Information processing device, program verification method and program

Abstract

To perform tampering detection on a last-in program.SOLUTION: An information processing apparatus refers to a correct answer value stored in a flash memory in advance to perform verification of a program stored in the flash memory, when storing an additional program in an HDD, stores a correct answer value corresponding to the additional program in the HDD, and in verification, refers to the correct answer value stored in the HDD to verify the additional program.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an information processing device and a program verification method and program. [Background technology]

[0002] Attacks that exploit software vulnerabilities, tamper with the software, and exploit computers have become a problem. One known countermeasure for such attacks is to store hash values ​​or signatures as the correct values ​​for the program in advance and then detect tampering. Another known method for preventing storage tampering itself is to check whether the command attempting to access the storage has been tampered with, and if so, allow access to the storage using that command (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Special issue 2011-86313 publication Summary of the Invention [Problem to be solved by the invention]

[0004] In the case of an information processing device that has a limited storage area and can add programs later, it is difficult to store in advance the correct values ​​for detecting tampering with the programs that are added later. Furthermore, the method in Patent Document 1 cannot prevent attacks such as tampering with the storage area while the power is turned off, and there are cases in which it is not a countermeasure.

[0005] The present invention has been made in consideration of the above-mentioned conventional examples, and aims to perform tamper detection on programs added later, even in an environment where it is difficult to store correct values ​​for tamper detection in advance. [Means for solving the problem]

[0006] In order to achieve the above object, the present invention has the following configuration. to According to the present invention, a verification means for verifying a native program stored in a first storage means by referring to a correct answer value stored in advance in the first storage means; Additional Programs and an application including a corresponding correct answer value and a digital signature corresponding to the correct answer value. of 、 When storing the data in a second storage means different from the first storage means, If the verification using the digital signature of the application and the verification using the digital signature corresponding to the correct value are successful, Corresponding to the additional program The aforementioned Correct answer and a digital signature corresponding to the correct answer value, and the application and a digital signature corresponding to the application. additional means for storing the above in the second storage means; and The verification means for verifying the native program not only verifies the native program stored in the first storage means, but also verifies the additional program by referring to the correct answer value stored in the second storage means. death, When the application is started, the additional program included in the application is placed in the second storage means in an executable manner. R An information processing device characterized by the above features is provided. [Effects of the Invention]

[0007] According to the present invention, even in an environment where it is difficult to store correct values ​​for tamper detection in advance, it is possible to perform tamper detection on a program added later. [Brief explanation of the drawings]

[0008] [Figure 1] Multifunction printer hardware configuration diagram [Figure 2] Multifunction printer software configuration diagram [Figure 3A] , [Figure 3B] , [Figure 3C] , [Figure 3D] , [Figure 3E] , [Figure 3F] Flowchart of the process performed by the multifunction device to detect tampering when it starts up [Figure 4]Schematic diagram of a Java program and its signature DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. Note that the following embodiments do not limit the scope of the invention claimed. Although multiple features are described in the embodiments, not all of these multiple features are necessarily essential to the invention, and multiple features may be combined arbitrarily. Furthermore, in the accompanying drawings, the same reference numerals are used to designate the same or similar components, and redundant explanations will be omitted.

[0010] Further, the information processing apparatus according to the embodiment will be described taking a multifunction peripheral (digital multifunction peripheral / MFP / Multi Function Peripheral) as an example, however, the scope of application is not limited to multifunction peripherals and may be any information processing apparatus.

[0011] [Embodiment 1] ●Hardware FIG. 1 is a block diagram illustrating the hardware configuration of a multifunction peripheral 100 according to the first embodiment.

[0012] The CPU (also called a processor) 101 executes the software program of the multifunction peripheral 100 and controls the entire device. In this example, the CPU 101 is treated as a single unit, but it may be configured with multiple processors. The ROM 102 is a read-only memory that stores the boot program and fixed parameters of the multifunction peripheral 100. The RAM 103 is a random access memory that is used to store programs and temporary data when the CPU 101 controls the multifunction peripheral 100. The HDD 104 is a hard disk drive that stores later-installed programs and various data. The flash memory 114 stores the minimum programs necessary for the operation of the multifunction peripheral 100, including the BIOS, loader, and kernel. It also holds a supervised value list and a supervised value list signature used for tamper detection. The flash memory 114 may be connected via an interface such as a serial ATA (SATA) and may be fixed, or may be removable / installable. The flash memory 114 can store programs and data as files in a format similar to that of a hard disk.

