., a reading process or a printing process. By performing authentication, even if both the operation terminal 300A of the authorized user and the operation terminal 300B of an unauthorized user who does not have permission to execute printing can be connected to the multifunction peripheral 200, for example, as shown in FIG. 3, printing through unauthorized access from the operation terminal 300B can be prevented.

[0023] <Lockout> Specifically, when the cumulative number of user authentication failures reaches a predetermined number due to repeated command transmissions using unauthorized user information from operation terminal 300B, for example, multifunction device 200 executes a so-called lockout, which denies subsequent user authentication attempts for a predetermined period of time. Hereinafter, the operation terminal 300A of the authorized user will be simply referred to as the "authorized terminal 300A," and the operation terminal 300B of the unauthorized user will be simply referred to as the "unauthorized terminal 300B." Hereinafter, the cumulative number of user authentication failures will be simply referred to as the "accumulated number of failures." When lockout is executed, the count of the cumulative number of failures is usually reset if authentication is successful upon access from authorized terminal 300A before the cumulative number of failures reaches the predetermined number.

[0024] <Issues with lockouts> However, the above-described lockout method causes the following problem: For example, when polling is performed periodically from the authorized terminal 300A, if authentication success occurs at the multifunction device 200 at short intervals due to commands using authorized user information being sent from the authorized terminal 300A at short intervals, the count of the cumulative number of failures is reset each time. Therefore, in a situation where authentication success occurs at the multifunction device 200 at short intervals, even if a brute force password attack is performed from the unauthorized terminal 300B, the lockout may not function properly, reducing the effectiveness of the lockout.

[0025] <Comparative Example> The above problem will be explained in detail using a comparative example shown in Fig. 4. Fig. 4 is a sequence flow showing a control process executed by the CPU 310 of the authorized terminal 300A, the CPU 310 of the unauthorized terminal 300B, and the control unit 210 of the multifunction device 200 in cooperation with each other. In this comparative example, a case will be explained in which the predetermined number of cumulative failures required for lockout is set to three. The predetermined number, three in this example, is an example of a predetermined threshold.

[0026] 4, for example, in S2, the unauthorized terminal 300B sends a command using user information including an unauthorized user ID and an unauthorized password that are not the ID and password of a legitimate user. The multifunction device 200 receives the command and acquires the user information in S4. In S6, the multifunction device 200 performs authentication and determines whether the user ID and password of the user information acquired in S4 are the ID of a legitimate user (hereinafter referred to as the "legitimate user ID" as appropriate) and the password of a legitimate user (hereinafter referred to as the "legitimate password" as appropriate).

[0027] Since a command using unauthorized user information from the unauthorized terminal 300B as described above will result in authentication failure, the multifunction device 200 transmits an authentication failure notification to the unauthorized terminal 300B in S8. Based on the authentication failure, the multifunction device 200 increments the count of the cumulative number of failures N by one in S10, and in this example, N=1.

[0028] In S12, the unauthorized terminal 300B sends a command using user information including an unauthorized user ID and an unauthorized password. The multifunction device 200 receives the command in S14 and acquires the user information. In S16, the multifunction device 200 performs authentication using the user ID and password acquired in S14, and if the authentication fails, sends an authentication failure notification in S18, and increments the count of the cumulative number of failures N by one to N=2 in S20. As described above, the cumulative number of failures that will result in lockout is N=3 in this example, so the multifunction device 200 does not execute lockout when there have been two unauthorized accesses from the unauthorized terminal 300B.

[0029] In a lockout non-execution state where N=2, the authorized terminal 300A transmits a command using user information including an authorized user ID and an authorized password in S22. The multifunction device 200 receives the command and acquires the user information in S24. In S26, when the multifunction device 200 performs authentication, the authentication is successful based on the authorized user ID and authorized password acquired in S24, and the command from the authorized terminal 300A becomes valid. The multifunction device 200 executes processing in accordance with the command. In S28, the multifunction device 200 transmits an authentication success notification to the authorized terminal 300A, and in S30, resets the cumulative number of failures N to N=0.

