Image forming apparatus, information processing method, and program

Abstract

To increase the likelihood of preventing unauthorized execution of a program. [Solution] The image forming apparatus includes a determination unit that, when a process started in the image forming apparatus instructs the execution of a first program, refers to a list of information containing a string as identification information for each program permitted to be executed by the process, and determines whether or not to permit the execution of the first program; and an output control unit that outputs information indicating an abnormality when the execution of the first program is not permitted.

Description

Technical Field

[0001] The present invention relates to an image forming apparatus, an information processing method, and a program.

Background Art

[0002] Conventionally, as a security measure for devices, techniques for suppressing unauthorized execution of programs in devices have been studied.

[0003] For example, Patent Document 1 describes detecting tampering of an execution module using the hash value of the execution module and prohibiting execution of the tampered execution module.

Summary of the Invention

Problems to be Solved by the Invention

[0004] However, with the technique of Patent Document 1, it is difficult to cope with attacks (for example, overflow attacks) that cause an untampered program to be executed due to unauthorized access during operation of the device.

[0005] The present invention has been made in view of the above points, and an object thereof is to increase the possibility of avoiding unauthorized execution of a program.

Means for Solving the Problems

[0006] Therefore, to solve the above problems, when the execution of a first program is instructed by a process activated in the image forming apparatus, the image forming apparatus refers to list information including a character string as identification information of the program for each program whose execution is permitted by the process, and a determination unit that determines whether to permit the execution of the first program, and an output control unit that outputs information indicating an abnormality when the execution of the first program is not permitted.

Effects of the Invention

[0007] This can increase the likelihood of preventing unauthorized execution of the program. [Brief explanation of the drawing]

[0008] [Figure 1] This figure shows an example of a system configuration in an embodiment of the present invention. [Figure 2] This figure shows an example of the hardware configuration of the image forming apparatus 10 in the first embodiment. [Figure 3] This figure shows an example of the functional configuration of the image forming apparatus 10 in the first embodiment. [Figure 4] This is a sequence diagram illustrating an example of the processing procedure for starting up the image forming apparatus 10. [Figure 5] This is a sequence diagram illustrating an example of a processing procedure performed during the operation of the image forming apparatus 10. [Figure 6] This figure shows an example of a whitelist. [Figure 7] This figure shows an example of an anomaly detection file. [Figure 8] This figure shows an example of how the displayed information is shown. [Figure 9] This is a flowchart illustrating an example of the processing steps performed by kernel 18. [Figure 10] This figure shows a second example of a system configuration. [Modes for carrying out the invention]

[0009] Embodiments of the present invention will be described below with reference to the drawings. Figure 1 is a diagram showing an example of a system configuration in an embodiment of the present invention. In Figure 1, one or more terminals 20 are connected to the image forming apparatus 10 via a LAN (Local Area Network) or a network such as the Internet (whether wired or wireless).

[0010] The image forming apparatus 10 is a multifunction device that implements two or more functions, such as printing, scanning, copying, and fax transmission / reception, in a single housing. A device having any one of these functions individually may be used as the image forming apparatus 10. In this embodiment, it may be a printer having only a printing function, or a copier having only a copying function.

[0011] Terminal 20 is a computer equipped with input means such as a mouse, keyboard, buttons, or touch panel, and display means such as a liquid crystal display, and functions as a remote user interface to the image forming apparatus 10. A portable communication terminal such as a mobile phone, smartphone, tablet, or PDA (Personal Digital Assistance) may be used as terminal 20.

[0012] Figure 2 shows an example of the hardware configuration of the image forming apparatus 10 in the first embodiment. The image forming apparatus 10 shown in Figure 2 includes an operation panel 101, a printer 102, a scanner 103, a network interface 104, and a controller 110. The controller 110 includes a CPU (Central Processing Unit) 111, an eMMC (embedded Multimedia Card) 112, a DRAM (Dynamic Random Access Memory) 113, and an NVRAM (Non-Volatile Random Access Memory) 114.

[0013] The control panel 101 is a device that displays various information, such as function selection screens, and accepts input from the operator. Specifically, the control panel 101 includes a touch panel that combines display and operation functions, a numeric keypad that accepts input of setting values ​​related to image formation functions such as density setting conditions, or a start key that accepts instructions such as starting copying.

