Information processing apparatus, method for controlling information processing apparatus, and storage medium

Abstract

In an information processing apparatus having a multifactor authentication function, when user authentication is performed by an authentication server, an additional extended authentication application, or the like, a case where an additional security measure related to multifactor authentication is possible cannot be correctly determined, and a security measure status cannot be displayed in some cases.SOLUTION: In the multi-function peripheral 100, when the application used in the user verification is a standard verification application incorporated in advance in the firmware of the multi-function peripheral 100 and the verification server is not used (No in S414), the security measure status related to the multi-factor verification is displayed based on the setting value related to the multi-factor verification (S415, S416, S412), and when the application used in the user verification is an additional extended verification application (Yes in S411), the fact that the security measure related to the multi-factor verification has been implemented is displayed regardless of the setting value related to the multi-factor verification (S412).SELECTED DRAWING: Figure 4B

Description

[Technical Field]

[0001] The present invention relates to an information processing device, a control method for an information processing device, and a program. [Background technology]

[0002] User authentication is one of the methods for ensuring the security of information processing devices. There are several methods for implementing user authentication, such as PIN codes, ID / passwords, IC cards, and multi-factor authentication, and the easier the authentication method is to manage or use, the weaker its security. Therefore, the method for implementing user authentication is selected depending on the usage environment and use case of the information device, but from a security perspective, the use of multi-factor authentication is desirable.

[0003] For example, in the case of multi-function devices, in addition to using a user authentication function pre-installed in the firmware, there are cases where an extended application for user authentication is installed on the device and used, or an external authentication server is used. In either case, it is desirable to configure the device to use multi-factor authentication.

[0004] A technology related to the setting of multi-factor authentication is disclosed in Patent Document 1. Patent Document 1 proposes a technology that does not enable the setting if, for example, there is no user who has registered information for executing multi-factor authentication. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Publication No. 2023-127338 Summary of the Invention [Problem to be solved by the invention]

[0006] Because security-related settings for multifunction peripherals and the like vary widely, it is desirable to provide a means for easily checking the security status, including user authentication, and to notify the user when multi-factor authentication can be configured. For example, it is desirable to display information that additional settings are available for settings that do not include security measures. However, depending on the user authentication used by multifunction peripherals and the like, the firmware of the multifunction peripheral or the like may be unable to correctly determine whether multi-factor authentication can be configured, due to the extended application containing the multi-factor authentication settings or the settings being stored on the server side. In other words, information processing devices with multi-factor authentication functionality may be unable to correctly determine whether additional security measures related to multi-factor authentication are available and may be unable to display the security measure status. However, there has been no technology to date that solves this problem. The technology described in Patent Document 1 above is a technology for preventing incorrect settings related to multi-factor authentication, but it does not solve this problem.

[0007] The present invention has been made to solve the above-mentioned problems, and aims to provide a mechanism that can determine when additional security measures related to multi-factor authentication are possible, encourage users to use multi-factor authentication, and improve security and convenience. [Means for solving the problem]

[0008] The present invention is an information processing device having a multi-factor authentication function for user authentication, comprising: a management means for managing setting values ​​related to user authentication including setting values ​​related to the multi-factor authentication; and a display control means for performing a display indicating whether security measures related to the multi-factor authentication have been taken or whether additional security measures are possible, wherein the display control means performs the display based on the setting values ​​related to the multi-factor authentication when an application used in the user authentication is a first application and satisfies a predetermined condition, and displays that security measures related to the multi-factor authentication have been taken regardless of the setting values ​​related to the multi-factor authentication when the application used in the user authentication is a second application. [Effects of the Invention]

[0009] According to the present invention, it is possible to determine when additional security measures related to multi-factor authentication are possible and encourage users to use multi-factor authentication, thereby improving security and convenience. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating an example of a hardware configuration of an information processing apparatus according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram illustrating a part of the software configuration of the information processing apparatus according to the embodiment. [Figure 3A] FIG. 2 is a diagram illustrating a display screen according to the first embodiment. [Figure 3B] FIG. 2 is a diagram illustrating a display screen according to the first embodiment. [Figure 3C] FIG. 2 is a diagram illustrating a display screen according to the first embodiment. [Figure 4A] 10 is a flowchart illustrating a process for displaying a security countermeasure status screen. [Figure 4B] 3 is a flowchart illustrating a process according to the first embodiment. [Figure 5] 10 is a flowchart illustrating a process according to a second embodiment. [Figure 6A]FIG. 10 is a diagram illustrating a display screen according to the second embodiment. [Figure 6B] FIG. 10 is a diagram illustrating a display screen according to the second embodiment. [Figure 6C] FIG. 10 is a diagram illustrating a display screen according to the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, embodiments of the present invention will be described with reference to the drawings. 1 is a diagram illustrating an example of the hardware configuration of an information processing device according to an embodiment of the present invention. Here, a multifunction peripheral 100, which is an image processing device, will be used as an example of the information processing device. However, the present invention is not limited to multifunction peripherals, and can be applied to various types of computers, smartphones, various types of home appliances, and other electronic devices as long as the information processing device has a multi-factor authentication function.

[0012] In the multifunction peripheral 100, a CPU 101 executes the software program of the multifunction peripheral 100 and controls the entire device. The ROM 102 is a read-only memory and stores a boot program, which is the program that is first read and executed directly by the CPU 101 when the multifunction peripheral 100 is powered on. The RAM 103 is a random access memory that is used to store programs and temporary data when the CPU 101 controls the multifunction peripheral 100.

