Information processing device, control method for information processing device, control program, recording medium

Abstract

Performing a recovery operation on an information processing device to reset it to its factory default state will also reset the reconfigured authentication information, resulting in a default authentication information state that is vulnerable from a security standpoint. [Solution] In an information processing device having an authentication function based on authentication information, even when a recovery is performed to reset to the factory default state, the authentication information that has been updated from the factory default state is not reset to the factory default authentication information.

Description

Technical Field

[0002] ,

[0001] The present invention relates to authentication management of an information processing apparatus.

Background Art

[0002] The administrator authority of an information processing apparatus is given by authenticating as an administrator user. The authentication is generally performed by inputting authentication information consisting of a username and a password.

[0003] At the time of shipment of this information processing apparatus, default values are set for this authentication information, and the values are often known as described in a manual or the like.

[0004] Since such authentication information in the default state is vulnerable in terms of security, it is recommended to reset the authentication information. [[ID=2I]]

[0005] Therefore, a method (Patent Document 1) has been devised to save an operation log until the authentication information is changed after initialization and verify an unauthorized operation.

Prior Art Documents

Patent Documents

[0006]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0007] However, in the above Patent Document 1, when the information processing apparatus executes recovery to initialize it to the state at the time of factory shipment, the reset authentication information is also initialized, resulting in authentication information in a vulnerable default state in terms of security.

Means for Solving the Problems

[0008] The present invention is an information processing apparatus having an authentication function by authentication information, The system has a recovery execution means for resetting to the factory default state, and the recovery execution means does not reset the authentication information that has been updated from the factory default state to the authentication information of the factory default state. It is characterized by the following: [Effects of the Invention]

[0009] According to the present invention, even when a recovery is performed on the information processing device to initialize it to its factory default state, the reconfigured authentication information is not reset, thus avoiding the default state of authentication information which is vulnerable from a security standpoint. [Brief explanation of the drawing]

[0010] [Figure 1] This is a schematic diagram showing an example of the hardware configuration of an information processing device. [Figure 2] This is a schematic diagram of the software configuration on an information processing device. [Figure 3] This is a schematic diagram showing the functional configuration of an information processing device. [Figure 4] This is an example of a settings screen displayed by the information processing device according to Example 1. [Figure 5] This is an example of an authentication screen displayed by the information processing device according to Example 1. [Figure 6] This is an example of an initialization operation screen displayed by the information processing device according to Example 1. [Figure 7] This is an example of data stored by the information processing device according to Example 1. [Figure 8] This is an example of authentication information held by the information processing device according to Example 1. [Figure 9] This is a flowchart of the authentication process performed by the information processing device according to Example 1. [Figure 10] This is a flowchart of the initialization process performed by the information processing device according to Example 1. [Figure 11] This is a flowchart of the initialization process performed by the information processing device according to Example 2. [Figure 12]It is a flowchart of a process for initializing an information processing apparatus according to Example 3. [Figure 13] It is a flowchart�lowchart of a process for initializing an information processing apparatus according to Example 4. [Figure 14] It is an example of a screen for updating authentication information of an information processing apparatus according to Example 1. [Figure 15] It is a schematic diagram showing an example of the hardware configuration of an information processing apparatus according to Example 3. [Figure 16] It is a schematic diagram of the software configuration configured on the information processing apparatus according to Example 3.

Modes for Carrying Out the Invention

[0011] Hereinafter, modes for carrying out the present invention will be described with reference to the drawings.

[0012] <Example 1> The configuration of the hardware and the system in the present invention will be described. FIG. 1 is a diagram showing an example of the hardware configuration of a general information processing apparatus 100. As shown in FIG. 1, the information processing apparatus 100 includes a CPU 11 as a hardware configuration.

[0013] The CPU 11 performs processing based on programs corresponding to each of the applications and program execution environments described later stored in the storage unit 13, thereby realizing each function or flowchart described later.

[0014] In addition, an input unit 12, a storage unit 13, a display unit 14, and an external connection IF 15 are connected to the CPU 11 via a bus 10. The input unit 12 is a keyboard and / or a mouse for inputting information. The storage unit 13 includes, for example, a ROM, a RAM, a hard disk device, etc., and stores data used in processing based on programs in addition to the above-described programs. The display unit 14 is a display for displaying a screen or the like. The external connection IF 15 is a network interface and various connection interfaces to external devices.

[0015] Furthermore, the CPU 11 can function as various means by executing a program. Control circuits such as ASICs operating in cooperation with the CPU 11 may also function as these means. Alternatively, these means may be realized through the cooperation of the CPU 11 and a control circuit that controls the operation of the information processing device 100. Also, the CPU 11 does not need to be a single entity; there may be multiple CPUs.