[0013] The network I / F control unit 105 controls the transmission and reception of data to and from the network 113. The scanner I / F control unit 106 controls the reading of documents by the scanner 111. The printer I / F control unit 107 controls printing processes by the printer 110, etc. The panel control unit 108 controls the touch panel type operation panel 112, and controls the display of various information and the input of instructions from the user. The bus 109 interconnects the CPU 101, ROM 102, RAM 103, HDD 104, network I / F control unit 105, scanner I / F control unit 106, printer I / F control unit 107, panel control unit 108, and flash memory 114. Control signals from the CPU 101 and data signals between the devices are transmitted and received via this bus 109.

[0014] ●Software 2 is a block diagram illustrating software modules included in the multifunction peripheral 100 according to the first embodiment. All of these software modules are assumed to be processed by the CPU 101.

[0015] The communication management unit 207 controls the network I / F control device 105 connected to the network 113 to transmit and receive data to and from the outside via the network 113 .

[0016] The UI control unit 203 receives input to the operation panel 112 via the panel control unit 108, and performs processing according to the input and outputs the screen to the operation panel 112.

[0017] The boot program 200 is a program stored in the ROM 102, and is the first program executed by the CPU 101 when the multifunction peripheral 100 is powered on. During the startup process, the boot program 200 uses a BIOS tampering detection processor 206 to detect tampering of the BIOS 201 stored in the flash memory 114.

[0018] The BIOS 201 is a program that is executed after the processing of the boot program 200 is completed, and is a program that is read from the flash memory 114 into the RAM 103 and executed. During the startup process, the BIOS 201 uses a loader tampering detection processing unit 202 to detect tampering of the loader 210 stored in the flash memory 114.

[0019] The loader 210 is a program that is executed after the processing of the BIOS 201 is completed, and is a program that is read from the flash memory 114 into the RAM 103 and executed. During the startup process, the loader 210 uses a kernel tampering detection processing unit 211 to perform tampering detection processing on the kernel 212 stored in the flash memory 114.

[0020] The kernel 212 is a program that is executed after the processing of the loader 210 is completed, and is a program that is read from the flash memory 114 into the RAM 103 and executed. In addition to performing startup-related processing, the kernel 212 also has a native tampering detection processor 205 that detects tampering of the native program 213. The native tampering detection processor is also called a program tampering processor.

[0021] The native programs 213 are programs executed by the CPU 101 and consist of multiple programs that provide each function of the multifunction peripheral 100. For example, these include programs that control the scanner IF controller 106 and printer IF controller 106, and a startup program. The kernel 212 calls the startup program from among the native programs and performs startup processing. The native programs 213 may be stored in the flash memory 114 and loaded into the RAM 103 for execution. Furthermore, the native programs 213 may be provided via communication and added to the HDD 104, i.e., additionally installed. Additional programs that are installed are also called additional programs. Functions provided by native programs can be used, for example, from a Java (registered trademark, omitted below) program 214. One of the native programs 213 includes a Java program management unit 204, but in this example, the Java program management unit 204 is not additionally installed, but is installed in the flash memory 114 at the time of product shipment.

[0022] The Java program 214 is a program executed by the CPU 101, added by the user after product shipment, and stored in the HDD 104 as a program to be used. It may be provided after product shipment via communication, for example. A Java program is also called an application or a bundle. To install the Java program 214, authentication using an installation license file is required. The license file may include, for example, a digital signature, and in this case, the license is authenticated by verifying the signature, allowing installation.

[0023] When a Java program is added later by a user, Java program management unit 204 uses the signature to verify that the program is legitimate, and if successful, records it on HDD 104. Java program management unit 204 also launches the Java program in response to a startup program instruction.

[0024] ●Processing when starting up a multifunction device First, the process of the multifunction peripheral 100 performing tamper detection at startup in a state where the later-installed Java program 214 is not present will be described with reference to the flowchart of FIG. 3A.