[0030] In a state where N=0, for example, in S32 the unauthorized terminal 300B transmits a command using user information including an unauthorized user ID and an unauthorized password. The multifunction device 200 receives the command and acquires the user information in S34. In S36, the multifunction device 200 performs authentication using the user ID and password acquired in S34, and transmits an authentication failure notification in S38 based on the authentication failure, and in S40 increments the count of the cumulative number of failures N by one to set N=1. Since N=1, the multifunction device 200 does not execute a lockout.

[0031] In the lockout non-execution state of N=1, the authorized terminal 300A again transmits a command using user information including the authorized user ID and authorized password in S42. The multifunction device 200 receives the command and acquires the user information in S44. In S46, when the multifunction device 200 performs authentication, the authentication is successful based on the authorized user ID and authorized password acquired in S44, and the command from the authorized terminal 300A becomes valid. The multifunction device 200 executes processing in accordance with the command. In S48, the multifunction device 200 transmits an authentication success notification to the authorized terminal 300A, and in S50, resets the cumulative number of failures N again to N=0.

[0032] In a state where N=0, for example, in S52 the unauthorized terminal 300B sends a command using user information including an unauthorized user ID and an unauthorized password, as described above. The multifunction device 200 receives the command in S54 and acquires the user information. In S56, the multifunction device 200 performs authentication using the user ID and password acquired in S54, and sends an authentication failure notification in S58 based on the authentication failure, and in S60 increments the count of the cumulative number of failures N by one to set N=1. As described above, since N=1, the multifunction device 200 does not execute a lockout.

[0033] Furthermore, in S62, the unauthorized terminal 300B transmits a command using user information including an unauthorized user ID and an unauthorized password. The multifunction device 200 receives the command in S64 and acquires the user information. In S66, the multifunction device 200 performs authentication using the user ID and password acquired in S64, and transmits an authentication failure notification in S68 based on the authentication failure, and in S70 increments the count of the cumulative number of failures N by one to set N=2. As described above, the multifunction device 200 does not execute a lockout at this point.

[0034] As described above, in this comparative example, when commands using legitimate user information are transmitted from the authorized terminal 300A, authentication success occurs at the multifunction device 200 at short intervals, and each time the count of the number of failures N is reset (S30, S50). As a result, even if the unauthorized terminal 300B transmits commands using unauthorized user information three times in S2, S12, and S32, the lockout does not function, and the multifunction device 200 authenticates commands using user information transmitted from the unauthorized terminal 300B in S52 and S62 following S32 in S56 and S66. If the user information transmitted from the unauthorized terminal 300B in S52 and S62 happens to match the authorized user information, the authentication is successful, and the multifunction device 200 executes processing in accordance with the commands from the unauthorized terminal 300B, thereby reducing the effectiveness of the lockout.

[0035] <Features of the embodiment> In order to address the above-mentioned issues, in this embodiment, even if authentication at the multifunction device 200 is successful when a command using legitimate user information is sent from the legitimate terminal 300A as described above, if a specific predetermined condition is met, the value of the cumulative number of failures N is maintained without being reset to 0. In order to realize this method, the control processing executed by the CPU 310 of the legitimate terminal 300A, the CPU 310 of the unauthorized terminal 300B, and the control unit 210 of the multifunction device 200 in this embodiment in cooperation with each other will be described using the sequence flows in Figures 5 to 7.

[0036] 5, for example, in S102, the authorized terminal 300A sends a login command using user information including the authorized user's ID and password. The multifunction device 200 receives the command and acquires the user information in S104. The user ID and password included in the user information acquired in S104 are an example of first user information.

[0037] 8 shows an example of the content transmitted from the authorized terminal 300A to the multifunction device 200 in S102. In this example, the login command is incorporated into the print job, which also includes a print command, a user ID, a password, and print data. The user ID is an example of user identification information.

[0038] Returning to FIG. 5, in S105, the multifunction device 200 identifies the type of the command received in S104. In this embodiment, the aforementioned predetermined specific condition is that the received command is a predetermined specific type of command, in this example, a status request command. If the received command is a status request command, the multifunction device 200 does not reset the value of the cumulative failure count N to 0, but maintains it. In this embodiment, a flag F is set to indicate that the command type is one for which the value of N should be reset to 0. If the command is a login command as described above, the command type should be reset to 0, so in S105 the multifunction device 200 sets flag F to 1.