[0016] In this case, multiple CPUs 11 can perform processing in a distributed manner. Furthermore, multiple CPUs 11 may be located in a single computer, or they may be located in multiple physically different computers. The means by which the CPUs 11 execute programs may also be implemented by dedicated circuits.

[0017] Next, the system configuration to be built on the information processing device 100 will be explained using Figure 2. Figure 2 is a diagram showing an example of the system configuration of the information processing device 100. The operating system 201 (hereinafter referred to as OS201) is the software that forms the foundation of the entire system. Program 202 is software that runs on OS201. This system configuration is similar to that of a typical computer.

[0018] Figure 3(a) shows the configuration of the functions of the information processing device 100. The information processing device 100 includes a recovery execution unit 301 that resets the device to an initial state equivalent to that of the factory default (factory default state). Generally, clearing the database of the information processing device 100 will return it to the same state as the factory default.

[0019] Furthermore, the information processing device 100 has an authentication function using authentication information and includes an authentication information management unit 302 for managing the authentication information. While it is common to use a username and password string for inputting authentication information, a four-digit number or gesture input on a touch panel may also be used. Hereafter, authentication information will be described as a username and password string.

[0020] Figure 4 shows an example of a screen displayed by the information processing device 100. This screen may be displayed on the display screen of the information processing device 100, or it may be displayed when the information processing device 100 is accessed via a web browser from a PC or smartphone. In Figure 4, 401 is the frame of the entire display screen. 402, 403, and 404 in Figure 4 are the operation menus of the information processing device 100. In the example in Figure 4, 403 is selected, and details of 403 are displayed in area 405 at the bottom of the screen.

[0021] Furthermore, operating instructions and hints are displayed in area 406. Since allowing anyone to configure the various settings of the information processing device 100 would pose a risk of information leakage and other problems, authentication is required before any configuration operations can be performed.

[0022] Figure 5 shows an example of an authentication screen displayed by the information processing device 100. This screen is displayed when the user selects menu item 403 or an item requiring authentication from item 405. Area 405 displays 501, which is the input field for the username of the authentication information, 502, which is the input field for the password, and 503, which is the login button to perform authentication.

[0023] Information processing devices are typically configured with default authentication information at the time of shipment, and this default authentication information is usually documented in the product manual. This default authentication information is the initial setting and is applied during factory resets or device resets.

[0024] Because the default authentication credentials pose a security risk, users can change their credentials. A typical screen for changing authentication credentials is shown in Figure 14. In Figure 14, the user enters a new username in 1401, a new password in 1402, and presses button 1403 to complete the change. The changed data is saved in the database. Figure 8 shows an example of the data saved in the database.

[0025] Next, the details of the data held by the information processing device 100 will be explained using Figure 7. The memory unit 13 stores the recovery farm 701, which consists of the OS 201 and the execution program for program 202 of the information processing device. The OS 201 and program 202 of the information processing device 100 are initialized by loading this recovery farm into the area that is read when the information processing device starts up. Generally, the recovery farm 701 is often stored in the ReadOnly area of ​​the memory unit 13, but there are no particular restrictions.

[0026] Furthermore, the ReadWrite area of ​​the storage unit 13 stores the database 702. The authentication information data and network settings mentioned above in Figure 8 are stored in the database 702. In addition, the authentication information 703 for post-initialization, which is necessary in this embodiment, is also stored there. The authentication information 703 for post-initialization may be a text file or it may be a database separate from the database 702.

[0027] Next, the process flow for authentication performed by the information processing device 100 will be explained using Figure 9. The flowchart in Figure 9 starts when a user performs an operation that requires authentication information.

[0028] First, the information processing device 100 displays the authentication screen shown in Figure 5 (S901). Then, the information processing device 100 checks whether the entered authentication information matches (S902).

[0029] The verification method is simple: the information processing device 100 compares the authentication information in the database shown in Figure 8 with the entered authentication information. In step S902, if the entered authentication information matches, the information processing device 100 permits authentication (S903). In step S902, if the entered authentication information does not match, the information processing device 100 denies authentication (S904).

[0030] Next, using Figure 10, we will explain the process flow in which the information processing device 100 performs initialization. When the user performs an operation to instruct initialization, the process in the flowchart of Figure 10 begins.

[0031] First, the information processing device 100 displays the authentication information update screen shown in Figure 6 (S1001). Figure 6 is an example of a screen displayed when the user instructs the information processing device 100 to perform initialization. This screen displays areas 601 and 602 for entering new authentication information to be applied after initialization. It also displays a button 604 for the user to start the initialization and a button 603 for the user to return to the operation without performing initialization.

[0032] The information processing device 100 then acquires the content entered on the screen shown in Figure 6 (S1002). The information processing device 100 then checks whether values ​​have been entered in areas 601 and 602 (S1003). If no values ​​have been entered in step S1003, the process ends without initialization.