[0013] The HDD 104 is a hard disk drive. The HDD 104 stores programs that are loaded into the RAM 103 by a boot program and executed by the CPU 101. The HDD 104 is also used to store data necessary for processing by the multifunction peripheral 100. Note that the configuration may include other storage devices such as an SSD (Solid State Drive) or an eMMC (embedded MultiMediaCard) instead of or in addition to the HDD. The CPU 101 realizes various controls by reading out software programs stored in the ROM 102, HDD 104, etc. into the RAM 103 and executing them.

[0014] The scanner I / F control unit 106 controls the reading of the document by the scanner 111 . The printer I / F control unit 107 controls the printing process by the printer 110 and the like. The panel control unit 108 controls a touch panel type operation panel 114, and controls the display of various information and the input of instructions from the user. The network I / F 105 controls the transmission and reception of data from a network 113 to an external device (not shown).

[0015] A bus 109 interconnects the CPU 101, ROM 102, RAM 103, HDD 104, network I / F 105, scanner I / F control unit 106, printer I / F control unit 107, and panel control unit 108. Control signals from the CPU 101 and data signals between the devices are transmitted and received via this bus 109.

[0016] The software configuration of the multifunction peripheral 100 will be described below with reference to FIG. 2 and FIGS. 3A to 3C. 2 is a diagram illustrating a portion of the software configuration of the multifunction peripheral 100. Note that the software configuration shown in FIG. 2 illustrates only the characteristic parts of the present invention, and other software configurations may also be included. The software described below is realized by the CPU 101 of the multifunction peripheral 100 loading a program from the ROM 102 or HDD 104 into the RAM 103 and executing it, and a description of this will be omitted below. 3A to 3C are diagrams illustrating display screens according to the first embodiment. Hereinafter, FIGS. 3A to 3C will be collectively referred to as "FIG. 3." Note that while the screens shown in FIG. 3 will be described as being displayed on operation panel 114, the present invention also includes a configuration in which the screens are displayed on a screen of a PC or the like connected via network 113.

[0017] 2, setting management unit 201 is software that changes and manages the setting values ​​of multifunction peripheral 100. When setting management unit 201 receives a setting change instruction from the user via operation panel 114 or network I / F 105, it stores the settings input by the user in HDD 104. Other software uses setting management unit 201 to read setting values ​​from HDD 104 and controls processing according to the settings.

[0018] The user authentication unit 202 provides a user authentication function including multi-factor authentication in the multifunction device 100. There are multiple ways to provide the user authentication function, and the user authentication unit 202 has a method of authenticating using user information stored in the multifunction device 100 (HDD 104), a method of communicating with an external user authentication server via the network 113, and other methods. These methods of user authentication are processed by a standard authentication application pre-installed in the firmware of the multifunction device 100. The user authentication unit 202 also has a function of substituting an added extended application for part of the user authentication function, and is also capable of user authentication processed by an extended authentication application added by the application management unit 203, which will be described later.

[0019] Although the authentication server is not shown in the figure, the authentication server may be realized by a single computer, by multiple computers, or by using cloud computing technology.

[0020] Here, with reference to Fig. 3(e), we will explain the settings related to the operation of the user authentication unit 202. Fig. 3(e) shows an example of an authentication setting screen 340 that is displayed on the operation panel 114 for changing the settings related to the operation of the user authentication unit 202.

[0021] On the authentication setting screen 340, the use of user authentication can be switched ON / OFF using button 341. In addition, the use of an authentication server can be switched ON / OFF using button 342, and the connection destination server can be set in input field 343 when an authentication server is used. In addition, the use of multi-factor authentication can be switched ON / OFF using button 344. When OK button 346 is pressed, the contents set on this authentication setting screen 340 are stored in HDD 104 by the setting management unit 201. Note that when a setting is made to use an authentication server, depending on the server configuration, operation may ignore the "Use multi-factor authentication" setting set on the authentication setting screen 340 and stored in HDD 104. In that case, user authentication operates according to the settings stored in the server. When the cancel button 345 is pressed, the settings made on the authentication setting screen 340 are cancelled.

[0022] Returning to the explanation of Figure 2 below. The application management unit 203 manages the installation and uninstallation of extension applications that extend the functions of the multifunction peripheral 100 . Here, the settings for using an extended application related to user authentication will be described with reference to Fig. 3(f). Fig. 3(f) shows an example of an extended application management screen 350 displayed on the operation panel 114 for changing the settings for using an extended application related to user authentication.

[0023] As shown in display 351, when the standard authentication application pre-installed in the firmware of the multifunction peripheral 100 is "in use," the user authentication unit 202 performs all processing related to user authentication. In this case, user authentication is performed according to the settings configured on the authentication setting screen 340 and stored in the HDD 104.

[0024] On the extended application management screen 350, various applications (for example, an authentication application) can be additionally installed by using button 354. Also, by using button 352, the application used for user authentication can be changed to the application added as described above. Note that, depending on the configuration of the added application, the settings made on the authentication setting screen 340 of FIG. 3(e) described above may be ignored, and the added application may operate according to settings separately stored in HDD 104. Also, by using button 353, the application additionally installed as described above can be uninstalled.

[0025] Returning to the explanation of Figure 2 below. The communication control unit 204 uses the network I / F 105 to connect to and communicate with the network 113. Hereinafter, when the multifunction peripheral 100 communicates with another device via the network 113, it is assumed that the communication control unit 204 is operating, and a description thereof will be omitted.