[0025] When the multifunction peripheral 100 is powered on, the CPU 101 executes the boot program 200 stored in the ROM 102, the BIOS 201 stored in the flash memory 114, the loader 210, and the kernel 212 in that order.

[0026] When the multifunction peripheral 100 is powered on, the boot program 200 is executed by the CPU 101 from the ROM 102, and instructs the BIOS tampering detection processor 206 to perform tampering detection processing. Upon receiving the instruction, the BIOS tampering detection processor 206 performs tampering detection processing of the BIOS 201 through signature authentication using the BIOS 201 and the signature for the BIOS 201 stored in the flash memory 114 (S300). If the BIOS signature verification fails as a result, the boot program 200 displays an error message on the operation panel 112 (S308). If the signature verification is successful, the boot program 200 reads the BIOS 201 from the flash memory 114 into the RAM 103 and executes it.

[0027] When the BIOS 201 starts up, it performs various initialization processes and then instructs the loader tampering detection processing unit 202 to perform tampering detection processing. Upon receiving the instruction, the loader tampering detection processing unit 202 performs signature verification using the loader 210 stored in the flash memory 114 and the signature for the loader (S301). If the signature verification fails as a result, the BIOS 201 displays an error message on the operation panel 112 (S308). If the signature verification is successful, the BIOS 201 reads the loader 210 from the flash memory 114 to the RAM 103 and executes it. When the loader 210 starts up, it performs various initialization processes and then instructs the kernel tampering detection processing unit 211 to perform tampering detection processing. Upon receiving the instruction, the kernel tampering detection processing unit 211 performs signature verification using the kernel 212 stored in the flash memory 114 and the signature for the kernel (S302). If the signature verification fails as a result, the loader 210 displays an error message on the operation panel 112 (S308). If the signature verification is successful, the loader 210 loads the kernel 212 from the flash memory 114 into the RAM 103 and executes it.

[0028] After performing various initialization processes, the kernel 212 instructs the native tampering detection processor 205 to perform tampering detection. Upon receiving the instruction, the native tampering detection processor 205 performs signature verification of the supervised value list stored in the flash memory 114 (S303). Table 1 is a schematic diagram of the supervised value list. The supervised value list is a list in which the location of each program stored in the flash memory 114 is associated with the hash value of each program. The supervised value list and signature are created by an external information processing device, written to the flash memory 114 together with the corresponding program, and updated. [Table 1] Program location hash value / lib / aaa.so e3b0c44298fc1c1... / lib / bbb.so 1047ee5d71e7d8... / usr / bin / ccc.out 73aeec9e373455... ....

[0029] As a result of the verification, if the signature verification of the correct answer value list fails, the native tampering detection processing unit 205 instructs the UI control unit 203 to display an error message on the operation panel 112 in S308.

[0030] If the signature verification of the supervised value list is successful, the native tampering detection processing unit 205 calculates the hash value of the corresponding program, for example, the program stored in the flash memory 114, based on the information on the program location in the supervised value list. Here, hash values ​​are calculated for all programs included in the supervised value list. It is determined whether the calculated hash value matches the corresponding hash value stored in the supervised value list (S304), and if there is a mismatch, the process of S308 is performed. In other words, an error message is displayed.

[0031] On the other hand, if the hash values ​​of all programs match the hash values ​​in the correct value list, the native tampering detection processing unit 205 notifies the kernel 212 of the success of signature verification, and the kernel 212 starts the native program 213 (S305), which also starts the Java program management unit 204, which is one of the native programs 213.

[0032] The started Java program management unit 204 verifies each of the Java programs 214 stored in HDD 104 using the signatures stored in HDD 104 (S306). If the verification fails, Java program management unit 204 instructs UI control unit 106 to display an error message on operation panel 112 (S308). On the other hand, if the verification is successful, that is, if the authentication of the installation license is successful, the successfully verified Java program 214 is executed.

[0033] ●Verification of conventional Java programs Next, a conventional process for adding a Java program 214 later in such a multifunction peripheral 100 will be described with reference to the flowchart of FIG. 3B.

[0034] When an instruction to install a Java program is received from a user via network 113, Java program management unit 204 uses the received Java program and signature to verify whether the Java program has been tampered with (S320). The signature used here is used to determine whether the Java program is legitimate. This signature is assigned by the multifunction device vendor to Java programs that have passed an inspection outside multifunction device 100 (for example, an inspection to determine whether the program is malicious, etc.). This signature corresponds to the installation license mentioned above.