[0033] If values ​​are entered in step S1003, the information processing device 100 saves those values ​​to the authentication information 703 for post-initialization (S1004). Then, the information processing device 100 deletes the database 702 (S1005).

[0034] Specifically, all tables in the database are cleared. By deleting the various settings and history of the information processing device 100 stored in database 702, the information processing device 100 is returned to the same state as when it was shipped from the factory. Then, the authentication information 703 for post-initialization saved in step S1004 is saved in database 702 (S1006). As a result of step S1006, the authentication information that the information processing device 100 verifies in step S902 is the authentication information entered on the screen in Figure 6.

[0035] Then, the information processing device 100 deletes the post-initialization authentication information 703 saved in step S1004 (step S1007). If necessary, the information processing device 100 may apply the recovery firmware 701 to itself in any of steps S1005, S1006, or S1007.

[0036] The above describes the process by which the information processing device 100 accepts registration of authentication information before recovery execution and automatically resets this authentication information after recovery.

[0037] <Example 2> In Example 1, in Figure 6, which shows the initialization operation screen for the information processing device 100, areas 601 and 602 for entering authentication information to be applied after initialization are displayed as blank. This makes it easy to enter new authentication information.

[0038] However, there are many cases where you want to initialize the information processing device 100, but retain only the current authentication information. Therefore, a method for easily retaining only the authentication information will be described as Example 2. When the user performs the operation to instruct initialization, the processing in the flowchart of Figure 11 begins.

[0039] First, the information processing device 100 obtains the configured authentication information (S1101). The most natural method of obtaining this information is from the database shown in Figure 8. Then, it displays the authentication information update screen shown in Figure 6 (S1102). However, the authentication information obtained in step S1101 is already entered into the authentication information input areas 601 and 602.

[0040] Then, the information processing device 100 acquires the content entered on the screen in Figure 6 (S1103). Then, the information processing device 100 checks whether values ​​have been entered in areas 601 and 602 (S1104). If values ​​have been entered, the information processing device 100 saves those values ​​to the authentication information 703 for post-initialization (S1105). Then, the information processing device 100 deletes the database 702 (S1106). Then, the information processing device 100 saves the authentication information 703 for post-initialization that was saved in step S1105 to the database 702 (S1107).

[0041] Then, the information processing device 100 deletes the authentication information 703 for post-initialization that was saved in step S1105 (step S1108).

[0042] The above describes a method for easily performing the operation of transferring only authentication information during the initialization process of the information processing device 100.

[0043] <Example 3> Example 1 described a method for users to set different authentication information than before. However, many users forget this different authentication information. An example of an information processing device that requires authentication for operation is one that has a function to print confidential business documents. In this configuration, when different authentication information is set, the authentication information can be printed and kept by the user, preventing problems caused by forgetting it.

[0044] Therefore, a method for printing authentication information and having the user retain it will be described as Example 3. Figure 15 is a diagram showing an example of the hardware configuration of the information processing device 100 according to Example 3. The information processing device 100 includes a printing unit 16 that performs printing. The system configuration built on the information processing device 100 will be explained using Figure 16. In addition to Figure 2, the OS 201 is configured to also control the printing unit 16. Figure 3(b) shows the configuration of the functions provided by the information processing device 100. The information processing device 100 includes a printing unit 303 that performs printing.

[0045] Next, the initialization process of the information processing device according to Example 3 will be explained using Figure 12. When the user performs an operation to instruct initialization, the process in the flowchart of Figure 12 begins.

[0046] First, the authentication information update screen shown in Figure 6 is displayed (S1201). Then, the information processing device 100 retrieves the information entered on the screen shown in Figure 6 (S1202). Next, the information processing device 100 checks whether values ​​have been entered in areas 601 and 602 (S1203). If values ​​have been entered, the information processing device 100 saves those values ​​to the authentication information 703 for post-initialization (S1204).

[0047] Then, the information processing device 100 prints and outputs those values ​​using the printing unit 303 (S1205). Then, the information processing device 100 deletes the database 702 (S1206). Then, the information processing device 100 saves the authentication information 703 for post-initialization, which was saved in step S1204, to the database 702 (S1207).

[0048] Then, the information processing device 100 deletes the authentication information 703 for post-initialization that was saved in step S1204 (step S1208).

[0049] The above describes a method for printing authentication information and allowing the user to retain it during the initialization process of the information processing device 100.

[0050] Even in the case of an information processing device that does not have a printing unit 303, the problem of users forgetting their authentication information can be prevented by sending the authentication information to an email address registered as an administrator (a method of notifying the user). In this embodiment, the user was notified via email to an external device via a communication means. However, the authentication information may also be displayed on the display means of an external device (for example, a terminal device such as a PC or smartphone) via a communication means.

