Electronic device

Abstract

To obtain an electronic apparatus which suppresses the possibility that a falsified program is executed when falsification detection processing is not performed.SOLUTION: The activity monitoring unit 32 monitors whether a specific activity related to external data input and internal data rewriting has been detected. The tamper-evidence determination unit 33 determines whether to perform the tamper-evidence processing on the program 21 based on the activity detected by the activity monitoring unit 32 after the execution of the previous tamper-evidence processing on the program 21. The tamper detection unit 34 performs the tamper detection process on the program 21 when the tamper detection necessity determination unit 33 determines that the tamper detection process should be performed.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an electronic device. [Background technology]

[0002] Some electronic devices perform software tamper detection processing when started from a power-off state, but do not perform software tamper detection processing when started from a suspended state (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2020-149164 Summary of the Invention [Problem to be solved by the invention]

[0004] However, in the above-mentioned electronic devices, if the tampering detection process is not performed, there is a possibility that tampered software (programs) will be executed, which is undesirable from the viewpoint of security.

[0005] The present invention has been made in consideration of the above-mentioned problems, and aims to provide an electronic device that reduces the possibility of a tampered program being executed if tampering detection processing is not performed. [Means for solving the problem]

[0006] The electronic device of the present invention comprises a processor capable of executing a program, an activity monitoring unit that monitors whether specific activity related to external data input and internal data rewriting has been detected, a tampering detection necessity determination unit that determines whether the tampering detection process should be performed on the program based on the activity detected by the activity monitoring unit after the previous tampering detection process was performed on the program, and a tampering detection unit that performs the tampering detection process on the program when the tampering detection necessity determination unit determines that the tampering detection process should be performed. [Effects of the Invention]

[0007] According to the present invention, an electronic device can be obtained that reduces the possibility of a tampered program being executed if tampering detection processing is not performed.

[0008] The above and other objects, features and advantages of the present invention will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a block diagram showing the configuration of an electronic device according to an embodiment of the present invention. [Figure 2] FIG. 2 is a flowchart illustrating the operation of the electronic device according to the first embodiment. [Figure 3] FIG. 3 is a flowchart illustrating the determination of whether or not the tampering detection process is necessary in FIG. [Figure 4] FIG. 4 is a flowchart illustrating the first condition determination process in FIG. [Figure 5] FIG. 5 is a flowchart illustrating the second condition determination process in FIG. [Figure 6] FIG. 6 is a flowchart illustrating the third condition determination process in FIG. [Figure 7]FIG. 7 is a flowchart illustrating the comprehensive determination process in FIG. [Figure 8] FIG. 8 is a flowchart illustrating the first condition determination process according to the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0011] Embodiment 1

[0012] Fig. 1 is a block diagram showing the configuration of an electronic device according to an embodiment of the present invention. The electronic device shown in Fig. 1 is, for example, an image forming device such as a multifunction peripheral. The electronic device shown in Fig. 1 also includes a controller 1, an internal device 2, a network interface 3, a peripheral device interface 4, an operation panel 5, etc.

[0013] The controller 1 has a processor 11 capable of executing programs, which includes a CPU (Central Processing Unit), RAM (Random Access Memory), ROM (Read Only Memory), etc., and a non-volatile storage device 12 such as flash memory or SSD (Solid State Drive).The controller loads a program 21 stored in the storage device 12 or a program stored in the ROM into the RAM and executes it on the CPU, and controls the internal device 2, network interface 3, peripheral device interface 4, etc. according to the program to perform various jobs.

[0014] The internal device 2 includes a printing device, a scanner, and the like.

[0015] The network interface 3 is a device that is connected to a computer network such as an intranet or the Internet, and that performs data communication with an external device (a host device such as a personal computer, a server, etc.) via the computer network.

[0016] The peripheral device interface 4 is, for example, a USB (Universal Serial Bus) interface or a memory card interface, and is a device that performs data communication with devices directly connected to the peripheral device interface 4, devices connected to the peripheral device interface 4 via a cable, and devices connected to the peripheral device interface 4 via short-range wireless communication.

