Management system, device, management server, and control method and program thereof

Abstract

Conventional techniques have not been able to prevent unauthorized transmission of information through spoofing. [Solution] The printer 100 sends device usage information to the printer management server 200 using the HTTPS protocol and stores a certain number of these in the DB 110. The printer management server 200 saves the device usage information received using the HTTPS protocol in the DB 210. The printer management server 200 also initiates a push notification of an impersonation check job to the printer 200 using the MQTT protocol. In accordance with the impersonation check job, the printer 100 collects the information stored in the DB 110 and sends it to the printer management server 200 as a sent device usage information list. The printer management server 200 compares the received sent device usage information list with the device usage information already received in the DB 210 and determines whether the device usage information received using the HTTPS protocol is unauthorized information.

Description

[Technical Field]

[0001] The present invention relates to a management system, a device, a management server, a control method thereof, and a program. [Background technology]

[0002] With the development and spread of the Internet of Things (hereinafter referred to as "IoT") and cloud services, it has become easier than ever for any "thing" to send data to a cloud server via the Internet. Image forming devices are also becoming more and more multifunctional, and multifunction devices called multifunction printers (hereinafter referred to as "printers") also transmit various types of data to cloud servers as client devices.

[0003] The cloud server uses the data received from the printer for various services. Some of these services provide benefits to the printer owner (hereafter referred to as "user"). For example, data on "number of pages printed" is used by a service that provides users with points that can be exchanged for special benefits depending on the number of pages printed. Data on "remaining ink tank amount" is used by a subscription service that delivers new ink tanks to users when the ink tank is low.

[0004] The data that the printer sends to the cloud server for purposes including providing benefits to such users (hereinafter referred to as "device usage information") is sent over an encrypted communication path using authentication information stored inside the printer.

[0005] However, it is conceivable that a malicious user may somehow obtain the authentication information stored in the printer. In such a scenario, the malicious user may misuse the obtained authentication information to masquerade as the printer and send fraudulent device usage information (hereinafter referred to as "fraudulent device usage information") that differs from the actual situation to the cloud server, thereby obtaining fraudulent profits.

[0006] Patent Document 1 proposes a technology in which the sender of data periodically sends a request to the destination of the data to prove that the sender is a legitimate client terminal in addition to the data itself, thereby proving itself and improving security. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] Patent No. 3824274 Summary of the Invention [Problem to be solved by the invention]

[0008] However, the method described in Patent Document 1 makes it relatively easy for a malicious user to spoof a client terminal by sending not only normal data transmissions but also a request proving that the user is a legitimate client terminal.

[0009] The configuration of Patent Document 1 has the following problems. First, both normal data transmission and requests for proof are communicated over the same protocol. The second point is that both normal data transmission and requests for certification are realized through communication initiated by the client terminal. Both of these points mean that the verification request itself can be spoofed. As described above, conventional techniques have been unable to prevent malicious users from "spoofing" and sending fraudulent information.

[0010] The present invention has been made to solve the above-mentioned problems, and aims to provide a mechanism that can determine with high accuracy information that has been fraudulently transmitted through spoofing, thereby improving safety against spoofing by malicious users. [Means for solving the problem]

[0011] The present invention is a system capable of communication between a device and a management server that manages the device, wherein the device has a first transmission means that transmits operation information of the device to the management server using a first communication method, a first storage means that stores a certain amount of information transmitted to the management server by the first transmission means or information that can identify that information, and a second transmission means that, in response to receiving a specified request that has been push-notified from the management server using a second communication method that is different from the first communication method, collects the information stored in the first storage means and transmits it to the management server; and the management server has a first reception means that receives information using the first communication method, a second storage means that stores the information received by the first receiving means, a first notification means that, starting from the management server, pushes the specified request to the device using the second communication method, a second reception means that receives information transmitted from the device in response to the specified request, and a determination means that compares the information received by the second receiving means with the information stored in the second storage means and determines whether the information received by the first receiving means is invalid information based on the result of the comparison. [Effects of the Invention]

[0012] According to the present invention, it is possible to determine with high accuracy information that has been fraudulently transmitted through spoofing, thereby improving safety against spoofing by malicious users. [Brief explanation of the drawings]

[0013] [Figure 1] 1 is a diagram showing an example of the overall configuration of a data transmission system according to an embodiment of the present invention. [Figure 2] FIG. 1 is a diagram illustrating the schematic configuration of a printer as an example of a device according to an embodiment of the present invention. [Figure 3] FIG. 2 is a diagram illustrating a schematic configuration of a printer management server according to the present embodiment. [Figure 4] FIG. 2 is a diagram showing an example of the configuration of a control application and DB in a printer. [Figure 5] FIG. 10 is a diagram showing an example of the configuration of a web application and a database in a printer management server. [Figure 6] FIG. 10 is a diagram showing an example of a sequence in which device usage information is transmitted to a service server as a result of the first determination process according to the present embodiment. [Figure 7] FIG. 10 is a diagram showing an example of a sequence in which device usage information is transmitted to a service server as a result of the second determination process according to the present embodiment. [Figure 8] FIG. 10 is a diagram showing an example of a sequence in which printer identification information is sent to a monitoring server as a result of the second determination process according to the present embodiment. [Figure 9] 10 is a flowchart showing an example of a first determination process of the present embodiment. [Figure 10] 10 is a flowchart showing an example of a second determination process according to the present embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0014] Preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Note that the following embodiments do not limit the scope of the present invention, and not all of the combinations of features described in the embodiments are necessarily essential to the solution of the present invention.

[0015] [First embodiment] In this embodiment, when a printer management server receives suspicious device usage information, the history of device usage information stored in the printer is collected using a protocol different from that used to transmit the device usage information, and compared with the history of device usage information stored in the printer management server, thereby presenting an example of a method for checking for the mixing of device information due to impersonation by a malicious user.

[0016] FIG. 1 is a diagram showing an example of the overall configuration of a data transmission system according to this embodiment. The network 1000 is a network that communicatively connects the printer 100, the printer management server 200, the monitoring server 300, and the service server 400. The network 1000 is a communication network realized by, for example, a local area network (hereinafter abbreviated as "LAN") such as the Internet, a wide area network (hereinafter abbreviated as "WAN"), a telephone line, a dedicated digital line, an ATM or frame relay line, a cable television line, a wireless line for data broadcasting, etc. The type of the network 1000 does not matter as long as data can be sent and received between the components. In this embodiment, the network 1000 will be described as the Internet.

[0017] The printer 100 is an image forming apparatus serving as a client device with a printing function. In the printer 100, the control application 120 of the printer 100 is an application program having a communication function via the network 1000 and a control function of the printer 100.