[0026] The security setting display unit 205 provides a function of summarizing some of the security-related settings managed by the setting management unit 201 and displaying them on the operation panel 114 . When a user instructs the operation panel 114 to display the security countermeasure status, the security setting display unit 205 receives this instruction, collects security-related settings from the setting management unit 201, and displays a security countermeasure status screen 300 such as those shown in Figures 3(a) to 3(d) on the operation panel 114. 3(a) to 3(d) are examples of a security countermeasure status screen 300 displayed as the security countermeasure status in the first embodiment.

[0027] As shown in FIG. 3(a), on the security countermeasure status screen 300, 301 to 305 indicate whether security countermeasures based on general standards have been implemented for the multifunction peripheral 100 from the perspectives of ID, device, network, application, and data. For items for which security countermeasures have been implemented, the corresponding position is marked "Measures Completed," as in 306 in FIG. 3(a). On the other hand, for items for which security countermeasures have not been implemented, the corresponding position is marked "Additional Countermeasures Possible," as in 307 in FIG. 3(a). In the example of FIG. 3(a), "TLS Settings: Additional Countermeasures Possible" is displayed for network 303. In this case, the user can change the setting of the TLS version used to "Measures Completed" by referring to the online manual linked from a two-dimensional code 308, such as a QR code (registered trademark), and appropriately changing the setting. Similarly, even if other items do not display "Measures Completed," they can be displayed as "Measures Completed" by changing the appropriate settings.

[0028] 4A is a flowchart showing an example of the processing of the security setting display unit 205 when displaying the security countermeasure status screen 300. That is, the processing shown in this flowchart is realized by the CPU 101 of the multifunction peripheral 100 reading a program from the ROM 102 or HDD 104 into the RAM 103 and executing it.

[0029] In S401, the security setting display unit 205 checks the setting of ID (identification), that is, checks the setting of user authentication. There are two types of processes for checking the ID settings: (1) a process when the user authentication unit 202 only has a method for authenticating using user information stored in the multifunction device; and (2) a process when the user authentication unit 202 is capable of authenticating the user using a server or an extended application.

[0030] First, "(1) Processing when the user authentication unit 202 has only a method of authentication using user information stored in the multifunction peripheral" will be described. In this case, the security setting display unit 205 checks whether the multi-factor authentication function is enabled via the setting management unit 201 to confirm the ID setting. Here, if the multi-factor authentication function is enabled, the security setting display unit 205 stores in the RAM 103 the display of "Multi-factor authentication measures taken" for ID 301, as shown at 306 in FIG. 3(a). Furthermore, if multi-factor authentication is not enabled and user authentication is used, the security setting display unit 205 stores in the RAM 103 the display of "Multi-factor authentication additional measures available" for ID 301, as shown at 311 in FIG. 3(b). Furthermore, if a setting is made such that neither multi-factor authentication nor user authentication is used, the security setting display unit 205 stores in the RAM 103 the display of "User authentication additional measures available" for ID 301, as shown at 321 in FIG. 3(c). Here, the determination is made based on the setting of the multi-factor authentication function alone, but a comprehensive determination may also be made by checking related settings, such as the enablement status of user authentication, which is a prerequisite for the multi-factor authentication function, and the registration status of the user account. Note that "(2) Processing when the user authentication unit 202 is capable of performing user authentication using a server or an extended application" will be described later with reference to FIG. 4B.

[0031] In step S402, the security setting display unit 205 checks whether the tamper detection function is enabled via the setting management unit 201 to confirm the device settings. If the tamper detection function is enabled, the security setting display unit 205 stores in the RAM 103 a message to display "System verification at startup, measures taken" for the device 302, as shown in FIG. 3(a). While the determination is limited to the tamper detection function here, the determination may also be made based on other security settings related to the device, such as whether the TPM is enabled. Alternatively, the determination may also be made based on a combination of multiple settings.

[0032] In step S403, the security setting display unit 205 checks whether the Transport Layer Security (TLS) version is limited to "1.2" or higher via the setting management unit 201 to confirm the network settings. If the TLS version is limited to "1.2" or higher, the security setting display unit 205 stores information in the RAM 103 to display "TLS settings, measures taken" for the network 303, as shown in FIG. 3(b). It should be noted that the determination may be made based on settings related to TLS processing, such as available algorithms, other than the TLS version. It may also be made based on settings of network protocols other than TLS.

[0033] In step S404, the security setting display unit 205 checks, via the setting management unit 201, whether or not the setting prohibits installation of applications other than legitimate applications, as a confirmation of the application settings. If the setting prohibits installation of applications other than legitimate applications, the security setting display unit 205 stores in the RAM 103 a message to display "Measures taken against installation of unauthorized applications" for the application 304, as shown in FIG. 3(a). Note that this determination may also be made based on other application protection settings, such as whether antivirus software is enabled. If there is no setting prohibiting installation of applications other than legitimate applications, or if the multifunction peripheral does not permit installation of additional programs, the security setting display unit 205 may uniformly determine that measures have been taken regardless of the setting and display this message.