[0014] The printer 102 is a device that forms an image on a recording medium such as paper.

[0015] Scanner 103 is a device that reads an image of a sheet of paper by means of scanning processing by a sensor to generate image data.

[0016] Network I / F 104 is an interface for data communication using a communication network.

[0017] CPU 111 is a control device that controls various functions of the image forming apparatus 10. Specifically, CPU 111 reads out a program stored in eMMC 112 and executes various processes defined in the read program. CPU 111 incorporates a logic circuit that executes operations and a storage circuit called a register. The register is a storage area required for processing by the logic circuit, can be written to or read from at high speed, and has a small storage capacity.

[0018] eMMC 112 is a non-volatile memory and is a storage device that stores programs for realizing various functions.

[0019] DRAM 113 is a volatile memory and is a storage device used as a storage area for a RAMDISK capable of storing data in a file format under the control of CPU 111.

[0020] NVRAM 114 is a non-volatile memory and is a storage device that stores setting values and the like for various functions.

[0021] Figure 3 shows an example of the functional configuration of the image forming apparatus 10 in the first embodiment. In Figure 3, the image forming apparatus 10 includes a process startup unit 11, a system control unit 12, an anomaly monitoring unit 13, a web server unit 14, a copy control unit 15, a printer control unit 16, a scanner control unit 17, and a kernel 18. Each of these units is realized by a process in which one or more programs installed in the image forming apparatus 10 and stored in the eMMC 105 cause the CPU 111 to execute. The image forming apparatus 10 also utilizes a whitelist storage unit 121 and an anomaly detection file storage unit 122. The whitelist storage unit 121 is realized, for example, using the eMMC 112. The anomaly detection file storage unit 122 is realized, for example, using the DRAM 113 (RAMDISK). Since the DRAM 113 is volatile memory, the contents of the anomaly detection file storage unit 122 are lost when the power of the image forming apparatus 10 is turned off.

[0022] The process startup unit 11 starts various processes that function as the system control unit 12, abnormality monitoring unit 13, web server unit 14, copy control unit 15, printer control unit 16, and scanner control unit 17 when the image forming apparatus 10 is started. A process is a unit of processing managed by the OS (Operating System). Each process is uniquely identified by a process ID (Identifier). The process startup unit 11 is realized by the CPU 111 utilizing the functions of the OS. For example, the process startup unit 11 is equivalent to Systemd in Linux (registered trademark).

[0023] The process startup unit 11 also sets the whitelist stored in the whitelist storage unit 121 to the kernel 18 when the image forming apparatus 10 is started. The whitelist is an example of a list of information that includes a string as identification information for each program that is permitted to be executed by a process started in the image forming apparatus 10.

[0024] Kernel 18 is the kernel 18 of the OS (Operating System) of the image forming apparatus 10. Kernel 18 determines whether to allow (permit or deny) the execution of a program by each process. A program here refers to an executable program, also called an executable file or command. For example, each process can request the kernel 18 to execute any program via a system call. If kernel 18 determines that execution is not permitted, it records an abnormality detection file containing information indicating the detection of an abnormality (hereinafter referred to as "abnormality detection information") in the abnormality detection file storage unit 122. "Abnormality" means that the execution of an unauthorized program has been requested.

[0025] The anomaly monitoring unit 13 periodically monitors, for example, the recording of anomaly detection files in the anomaly detection file storage unit 122. When an anomaly detection file is recorded in the anomaly detection file storage unit 122, the anomaly monitoring unit 13 reads the information to be displayed (hereinafter referred to as "display information") from the anomaly detection file and writes the display information to the NVRAM 114. The anomaly monitoring unit 13 also notifies the system control unit 12 of the detection of an anomaly. The anomaly monitoring unit 13 is implemented by an anomaly detection process started by the process startup unit 11.

[0026] The system control unit 12 controls the entire embedded system of the image forming apparatus 10. The system control unit 12 is implemented by a system control process initiated by the process startup unit 11.

[0027] When the system control unit 12 receives notification of an anomaly detection from the anomaly monitoring unit 13, it reads the display information written to the NVRAM 114 and displays the display information on the operation panel 101.