[0018] The control application 120 has two types of communication functions via the network 1000: an HTTPS communication function and an MQTT communication function. When the printer 100 sends device usage information to the printer management server 200, the HTTPS (Hypertext Transfer Protocol Secure) communication function is used. When receiving a print job or a spoofing check job sent by the printer management server 200, the MQTT (Message Queuing Telemetry Transport) communication function is usually used. The DB 110 stores device usage information of the printer 100 and the like.

[0019] The printer management server 200 is connected to the printer 100 , the monitoring server 300 , and the service server 400 via a network 1000 . The printer management server 200 accepts communications from the printer 100. In the printer management server 200, the web application 220 is an application program that transmits device usage information transmitted from the printer 100 to the service server 400 and sends push notifications of print jobs and spoofing check jobs to the printer management server 200. Furthermore, when the printer management server 200 detects unauthorized communications from a malicious user, the printer management server 200 transmits identification information of the printer 100 corresponding to the unauthorized communications to the monitoring server 300. The DB 210 stores identification information for the printer 100 and data for determining whether unauthorized communications have been made by malicious users.

[0020] 1 shows the printer 100 and the printer management server 200 as a management server that accepts communication from the printer 100, but instead of the printer 100, devices such as various IoT (Internet of Things) devices may transmit device usage information to the management server, which then receives and processes the information. The devices that transmit information to the management server may be any type of device, such as air conditioning equipment such as an air conditioner, network home appliances, network cameras, navigation devices, or various other IoT devices. There are also no limitations on the device usage information transmitted from the devices to the management server, and the information may include various types of operation information transmitted from the devices to the management server. Furthermore, the management server may be configured to transmit information to servers other than the monitoring server 300 and the service server 400 as well.

[0021] 1, in order to simplify the explanation of this embodiment, each component is illustrated as being made up of one unit, but there is no intention to limit or restrict the number of units in the configuration. Each component may be made up of one or more multiple elements.

[0022] FIG. 2 is a diagram illustrating a schematic configuration of a printer 100, which is an example of a device according to this embodiment. The CPU 101 calculates, judges, and controls data and requests according to programs stored in the RAM 102 and the ROM 103 . The RAM 102 is used as a temporary storage area when the CPU 101 performs various processes. The ROM 103 stores an operating system (OS) and other application software (for example, the control application 120) in a computer-readable manner. The ROM 103 may also be a non-volatile memory, such as a flash memory, that allows data to be rewritten.

[0023] The communication device 104 is an interface to which a LAN cable is connected, and performs data communication with the printer management server 200 via a router (not shown) or the network 1000. This data communication may be performed wirelessly, for example, using a wireless interface, or may be performed via a wired connection.

[0024] The display unit 108 is configured by, for example, an LCD, and displays various types of information. The operation unit 109 includes buttons, a touch panel, and the like for the user to perform various input operations. The printing device 106 processes the job data received by the communication device 104 and prints it on manuscript paper.

[0025] The storage device 105 stores job data received by the communication device 104. The storage device 105 also stores a database such as a DB 110, for example. A system bus 107 exchanges data with the CPU 101, RAM 102, ROM 103, communication device 104, storage device 105, printing device 106, display unit 108, operation unit 109, and the like.

[0026] The processing of the control application 120 of the printer 100 is realized by the CPU 101 reading out a program required for the processing from the ROM 103 or the like and executing it.

[0027] FIG. 3 is a diagram illustrating a schematic configuration of the printer management server of this embodiment. The CPU 201 is a central processing unit for controlling the following components 201 to 207. The disk device 202 is a storage device such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), etc. The disk device 202 stores an application program 231 (for example, a Web application 220) read by the CPU 201, a database 232 (for example, a DB 210), an OS, and various files.

[0028] The external storage medium reader 203 is a device for reading information such as files stored in an external storage medium such as an SD card. The memory 204 is configured with RAM or the like, and the CPU 201 temporarily stores data, buffers data, and so on as needed.

[0029] The display unit 205 is configured by, for example, an LCD, and displays various types of information. The operation unit 206 includes a keyboard, a mouse, and the like for the user to perform various input operations. The communication unit 207 is connected to a network such as the Internet and performs various communications. The communication unit 207 is compatible with wired LANs and wireless LANs. The above-mentioned units 201 to 207 are connected to one another by a bus 209.

[0030] The printer management server 200 may be realized by one computer or by multiple computers. For example, the printer management server 200 may be configured to be realized using cloud computing technology.

[0031] The monitoring server 300 and the service server 400 have the same hardware configuration as the printer management server 200, and a description thereof will be omitted. The monitoring server 300 and the service server 400 may have a different hardware configuration from that of the printer management server 200.

[0032] FIG. 4 is a diagram showing an example of the configuration of the control application 120 and DB 110 in the printer 100. As shown in FIG. In the control application 120, the MQTT communication module 121 is a module for receiving push notifications transmitted from the printer management server 200 via the network 1000. The main types of push notifications include print jobs and spoofing check jobs.

[0033] The print module 122 is a module that controls print jobs received from the MQTT communication module 121 or other paths. After printing is executed, the print module 122 passes information such as the number of printed sheets and the amount of ink consumed by printing to the device usage information module 123.

[0034] The device usage information module 123 transmits information received from the print module 122 and information collected from sensors possessed by the device usage information module 123 itself as device usage information to the printer management server 200 via the HTTPS communication module 124. After transmission, the device usage information module 123 also stores the device usage information in a transmitted device usage information table 111 in the DB 110. Note that there is an upper limit to the amount of device usage information that can be stored in the transmitted device usage information table 111, and when more device usage information is stored than the upper limit, the oldest information is deleted.

[0035] The spoofing check module 125 is a module that performs an spoofing check when an spoofing check job is received by the MQTT communication module 121. When performing an spoofing check, information in the transmitted device usage information table 111 is collected and transmitted to the printer management server 200 via the HTTPS communication module 124 as a transmitted device usage information list. The DB 110 stores the device usage information of the printer 100 in a transmitted device usage information table 111 .

[0036] FIG. 5 is a diagram showing an example of the configuration of the Web application 220 and DB 210 in the printer management server 200. As shown in FIG. The Web application 220 has a function of managing the printer 100 and transferring device usage information to the service server 400. In addition, the Web application 220 has a function of performing an impersonation check when it detects critical usage information suspected of being sent by a malicious user (hereinafter referred to as "suspicious device usage information") in the first determination process described below.

[0037] In the web application 220, the HTTPS communication module 221 is used for HTTPS communication via the network 1000. The HTTPS communication includes receiving device usage information from the printer 100, transmitting the device usage information to the service server 400, and transmitting the identification information of the printer 100 to the monitoring server 300 when unauthorized device usage information is confirmed.