[0017] The operation panel 5 is arranged on the surface of the housing of the electronic device, and includes a display device 5a (such as a liquid crystal display) that displays an operation screen to the user, and an input device 5b (such as a touch panel) that detects user operations.

[0018] Furthermore, the controller 1 executes a program separate from the program 21, thereby operating as a control unit 31, an activity monitoring unit 32, a tampering detection necessity determining unit 33, and a tampering detection unit .

[0019] The control unit 31 receives a job request, and when the tamper detection necessity determination unit 33 and the tamper detection unit 34 permit the program 21 to be started, the control unit 31 starts the program 21 corresponding to the job request and executes the job (such as a print job) specified by the job request.

[0020] The activity monitoring unit 32 monitors whether or not specific activities relating to external data input and internal data rewriting have been detected.

[0021] The tampering detection necessity determining unit 33 determines whether or not tampering detection processing should be performed on the program 21 based on the activity detected by the activity monitoring unit 32 after the previous tampering detection processing on the program 21 was performed.

[0022] When the tampering detection necessity determination unit 33 determines that tampering detection processing should be performed, the tampering detection unit 34 performs tampering detection processing by a known method on the program 21. If tampering (alteration) of the program 21 is detected in the tampering detection processing, execution of the program 21 is prohibited, and if tampering (alteration) of the program 21 is not detected, execution of the program 21 is permitted.

[0023] In this embodiment, the activities are classified into a plurality of levels based on the degree of security risk. Then, the tampering detection necessity determination unit 33 (a) determines as a first determination result whether or not a number of activities classified into a predetermined first level (high level) among the above-mentioned activities have been detected by the activity monitoring unit 32 after the previous tampering detection process for the program 21, the number of activities being detected by the activity monitoring unit 32 being more than a predetermined first number, the number being greater than the first number, the previous tampering detection process for the program 21, the number of activities being detected by the activity monitoring unit 32 being more than a predetermined second number, the number being greater than the first number, the number being greater than the first number, the number being greater than the second number, the number being greater than the first number, the number being greater than the second determination result, the number being greater than the first determination result, the number being greater than the first determination result, the number being greater than the first determination result, the number being greater than the second ...

[0024] Here, if more than a predetermined first number of activities classified into a predetermined first level among the above-mentioned multiple levels are detected after the previous execution of the tampering detection process for the program 21, it is determined that the tampering detection process should be performed, or it is more likely to be determined that the tampering detection process should be performed. Also, if more than a second number of activities at all of the above-mentioned multiple levels are detected after the previous execution of the tampering detection process for the program 21, it is determined that the tampering detection process should be performed, or it is more likely to be determined that the tampering detection process should be performed.

[0025] In addition, in this embodiment, the tampering detection necessity determination unit 33 determines whether or not to perform tampering detection processing based on the result of comparing the time limit corresponding to the activation factor of the program 21 with the time required for the tampering detection processing for the program 21.

[0026] This time limit is the time allowed for starting the program 21 in consideration of convenience, and the start-up factor may be, for example, a job request received via a network or a user operation on the operation panel 5 (input device 5b). In consideration of convenience, the time limit when the start-up factor is a user operation on the operation panel 5 (input device 5b) is set shorter than the time limit when the start-up factor is a job request received via a network. Furthermore, the time required for the tampering detection process for the program 21 may be derived based on the size (data size) of the program 21, or may be set in advance.

[0027] Here, if the time required for the tamper detection process is equal to or less than the above-mentioned time limit, it is determined that the tamper detection process should be performed, or it is more likely to be determined that the tamper detection process should be performed. On the other hand, if the time required for the tamper detection process is longer than the above-mentioned time limit, it is determined that the tamper detection process should not be performed, or it is more likely to be determined that the tamper detection process should not be performed.