[0028] The web server unit 14 is implemented by a process (httpd) that functions as a web server. The web server unit 14 performs processing in response to HTTP requests sent from the terminal 20.

[0029] The copy control unit 15 controls the copy process of the image forming apparatus 10. The printer control unit 16 controls the printing process of the image forming apparatus 10. The scanner control unit 17 controls the scanning process of the image forming apparatus 10.

[0030] The following describes the processing procedures performed by the image forming apparatus 10. Figure 4 is a sequence diagram illustrating an example of the processing procedure for starting up the image forming apparatus 10.

[0031] In step S101, the process startup unit 11 reads the whitelist from the whitelist storage unit 121. Subsequently, the process startup unit 11 sets the whitelist in the kernel 18 (S102).

[0032] Next, the process startup unit 11 constructs a RAMDISK using DRAM 113 and mounts it to the storage area of ​​DRAM 113 in order to make DRAM 113 function as an anomaly detection file storage unit 122 (S103). Mounting is a procedure that allows the OS to use the RAMDISK's file system, such as the mount command in Linux (registered trademark). This enables each process to write and read files to and from DRAM 113.

[0033] Next, the process startup unit 11 generates and starts a system control process that functions as the system control unit 12 (S104).

[0034] Next, the process startup unit 11 records a process ID for identifying the system control process (process startup unit 11) in the abnormality detection file storage unit 122 (S105).

[0035] Next, the process startup unit 11 generates and starts an abnormal termination monitoring process that functions as an abnormality monitoring unit 13 (S106).

[0036] Next, the process startup unit 11 generates and starts a network control process (hppd) that functions as a web server unit 14 (S107). Next, the process startup unit 11 generates and starts a copy control process that functions as a copy control unit 15 (S108). Next, the process startup unit 11 generates and starts a printer control process that functions as a printer control unit 16 (S109). Next, the process startup unit 11 generates and starts a scanner control process that functions as a scanner control unit 17 (S110). Each unit (process) started by the process startup unit 11 calls system calls at timings corresponding to the logic implemented within it (for example, S111, S112).

[0037] Next, an example of a processing procedure performed when the image forming apparatus 10 is in operation will be described. Figure 5 is a sequence diagram illustrating an example of a processing procedure performed when the image forming apparatus 10 is in operation. Here, we assume a scenario in which a buffer overflow attack is performed from terminal 20 to the web server unit 14 (httpd) via LAN.

[0038] In step S201, terminal 20 sends an attack request that causes a buffer overflow. Here, it is assumed that there is a vulnerability in the web server unit 14, and that a buffer overflow attack can be used to request the kernel 18 to execute an arbitrary program (S202). The request to execute an arbitrary program can be executed, for example, by calling the system() function with a string indicating the path name of the program to be executed as an argument. The system() function creates a child process using the fork() system call, and the child process can execute the program (hereinafter referred to as the "target program") by calling the execv() system call with the string indicating the path name as an argument.

[0039] The kernel 18 determines whether to allow or deny the execution of the program based on the whitelist set in step S102 of Figure 4 (S203).

[0040] Figure 6 shows an example of a whitelist. The whitelist shown in Figure 6 includes a line indicating whether execution is permitted or not for each program that is allowed to run for each process started in the image forming apparatus 10. The line for a program that is allowed to run includes a string as the program's identification information (here, the path name (absolute path name) of the file where the program is stored) and "Execution permitted". The line for a program that is not allowed to run includes a string as the program's identification information (here, the path name (absolute path name) of the file where the program is stored) and "Execution not permitted". A wildcard character (*) can be specified in the string as the program's identification information (program's path name). In the example in Figure 6, programs other than / system / scan, / system / printer, / system / control, and / system / httpd are marked as "Execution not permitted".

[0041] Kernel 18 allows the execution of the target program if the line containing a string (pathname) that matches the string specified as an argument to the system call (execv() in the example above) (the string that serves as the identification information for the target program) in the whitelist has "execute permission" set, and does not allow the execution of the target program otherwise.