[0038] The first determination module 222 is a module that performs a first determination process to determine whether the device usage information received by the Web application 220 is suspicious, and starts a spoofing check if the device usage information is suspicious.

[0039] The second determination module 223 performs a second determination process to determine whether the suspicious device usage information is unauthorized device usage information by comparing the information sent from the printer 100 with the information stored in the DB 210 during the impersonation check, and has the function of sending the identification information of the printer 100 to the monitoring server 300 if the device usage information is unauthorized.

[0040] The MQTT communication module 224 is used when the printer management server 200 sends a push notification to the printer 100 .

[0041] Next, the DB 210 will be described. The printer table 211 stores information about the printer 100. In the received device usage information table 213, device usage information transmitted not from a malicious user but from the printer 100 (hereinafter referred to as "legitimate device usage information") through the second determination process is stored in a form linked to the identifier of the printer 100. There is also an upper limit to the number of entries that can be stored in the received device usage information table 213, and when the upper limit is exceeded, the oldest entries are overwritten. The number of entries stored in the received device usage information table 213 is greater than the number of entries stored in the transmitted device usage information table 111 described below. While the above description has been given of a case in which there are upper limits on the number of entries stored in the received device usage information table 213 and the transmitted device usage information table 111, it is also possible to set upper limits on the storage period of the received device usage information table 213 and the transmitted device usage information table 111. For example, the upper limit on the storage period of the received device usage information table 213 may be three months, and the storage period of the transmitted device usage information table 111 may be one month.

[0042] The pending device usage information table 212 stores device usage information that has been determined to be suspicious device usage information and device usage information that has been received by the printer management server 200 until the spoofing check is completed.

[0043] The suspicious device usage information determination formula table 214 is a knowledge base for determining whether device usage information is suspicious, and stores information about the printer 100, a list of received device usage information linked to the printer 100, and a formula that takes the device usage information as input.

[0044] Next, in this embodiment, the flow when device usage information sent to the printer management server 200 from an unknown source, either the printer 100 or a malicious user (hereinafter referred to as an "unknown source"), is determined to be "legitimate device usage information" by the first judgment module and the device usage information is sent to the service server 400 will be explained using the sequence diagram shown in Figure 6.

[0045] FIG. 6 is a diagram showing an example of a sequence in which device usage information is transmitted to the service server 400 as a result of the first determination process of this embodiment. The processing of printer 100 shown here is realized by CPU 101 of printer 100 expanding program code stored in a computer-readable manner in ROM 103 onto RAM 102 and executing it. Furthermore, the processing of printer management server 200 is realized by CPU 201 of printer management server 200 expanding program code stored in a computer-readable manner in disk device 202 onto memory 204 and executing it. Furthermore, the processing of service server 400 is realized by CPU 201 of service server 400 expanding program code stored in a computer-readable manner in disk device 202 onto memory 204 and executing it. That is, the series of processes shown in FIG. 6 can be performed by the CPU of each device expanding program code stored in a storage device onto RAM and executing it. Alternatively, some or all of the functions of the steps shown in FIG. 6 may be realized by an electronic circuit such as an ASIC or hardware.

[0046] In S6001, the unknown sender transmits device usage information to the HTTPS communication module 221. Upon receiving this device usage information, the HTTPS communication module 221 advances the process to S6002.

[0047] In S6002, the HTTPS communication module 221 passes the device usage information received in S6001 to the first determination module 222. Upon receiving this device usage information, the first determination module 222 advances the process to S6003. In S6003 and S6004, the first determination module 222 acquires information about the printer 100, a list of received device usage information about the printer 100, and a list of suspicious device usage information determination formulas from the DB 210. Note that S6003 indicates an instruction from the first determination module 222 to the DB 210 to acquire information, and S6004 indicates a response from the DB 210 to the first determination module 222 in response to the instruction.

[0048] Next, in S6005, the first determination module 222 confirms that the "unauthorized printer" flag is not set based on the information about the printer 100. The "unauthorized printer" flag is set in S8021 and S8022 in Fig. 8, which will be described later. In S6005, the explanation will be given assuming that the "unauthorized printer" flag is not set, but if the "unauthorized printer" flag is set, the printer management server 200 rejects the device usage information received in S6001 above and returns "ok" to the unknown sender. If the "unauthorized printer" flag is not set, the first determination module 222 advances the process to S6006.

[0049] In S6006, the first determination module 222 confirms that the "checking for spoofing" flag is not set based on the information about the printer 100. The "checking for spoofing" flag is set in S7008 and S7009 of Fig. 7 and S8008 and S8009 of Fig. 8, which will be described later. In S6006, the description will be given assuming that the "checking for spoofing" flag is not set, but if the "checking for spoofing" flag is set, the printer management server 200 determines that the device usage information received in S6001 above is suspicious device usage information without undergoing the first determination process, which will be described later, and stores this information in the pending device usage information table 212 of the DB 210. If the "spoofing check in progress" flag is not set, the first determination module 222 advances the process to S6007.

[0050] In S6007, the first determination module 222 executes a first determination process shown in FIG. 9, which will be described later, on the device usage information, and determines that the device usage information is legitimate. Next, in S6008 and S6009, the first determination module 222 registers the legitimate device usage information in the received device usage information table 213 of the DB 210. That is, the first determination module 222 requests the DB 210 to register the legitimate device usage information in the received device usage information table 213 (S6008). The DB 210 returns a response to the first determination module 222 (S6009).

[0051] Next, in S6010 and S6011, the first determination module 222 uses the HTTPS communication module 221 to transmit legitimate device usage information to the service server 400. In S6012 and S6013, the service server 400 uses the HTTPS communication module 221 to return a response to the first determination module 222. Next, in S6014 and S6015, the first determination module 222 uses the HTTPS communication module 221 to return a response to the sender that sent the device usage information in S6001 above.

[0052] Next, in this embodiment, the flow when the printer management server 200 determines that the received device usage information is "suspicious device usage information" by the first determination module, sends an impersonation check job to the printer 100, and then determines that the information is "legitimate device usage information" by the second determination module, and sends the device usage information to the service server 400 will be described with reference to the sequence diagram shown in Fig. 7. The impersonation check job corresponds to a request (command) to collect a certain amount of transmitted device usage information held in the printer 100 and transmit it to the printer management server 200 as a transmitted device usage information list.

[0053] FIG. 7 is a diagram showing an example of a sequence in which device usage information is transmitted to the service server 400 as a result of the second determination process of this embodiment. The processing of printer 100 shown here is realized by CPU 101 of printer 100 expanding program code stored in a computer-readable manner in ROM 103 onto RAM 102 and executing it. Furthermore, the processing of printer management server 200 is realized by CPU 201 of printer management server 200 expanding program code stored in a computer-readable manner in disk device 202 onto memory 204 and executing it. Furthermore, the processing of service server 400 is realized by CPU 201 of service server 400 expanding program code stored in a computer-readable manner in disk device 202 onto memory 204 and executing it. That is, the series of processes shown in FIG. 7 can be performed by the CPU of each device expanding program code stored in a storage device onto RAM and executing it. Alternatively, some or all of the functions of the steps shown in FIG. 7 may be realized by an electronic circuit such as an ASIC or hardware.