[0034] In step S405, the security setting display unit 205 checks whether the audit log function is enabled via the setting management unit 201 to confirm the data protection setting. If the audit log function is enabled, the security setting display unit 205 stores in the RAM 103 the message "Audit Log: Countermeasures Completed" for the data 305, as shown in FIG. 3A. In other words, the audit log allows the MFP 100 to check the operation history of confidential documents, such as uploading, downloading, and printing, performed via the MFP 100. This can also be considered a printer-specific protection perspective specialized for handling business documents. Furthermore, if a more advanced function, such as analyzing recorded logs, is installed, the enablement status of the log analysis function may be used to make this determination. Furthermore, as a data protection perspective other than the audit log, the enablement status of the HDD 104 encryption function may also be used to make this determination.

[0035] In the examples of Figures 3(a) to 3(d) and 4A, the information is displayed from five perspectives: ID, device, network, application, and data. However, the information may be displayed from other perspectives. Also, the information may be determined in a composite manner based on multiple settings. Furthermore, the processing order of the above S401 to S405 is not limited to the above order, and processing can be performed in any order.

[0036] Next, in S406, the security setting display unit 205 displays the results stored in RAM 103 in S401 to S405 above on the operation panel 114, as shown in Figures 3(a) to 3(d). Note that for items for which no display information is stored in RAM 103, "Additional measures possible" is displayed on the operation panel 114. This completes the display of the security countermeasure status screen 300.

[0037] Next, the process of checking the ID settings shown in S401, "(2) Process when the user authentication unit 202 can perform user authentication using a server or an extended application" will be described with reference to FIG. 4B. When user authentication is performed by a server or an extended application, the user authentication unit 202 receives the authentication result from the authentication server or the extended application and provides the functions of the multifunction device 100 according to the result. In this case, the server or the extended application can be configured to store and operate its own settings without using the setting management unit 201, and the user authentication unit 202 cannot detect which authentication method was used for user authentication. As a result, the user authentication unit 202 cannot determine whether multi-factor authentication was used, and the above-mentioned "(1) Processing when the user authentication unit 202 only has a method for authenticating using user information stored in the multifunction device" cannot correctly confirm the ID settings. Therefore, "(2) Processing when the user authentication unit 202 can perform user authentication by a server or an extended application" described below in Figure 4B is used.

[0038] 4B is a flowchart showing an example of processing by the user authentication unit 202 in the first embodiment. That is, the processing shown in this flowchart is realized by the CPU 101 of the multifunction peripheral 100 reading a program from the ROM 102 or HDD 104 into the RAM 103 and executing it. The processing of this flowchart corresponds to the processing started by the user authentication unit 202 when the security setting display unit 205 performs the processing of S401 in Figure 4A (ID setting confirmation) by inquiring about the display content from the user authentication unit 202. When the user authentication unit 202 receives an inquiry about the display content from the security setting display unit 205, it performs the processes shown in S411 to S417, which will be described in detail below.

[0039] In S411, the user authentication unit 202 acquires the application management settings via the setting management unit 201, and determines whether the extended authentication application added by the application management unit 203 is set to be used. Here, if the setting is such that an additional extended authentication application is to be used (Yes in S411), the user authentication unit 202 advances the process to S412.

[0040] In S412, the user authentication unit 202 stores in the RAM 103 the message "User authentication, measures taken" for ID 301, as shown in 331 in Fig. 3(d), and ends the processing of this flowchart. After this, the processing of the security setting display unit 205 proceeds to S402.

[0041] On the other hand, in the above S411, if the setting is such that the additional extended authentication application is not used (that is, the setting is such that the standard authentication application is used) (No in S411), the user authentication unit 202 proceeds to S413. In S413, the user authentication unit 202 acquires the setting of the use user authentication 341 via the setting management unit 201, and determines whether the setting is to use user authentication (use user authentication 341 is ON).

[0042] Here, if the setting is such that user authentication is not used (Use user authentication 341 is OFF) (No in S413), the user authentication unit 202 advances the process to S417. In S417, the user authentication unit 202 stores in the RAM 103 the message "User authentication additional measures available" for ID 301, as shown in 321 in Fig. 3(c), and ends the processing of this flowchart. After this, the processing of the security setting display unit 205 proceeds to S402.

[0043] On the other hand, in the above S413, if it is set to use user authentication (use user authentication 341 is ON) (Yes in S413), the user authentication unit 202 advances the process to S414. In S414, the user authentication unit 202 acquires the setting of the authentication server use 342 via the setting management unit 201, and determines whether the setting is to use the authentication server (the authentication server use 342 is ON).

[0044] Here, if it is set to use the authentication server (Use Authentication Server 342 is ON) (Yes in S414), the user authentication unit 202 advances the process to S412. On the other hand, if the setting is such that the authentication server is not used (Use Authentication Server 342 is OFF) (No in S414), the user authentication unit 202 advances the process to S415.

[0045] In S415, the user authentication unit 202 acquires the setting for use of multi-factor authentication 344 via the setting management unit 201, and determines whether the setting for use of multi-factor authentication (use of multi-factor authentication 344 is ON) is enabled. Here, if the setting to use multi-factor authentication is made (Use multi-factor authentication 344 is ON) (Yes in S415), the user authentication unit 202 advances the process to S412.

[0046] On the other hand, if the setting is not to use multi-factor authentication (Use multi-factor authentication 344 is OFF) (No in S415), the user authentication unit 202 proceeds to S416. In S416, the user authentication unit 202 stores in the RAM 103 the message "Multi-factor authentication additional measures available" for ID 301, as shown in 311 in Fig. 3(b), and ends the processing of this flowchart. After this, the processing of the security setting display unit 205 proceeds to S402.