[0035] If the Java program has been tampered with, Java program management unit 204 instructs UI control unit 203 to display an error message on operation panel 112 (S324). If the Java program has not been tampered with, Java program management unit 204 stores Java program 214 and the signature used for verification in step S320 in HDD 104 (S321). Java program management unit 204 then executes Java program 214 (S322). It is assumed here that the public key for verifying the signature assigned to the Java program has been stored in advance in HDD 104.

[0036] In the multifunction peripheral 100 configured as described above, suppose a Java program 214 is installed that expands and stores a native program on the HDD 104 at startup and executes the native program when the Java program is started. In this case, every time the multifunction peripheral 100 is started, the native program recorded in the flash memory 114 is checked for tampering in S304, but the native program recorded on the HDD 104 is executed without being detected as having been tampered with. This poses a problem in that it may be possible to tamper with the multifunction peripheral 100 by tampering with the native program recorded on the HDD 104.

[0037] Verification of later-inserted Java programs in embodiment 1 Among the processes for solving this problem, the installation process of a Java program in this embodiment will first be described using the flowchart in Figure 3C. The processes of S320, S321, S322, and S324 are the same as those in Figure 3B, so their description will be omitted. In this method, when examining whether a signature is to be assigned to a Java program, it is determined whether a native program is included as a target for installation. If included, the correct value list of the native program to be installed and the signature of the correct value list are assigned to the Java program.

[0038] Fig. 4(a) is a schematic diagram of a Java program and signature that does not include a native program. On the other hand, Fig. 4(b) is a schematic diagram of a Java program 404 that includes a native program. The Java program 404 is distributed in a state that includes a native program 400, a list of correct answers 401 that corresponds to the native program 400, and a signature 402 of the list of correct answers 401. In either case, the signature is attached to the Java program.

[0039] In Fig. 3C, the Java program management unit 204 verifies the signature of the Java program in S320. The target of the verification is the Java program 404, and if the native program 400, the correct value list 401, and the signature 402 of the correct value list are included, they are also subject to verification. If the signature verification is successful, it is determined in S330 whether the Java program to be installed includes a native program. The presence or absence of a native program may be determined, for example, by including information indicating the presence or absence in the Java program and testing this. If a native program is not included, the process of S321 is performed. In this case, the process is the same as that of Fig. 3B.

[0040] On the other hand, if a native program is included, in S331 the Java program management unit 204 performs signature verification of the supervised value list 401 included together with the native program 400. Here, it is assumed that the public key for verifying the signature 402 is stored in advance in the HDD 104. If the signature verification is successful and it is determined that the supervised value list 401 is correct, the Java program management unit 204 records (saves) the supervised value list 401 and the signature 402 of the supervised value list in the HDD 104 in S332. Subsequently, the Java program management unit 204 performs the process of S321 to record the Java program 404 and its signature in the HDD 104.

[0041] After this, during the Java program startup process in S322, the Java program 404 extracts the native program 400 contained therein and records it executable on the HDD 104. Recording it executable may include, for example, registering the native program 400 in an execution environment such as an OS and setting it in a state where it can be scheduled in response to its invocation. Recording it executable may also be referred to as arranging it executable, or simply arranging it.

[0042] If the signature verification fails in step S331, the Java program management unit 204 proceeds to the process of S324, where it outputs a message corresponding to the error that has occurred.

[0043] Processing at startup of the multifunction device of this embodiment Next, with reference to Fig. 3D, the startup process of the multifunction peripheral 100 after the Java program 404 has been installed according to the procedure in Fig. 3C will be described. Fig. 3D is also applicable to cases where the Java program 404 has not been installed, and includes the procedure in Fig. 3A. Note that the same steps as in Fig. 3A are given the same reference numerals. The process from steps S300 to S304 is the same as in Fig. 3A, so a description thereof will be omitted.

[0044] If it is determined in step S304 that the hash value of the native program in the flash memory 114 matches the corresponding correct value, it is determined whether the native program is installed on the HDD 104 (S341). This determination may be made, for example, based on the presence or absence of a correct value list or the presence or absence of a correct value included in the correct value list. If it is determined that the native program is not installed on the HDD 104, the process branches to step S305. If it is determined that the native program is installed, the native tampering detection processing unit 205 performs signature verification of the correct value list using the correct value list 401 and signature 402 on the HDD 104 (S342).