[0042] A whitelist may be prepared for each process launched in the image forming apparatus 10. In this case, the kernel 18 can determine whether or not to allow the execution of the target program based on the whitelist corresponding to the Web server unit 14 in the above example.

[0043] If the kernel 18 determines that it should not allow the execution of the target program, it generates an error detection file in the error detection file storage unit 122 (S204) and returns an error to the web server unit 14 (S205).

[0044] Figure 7 shows an example of an anomaly detection file. The anomaly detection file shown in Figure 7 includes the date and time, the name of the target program, and the error number. The date and time is the date and time when the anomaly was detected (when the execution of the target program was requested). The name of the target program is the file path of the target program. The error number is the error number indicating that the system call could not be executed.

[0045] The filename of the anomaly detection file may have a format similar to the following:

[0046] / tmp / acc / <process ID>.acc_notify Here, <process ID> is the process ID of the process that requested the execution of the unauthorized program (in this example, the Web server process 14). Therefore, the anomaly detection file can be different for each process.

[0047] Meanwhile, the anomaly monitoring unit 13 repeatedly (for example, periodically) refers to the anomaly detection file storage unit 122 to monitor whether or not an anomaly detection file has been generated (S211-1 to S211-N). When the anomaly detection unit detects the generation of an anomaly detection file, it obtains the display information to be displayed from the anomaly detection file (S212), and obtains the process ID of the system control unit 12 (hereinafter referred to as the "system control process ID") recorded in the anomaly detection file storage unit 122 in step S105 of Figure 4 (S213). Subsequently, the anomaly monitoring unit 13 writes the display information to the RAMDISK (S214) and notifies the system control unit 12, which is the process related to the system control process ID, of the detection of an anomaly (S215).

[0048] The system control unit 12, in response to notification of an anomaly detection, acquires display information from the RAMDISK (S216). Subsequently, the system control unit 12 outputs (displays) the display information on the operation panel (S217).

[0049] Figure 8 shows an example of how display information is shown. In Figure 8, an example is shown where the target file name, among the information recorded in the anomaly detection file (Figure 7), is used as display information. By displaying this information, the user can be notified that an anomaly has occurred (that the image forming apparatus 10 has been attacked from an external source).

[0050] Next, the system control unit 12 assigns a processed flag to the display information stored in the RAMDISK, indicating that it has been notified to the user (S218). In step S216, the system control unit 12 acquires display information that does not have the processed flag assigned to it.

[0051] Next, we will explain in detail the processing steps that kernel 18 executes in the sequence diagram of Figure 4. Figure 9 is a flowchart illustrating an example of a processing step that kernel 18 executes.

[0052] In step S301, a decision is made on whether to allow or deny the execution of the target program based on the whitelist (Figure 6) set in step S102 in Figure 4.

[0053] If the target program is set to "execute permission" in the whitelist (Figure 6) (Yes in S302), kernel 18 executes the target program (S303).

[0054] If the target program is not set to "execution permission" in the whitelist (Figure 6) (No in S302), the kernel 18 generates an anomaly detection file (Figure 7) in the anomaly detection file storage unit 122 (S304).

[0055] As described above, according to this embodiment, even if an attempt is made to illegally execute a program (the first program) due to a buffer overflow attack or the like, the image forming apparatus 10 refers to a list of information (whitelist) containing a string as identification information for each program that is permitted to be executed by a process started in the image forming apparatus 10, and determines whether or not to allow the execution of the first program. If the execution of the first program is not permitted, information indicating an abnormality is output. Therefore, the possibility of avoiding the illegal execution of the program can be increased. In addition, the user can be notified that there is a possibility of an attack.

[0056] Note that the system configuration example shown in Figure 1 may be modified as shown in Figure 10. Figure 10 shows a second system configuration example.

[0057] In Figure 10, the same reference numerals are used for parts identical to those in Figure 1, and their descriptions are omitted. In Figure 10, the image forming apparatus 10 is further connected to a server device 30 via a network such as a LAN or the Internet. The server device 30 is composed of one or more general-purpose computers.

[0058] In the case of Figure 10, the system control unit 12 of the image forming apparatus 10 transmits display information to the server device 30 before and after step S217 in Figure 4. That is, information indicating that an abnormality has occurred may not only be displayed on the operation panel 101, but may also be transmitted externally via the network.