[0047] That is, if the application used for user authentication is a standard authentication application pre-installed in the firmware of the multifunction device 100 and the conditions that an authentication server is not used are met (i.e., if No in S411 and No in S414), the display is controlled to display the status of security measures related to multifactor authentication based on the setting values ​​related to multifactor authentication (S415, S416, S412). Furthermore, if the app used for user authentication is an additional extended authentication app (i.e., if the answer to S411 is Yes), the display is controlled to display that security measures related to multi-factor authentication have been taken, regardless of the setting values ​​related to multi-factor authentication (S412). Furthermore, for items other than multi-factor authentication, the display is controlled to display whether security measures have been taken or whether additional security measures are possible, based on the setting values ​​for each item.

[0048] In the above description, each process described in FIG. 4B is configured to be executed by the user authentication unit 202 in response to an inquiry about the display content from the security setting display unit 205, but it is also possible to configure the security setting display unit 205 to execute some or all of the processes described in FIG. 4B.

[0049] As described above, according to the first embodiment, the security setting display unit 205 and the user authentication unit 202, etc., control the display of the security measure status, so that if additional measures for multi-factor authentication are possible depending on the settings of the multifunction device 100, this fact can be displayed to notify the user. Note that, if an additional extended authentication application is being used or if server authentication is being used (if Yes in S411 or S114), instead of the processing of S412 (processing to display "Protection measures taken by user"), since the security measures regarding multi-factor authentication are unknown, processing or display may be performed to guide the user to refer to the manual for the authentication application or server authentication to confirm that multi-factor authentication is set to be used.

[0050] Second Embodiment In the first embodiment described above, when an additional extended authentication application is used or server authentication is used, the system determines that "protection measures have been taken by user authentication" regardless of the setting value for multi-factor authentication, and does not guide the user to take additional measures for multi-factor authentication. In the second embodiment, a configuration is described in which, even when an additional extended authentication application is used or server authentication is used, the system correctly determines when additional measures for multi-factor authentication are possible as much as possible, and guides the user to use multi-factor authentication as much as possible. This will be described in detail below with reference to FIGS. 5 and 6.

[0051] 5 is a flowchart showing an example of processing by the user authentication unit 202 in the second embodiment. That is, the processing shown in this flowchart is realized by the CPU 101 of the multifunction peripheral 100 reading a program from the ROM 102 or HDD 104 into the RAM 103 and executing it. 6A to 6C are diagrams illustrating display screens according to the second embodiment. Hereinafter, FIGS. 6A to 6C will be collectively referred to as "FIG. 6."

[0052] The processing shown in the flowchart of Figure 5 corresponds to the processing started by the user authentication unit 202 when the security setting display unit 205 performs the processing of S401 in Figure 4A (ID setting confirmation) by inquiring about the display content from the user authentication unit 202. When the user authentication unit 202 receives an inquiry about the display content from the security setting display unit 205, it performs the processing of the flowchart shown in S411 to S417 and S501 to S506 in Fig. 5. This will be explained in detail below. Note that the same steps as those in Fig. 4B are assigned the same step numbers, and their explanation will be omitted.

[0053] In the second embodiment, if the user authentication unit 202 determines in S411 of FIG. 5 that the setting to use the authentication application is enabled (i.e., if the answer is Yes in S411 of FIG. 5), the user authentication unit 202 proceeds to S501. In S501, the user authentication unit 202 obtains information on whether the additional extended authentication application supports multi-factor authentication from the application management unit 203. For example, if the additional application extension is realized using Java's OSGi (Open Services Gateway initiative), the information can be transmitted using a configuration file called a manifest. In this case, a header definition that declares support for multi-factor authentication can be prepared and the application can declare it. Note that the method for obtaining the information on whether the additional extended authentication application supports multi-factor authentication does not necessarily have to be this method; for example, the additional extended authentication application can be forced to implement a predetermined information acquisition API, or the additional extended authentication application can be forced to store the information in a predetermined area of ​​the RAM 103 or the HDD 104.

[0054] Here, if information indicating that the additional extended authentication application supports multi-factor authentication cannot be acquired (No in S501), the user authentication unit 202 proceeds to S503. In S503, the user authentication unit 202 stores in the RAM 103 a confirmation message such as "The countermeasure status of the ID could not be determined. Please refer to the manual for the extended authentication application and set multi-factor authentication if available," as shown in 601 in Fig. 6(a), and ends the processing of this flowchart. After that, the processing of the security setting display unit 205 proceeds to S402. 6(a) to 6(c) are examples of a security countermeasure status screen 600 displayed as the security countermeasure status in the second embodiment.

[0055] On the other hand, if information indicating that the additional extended authentication application supports multi-factor authentication can be acquired in S501 (Yes in S501), the user authentication unit 202 advances the process to S502.

[0056] In S502, the user authentication unit 202 determines whether the additional extended authentication application is in a state where it uses multi-factor authentication. If the additional extended authentication application is required to implement an API that acquires the setting status when it declares support for multi-factor authentication, the user authentication unit 202 can acquire the setting status. Note that the means for acquiring the setting status does not necessarily have to be this method; for example, the additional extended authentication application may be forced to store the setting status in a predetermined area of ​​the HDD 104.

[0057] Here, if it is determined that the additional extended authentication application is in a state in which multi-factor authentication is used (Yes in S502), the user authentication unit 202 performs the process of S412 and ends the process of this flowchart.

[0058] On the other hand, if it is determined that the additional extended authentication application is not in a state where multi-factor authentication is used (No in S502), the user authentication unit 202 performs processing in S503 and ends the processing of this flowchart.