[0045] If the signature verification fails, the native tampering detection processing unit 205 assumes that tampering has occurred and performs the process of S308. An error message regarding the error that occurred is output. If the signature verification is successful, the native tampering detection processing unit 205 calculates a hash value of the native program 400 stored in the HDD 104 based on the program location information written in the correct value list 401. The native tampering detection processing unit 205 determines whether the calculated hash value matches the value stored in the correct value list (S343). If they do not match, the native tampering detection processing unit 205 assumes that tampering has occurred and performs the process of S308. If they match, the native tampering detection processing unit 205 performs the processes from step S305 onwards. This process is similar to that shown in FIG. 3A, so its description is omitted. Note that in this embodiment, it is the native program in the flash memory 114 that is started in step S305, and the native program in the HDD 104 is not started here. The native program in the HDD 104 is started in response to the start of the Java program that calls it.

[0046] As described above, according to the first embodiment, even if a native program is installed together with a later-installed Java program, verification of these programs can be performed without omission. This makes it possible to detect tampering even in a configuration in which a later-installed Java program includes a native program and executes it.

[0047] In this embodiment, the explanation is given on the assumption that one Java program is installed, but if multiple Java programs are installed, a configuration may be adopted in which the correct answer list 401 and the signature 402 are saved for each program. In this case, if it is determined that some Java programs have been tampered with, a configuration may be adopted in which only the tampered Java programs are not started.

[0048] Furthermore, for the determination in step S341, an empty supervised value list 401 and a signature 402 may be stored in advance in the HDD 104. In this case, if an empty supervised value list 401 and a signature 402 are stored on the HDD, it may be determined that a native program is not installed on the HDD.

[0049] Furthermore, if the hash values ​​do not match in S343, the Java program stored in HDD 104 may be deleted along with the corresponding native program. In the startup process of Java program 404 in step S307, a process is run to store the native program used by it, stored in HDD 104, in an executable state on HDD 104. Therefore, if Java program 404 is deleted, the native program suspected of having been tampered with will not be executed. This allows the program to operate in an untampered state.

[0050] [Embodiment 2] In the method of the first embodiment, it is necessary to add a correct value list 401 and a correct value list signature 402 to a Java program 404 including a native program 400 outside the multifunction device 100. This poses a problem that the multifunction device 100 cannot complete the processing by itself.

[0051] In the second embodiment, the multifunction peripheral 100 generates a supervised value list 401 for the native program 400 in the Java program 404 by itself, and assigns a supervised value list signature 402. This method will be described with reference to Fig. 3E. Note that the difference from Fig. 3C is that S331 is no longer present and S332 has been replaced with S350, and therefore a description of the other parts will be omitted.

[0052] If it is determined in S330 that the installation target includes a native program, in S350 the Java program management unit 204 generates a correct value list corresponding to the native program to be installed and stores it in the HDD 104. Next, the Java program management unit 204 generates a public key and a private key, generates a signature using the private key from the correct value list, and records the public key and signature in the HDD 104. A library for creating public keys and private keys is provided in advance to the multifunction device 100, and public keys and private keys can be created by providing an appropriate ID, passphrase, etc. as parameters.

[0053] The process when the multifunction peripheral 100 is started up is the same as that shown in FIG. 3D of the first embodiment, except that the process of S342 is performed using the public key stored in the HDD 104 in S350.

[0054] In this example, even if a later-inserted native program is included in the Java program, the correct answer list and its digital signature are not included. Therefore, the Java program to be signature-verified does not include the correct answer list of the native program and its digital signature.

[0055] As described above, according to the second embodiment, even if a later-installed Java program includes and executes a native program, it is possible to detect tampering with the native program. Also, unlike the first embodiment, the multifunction peripheral 100 can complete the processing by itself.

[0056] [Embodiment 3] In the first and second embodiments, it is necessary to newly store a supervised value list and a signature of the supervised value list in the HDD 104, which poses a problem that cannot be realized in devices with limited storage area. Therefore, in the third embodiment, a method that does not use a supervised value list and a signature of the supervised value list will be described. The method for installing the Java program is the same as that shown in Figure 3B, so its description will be omitted.