[0028] In addition, in this embodiment, the above-mentioned external data input activities include (a) receiving data via the network (receiving a print job request, transferring data, etc.), (b) receiving data via the peripheral device interface 4 (receiving a print job request, reading data from a USB memory or a memory card, etc.), and (c) obtaining image data from the scanner (internal device 2).

[0029] In this embodiment, the internal data rewriting activity described above includes (a) writing data to the storage device 12 in which the program 21 is stored, (b) updating firmware in the controller 1, and (c) writing to the file system. Note that if a memory card is used while attached to the peripheral device interface 4, data writing to the memory card, as well as the storage device 12, may also be included in the activity.

[0030] A flag is set corresponding to each of these activity items, and when the activity monitoring unit 32 detects any of these activities, it changes the state of the flag for that activity from off to on. The flags are stored as data in a non-volatile storage device such as the storage device 12. When the tampering detection process is executed, the activity monitoring unit 32 changes the state of all flags from on to off (initial state). Furthermore, when writing to a file system deployed on RAM is detected, the state of the corresponding flag is changed from off to on. However, when the electronic device 1 is started up after being powered off, the state of this flag is initialized to off because the data in the RAM was lost when the power was turned off.

[0031] These flags are also classified based on the level of security risk, with flags for specific activities that pose a high level of security risk being classified as high-level flags.

[0032] Next, a description will be given of the operation of the electronic device according to embodiment 1. Fig. 2 is a flowchart illustrating the operation of the electronic device according to embodiment 1.

[0033] (a) Activity Monitoring

[0034] When various processes are executed by the control unit 31 or the like in the electronic device, the activity monitoring unit 32 determines whether any of a plurality of specific activities related to external data input and internal data rewriting has been executed, and when it detects that a specific activity has been executed, it sets a flag corresponding to that specific activity (turns it on).

[0035] (b) Tamper detection

[0036] When the control unit 31 receives a job request, a request to start the program 21 corresponding to the job request occurs (step S1), and the control unit 31 causes the tampering detection necessity determination unit 33 to determine whether tampering detection is necessary (step S2).

[0037] When the determination as to whether tampering detection is necessary is executed, the tampering detection unit 34 determines whether the tampering detection necessity determination unit 33 has determined that tampering detection processing should be executed (step S3).

[0038] If it is determined that the tampering detection process should not be executed, the tampering detection unit 34 does not execute the tampering detection process, and the control unit 31 immediately starts up the program 21 (step S4).

[0039] On the other hand, if it is determined that the tampering detection process should be executed, the tampering detection unit 34 executes the tampering detection process (step S5).

[0040] The control unit 31 determines whether or not tampering has been detected in the tampering detection process (step S6), and if no tampering has been detected in the tampering detection process, starts (step S4) the program 21. On the other hand, if tampering has been detected in the tampering detection process, the control unit 31 prohibits the start of the program 21 and performs error processing (such as displaying a message indicating that tampering has been detected) (step S7).

[0041] Here, the determination of whether or not the tampering detection process is necessary in step S2 will be described below. Fig. 3 is a flowchart for explaining the determination of whether or not the tampering detection process is necessary in Fig. 2.

[0042] To determine whether or not tampering detection processing is necessary, the tampering detection necessity determination unit 33 performs a first condition determination processing (step S21), a second condition determination processing (step S22), and a third condition determination processing (step S23), and then performs a comprehensive determination processing (step S24) based on the determination results of the first condition determination processing, the second condition determination processing, and the third condition determination processing, to determine whether or not tampering detection processing should be performed.

[0043] Here, the first condition determination process in step S21 will be described. Fig. 4 is a flowchart illustrating the first condition determination process in Fig. 3.

[0044] In the first condition determination process, the tampering detection necessity determination unit 33 first identifies the number N1 of flags in the ON state among the flags of a specific activity related to external data input (external input flags) (step S31), and determines whether the number N1 of flags is greater than zero (step S32).Furthermore, the tampering detection necessity determination unit 33 first identifies the number N2 of flags in the ON state among the flags of a specific activity related to internal data rewriting (data rewrite flags) (step S33), and determines whether the number N2 of flags is greater than zero (step S34).