[0059] Also, in the second embodiment, if the user authentication unit 202 determines that the setting to use the authentication server is set (Use Authentication Server 342 is ON) (i.e., if Yes in S414 of FIG. 5), the process proceeds to S504.

[0060] In S504, the user authentication unit 202 internally attempts user authentication on behalf of the user at the authentication server using the security countermeasure status determination ID and security countermeasure status determination password that have been set in advance as shown in 651 and 652 in FIG. 6(d) and stored in the HDD 104, and determines whether the attempt was successful.

[0061] Here, settings related to the operation of the user authentication unit 202 of the second embodiment will be described with reference to Fig. 6(d). Fig. 6(e) shows an example of an authentication setting screen 650 of the second embodiment. This authentication setting screen 650 is displayed on the operation panel 114 by, for example, the setting management unit 201, and the same elements as those on the authentication setting screen 340 of the first embodiment are denoted by the same reference numerals. In addition to the configuration of the first embodiment, the authentication setting screen 650 has an input field 651 for a security countermeasure status determination ID and an input field 652 for a security countermeasure status determination password. When the security countermeasure status determination ID and security countermeasure status determination password are set by the user, they are stored in the HDD 104 by the setting management unit 201. In the processing of S504 above, this security countermeasure status determination ID and security countermeasure status determination password are used.

[0062] Below, we return to the explanation of S504 in FIG. Then, if the user authentication unit 202 receives a notification from the authentication server indicating that user authentication has been successful, i.e., if user authentication at the authentication server has been successful (Yes in S504), it determines that "multi-factor authentication is not enabled" and proceeds to S505. In S505, the user authentication unit 202 stores in the RAM 103 a confirmation message such as "The countermeasure status of the ID could not be determined. Please refer to the authentication server manual and set multi-factor authentication if available," as shown in 611 in Fig. 6(b), and ends the processing of this flowchart. After this, the processing of the security setting display unit 205 proceeds to S402.

[0063] On the other hand, if the user authentication unit 202 has not received a notification from the authentication server indicating that the user authentication was successful, that is, it determines that the user authentication at the authentication server was not successful (No in S504), and proceeds to S507.

[0064] In S507, the user authentication unit 202 determines whether or not the user authentication at the authentication server has failed. If the user authentication unit 202 receives a notification from the authentication server indicating that the user authentication has failed, that is, if the user authentication at the authentication server has failed (Yes in S507), the process proceeds to S506.

[0065] In S506, the user authentication unit 202 stores in the RAM 103 a confirmation message such as "The countermeasure status of the ID could not be determined. Please check the security countermeasure status determination ID and password," as shown in 621 in Fig. 6(c), and ends the processing of this flowchart. After this, the processing of the security setting display unit 205 proceeds to S402.

[0066] On the other hand, if the user authentication unit 202 has not received a notification from the authentication server indicating that user authentication has failed, i.e., if user authentication at the authentication server has not failed (No in S507), it determines that "multi-factor authentication is enabled," performs processing of S412, and terminates the processing of this flowchart.

[0067] As described above, the security setting display unit 205 and the user authentication unit 202, etc., control the display of the security measure status, and therefore, according to the second embodiment, it is possible to encourage the use of multi-factor authentication in more cases than in the first embodiment.

[0068] In the above description, the process of determining that "multi-factor authentication is enabled" when user authentication is neither successful nor unsuccessful in S504 and S507 has been described, but this method is not necessarily required. For example, the authentication server may determine that "multi-factor authentication is enabled" in response to a request to display an additional authentication screen being sent from the authentication server to the multifunction peripheral 100 via the network 113.

[0069] In the above explanation, each process described in FIG. 5 is configured to be executed by the user authentication unit 202 in response to an inquiry about the display content from the security setting display unit 205, but it is also possible to configure the security setting display unit 205 to execute some or all of the processes described in FIG.

[0070] Even if an additional extended authentication application supports multi-factor authentication, if information indicating that the additional extended authentication application supports multi-factor authentication cannot be obtained, S501 may be determined as No, and a confirmation message like 601 in Figure 6(a) may be displayed in S503. For example, this occurs when an additional application extension supports multi-factor authentication but does not declare multi-factor authentication support in the manifest. In such a case, even if the user successfully completes multi-factor authentication using the additional application extension, a confirmation message like 601 in Figure 6(a) may always be displayed, which may be annoying to the user. In such a case, the user can manually change each security measure item to "measure completed" by pressing the "Manually update countermeasure status" button like 602 in Figure 6(a). This is explained in detail below.

[0071] When the "Manually update countermeasure status" button 602 is pressed, the security setting display unit 205 displays on the operation panel 114 a manual update screen 660 for manually updating the security setting status as shown in FIG. 6(e).

[0072] The manual update screen 660 has a check box 661 for each security item, and the user can mark the security measures for the checked items as "measures taken" by checking each check box 661. When the OK button 663 is pressed, information about the items checked in each check box 661 on the manual update screen 660 is stored in the HDD 104 by the setting management unit 201. When the cancel button 662 is pressed, the settings made on the manual update screen 660 are cancelled.

[0073] In this embodiment, in S406 of FIG. 4, the security setting display unit 205 obtains information on the items checked in the check boxes 661 on the screen 660 of FIG. 6(e) from the HDD 104 via the setting management unit 201, and displays "Additional measures possible" for the checked items on the operation panel 114 regardless of the results stored in the RAM 103 in S401 to S405 of FIG.