[0051] <Example 4> In Example 1, if the authentication information after initialization was not entered in step S1003, the process was terminated without initialization. However, if the authentication information after initialization is not entered, applying the default authentication information and performing initialization would reduce the burden on the user.

[0052] Therefore, if the authentication information after initialization is not entered, a method for applying the default authentication information and performing initialization will be explained as Example 4 using Figure 13. When the user performs the operation to instruct initialization, the processing of the flowchart in Figure 13 begins.

[0053] First, the information processing device 100 displays the authentication information update screen shown in Figure 6 (S1301). Then, the information processing device 100 retrieves the information entered on the screen shown in Figure 6 (S1302). Next, the information processing device 100 checks whether values ​​have been entered in areas 601 and 602 (S1303). If values ​​have been entered, the information processing device 100 saves those values ​​to the authentication information 703 for post-initialization (S1304).

[0054] Then, the information processing device 100 deletes the database 702 (S1305). Then, the information processing device 100 saves the post-initialization authentication information 703 saved in step S1104 to the database 702 (S1306). Then, the information processing device 100 deletes the post-initialization authentication information 703 saved in step S1104 (S1307).

[0055] In step S1303, if no value is entered, the information processing device 100 saves the factory default authentication information to the post-initialization authentication information 703 (S1308). The factory default authentication information can be easily obtained from the recovery firmware 701 or the like.

[0056] The above describes how, in the initialization process of the information processing device 100, if no authentication information is entered after initialization, the default authentication information is applied to perform the initialization.

[0057] Furthermore, when initializing, the system may be configured to allow users to choose whether or not to revert the authentication information, which has been changed from the factory default settings, back to its factory default state. A selection button may be provided on the display of the information processing device.

[0058] If you choose to reset the authentication information, the authentication information will be set to its factory default state. If you choose not to reset the authentication information, the updated authentication information from the factory default state will be set as the authentication information.

[0059] <Other examples> Although embodiments have been described in detail above, the present invention can take the form of, for example, a system, apparatus, control method, control program, or recording medium (storage medium).

[0060] Specifically, it may be applied to a system consisting of multiple devices (for example, a host computer, interface devices, imaging devices, web applications, etc.), or it may be applied to a device consisting of a single device.

[0061] Furthermore, it goes without saying that the object of the present invention is achieved as follows: a recording medium (or storage medium) containing program code (computer program) of software that realizes the functions of the embodiments described above is supplied to a system or device. Such storage medium is, needless to say, a computer-readable storage medium.

[0062] Then, the computer (or CPU or MPU) of the system or device reads and executes the program code stored on the recording medium. In this case, the program code read from the recording medium itself realizes the function of the embodiment described above, and the recording medium on which the program code is recorded constitutes the present invention. [Explanation of Symbols]

[0063] 100 Information Processing Devices

Claims

1. In an information processing device having an authentication function based on authentication information, The system has a recovery execution means for resetting to the factory default state, and the recovery execution means does not reset the authentication information that has been updated from the factory default state to the authentication information of the factory default state. An information processing device characterized by the following features.

2. In the information processing apparatus according to claim 1, When performing recovery using the recovery execution means, the means includes a means for notifying the user of the updated authentication information from the factory default state. An information processing device characterized by the following features.

3. In the information processing apparatus according to claim 2, The means for notifying the user of the authentication information is a display means for displaying the authentication information, a printing means for printing the authentication information, or a communication means for notifying an external device of the authentication information. An information processing device characterized by the following features.

4. In the information processing apparatus described in claim 3, When performing the recovery, the system includes a selection means that allows the user to choose whether or not to reset the authentication information. An information processing device characterized by the following features.

5. In the information processing apparatus according to claim 4, If a user chooses to reset the authentication information, the means for notifying the user of the authentication information is: A display means for displaying the factory default authentication information, a printing means for printing the factory default authentication information, or a communication means for notifying an external device of the factory default authentication information. If the user chooses not to reset the authentication information, the means for notifying the user of the authentication information is: The means includes a display means for displaying the authentication information updated from the factory default state, a printing means for printing the authentication information updated from the factory default state, or a communication means for notifying an external device of the authentication information updated from the factory default state. An information processing device characterized by the following features.

6. In a control method for an information processing device having an authentication function based on authentication information, It has a recovery execution process that resets to the factory default settings. The recovery execution process does not reset the authentication information, which has been updated from the factory default state, to the factory default authentication information. A control method for an information processing device, characterized by the features described herein.

7. In a control program for an information processing device having an authentication function based on authentication information, The system includes a recovery execution step that resets to the factory default state, and the recovery execution step does not reset the authentication information that has been updated from the factory default state to the authentication information of the factory default state. A control program for an information processing device, characterized by the following features.

8. A recording medium for storing the program described in claim 7.

Images