[0039] In S106, the multifunction peripheral 200 performs authentication and determines whether the user ID and password of the user information acquired in S104 are a legitimate user ID and a legitimate password. The storage unit 215 stores in advance the legitimate user IDs and legitimate passwords related to the multifunction peripheral 200. The storage unit 215 stores the legitimate user IDs and legitimate passwords for each user in association with each other in the form of a memory table shown in FIG. 9, for example. In S106, the multifunction device 200 reads out the stored authorized user ID and authorized password. The authorized user ID and authorized password stored in the storage unit 215 are an example of second user information. The multifunction device 200 makes the above determination by comparing the read authorized user ID and authorized password with the user ID and password of the user information acquired in S104.

[0040] The command using the authorized user information from the authorized terminal 300A is authenticated successfully, and the multifunction device 200 sends an authentication success notification to the authorized terminal 300A in S108. Based on the authentication success, the multifunction device 200 executes a process according to the login command, such as a print process or a read process. In S110, the multifunction device 200 resets the count of the cumulative number of failures N in accordance with the setting of flag F=1 in S105 (see dashed line).

[0041] In a state where N=0, for example, in S112, the unauthorized terminal 300B transmits a login command using user information including an unauthorized user ID and an unauthorized password. The multifunction device 200 receives the command in S114 and acquires the user information. In S115, the multifunction device 200 sets the above flag F to 1 in response to the login command.

[0042] In S116, the multifunction device 200 performs the same authentication as above for the user ID and password acquired in S114. Since the authentication will fail if the command using the unauthorized user information from the unauthorized terminal 300B as described above is sent, the multifunction device 200 sends an authentication failure notification to the unauthorized terminal 300B in S118. Based on the authentication failure, in S120 the multifunction device 200 increments the count of the cumulative failure count N by one, so that N=1.

[0043] When N=1, in S122 the authorized terminal 300A uses user information including the authorized user ID and authorized password to send a status request command requesting the status of the multifunction device 200. In S124, the multifunction device 200 receives the command and acquires the user information. In S125, the multifunction device 200 sets the flag F to 0 in accordance with the fact that the command received in S124 is a status request command and is a command type for which the value of N should not be reset to 0 as described above.

[0044] In S126, the multifunction device 200 performs authentication, and the authentication is successful based on the authorized user ID and authorized password acquired in S124. The multifunction device 200 performs processing in accordance with the status request command, for example, processing to send information about the status of the multifunction device 200 itself, such as the amount of paper remaining and the amount of printing agent remaining, to the authorized terminal 300A. In S128, the multifunction device 200 sends an authentication success notification to the authorized terminal 300A, and in S131, the multifunction device 200 checks flag F, and since flag F is set to 0, the multifunction device 200 does not reset the cumulative failure count N, but leaves it at N=1.

[0045] In the comparative example described above, the cumulative number of failures N was unconditionally reset to 0 if the authentication was successful as described above, but in this embodiment, in S131, the multifunction device 200 maintains N=1 in accordance with the setting of flag F=0 in S125 (see dashed line).

[0046] In a state where N=1, for example, in S132, the unauthorized terminal 300B transmits a login command using user information including an unauthorized user ID and an unauthorized password. The multifunction device 200 receives the command in S134 and acquires the user information. In S135, the multifunction device 200 sets the above flag F to 1 in response to the login command. In S136, the multifunction device 200 fails the authentication if the command is from the unauthorized terminal 300B and uses unauthorized user information, and in S138 sends an authentication failure notification to the unauthorized terminal 300B. Based on the authentication failure, in S140 the multifunction device 200 increments the count of the cumulative number of failures N by 1, so that N=2. At this point, N=2, so the multifunction device 200 does not execute lockout.

[0047] 6, in a state where N=2, the authorized terminal 300A again transmits a login command using user information including an authorized user ID and an authorized password in S142. The multifunction device 200 receives the command and acquires the user information in S144. In S145, the multifunction device 200 sets the flag F to 1 in response to the fact that the command received in S144 is a login command and the command type is one for which the value of N should be reset to 0, as described above.

[0048] In S146, the multifunction device 200 performs authentication, and the authentication is successful based on the authorized user ID and authorized password acquired in S144. The multifunction device 200 executes processing in accordance with the login command, such as printing or reading. In S148, the multifunction device 200 transmits an authentication success notification to the authorized terminal 300A, and in S151, the multifunction device 200 resets the count of the cumulative number of failures N to N=0 in accordance with the setting of flag F=1 in S145 (see dashed line).