[0045] If the number of flags N1 is greater than zero and the number of flags N2 is greater than zero, the tampering detection necessity determination unit 33 determines the first condition determination result to be "necessary" (tampering detection necessary) (step S35), and if not, the tampering detection necessity determination unit 33 determines the first condition determination result to be "not necessary" (tampering detection not necessary) (step S36).

[0046] Here, the second condition determination process in step S22 will be described. Fig. 5 is a flowchart illustrating the second condition determination process in Fig. 3 .

[0047] In the second condition determination process, the tampering detection necessity determination unit 33 first identifies the number Nh of the above-mentioned high-level flags that are in the ON state (step S41), and determines whether the number Nh of flags is greater than zero (step S42).Furthermore, the tampering detection necessity determination unit 33 first identifies the number Na of flags that are in the ON state among all flags (external input flags and data rewrite flags) (step S43), and determines whether the number Na of flags is greater than 1 (step S44).

[0048] If the number of flags Nh is not greater than zero and the number of flags Na is not greater than 1, the tampering detection necessity determination unit 33 determines the second condition judgment result to be "not required" (tampering detection not required) (step S45), and if not, the tampering detection necessity determination unit 33 determines the second condition judgment result to be "required" (tampering detection required) (step S46).

[0049] Here, the third condition determination process in step S23 will be described. Fig. 6 is a flowchart illustrating the third condition determination process in Fig. 3.

[0050] In the third condition determination process, the tampering detection necessity determination unit 33 identifies the activation factor of the program 21 and specifies the above-mentioned time limit (step S51). In addition, the tampering detection necessity determination unit 33 estimates the tampering detection processing time corresponding to the size of the program 21 (step S52).

[0051] Then, the tampering detection necessity determination unit 33 determines whether the tampering detection processing time is less than or equal to the time limit (step S53), and if the tampering detection processing time is less than or equal to the time limit, the third condition determination result is "necessary" (tampering detection required) (step S54), and if not, the tampering detection necessity determination unit 33 determines the third condition determination result is "not required" (tampering detection not required) (step S55).

[0052] The overall determination process in step S24 will now be described with reference to a flowchart of FIG.

[0053] In the comprehensive judgment process, the tampering detection necessity judgment unit 33 identifies the evaluation value Ri (i = 1, 2, 3) of the ith condition judgment result (step S61). The evaluation value Ri of the ith condition judgment result for which tampering detection is necessary is higher than the evaluation value Ri of the ith condition judgment result for which tampering detection is not necessary. Here, the evaluation value Ri of the ith condition judgment result for which tampering detection is necessary is 100, and the evaluation value Ri of the ith condition judgment result for which tampering detection is not necessary is 0.

[0054] Next, the tamper detection necessity determination unit 33 derives a weighted sum (overall evaluation value) r of the evaluation values ​​Ri of the i-th condition determination results (step S62), where r = C1 × R1 + C2 × R2 + C3 × R3, and Ci is a weighting coefficient (i = 1, 2, 3). C1 to C3 may be the same or different from each other.

[0055] Then, the tampering detection necessity determination unit 33 determines whether the overall evaluation value r exceeds a predetermined threshold value s (step S63). If the overall evaluation value r exceeds the threshold value s, the tampering detection necessity determination unit 33 determines the overall determination result as "necessary" (tampering detection necessary) and determines that tampering detection processing should be executed (step S64), but if not, the tampering detection necessity determination unit 33 determines the overall determination result as "unnecessary" (tampering detection not necessary) and determines that tampering detection processing should not be executed (step S65).

[0056] As described above, according to the first embodiment, the activity monitoring unit 32 monitors whether specific activities related to external data input and internal data rewriting have been detected. The tampering detection necessity determining unit 33 determines whether tampering detection processing should be performed on the program 21, based on the activity detected by the activity monitoring unit 32 after the previous tampering detection processing was performed on the program 21. The tampering detection unit 34 performs tampering detection processing on the program 21 when the tampering detection necessity determining unit 33 determines that tampering detection processing should be performed.