[0074] In the second embodiment, the security status is checked in both the case of using an additional extended authentication application and the case of using server authentication, and the user is guided to manual confirmation. However, the present invention also includes a configuration in which only one of the two is implemented.

[0075] In the second embodiment, a message is displayed to prompt the user to check the manual for the extended authentication application or the manual for the authentication server, as shown in 601 in Fig. 6(a). However, a two-dimensional code such as a QR code (registered trademark) in which a URL containing these manuals is embedded may be displayed alongside the two-dimensional code for the online manual of the device.

[0076] As described above, according to each embodiment, it is possible to determine when additional security measures related to multi-factor authentication are possible, and encourage users to use multi-factor authentication, thereby improving security and convenience.

[0077] It goes without saying that the configurations and contents of the various data described above are not limited to those described above, and that the data may be configured in various configurations and contents depending on the application and purpose. Although one embodiment has been described above, the present invention can be embodied as, for example, a system, an apparatus, a method, a program, a storage medium, etc. Specifically, the present invention may be applied to a system made up of multiple devices, or may be applied to an apparatus made up of a single device. Furthermore, the present invention also includes any combination of the above embodiments.

[0078] Other Embodiments The present invention can also be realized by supplying a program that realizes one or more functions of the above-described embodiments to a system or device via a network or a storage medium, and having one or more processors in the computer of the system or device read and execute the program.The present invention can also be realized by a circuit (e.g., ASIC) that realizes one or more functions. Furthermore, the present invention may be applied to a system made up of multiple devices, or to an apparatus made up of a single device. The present invention is not limited to the above-described embodiments, and various modifications (including organic combinations of the embodiments) are possible based on the spirit of the present invention, and these modifications are not excluded from the scope of the present invention. In other words, all configurations that combine the above-described embodiments and their modifications are included in the present invention.

[0079] The disclosure of this embodiment includes the following configuration, method, and program. (Configuration 1) An information processing device having a multi-factor authentication function for user authentication, a management unit for managing setting values ​​related to user authentication, including setting values ​​related to the multi-factor authentication; a display control means for displaying whether security measures relating to multi-factor authentication have been implemented or whether additional security measures are possible; The information processing device is characterized in that the display control means performs the display based on a setting value related to the multi-factor authentication when the application used in the user authentication is a first application and satisfies a predetermined condition, and displays that security measures related to the multi-factor authentication have been taken, regardless of the setting value related to the multi-factor authentication, when the application used in the user authentication is a second application. (Configuration 2) 2. The information processing device according to configuration 1, wherein the case where the predetermined condition is satisfied is a case where an authentication server is not used for the user authentication. (Configuration 3) The information processing device according to configuration 1 or 2, wherein the display control means displays whether security measures have been taken or additional security measures are possible for items other than the multi-factor authentication, in addition to displaying whether security measures have been taken or additional security measures are possible for the multi-factor authentication. (Configuration 4) The information processing device according to configuration 3, wherein the items other than the multi-factor authentication include at least one of system verification at startup, TLS (Transport Layer Security) settings, installation of unauthorized applications, and audit logs. (Configuration 5) an installation means for adding an application to the information processing device; the second application is an application added by the installation means, The information processing device described in any one of configurations 1 to 4, characterized in that the information processing device is capable of switching between multiple applications including the first application and the second application as applications used in the user authentication. (Configuration 6) the management means manages, as the setting value, a combination of a judgment ID and a password for judging security measures in user authentication using the authentication server; The information processing device according to configuration 2, wherein, when the application used for the user authentication is a first application and does not satisfy a predetermined condition, the display control means displays a message urging the user to check a manual on the authentication server and use multi-factor authentication, in response to success of authentication attempted on the authentication server using the combination of the ID and password for determination. (Configuration 7) The information processing device according to configuration 6, wherein, when the application used in the user authentication is a first application and does not satisfy a predetermined condition, the display control means displays that security measures for the multi-factor authentication have been taken regardless of a setting value for the multi-factor authentication, in response to the fact that authentication in the authentication server using the combination of the determination ID and password was neither successful nor failed, or in response to the fact that a request to display an additional authentication screen has been notified from the authentication server. (Configuration 8) An information processing device having a multi-factor authentication function for user authentication, a management unit for managing setting values ​​related to user authentication, including setting values ​​related to the multi-factor authentication; a display control means for displaying whether security measures relating to multi-factor authentication have been implemented or whether additional security measures are possible; a first confirmation means for confirming whether the second application has a multi-factor authentication function; and a second confirmation means for confirming, when the second application has a multi-factor authentication function, whether a setting state related to the multi-factor authentication in the second application is in a state in which the multi-factor authentication is used; the display control means, when the application used for the user authentication is a second application, displays that security measures for the multi-factor authentication have been taken regardless of the setting value for the multi-factor authentication, in response to confirming that the setting state for the multi-factor authentication in the second application is in a state where the multi-factor authentication is used; and, when it cannot be confirmed that the setting state for the multi-factor authentication in the second application is in a state where the multi-factor authentication is used, checks a manual for the second application and displays a display encouraging the use of multi-factor authentication. (Configuration 9) an update means for allowing a user to perform a setting to update the status of the security measures related to the multi-factor authentication to "measures completed" regardless of a setting value related to the application used in the user authentication and the multi-factor authentication; 9. The information processing device according to configuration 8, wherein the display control means displays, when the update has been performed by the update means, that security measures regarding the multi-factor authentication have been taken. (Configuration 10) 10. The information processing device according to any one of configurations 1 to 9, which is an image processing device. (Method 1) A method for controlling an information processing device having a multi-factor authentication function as user authentication, the information processing device including a management unit for managing setting values ​​related to user authentication including setting values ​​related to the multi-factor authentication, the method comprising: a display step of displaying whether security measures relating to multi-factor authentication have been implemented or whether additional security measures are possible; a display step of displaying the information based on a setting value related to the multi-factor authentication when the application used in the user authentication is a first application and satisfies a predetermined condition, and a display step of displaying the information based on a setting value related to the multi-factor authentication when the application used in the user authentication is a second application, regardless of the setting value related to the multi-factor authentication, to indicate that security measures related to the multi-factor authentication have been taken. (Program 1) A program for causing a computer to function as each of the means according to any one of configurations 1 to 10. [Explanation of symbols]