[0054] First, the sequence from S7001 to S7006 is the same as S6001 to S6006 in FIG. 6, so the description will be omitted and only S7007 and thereafter will be described. In S7007, the first determination module 222 determines that the received device usage information is suspicious device usage information as a result of the first determination process shown in FIG. 9, which will be described later.

[0055] Next, in S7008 and S7009, the first determination module 222 stores the suspicious device usage information in the pending device usage information table 212 of the DB 210, and sets a "spoofing check in progress" flag for the printer 100 stored in the printer table 211. Note that S7008 indicates an instruction from the first determination module 222 to the DB 210, and S7009 indicates a response from the DB 210 to the first determination module 222 in response to the instruction.

[0056] Next, in S7010 to S7012, the first determination module 222 sends an spoofing check job to the spoofing check module 125 of the printer 100 via the MQTT communication module 224 and the MQTT communication module 121. This "spoofing check job" corresponds to a request to have the printer 100 send to the printer management server 200 the device usage information or a list of part of the information (transmitted device usage information list) that has been sent from the printer 100 to the printer management server 200 and that is held in the transmitted device usage information table 111 by the printer 100. The MQTT communication module 121 returns "ok" to the first determination module 222 asynchronously with S7011 (S7011'). In addition, the first determination module sends the same reply to the unknown sender as S6014 and S6015 in FIG. 6 (S7012', S7013').

[0057] When the spoofing check job is received, the spoofing check module 125 advances the process to S7013. In S7013 and S7014, spoofing check module 125 collects information in transmitted device usage information table 111 in DB 110 and acquires it as a transmitted device usage information list. Note that S7013 indicates an instruction from spoofing check module 125 to DB 110 to acquire information, and S7014 indicates a response from DB 110 to spoofing check module 125 in response to the instruction.

[0058] Next, in S7015 to S7019, the spoofing check module 125 transmits the transmitted device usage information list acquired in S7014 to the second determination module 223 via the HTTPS communication module 124 and the HTTPS communication module 221. Upon acquiring this transmitted device usage information list, the second determination module 223 proceeds to S7018. Note that the transmission of the transmitted device usage information list in S7015 to S7019 is not limited to the HTTPS protocol. For example, the transmitted device usage information list may be transmitted from the spoofing check module 125 to the second determination module 223 via the MQTT communication module 121 and the MQTT communication module 224. In other words, as long as the transmitted device usage information list is transmitted from the check module 125 to the second determination module 223, the HTTPS protocol, the MQTT protocol, or another protocol may be used, and any communication method may be used.

[0059] Next, in S7018 and S7019, the second determination module 223 obtains information about the printer 100, a list of received device usage information for the printer 100, and a list of on-hold device usage information for the printer 100 from the DB 210. S7018 indicates an instruction from the second determination module 223 to the DB 210, and S7019 indicates a response from the DB 210 to the second determination module 223 in response to the instruction. At this time, the DB 210 obtains information about the printer 100 from the printer table 211, obtains a list of received device usage information linked to the identifier of the printer 100 from the received device usage information table 213, and obtains a list of on-hold device usage information linked to the identifier of the printer 100 from the on-hold device usage information table 212, and sends these to the second determination module 223.

[0060] Next, in S7020, the second determination module 223 executes the second determination process shown in FIG. 10, which will be described later, and determines the suspicious device usage information as "legitimate device usage information."

[0061] Next, in S7021 and S7022, the second determination module 223 registers the suspicious device usage information related to the printer 100 stored in the pending device usage information table 212 in the DB 210 as legitimate device usage information in the received device usage information table 213, and deletes the suspicious device usage information from the pending device usage information table 212. The second determination module 223 also clears the "spoofing check in progress" flag for the printer 100 stored in the printer table 211. Note that S7021 indicates an instruction from the second determination module 223 to the DB 210, and S7022 indicates a response from the DB 210 to the second determination module 223 in response to the instruction.

[0062] Next, in S7023 and S7024, the second determination module 223 transmits the legitimate device usage information to the service server 400 via the HTTPS communication module 221. In S7025 and S7026, the service server 400 returns a response to the second determination module 223 via the HTTPS communication module 221.

[0063] Next, in S7027 to S7029, the second determination module 223 returns a notification of the completion of the spoofing check flow to the spoofing check module 125 via the HTTPS communication module 221 and the HTTPS communication module .

[0064] Next, in this embodiment, the flow when the printer management server 200 determines the received device usage information as "suspicious device usage information" using the first judgment module, sends an impersonation check job to the printer 100, and the second judgment module determines that the information is "fraudulent device usage information," and sends the identification information of the printer 100 to the monitoring server 300 is explained using the sequence diagram shown in Figure 8.

[0065] FIG. 8 is a diagram showing an example of a sequence in which the identification information of the printer 100 is sent to the monitoring server 300 as a result of the second determination process of this embodiment. The processing of the printer 100 shown here is realized by the CPU 101 of the printer 100 expanding onto RAM 102 the program code stored in a computer-readable manner in ROM 103 and executing it. The processing of the printer management server 200 is realized by the CPU 201 of the printer management server 200 expanding onto memory 204 the program code stored in a computer-readable manner in disk device 202 and executing it. The processing of the monitoring server 300 is realized by the CPU 201 of the monitoring server 300 expanding onto memory 204 the program code stored in a computer-readable manner in disk device 202 and executing it. That is, the series of processes shown in FIG. 8 can be performed by the CPU of each device expanding onto RAM the program code stored in a storage device and executing it. Alternatively, some or all of the functions of the steps shown in FIG. 8 may be realized by an electronic circuit such as an ASIC or hardware.

[0066] First, the sequence from S8001 to S8019 is the same as S7001 to S7019 in FIG. 7, so the description will be omitted and only S8020 and thereafter will be described. In S8020, the second determination module 223 executes the second determination process shown in Fig. 10, which will be described later, and determines that the suspicious device usage information is "unauthorized device usage information." In this case, the second determination module 223 can determine that the unknown sender is "spoofing by a malicious user."