[0049] In a state where N=0, for example, in S152, the unauthorized terminal 300B transmits a login command using user information including an unauthorized user ID and an unauthorized password. The multifunction device 200 receives the command in S154 and acquires the user information. In S155, the multifunction device 200 sets the above flag F to 1 in response to the login command. In S156, the multifunction device 200 fails the authentication if the command is from the unauthorized terminal 300B and uses unauthorized user information, and in S158 sends an authentication failure notification to the unauthorized terminal 300B. Based on the authentication failure, in S160 the multifunction device 200 increments the count of the cumulative failure count N from the aforementioned N=0 by one to N=1.

[0050] With N=1, the authorized terminal 300A again transmits a status request command using user information including the authorized user ID and authorized password in S162. The multifunction device 200 receives the command and acquires the user information in S164. In S165, the multifunction device 200 sets the flag F to 0 in accordance with the fact that the command received in S164 is a status request command and is a command type for which the value of N should not be reset to 0 as described above.

[0051] In S166, the multifunction device 200 performs authentication, and the authentication is successful based on the authorized user ID and authorized password acquired in S164. In S168, the multifunction device 200 transmits an authentication success notification to the authorized terminal 300A, and in S171, in accordance with the setting of flag F=0 in S165 (see dashed line), the cumulative failure count N is maintained at N=1 without being reset.

[0052] In a state where N=1, for example, in S172, the unauthorized terminal 300B transmits a login command using user information including an unauthorized user ID and an unauthorized password. The multifunction device 200 receives the command in S174 and acquires the user information. In S175, the multifunction device 200 sets the above flag F to 1 in response to the login command. In S176, the multifunction device 200 fails authentication if the command is from the unauthorized terminal 300B and uses unauthorized user information, and in S178 sends an authentication failure notification to the unauthorized terminal 300B. Based on the authentication failure, in S180 the multifunction device 200 increments the count of the cumulative number of failures N to N=2. Since N=2, the multifunction device 200 does not execute lockout.

[0053] 7, in a state where N=2, the authorized terminal 300A again transmits a status request command using user information including the authorized user ID and authorized password in S182. The multifunction device 200 receives the command and acquires the user information in S184. In S185, the multifunction device 200 sets the flag F to 0 in accordance with the fact that the command received in S184 is a status request command, which is a command type that does not require the value of N to be reset to 0 as described above.

[0054] In S186, the multifunction device 200 performs authentication, and the authentication is successful based on the authorized user ID and authorized password acquired in S184. In S188, the multifunction device 200 transmits an authentication success notification to the authorized terminal 300A, and in S191, in accordance with the setting of flag F=0 in S185 (see dashed line), the multifunction device 200 maintains the cumulative number of failures N as N=2 without resetting it.

[0055] In a state where N=2, for example, in S192, the unauthorized terminal 300B transmits a login command using user information including an unauthorized user ID and an unauthorized password. The multifunction device 200 receives the command in S194 and acquires the user information. In S195, the multifunction device 200 sets the above flag F to 1 in response to the login command. In S196, the multifunction device 200 fails the authentication if the command is from the unauthorized terminal 300B and uses unauthorized user information, and in S198 sends an authentication failure notification to the unauthorized terminal 300B. Based on the authentication failure, in S200 the multifunction device 200 increments the count of the cumulative number of failures N to N=3.

[0056] In S300, in response to N reaching 3 in S200, the multifunction device 200 executes lockout processing. Specifically, in this example, for example, when the authorized terminal 300A sends a command using user information including an authorized user ID and an authorized password in S310, the multifunction device 200 receives the command and acquires the user information, but does not perform the above-mentioned authentication. Similarly, for example, when the unauthorized terminal 300B sends a command using user information including an unauthorized user ID and an unauthorized password in S315, the multifunction device 200 receives the command and acquires the user information, but does not perform the above-mentioned authentication.

[0057] The multifunction device 200 continues the lockout process started in S300 until a predetermined period of time has elapsed since the start and S305 is judged as Yes, and even if a command using user information is sent from any of the operation terminals 300, the multifunction device 200 only receives the command and acquires the user information, without performing authentication. If a predetermined period of time has elapsed since the start of the lockout process and S305 returns Yes, in S320, the multifunction device 200 resets the count of the cumulative number of failures N from N=3 to N=0. Thereafter, the multifunction device 200 returns the process to S104 in FIG.