[0057] The startup process of the multifunction peripheral 100 will be described with reference to Figure 3F. When the power to the multifunction peripheral 100 is turned on, the CPU 101 performs signature verification in order for the BIOS stored in the ROM 102, the loader stored in the flash memory 114, and the kernel 212, and if successful, the process is executed (S300-S302). These steps are as described in Figure 3A.

[0058] After performing various initialization processes, the kernel 212 instructs the native tampering detection processor 205 to perform tampering detection. Upon receiving the instruction, the native tampering detection processor 205 deletes all native programs from the HDD 104 in S360. The subsequent processes are the same as steps S303 to S308 in FIG. 3A. In the startup process of the Java program 404 in S307, a process is performed to store the native program included in the Java program and saved on the HDD 104 in an executable state on the HDD 104. Therefore, even if the native program stored in an executable state on the HDD 104 is tampered with, the native program can be rewritten each time the Java program is started, allowing it to operate in an untampered state.

[0059] As described above, according to the third embodiment, even if a later-installed Java program includes a native program and the native program is also later-installed, it is possible to detect tampering of the native program. In addition, it is possible to save storage space.

[0060] [Other Examples] The present invention can also be realized by supplying a program that realizes one or more functions of the above-described embodiments to a system or device via a network or a storage medium, and having one or more processors in the computer of the system or device read and execute the program.The present invention can also be realized by a circuit (e.g., ASIC) that realizes one or more functions.

[0061] The invention is not limited to the above-described embodiments, and various changes and modifications can be made without departing from the spirit and scope of the invention. Accordingly, the following claims are appended to apprise the public of the scope of the invention. [Explanation of symbols]

[0062] 204 Java program management unit, 205 program tampering detection processing unit, 404 Java program, 401 correct value list, 402 signature of correct value list

Claims

1. a verification means for verifying the native program stored in the first storage means by referring to the correct answer value stored in advance in the first storage means; an additional means for storing, in a second storage means different from the first storage means, an application including an additional program, a correct value corresponding thereto, and a digital signature corresponding to the correct value, in the second storage means, if verification of the application using the digital signature and verification of the correct value using the digital signature corresponding to the correct value are successful, the correct value corresponding to the additional program, the digital signature corresponding to the correct value, and the application and the digital signature corresponding to the application; and the verification means for verifying the native program verifies the native program stored in the first storage means and further verifies the additional program by referring to the correct answer value stored in the second storage means; When the application is started, the additional program included in the application is arranged in an executable manner in the second storage means.

1. An information processing device comprising:

2. 2. The information processing device according to claim 1, The verification means verifies the additional program when the additional program is executed.

1. An information processing device comprising:

3. 3. The information processing device according to claim 1, The correct answer value is a hash value of the additional program.

1. An information processing device comprising:

4. 4. The information processing device according to claim 1, The method further includes generating means for generating a correct answer value corresponding to the additional program.

1. An information processing device comprising:

5. 5. The information processing device according to claim 4, The method further includes a means for generating a digital signature of the correct answer value generated by the generating means.

1. An information processing device comprising:

6. 6. The information processing device according to claim 1, When the additional program is executed, the digital signature corresponding to the application and the digital signature corresponding to the correct answer value are further verified.

1. An information processing device comprising:

7. A program for causing a computer to function as the information processing device according to any one of claims 1 to 6.

8. In an information processing device having a verification means and an addition means, the verification means verifies the native program stored in the first storage means by referring to the correct answer value stored in advance in the first storage means; when the adding means stores an application including an additional program, a corresponding correct value, and a digital signature corresponding to the correct value in a second storage means different from the first storage means, if verification of the application using the digital signature and verification of the correct value using the digital signature corresponding to the correct value are successful, the adding means stores the correct value corresponding to the additional program, the digital signature corresponding to the correct value, and the application and the digital signature corresponding to the application in the second storage means; the verification means for verifying the native program verifies the native program stored in the first storage means and further verifies the additional program by referring to the correct answer value stored in the second storage means; When the application is started, the additional program included in the application is arranged in an executable manner in the second storage means. A program verification method comprising:

Images