[0067] Next, in S8021 and S8022, the second determination module 223 deletes the unauthorized device usage information linked to the printer 100 from the pending device usage information table 212 in the DB 210, clears the "spoofing check in progress" flag for the printer 100 in the printer table 211, and sets the "unauthorized printer" flag. That is, in this process, device usage information received using the HTTP protocol from the time it is determined to be suspicious in the first determination process until the second determination process is completed is deleted. In addition, by setting the "unauthorized printer" flag, control is exercised so that device usage information received thereafter is rejected. S8021 indicates an instruction from the second determination module 223 to the DB 210, and S8022 indicates a response from the DB 210 to the second determination module 223 in response to the instruction.

[0068] Next, in S8023 and S8024, the second determination module 223 transmits the identification information of the printer 100 to the monitoring server 300 via the HTTPS communication module 221. In S8025 and S8026, the monitoring server 300 returns a response to the second determination module 223 via the HTTPS communication module 221. Note that information about unauthorized device usage may also be transmitted to the monitoring saga 300 along with the identification information of the printer 100.

[0069] Next, in S8027 to S8029, the second determination module 223 returns a notification of the completion of the spoofing check flow to the spoofing check module 125 via the HTTPS communication module 221 and the HTTPS communication module .

[0070] As described above, whether the device usage information received by the printer management server 200 is authentic or unauthorized is determined based on the results of two stages: the first determination process executed by the first determination module 222 and the second determination process executed by the second determination module 223. That is, if the device information is determined to be suspicious as a result of the first determination process, the printer management server 200 pushes an spoofing check job to the printer 100 and performs the second determination process to determine whether the information is authentic or unauthorized. However, regardless of the first determination process, the printer management server 200 may be configured to push an spoofing check job to the printer 100 at a predetermined interval to determine whether the information is authentic or unauthorized.

[0071] The determination processes shown in Figures 6, 7, and 8 will be described in detail below with reference to Figures 9 and 10. The processes shown in Figures 9 and 10 can be implemented by the CPU 201 of the printer management server 200 by loading onto the memory 204 program code stored in a computer-readable manner on the disk device 202 and executing the program code. Alternatively, some or all of the functions of the steps shown in Figures 9 and 10 may be implemented by an electronic circuit such as an ASIC or hardware.

[0072] FIG. 9 is a flowchart showing an example of the first determination process of this embodiment. The first determination process uses the device usage information, information on the printer 100, the received device usage information list, and the suspicious device usage information determination formula list. Here, the suspicious device usage information determination formula is a formula that takes the device usage information, information on the printer 100, and the received device usage information list as inputs, and outputs whether the input device usage information is suspicious device usage information (positive).

[0073] Examples of the above-mentioned suspicious device usage information determination formula are as follows: This corresponds to the judgment criteria that judges the device usage information as "positive" if it is sent from the sender of the input device usage information at a frequency equal to or greater than a threshold within a specific time period, and judges it as "negative" in all other cases. Corresponding to the judgment condition that judges the input device usage information as "positive" if the information sent as device usage information does not match the model information included in the printer 100 information, and judges it as "negative" in other cases. This corresponds to the judgment criteria that judges the input device usage information as "positive" if it is sent from an IP address different from the legitimate device usage information stored in the previously received device usage information, and judges it as "negative" in all other cases. The "suspicious device usage information determination formulas" given here are merely examples, and are not limited to these.

[0074] First, in S9001, the first determination module 222 assigns a determination formula in the list of suspicious device usage information determination formulas to formula F. That is, one unused "suspicious device usage information determination formula" is selected from the "suspicious device usage information determination formula list" and set as "formula F."

[0075] Next, in S9002, the first determination module 222 passes the printer 100 information, the received device usage information, and the received device usage information list as inputs to formula F, and determines whether the output of formula F is "positive" or not (negative). That is, the determination is made based on the determination conditions indicated by formula F.

[0076] Here, if the output of formula F (the determination result under the determination condition indicated by formula F) is "positive" (Yes in S9002), the first determination module 222 advances the process to S9003. In S9003, the first determination module 222 determines that the received device usage information is "suspicious device usage information" and ends the processing of this flowchart.

[0077] On the other hand, if the output of formula F (the determination result under the determination condition indicated by formula F) is "negative" (No in S9002), the first determination module 222 returns the process to S9001. If there are any unprocessed judgment formulas remaining in the list of suspicious device usage information judgment formulas, the unprocessed judgment formulas are input into formula F. In other words, if there are any unused "suspicious device usage information judgment formulas" in the "list of suspicious device usage information judgment formulas," one of them is selected and used as a new "formula F." On the other hand, if there are no unprocessed judgment formulas remaining in the suspicious device usage information judgment formula list, that is, if S9001 to S9002 are executed for all "suspicious device usage information judgment formulas" in the "suspicious device usage information list" and the results of formula F are all "negative", the first judgment module 222 proceeds to S9004.

[0078] In S9004, the first determination module 222 determines that the received device usage information is "legitimate device usage information" and ends the processing of this flowchart.

[0079] That is, in the first determination process, if any one of the determination results of the "suspicious device usage information determination formula" included in the "suspicious device usage information list" is "positive," the received device usage information is determined to be "suspicious device usage information." On the other hand, if all of the determination results of the "suspicious device usage information determination formula" included in the "suspicious device usage information list" are "negative," the received device usage information is determined to be "legitimate device usage information."

[0080] FIG. 10 is a flowchart showing an example of the second determination process of this embodiment. In the second determination process, the received device usage information list, the pending device usage information list, and the transmitted device usage information list are used.

[0081] First, in S10001, the second determination module 223 sorts the merged received device usage information list and pending device usage information list in descending order of reception date and time to create a "server list."

[0082] Next, in S10002, the second determination module 223 sets the transmitted device usage information list to "printer list." Then, in S10003, the second determination module 223 sets the length of the "printer list" to "printer list length."

[0083] Next, in S10004, the second determination module 223 determines a subset of the "server list" from the beginning with a length of "printer list length" as the "sub server list." That is, the set of the latest "printer list length" items in the "sub server list" (the subset from the beginning to the printer_list_length) as the "sub server list." Next, in S10005, the second determination module 223 compares the "sub server list" with the "printer list" and determines whether they match.

[0084] Here, if the "sub server list" and the "printer list" do not match (No in S10005), the second determination module 223 advances the process to S10006. In S10006, the second determination module 223 determines that the suspicious device usage information is "unauthorized device usage information," and ends the processing of this flowchart.

[0085] On the other hand, if the "sub server list" and the "printer list" match (Yes in S10005), the second determination module 223 advances the process to S10007. In S10007, the second determination module 223 determines that the suspicious device usage information is "legitimate device usage information" and ends the processing of this flowchart. In this case, the second determination module 223 determines that the unknown sender is "spoofed by a malicious user."