[0058] In each of the above procedures shown in Figures 5 to 7, S104, S114, S124, S134, S144, S154, S164, S174, S184, and S194 are each an example of an information acquisition step, and the processing executed in each is an example of an information acquisition process. Each of S106, S116, S126, S136, S146, S156, S166, S176, S186, and S196 is an example of an authentication step, and the processing executed in each step is an example of an authentication process. Each of S120, S140, S160, S180, and S200 is an example of a counting step, and the processing executed in each step is an example of a counting process.

[0059] S300 and S305 are an example of a restriction step, and the processes executed in S300 and S305 are an example of a restriction process. Each of S131, S151, S171, and S191 is an example of a number control step, and the processing executed in each step is an example of a number control processing.

[0060] <Effects of the embodiment> As described above, in this embodiment, the control unit 210 of the multifunction peripheral 200 acquires user information from the operation terminal 300 at S104, S114, S124, S134, S144, S154, S164, S174, S184, and S194. The control unit 210 performs authentication using the user information acquired from the operation terminal 300 at S106, S116, S126, S136, S146, S156, S166, S176, S186, and S196. If authentication fails, the control unit 210 counts the cumulative number of failures N in S120, S140, S160, S180, and S200. The cumulative number of failures N is counted each time authentication fails due to invalid user information. If authentication failures occur repeatedly, the cumulative number of failures N continues to be counted, and when the counted cumulative number of failures N reaches a predetermined threshold, three or more in the above example, the control unit 210 executes a lockout process in S300 to restrict successful authentication.

[0061] When the cumulative number of failures N is counted that is less than the threshold value, that is, when authentication has failed but successful authentication has not yet been restricted, and authentication is successful using the user information acquired from the operating terminal 300, the control unit 210 performs different processing depending on whether a predetermined specific condition is met. If the specific condition is not met, in the example described above, when a login command has been received from the regular terminal 300A, the control unit 210 resets the cumulative number of failures N counted as described above, as in the conventional method, in S151. If the specific condition is met, in the example described above, when a status request command has been received from the regular terminal 300A, the control unit 210 maintains the cumulative number of failures N counted as described above without resetting it, as in the conventional method, in S131, S171, and S191.

[0062] In this embodiment, by setting the specific conditions, even if authentication is successful when a command using user information is sent from the authorized terminal 300A of a legitimate user immediately before an attack from an unauthorized terminal 300B of a malicious third party, the cumulative failure count N may not be reset (see S131, S171, and S191 above). Therefore, when the unauthorized terminal 300B attacks the multifunction peripheral 200 by randomly changing the user information and repeatedly sending commands using the user information in a short period of time, the repeated authentication failures increase the likelihood that the cumulative failure count N will reach the threshold, increasing the likelihood that the control unit 210 will execute the lockout process of S300. This makes it possible to effectively limit successful authentication by the unauthorized terminal 300B. According to this embodiment, it is possible to improve the effectiveness of lockout against malicious third parties.

[0063] In particular, in this embodiment, user information relating to users having legitimate authority is stored in advance in the storage unit 215. The control unit 210 can smoothly perform authentication by comparing the user information stored in the storage unit 215 with the user information acquired in S104, S114, S124, S134, S144, S154, S164, S174, S184, and S194 in S106, S116, S126, S136, S146, S156, S166, S176, S186, and S196.

[0064] Note that, as described above, a method other than the method of comparing the user information acquired from the operation terminal 300 with the user information in the storage unit 215 may be used. For example, the user information received from the operation terminal 300 may be transmitted to the authentication server 400 shown in Fig. 1, and the authentication server 400 may perform authentication and transmit the result to the multifunction device 200. In this case, the multifunction device 200 may receive result information of authentication success or authentication failure from the authentication server 400 in S106, S116, S126, S136, S146, S156, S166, S176, S186, and S196, and thereby reflect the result information in subsequent processing.