[0057] As a result, the tampering detection process is not performed when there are few activities that can be easily used for tampering, and is performed when there are many activities that can be easily used for tampering, thereby reducing the possibility that a tampered program will be executed when the tampering detection process is not performed for convenience's sake.

[0058] Embodiment 2

[0059] In the second embodiment, operation setting data is provided that indicates whether convenience or security is to be prioritized in determining whether or not tampering detection processing is necessary, and is set by, for example, a user. Note that in this embodiment, the operation setting data indicates a value selected from "convenience priority," "security priority," and "security top priority" (a setting with a higher priority than security priority).

[0060] In the second embodiment, when the operation setting data indicates that convenience is prioritized, the tampering detection necessity determination unit 33 determines the determination result as to whether or not the activity detected by the activity monitoring unit 32 after the previous execution of the tampering detection process for the program 21 includes both an activity of external data input and an activity of internal data rewriting.

[0061] On the other hand, if the operation setting data indicates that security is a priority, the tampering detection necessity determination unit 33 determines the determination result as to whether the activity detected by the activity monitoring unit 32 after the previous tampering detection process for the program 21 includes at least one of an activity of external data input and an activity of internal data rewriting.

[0062] Then, based on the determination result (first condition determination result), the tampering detection necessity determination unit 33 determines whether or not the tampering detection process should be performed.

[0063] Next, a description will be given of the first condition determination process in the second embodiment. Fig. 8 is a flowchart illustrating the first condition determination process in the second embodiment.

[0064] In the first condition determination process of the second embodiment, the tamper detection necessity determination unit 33 identifies the operation setting (either "convenience priority," "security priority," or "security top priority") based on the operation setting data (step S81), determines whether the operation setting is "convenience priority" (step S82), and determines whether the operation setting is "security priority" (step S83).

[0065] When the operation setting is "convenience priority," the tampering detection necessity determination unit 33 identifies the flag numbers N1 and N2, as in embodiment 1, and if the flag number N1 is greater than zero and the flag number N2 is greater than zero, the first condition determination result is "necessary" (tampering detection required); otherwise, the tampering detection necessity determination unit 33 determines the first condition determination result is "not required" (tampering detection not required) (steps S84 to S86).

[0066] On the other hand, if the operation setting is "security priority," the tampering detection necessity determination unit 33 identifies the flag numbers N1 and N2 and determines whether the flag number N1 is greater than zero or the flag number N2 is greater than zero (step S87).If the flag number N1 is greater than zero or the flag number N2 is greater than zero, the first condition determination result is "required" (tampering detection required) (step S88); if not, the tampering detection necessity determination unit 33 determines the first condition determination result to be "not required" (tampering detection not required) (step S89).

[0067] On the other hand, if the operational setting is neither "convenience priority" nor "security priority" (i.e., if the operational setting is "security top priority"), the first condition judgment result is set to "required" (tamper detection required) regardless of the flag numbers N1 and N2 (step S90).

[0068] The rest of the configuration and operation of the electronic device according to the second embodiment is the same as that of the first embodiment, so a description thereof will be omitted.

[0069] Embodiment 3

[0070] In the third embodiment, the tampering detection necessity determining unit 31 determines whether or not to perform the tampering detection process based on the determination result of whether or not the activity monitoring unit 32 has detected more than a predetermined number of the above-mentioned activities after the previous execution of the tampering detection process for the program 21. This predetermined number is set according to the type of the program 21.

[0071] The "predetermined number" for programs 21 for which convenience should be prioritized is greater than the "predetermined number" for programs 21 for which security should be prioritized, and if the above-mentioned activity is detected more than the predetermined number, it is determined that tampering detection processing should be performed, or it is more likely that tampering detection processing should be performed. In addition, the type of program depends on the execution authority level of the program, whether the storage device in which the program is stored is rewritable, etc.

[0072] The rest of the configuration and operation of the electronic device according to the third embodiment is the same as that of the second or third embodiment, so a description thereof will be omitted.