[0086] That is, in the second determination process, a list of transmitted device usage information (printer list) held by the sender of the device usage information to be determined is compared with a list of device usage information (server list) that the printer management server 200 has received from the sender, thereby determining whether the device usage information to be determined is "legitimate device usage information" or "unauthorized device usage information." For example, the "sub server list," which contains the same amount of information as the "printer list" and is obtained from the latest information in the "server list," is compared with the "printer list." If there is no one-to-one correspondence between these, the device usage information to be determined is "unauthorized device usage information." On the other hand, if there is a one-to-one correspondence between these, the device usage information to be determined is "legitimate device usage information."

[0087] In this embodiment, the second determination process is performed using a list of all transmitted device usage information stored in printer 100. However, the second determination process may also be performed using a list of transmitted device usage information that specifies the number of items (list length) and / or transmission period, etc. In this configuration, when an spoofing check job is sent to printer 100, the number of items (list length) and / or transmission period, etc. are specified in the spoofing check job. When printer 100 receives an spoofing check job that includes such a specification, it generates a transmitted device usage information list of the number of items (list length) and / or transmission period in accordance with the specification and transmits it to printer management server 200. When the period is specified, it may be a period after the previous spoofing check job was sent to printer 100 and the second determination process was performed, or a fixed period may be specified. In addition, the printer management server 200 may be configured to generate a specified number (list length) and / or transmission period of transmitted equipment usage information lists from the transmitted equipment usage information list obtained from the printer 100 and use this in the second determination process.

[0088] Alternatively, multiple pieces of transmitted device usage information may be randomly selected from the list of transmitted device usage information obtained from the printer 100, and if all of the selected pieces of transmitted device usage information exist among the received device usage information stored in the printer management server 200, the device usage information to be judged may be determined to be "legitimate device usage information," and if even one piece of transmitted device usage information does not exist, the device usage information to be judged may be determined to be "unauthorized device usage information." In other words, if the "printer list" is a subset of the "server list" (if it is completely included), the device usage information to be judged above may be judged to be "legitimate device usage information," and if it is not a subset (if it is not included), the device usage information to be judged above may be judged to be "unauthorized device usage information."

[0089] As described above, in this embodiment, the printer management server 200 initiates a push notification of the spoofing check job to the printer 100 using a communication method (e.g., MQTT communication) different from the method used when transmitting device usage information from the printer 100 (HTTPS communication), and then obtains the transmitted device usage information list and performs the second determination process. This allows the spoofing check job to be transmitted using a protocol different from that used when transmitting device usage information. Furthermore, unlike the transmission of device usage information, the spoofing check job can be initiated by the printer management server 200. This enables more secure spoofing checks to be performed. As a result, information such as fraudulent device usage information transmitted by a malicious user through "spoofing" can be detected with high accuracy. Therefore, even if a malicious user fraudulently obtains authentication information and transmits fraudulent information to the management server, this can be detected with high accuracy, thereby minimizing damage caused by fraud by malicious users.

[0090] Second Embodiment In the first embodiment, all data included in the device usage information received from the printer 100 is compared in the determination in S10005 of FIG. In contrast, in the second embodiment, only the device usage information ID (information that can identify device usage information), which is uniquely assigned when the device usage information module 123 creates device usage information, is stored in the transmitted device usage information table 111 and the received device usage information table 213, respectively.

[0091] This configuration significantly reduces the amount of information that needs to be stored in each DB for each piece of device usage information compared to the first embodiment. This makes it possible to implement this even when the printer 100 has limited storage resources. Furthermore, the amount of processing required when comparing the "server list" and the "printer list" in the second determination process can be significantly reduced, significantly reducing the processing load on the printer management server 200 and enabling faster determination processing. Furthermore, it also makes it possible to significantly conserve the computer resources of the printer management server 200. The above-mentioned device usage information ID may be configured to be issued within the printer management server 200, such as the first determination module 222.

[0092] In this embodiment, when the printer management server 200 confirms unauthorized communication from a malicious user (for example, as shown in S8020 in FIG. 8), the printer management server 200 is configured to transmit identification information of the printer 100 corresponding to the unauthorized communication to the monitoring server 300. However, this is not limited to this, and the printer management server 200 may be configured to transmit identification information of the printer 100 corresponding to the unauthorized communication to a notification destination (for example, an email address) of a pre-registered administrator or the like when unauthorized communication from a malicious user is confirmed.

[0093] Note that, in steps S7010 to S7012 of FIG. 7 and steps S8010 to S8012 of FIG. 8, it is possible that the spoofing check job sent by the printer management server 200 via the MQTT protocol does not reach the printer 100 (for example, when an error occurs in the transmission via the MQTT protocol). It is also possible that the transmitted device usage information list cannot be received even after a certain period of time has passed since the transmission of the spoofing check job. In such cases, the printer management server 200 transmits information to the monitoring server 300, such as that the communication via the MQTT protocol did not reach the printer 100 or that the transmitted device usage information list could not be received even after a certain period of time has passed since the transmission of the spoofing check job, along with the identification information of the printer 100. Note that the transmission method is the same as in steps S8023 and S8024 of FIG. 8, but the above information may also be sent to a notification destination (for example, an email address) of a pre-registered administrator or the like.

[0094] According to each embodiment described above, by performing a spoofing check at the management server using a communication method different from that used when transmitting device usage information, it is possible to perform a more secure spoofing check and to determine with high accuracy whether information has been fraudulently transmitted by spoofing. In this way, even if device usage information or the like that has been fraudulently transmitted by a malicious user through "spoofing" is received, it is possible to detect that this information has been fraudulently transmitted. In other words, it is possible to build a system with improved security against spoofing.

[0095] It goes without saying that the configurations and contents of the various data described above are not limited to those described above, and that the data may be configured in various configurations and contents depending on the application and purpose. Although one embodiment has been described above, the present invention can be embodied as, for example, a system, an apparatus, a method, a program, a storage medium, etc. Specifically, the present invention may be applied to a system made up of multiple devices, or may be applied to an apparatus made up of a single device. Furthermore, the present invention also includes any combination of the above embodiments.

[0096] Other Embodiments The present invention can also be realized by supplying a program that realizes one or more functions of the above-described embodiments to a system or device via a network or a storage medium, and having one or more processors in the computer of the system or device read and execute the program.The present invention can also be realized by a circuit (e.g., ASIC) that realizes one or more functions. Furthermore, the present invention may be applied to a system made up of multiple devices, or to an apparatus made up of a single device. The present invention is not limited to the above-described embodiments, and various modifications (including organic combinations of the embodiments) are possible based on the spirit of the present invention, and these modifications are not excluded from the scope of the present invention. In other words, all configurations that combine the above-described embodiments and their modifications are included in the present invention.