[0065] Furthermore, in this embodiment, the specific condition is met particularly when the command received when acquiring user information from the operation terminal 300 is a predetermined specific type of command. If the command is a command that repeatedly results in successful authentication within a short period of time, such as the above-mentioned status request command for the multifunction device 200, the control unit 210 does not reset the cumulative number of failures N in S131, S171, and S191. According to this embodiment, by preventing repeated successful authentication attempts in a short period of time due to receiving commands using user information from the authorized terminal 300A and resetting the cumulative number of failures N each time, it is possible to make the lockout function effectively against attacks from the unauthorized terminal 300B by a malicious third party. As a result, it is possible to effectively limit successful authentication attempts from the unauthorized terminal 300B.

[0066] In addition to the specific condition being satisfied based on the command type as described above, the specific condition may also be satisfied if authentication has been successful a predetermined number of times or more within a predetermined period of time by a command received when user information is acquired from the operation terminal 300. In this case, if it is found that authentication has been successful repeatedly within a short period of time by the received command, the control unit 210 will not reset the cumulative number of failures N in the procedures corresponding to S131, S151, S171, and S191 above. In this case, as in the above, by preventing the cumulative number of failures N from being reset each time successful authentication is repeated within a short period of time, the lockout function can be effectively used against attacks by malicious third parties, thereby effectively limiting successful authentication attempts by unauthorized terminal 300B.

[0067] In particular, in this embodiment, the control unit 210 restricts the execution of authentication processes such as S106, S116, S126, S136, S146, S156, S166, S176, S186, and S196 in the lockout process of S300. According to this embodiment, it is possible to limit the success of authentication by limiting the execution of authentication processing.

[0068] Furthermore, in the processes of S300 and S305, the command is received from the operation terminal 300 and user information is acquired, but the method is not limited to not attempting to authenticate any operation terminal 300 for a predetermined period of time. For example, in S300, the control unit 210 may check whether the user account corresponding to the user ID acquired from the operation terminal 300 in S104, S114, S124, S134, S144, S154, S164, S174, S184, and S194 is locked. If the user account is locked, the multifunction peripheral 200 may refuse authentication corresponding to the user ID for a predetermined period of time without identifying the password.

[0069] Furthermore, in addition to the above, there is another method for limiting the success of authentication in S300 and S305, for example, the following method.

[0070] (a) The multifunction peripheral 200 does not attempt to acquire user information from the operation terminal 300 for a predetermined period of time, thereby indirectly preventing authentication.

[0071] (b) When the multifunction device 200 receives a command and fails authentication, it stores the user information for each failed command. When the cumulative number of failures N reaches a predetermined threshold, if all of the counted authentication failures were received from the operation terminal 300 of the same user, it is determined that either the authorized user has forgotten their password or that the authentication failures are the result of an attack by an unauthorized user who has obtained the authorized user name, and it does not perform authentication for that user for a predetermined period of time.

[0072] (c) In the case of (b) above, instead of restricting the execution of the authentication process, or in addition to restricting the execution of the authentication process, the password of the user is cleared and a notice such as "Your password has been cleared, so please reset it" is sent to the operation terminal 300 associated with the user. Alternatively, a notice urging the authorized user to change the user information may be sent to the authorized terminal 300A of the authorized user. In either case, the legitimate user is made aware of the possibility of an attack by a malicious third party, and the password and user information can be changed to ensure security. Therefore, for example, in response to an attack by an unauthorized user who has obtained a legitimate user name, the likelihood that the authorized user will change their user name increases, thereby limiting the success of authentication by unauthorized users.

[0073] (d) When the MFP 200 receives a command using user information repeated multiple times until the cumulative number of failures N reaches a threshold, and the user information acquired from each of the operation terminals 300 has the same user name but different passwords, the MFP 200 determines whether each password satisfies a predetermined rule. If the rule is satisfied, the MFP 200 identifies the operation terminal 300 corresponding to the user name in S300 and prohibits the execution of authentication processing for the identified operation terminal 300. This has the following significance.

[0074] When the cumulative number of failures N reaches the threshold, if the multiple pieces of user information acquired during repeated command reception have the same username but different passwords, for example, by only one digit, but the other digits are the same, it is highly likely that a malicious third party is attempting a brute force password attack. In response to this, if the multiple passwords satisfy a predetermined pattern, the control unit 210, in S300, identifies the operation terminal 300 corresponding to the username and prohibits the execution of authentication processing for the identified operation terminal 300. This identifies the malicious third party and reliably prevents the third party from fraudulently using the multifunction device 200, while allowing authorized users to continue using the multifunction device 200. It should be noted that when the above-described regularity is satisfied, there is a possibility that a legitimate user may repeatedly fail with a difference of one digit. Therefore, if there is such a possibility, the multifunction device 200 may not count it as the cumulative number of failures N.