[0059] In this embodiment, kernel 18 is an example of a determination unit, and system control unit 12 is an example of an output control unit.

[0060] Furthermore, each function of the embodiments described above can be realized by one or more processing circuits. Hereinafter, "processing circuit" in this specification includes processors programmed to execute each function by software, such as processors implemented by electronic circuits, as well as devices such as ASICs (Application Specific Integrated Circuits), DSPs (digital signal processors), FPGAs (field programmable gate arrays), and conventional circuit modules designed to execute each of the functions described above.

[0061] Although embodiments of the present invention have been described in detail above, the present invention is not limited to these specific embodiments, and various modifications and changes are possible within the scope of the gist of the present invention as described in the claims.

[0062] Examples of the present invention are as follows:

[0063] <1> An image forming apparatus, When the execution of a first program is instructed by a process running in the image forming apparatus, a determination unit determines whether or not to allow the execution of the first program by referring to a list of information containing a string as identification information for each program permitted to be executed by the process, An output control unit that outputs information indicating an abnormality if the execution of the first program is not permitted, An image forming apparatus characterized by having the following features.

[0064] <2> The output control unit causes the information indicating the abnormality to be displayed on the operation panel of the image forming apparatus. The image forming apparatus according to claim 1, characterized in that it is the same as described in claim 1.

[0065] <3> The aforementioned list information is set for each process running in the image forming apparatus. Characterized by <1> or <2> The image forming apparatus described above.

[0066] <4> The image forming apparatus, When the execution of a first program is instructed by a process running in the image forming apparatus, a determination procedure is performed to determine whether or not to allow the execution of the first program by referring to a list of information containing a string as identification information for each program permitted to be executed by the process, An output control procedure that outputs information indicating an abnormality if the execution of the first program is not permitted, An information processing method characterized by performing the following.

[0067] <5> In an image forming apparatus, When the execution of a first program is instructed by a process running in the image forming apparatus, a determination procedure is performed to determine whether or not to allow the execution of the first program by referring to a list of information containing a string as identification information for each program permitted to be executed by the process, An output control procedure that outputs information indicating an abnormality if the execution of the first program is not permitted, A program to execute. [Explanation of Symbols]

[0068] 10 Image forming apparatus 20 devices 30 Server Devices 11 Process startup section 12 System Control Unit 13 Abnormality monitoring section 14 Web Server Section 15 Copy Control Unit 16 Printer Control Unit 17 Scanner Control Unit 18 kernels 101 Control Panel 102 Printers 103 Scanner 104 Network I / F 110 Controller 111 CPU 112 eMMC 113 DRAM 114 NVRAM 121 Whitelist Storage Unit 122 Anomaly detection file storage unit [Prior art documents] [Patent Documents]

[0069] [Patent Document 1] Japanese Patent Publication No. 2023-129643

Claims

1. An image forming apparatus, When the execution of a first program is instructed by a process running in the image forming apparatus, a determination unit determines whether or not to allow the execution of the first program by referring to a list of information containing a string as identification information for each program permitted to be executed by the process, An output control unit that outputs information indicating an abnormality when the execution of the first program is not permitted, An image forming apparatus characterized by having the following features.

2. The output control unit causes the information indicating the abnormality to be displayed on the operation panel of the image forming apparatus. The image forming apparatus according to feature 1.

3. The aforementioned list information is set for each process running in the image forming apparatus. The image forming apparatus according to feature 1.

4. The image forming apparatus, When the execution of a first program is instructed by a process running in the image forming apparatus, a determination procedure is performed to determine whether or not to allow the execution of the first program by referring to a list of information containing a string as identification information for each program permitted to be executed by the process, An output control procedure that outputs information indicating an abnormality if the execution of the first program is not permitted, An information processing method characterized by performing the following.

5. In an image forming apparatus, When the execution of a first program is instructed by a process running in the image forming apparatus, a determination procedure is performed to determine whether or not to allow the execution of the first program by referring to a list of information containing a string as identification information for each program permitted to be executed by the process, An output control procedure that outputs information indicating an abnormality if the execution of the first program is not permitted, A program to execute.

Images