[0097] The disclosure of this embodiment includes the following configuration, method, and program. (Configuration 1) A system in which a device and a management server that manages the device can communicate with each other, The device comprises: a first transmission means for transmitting operation information of the device to the management server by a first communication method; a first storage means for storing a certain number of pieces of information transmitted to the management server by the first transmission means or pieces of information that can identify the information; a second transmission means for collecting information held in the first holding means and transmitting the information to the management server in response to receiving a predetermined request that has been push-notified from the management server using a second communication method different from the first communication method, The management server a first receiving means for receiving information by the first communication method; a second storage means for storing the information received by the first receiving means; a first notification means that sends a push notification of the predetermined request to the device using the second communication method, with the management server as the starting point; a second receiving means for receiving information transmitted from the device in response to the predetermined request; and a determination means for comparing the information received by the second receiving means with the information stored in the second storing means, and determining whether the information received by the first receiving means is invalid based on the result of the comparison. A system characterized by: (Configuration 2) The management server The system described in configuration 1 is characterized in that it has a control means that, when the determination means determines that the information is fraudulent, deletes from the second holding means the information received by the first receiving means between the notification of the specified request and the completion of the determination, and discards the information received by the first receiving means after the completion of the determination. (Configuration 3) The system described in configuration 1 or 2, characterized in that the determination means determines that the information received by the second receiving means is fraudulent if the information received is not a subset of the information stored in the second storing means. (Configuration 4) The system described in configuration 1 or 2, characterized in that the determination means compares the information received by the second receiving means with the same number of pieces of information corresponding to the device stored in the second storage means as the latest piece of information received by the second receiving means, and if there is no one-to-one correspondence between these pieces of information, determines that the information is invalid. (Configuration 5) 5. The system according to any one of configurations 1 to 4, wherein the first notification means performs the push notification when the information received by the first reception means satisfies a predetermined condition. (Configuration 6) The case where the predetermined condition is satisfied is: If the transmission frequency of the operation information from the transmission source of the information received by the first receiving means does not exceed the threshold value, If the information received by the first receiving means does not match the information of the device, If the address of the sender of the information received by the first receiving means does not match the address of the sender of the information corresponding to the device stored in the second storing means, The system according to configuration 5, wherein at least one of the following is true: (Configuration 7) 5. The system according to any one of configurations 1 to 4, wherein the first notification means performs the push notification at a predetermined cycle. (Configuration 8) The system according to any one of configurations 1 to 7, further comprising a second notification means for notifying a predetermined notification destination of information relating to the device when the determination means determines that the information is invalid. (Configuration 9) The system described in any one of configurations 1 to 8 is characterized in that it has a second notification means that notifies a predetermined notification destination of information about the device if notification by the first notification means fails or if reception by the second receiving means does not occur even after a certain period of time has passed since notification by the first notification means. (Configuration 10) 10. The system according to any one of configurations 1 to 9, wherein the second transmission means performs transmission using the first communication method or the second communication method. (Configuration 11) the predetermined request includes a designation of a period; 11. The system according to any one of configurations 1 to 10, wherein the second transmission means transmits information corresponding to a period designated in the predetermined request. (Configuration 12) 12. The system according to claim 11, wherein the period corresponds to a period after the determination is made by the determining means. (Configuration 13) 12. The system of claim 11, wherein the period is a fixed period. (Configuration 14) 14. The system according to any one of configurations 1 to 13, wherein the device is an image forming apparatus. (Configuration 15) 14. The system according to any one of configurations 1 to 13, wherein the device is an IoT (Internet of Things) device. (Configuration 16) A device capable of communicating with a management server, a first transmission means for transmitting operation information of the device to the management server by a first communication method; a storage means for storing a certain number of pieces of information transmitted to the management server by the first transmission means or pieces of information that can identify the information; a second transmission means for collecting information held in the holding means and transmitting the information to the management server in response to receiving a predetermined request that has been push-notified from the management server using a second communication method different from the first communication method; A device comprising: (Configuration 17) A management server for managing devices, a first receiving means for receiving information by a first communication method; a storage means for storing the information received by the first receiving means; a first notification means that sends a push notification of a predetermined request to the device using a second communication method different from the first communication method, with the management server as a starting point; a second receiving means for receiving information transmitted from the device in response to the predetermined request; a determination means for comparing the information received by the second receiving means with the information stored in the storage means, and determining whether the information received by the first receiving means is invalid based on the result of the comparison; The management server is characterized in that the specified request is a request to collect and send to the management server information that is stored in a certain number on the device and that has been sent from the device to the management server or information that can identify that information. (Configuration 18) The management server according to configuration 17, further comprising a control means for controlling, when the determination means determines that the information is fraudulent, to delete from the storage means the information received by the first receiving means between the notification of the specified request and the completion of the determination, and to discard the information received by the first receiving means after the completion of the determination. (Method 1) A method for controlling a system in which a device and a management server that manages the device can communicate with each other, comprising: Executed by the device, a first transmission step of transmitting operation information of the device to the management server by a first communication method; a first storage step of storing the information transmitted to the management server in the first transmission step or information that can identify the information in a first storage means in order to hold a certain number of the information; a second transmission step of collecting information held in the first holding means and transmitting the information to the management server in response to receiving a predetermined request that has been push-notified from the management server using a second communication method different from the first communication method, Executed by the management server, a first receiving step of receiving information using the first communication method; a second storage step of storing the information received in the first receiving step in a second holding means; a first notification step of sending a push notification of the predetermined request to the device using the second communication method, the first notification step being initiated by the management server; a second receiving step of receiving information transmitted from the device in response to the predetermined request; a determination step of comparing the information received in the second receiving step with the information stored in the second storage means, and determining whether the information received in the first receiving step is invalid based on the result of the comparison. A method for controlling a system. (Method 2) A method for controlling a device capable of communicating with a management server, comprising: a first transmission step of transmitting operation information of the device to the management server by a first communication method; a storage step of storing the information transmitted to the management server in the first transmission step or information that can identify the information in a storage means in order to hold a certain number of the information; a second transmission step of collecting information held in the holding means and transmitting the information to the management server in response to receiving a predetermined request that has been push-notified from the management server using a second communication method different from the first communication method; A device control method comprising: (Method 3) A method for controlling a management server that manages devices, comprising: a first receiving step of receiving information by a first communication method; a storing step of storing the information received in the first receiving step in a holding means for holding the information; a first notification step of, starting from the management server, notifying the device of a predetermined request by push notification using a second communication method different from the first communication method; a second receiving step of receiving information transmitted from the device in response to the predetermined request; a determination step of comparing the information received in the second receiving step with the information stored in the storage means, and determining whether the information received in the first receiving step is invalid based on the result of the comparison, A control method for a management server, characterized in that the specified request is a request to collect and transmit to the management server information that is stored in a certain number on the device and that has been sent from the device to the management server or information that can identify that information. (Program 1) A program for causing a computer to execute the control method described in Method 2. (Program 2) A program for causing a computer to execute the control method according to Method 3.