[0080] 100 MFPs 201 Settings Management Department 202 User authentication section 203 Application Management Department 204 Communication control section 205 Security setting display section

Claims

1. An information processing device having a multi-factor authentication function for user authentication, a management unit for managing setting values ​​related to user authentication, including setting values ​​related to the multi-factor authentication; a display control means for displaying whether security measures relating to multi-factor authentication have been implemented or whether additional security measures are possible; The information processing device is characterized in that the display control means performs the display based on a setting value related to the multi-factor authentication when the application used in the user authentication is a first application and satisfies a predetermined condition, and when the application used in the user authentication is a second application, displays that security measures related to the multi-factor authentication have been taken, regardless of the setting value related to the multi-factor authentication.

2. 2. The information processing apparatus according to claim 1, wherein the predetermined condition is satisfied when an authentication server is not used for the user authentication.

3. The information processing device according to claim 1, characterized in that the display control means, in addition to displaying whether security measures related to the multi-factor authentication have been taken or whether additional security measures are possible, also displays whether security measures have been taken or whether additional security measures are possible for items other than the multi-factor authentication.

4. 4. The information processing device according to claim 3, wherein the items other than the multi-factor authentication include at least one of system verification at startup, Transport Layer Security (TLS) settings, installation of unauthorized applications, and audit logs.

5. an installation means for adding an application to the information processing device; the second application is an application added by the installation means, The information processing apparatus according to claim 1 , wherein the information processing apparatus is capable of switching between a plurality of applications including the first application and the second application as applications used in the user authentication.

6. the management means manages, as the setting value, a combination of a judgment ID and a password for judging security measures in user authentication using the authentication server; The information processing device according to claim 2, characterized in that, when the application used for the user authentication is a first application and does not satisfy a predetermined condition, the display control means displays a message prompting the user to check a manual on the authentication server and use multi-factor authentication, in response to the authentication being successful when authentication is attempted on the authentication server using the combination of the ID and password for determination.

7. 7. The information processing device according to claim 6, wherein, when the application used in the user authentication is a first application and does not satisfy a predetermined condition, the display control means displays that security measures for the multi-factor authentication have been taken, regardless of a setting value for the multi-factor authentication, in response to the authentication being neither successful nor unsuccessful when an authentication attempt is made on the authentication server using the combination of the determination ID and password, or in response to a request to display an additional authentication screen being notified from the authentication server.

8. An information processing device having a multi-factor authentication function for user authentication, a management unit for managing setting values ​​related to user authentication, including setting values ​​related to the multi-factor authentication; a display control means for displaying whether security measures relating to multi-factor authentication have been implemented or whether additional security measures are possible; a first confirmation means for confirming whether the second application has a multi-factor authentication function; and a second confirmation means for confirming, when the second application has a multi-factor authentication function, whether a setting state related to the multi-factor authentication in the second application is in a state in which the multi-factor authentication is used; When the application used for the user authentication is a second application, the display control means, in response to confirming that the setting state for the multi-factor authentication in the second application is in a state where the multi-factor authentication is used, displays that security measures for the multi-factor authentication have been taken regardless of the setting value for the multi-factor authentication, and, in response to not confirming that the setting state for the multi-factor authentication in the second application is in a state where the multi-factor authentication is used, checks the manual of the second application and displays a display encouraging the use of multi-factor authentication.

9. an update means for allowing a user to perform a setting to update the status of the security measures related to the multi-factor authentication to "measures completed" regardless of a setting value related to the application used in the user authentication and the multi-factor authentication; 9. The information processing apparatus according to claim 8, wherein the display control means displays, when the update has been performed by the update means, that security measures regarding the multi-factor authentication have been taken.

10. 10. The information processing apparatus according to claim 1, wherein the information processing apparatus is an image processing apparatus.

11. A method for controlling an information processing device having a multi-factor authentication function as user authentication, the information processing device including a management unit for managing setting values ​​related to user authentication including setting values ​​related to the multi-factor authentication, the method comprising: a display step of displaying whether security measures relating to multi-factor authentication have been implemented or whether additional security measures are possible; a display step of displaying the information based on a setting value related to the multi-factor authentication when the application used in the user authentication is a first application and satisfies a predetermined condition, and a display step of displaying the information based on a setting value related to the multi-factor authentication when the application used in the user authentication is a second application, regardless of the setting value related to the multi-factor authentication, to indicate that security measures related to the multi-factor authentication have been taken.

12. A program for causing a computer to function as each of the means according to any one of claims 1 to 9.

Images