[0073] It should be noted that various changes and modifications to the above-described embodiments will be apparent to those skilled in the art. Such changes and modifications may be made without departing from the spirit and scope of the subject matter and without diminishing its intended advantages. In other words, it is intended that such changes and modifications be included within the scope of the claims.

[0074] For example, in the above-mentioned embodiments 1 to 3, the activity monitoring unit 32, the tampering detection necessity determination unit 33, and the tampering detection unit 34 may be realized by the processor 11 executing a program stored in a non-rewritable recording medium (such as a ROM).

[0075] Furthermore, in the above-described first to third embodiments, the tampering detection necessity determination unit 33 may determine whether or not the tampering detection process is necessary without executing part of the first condition determination process, the second condition determination process, and the third condition determination process. Moreover, the tampering detection necessity determination unit 33 may execute only one of the first condition determination process, the second condition determination process, and the third condition determination process, and determine whether or not the tampering detection process is necessary based on the determination result.

[0076] Furthermore, in the first to third embodiments, the electronic device may determine whether or not the tampering detection process is necessary for a specific program at a specific timing, such as when the electronic device is started up, and may execute the tampering detection process as necessary. [Industrial Applicability]

[0077] The present invention is applicable to, for example, electronic devices. [Explanation of symbols]

[0078] 11 processors 21 Programs 32 Activity Monitoring Unit 33 Tamper detection necessity determination unit 34 Tampering detection unit

Claims

1. a processor capable of executing a program; an activity monitoring unit that monitors whether specific activities related to external data input and internal data rewriting have been detected; a tampering detection necessity determination unit that determines whether or not the tampering detection process should be performed on the program based on the activity detected by the activity monitoring unit after the previous execution of the tampering detection process on the program; a tampering detection unit that performs the tampering detection process on the program when the tampering detection necessity determination unit determines that the tampering detection process should be performed; An electronic device comprising:

2. The activities are classified into levels based on the degree of security risk; the tampering detection necessity determination unit (a) specifies as a first determination result a determination result as to whether or not more than a predetermined first number of activities classified into a predetermined first level among the plurality of levels have been detected by the activity monitoring unit after the previous execution of the tampering detection process for the program; (b) specifies as a second determination result a determination result as to whether or not more than a predetermined second number, which is larger than the first number, of the activities in all of the plurality of levels have been detected by the activity monitoring unit after the previous execution of the tampering detection process for the program; and (c) determines whether or not the tampering detection process should be performed based on the first determination result and the second determination result.

2. The electronic device according to claim 1,

3. The electronic device according to claim 1, characterized in that the tampering detection necessity determination unit determines whether or not the tampering detection process should be performed based on a comparison result between a time limit corresponding to a trigger for starting the program and a time required for the tampering detection process for the program.

4. the tampering detection necessity determination unit determines whether or not the tampering detection process should be performed based on a determination result of whether or not the activity monitoring unit has detected a number of activities greater than a predetermined number after the previous execution of the tampering detection process for the program; the predetermined number is set according to the type of the program; 2. The electronic device according to claim 1,

5. The electronic device of claim 1, wherein the tampering detection necessity determination unit (a) determines, when the specified operation setting data indicates a priority on convenience, whether or not the activity detected by the activity monitoring unit after the previous execution of the tampering detection process for the program includes both the activity of external data input and the activity of internal data rewriting; (b) determines, when the operation setting data indicates a priority on security, whether or not the activity detected by the activity monitoring unit after the previous execution of the tampering detection process for the program includes at least one of the activity of external data input and the activity of internal data rewriting; and (c) determines, based on the determination result, whether or not the tampering detection process should be performed.

6. The external data input activity includes (a) receiving data via a network, (b) receiving data via a peripheral device interface, and (c) acquiring image data from a scanner; The internal data rewriting activity includes (a) writing data to a storage device in which the program is stored, (b) updating firmware, and (c) writing to a file system; 6. The electronic device according to claim 1, wherein:

Images