[0075] <Other> In the above embodiment, the present invention has been described as being applied to the multifunction peripheral 200 as an image processing device that includes both the printing unit 270 and the reading unit 275 as image processing units, but the present invention is not limited to this. That is, the present invention may also be applied to a reading device as an image processing device that includes only a reading unit as an image processing unit, a so-called scanner. The present invention may also be applied to a printing device as an image processing device that includes only the printing unit 270 as an image processing unit, a so-called printer. In these cases, the same effects as those described above can be obtained.

[0076] Furthermore, the sequence charts shown in Figures 5 to 7 do not limit the present invention to the procedures shown in the sequence charts, and procedures may be added or deleted or the order may be changed within the scope that does not deviate from the spirit and technical idea of ​​the invention.

[0077] In addition to the above, the methods according to the above embodiments and modifications may be used in appropriate combination.

[0078] Although not specifically illustrated, the present invention can be implemented with various modifications within the scope of the invention. [Explanation of symbols]

[0079] 200 Multifunction printer (an example of an image processing device) 210 Control Unit 215 Storage section 270 Printing unit (an example of an image processing unit) 300A Operation terminal (an example of an external device) 300B Operation terminal (an example of an external device) N cumulative failure count

Claims

1. An image processing device comprising an image processing unit and a control unit, The control unit an information acquisition process for acquiring first user information; an authentication process for performing authentication using the first user information acquired in the information acquisition process; a counting process of counting the number of authentication failures each time authentication fails in the authentication process; a limiting process for limiting success of the authentication when the number of authentication failures counted in the counting process reaches or exceeds a predetermined threshold; When the number of authentication failures counted by the counting process is less than the threshold, if authentication is successful in the authentication process using the first user information newly acquired by the information acquisition process, If a predetermined specific condition is not met, the number of authentication failures is reset, a count control process for maintaining the authentication failure count without resetting it when a predetermined specific condition is met; An image processing device that performs the above.

2. Further, the device has a storage unit that stores second user information, The control unit, in the authentication process, The image processing apparatus according to claim 1 , wherein authentication is performed by comparing the second user information stored in the storage unit with the first user information acquired in the information acquisition process.

3. The specific conditions are: The image processing apparatus according to claim 1 , wherein the command received when the first user information is acquired in the information acquisition process is a command of a predetermined specific type.

4. The specific conditions are: The image processing apparatus according to claim 2 , wherein authentication has been successful a predetermined number of times or more within a predetermined period of time by a command received when the first user information is acquired in the information acquisition process.

5. The control unit further The image processing apparatus according to claim 1 , wherein the restriction process restricts success of the authentication by restricting execution of the authentication process.

6. the first user information includes user identification information and a password; In the restriction process, the control unit 6. The image processing device according to claim 5, further comprising: a step of: checking whether a user account corresponding to the user identification information is locked based on the user identification information included in the first user information acquired in the information acquisition process; and, if the user account is locked, refusing authentication corresponding to the user identification information for a predetermined period of time without identifying the password.

7. The image processing unit 7. The image processing apparatus according to claim 1, wherein the image processing apparatus is a reading unit that reads an object to be read and generates a corresponding image, or an image forming unit that forms an image on a print medium.

8. A calculation unit provided in an image processing device having an image processing unit, an information acquisition step of acquiring first user information; an authentication step of performing authentication using the first user information acquired in the information acquisition step; a counting step of counting the number of authentication failures each time authentication fails in the authentication step; a limiting step of limiting success of the authentication when the number of authentication failures counted in the counting step reaches or exceeds a predetermined threshold; a count control step of resetting the number of authentication failures if a predetermined specific condition is not met when authentication is successful in the authentication step using the first user information newly acquired in the information acquisition step while the number of authentication failures is less than the threshold value in the counting step, and maintaining the number of authentication failures without resetting if the predetermined specific condition is met; An authentication processing program to execute the above.

Images