Claims

1. A system in which a device and a management server that manages the device can communicate with each other, The device comprises: a first transmission means for transmitting operation information of the device to the management server by a first communication method; a first storage means for storing a certain number of pieces of information transmitted to the management server by the first transmission means or pieces of information that can identify the pieces of information; a second transmission means for collecting information held in the first holding means and transmitting the information to the management server in response to receiving a predetermined request that has been push-notified from the management server using a second communication method different from the first communication method, The management server a first receiving means for receiving information by the first communication method; a second storage means for storing the information received by the first receiving means; a first notification means that sends a push notification of the predetermined request to the device using the second communication method, with the management server as the starting point; a second receiving means for receiving information transmitted from the device in response to the predetermined request; and a determination means for comparing the information received by the second receiving means with the information stored in the second storing means, and determining whether the information received by the first receiving means is invalid based on the result of the comparison. A system characterized by:

2. The management server The system described in claim 1 further comprises a control means for controlling, when the determination means determines that the information is fraudulent, to delete from the second storage means the information received by the first receiving means between the notification of the specified request and the completion of the determination, and to discard the information received by the first receiving means after the completion of the determination.

3. The system described in claim 1 or 2, characterized in that the determination means determines that the information received by the second receiving means is fraudulent if the information received is not a subset of the information stored in the second storage means.

4. The system described in claim 1 or 2, characterized in that the determination means compares the information received by the second receiving means with the same number of pieces of information corresponding to the device stored in the second storage means as the latest information received by the second receiving means, and if there is no one-to-one correspondence between these pieces of information, determines that the information is invalid.

5. 3. The system according to claim 1, wherein the first notification unit issues the push notification when the information received by the first reception unit satisfies a predetermined condition.

6. The case where the predetermined condition is satisfied is: If the transmission frequency of the operation information from the transmission source of the information received by the first receiving means does not exceed the threshold value, If the information received by the first receiving means does not match the information of the device, If the address of the sender of the information received by the first receiving means does not match the address of the sender of the information corresponding to the device stored in the second storing means, 6. The system according to claim 5, wherein at least one of the above is true.

7. 3. The system according to claim 1, wherein the first notification means performs the push notification at a predetermined interval.

8. 3. The system according to claim 1, further comprising a second notification unit that notifies a predetermined notification destination of information about the device when the determination unit determines that the information is invalid.

9. The system described in claim 1 or 2, characterized in that it has a second notification means that notifies a specified notification destination of information about the device if the first notification means fails to notify or if the second receiving means does not receive the notification even after a certain period of time has passed since the first notification means.

10. 3. The system according to claim 1, wherein the second transmission means performs transmission using the first communication method or the second communication method.

11. the predetermined request includes a designation of a period; 3. The system according to claim 1, wherein the second transmitting means transmits information corresponding to a period designated in the predetermined request.

12. 12. The system of claim 11, wherein the period of time corresponds to a period of time after the determination is made by the determining means.

13. The system of claim 11, wherein the period of time is a fixed period of time.

14. 3. The system according to claim 1, wherein the device is an image forming apparatus.

15. 3. The system according to claim 1, wherein the device is an Internet of Things (IoT) device.

16. A device capable of communicating with a management server, a first transmission means for transmitting operation information of the device to the management server by a first communication method; a storage means for storing a certain number of pieces of information transmitted to the management server by the first transmission means or pieces of information that can identify the information; a second transmission means for collecting information stored in the storage means and transmitting the information to the management server in response to receiving a predetermined request that has been push-notified from the management server using a second communication method different from the first communication method; A device comprising:

17. A management server for managing devices, a first receiving means for receiving information by a first communication method; a storage means for storing the information received by the first receiving means; a first notification means that sends a push notification of a predetermined request to the device using a second communication method different from the first communication method, the first communication method being initiated by the management server; a second receiving means for receiving information transmitted from the device in response to the predetermined request; a determination means for comparing the information received by the second receiving means with the information stored in the storage means, and determining whether the information received by the first receiving means is invalid based on the result of the comparison; The management server is characterized in that the specified request is a request to collect and send to the management server information that is stored in a certain number on the device and that has been sent from the device to the management server or information that can identify that information.

18. The management server according to claim 17, further comprising a control means for controlling, when the determination means determines that the information is fraudulent, to delete from the storage means the information received by the first receiving means between the notification of the specified request and the completion of the determination, and to discard the information received by the first receiving means after the completion of the determination.

19. A method for controlling a system in which a device and a management server that manages the device can communicate with each other, comprising: Executed by the device, a first transmission step of transmitting operation information of the device to the management server by a first communication method; a first storage step of storing the information transmitted to the management server in the first transmission step or information that can identify the information in a first storage means in order to hold a certain number of the information; a second transmission step of collecting information held in the first holding means and transmitting the information to the management server in response to receiving a predetermined request that has been push-notified from the management server using a second communication method different from the first communication method, Executed by the management server, a first receiving step of receiving information by the first communication method; a second storage step of storing the information received in the first receiving step in a second storage means; a first notification step of sending a push notification of the predetermined request to the device using the second communication method, the first notification step being initiated by the management server; a second receiving step of receiving information transmitted from the device in response to the predetermined request; a determination step of comparing the information received in the second receiving step with the information stored in the second storage means, and determining whether the information received in the first receiving step is invalid based on the result of the comparison. A method for controlling a system.

20. A method for controlling a device capable of communicating with a management server, comprising: a first transmission step of transmitting operation information of the device to the management server by a first communication method; a storage step of storing the information transmitted to the management server in the first transmission step or information that can identify the information in a storage device in order to hold a certain number of the information; a second transmission step of collecting information stored in the storage means and transmitting the information to the management server in response to receiving a predetermined request that has been push-notified from the management server using a second communication method different from the first communication method; A device control method comprising:

21. A method for controlling a management server that manages devices, comprising: a first receiving step of receiving information by a first communication method; a storing step of storing the information received in the first receiving step in a holding means for holding the information; a first notification step of, starting from the management server, notifying the device of a predetermined request by push notification using a second communication method different from the first communication method; a second receiving step of receiving information transmitted from the device in response to the predetermined request; a determination step of comparing the information received in the second receiving step with the information stored in the storage means, and determining whether the information received in the first receiving step is invalid based on the result of the comparison, A control method for a management server, characterized in that the specified request is a request to collect and transmit to the management server information that is stored in a certain number on the device and that has been sent from the device to the management server or information that can identify that information.

22. A program for causing a computer to execute the control method according to claim 20.

23. A program for causing a computer to execute the control method according to claim 21.

Images