MFP Setting Data Verification Using Dynamic Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional multifunction peripherals (MFPs) face challenges in preventing improper use due to insecure setting data, as attackers can rewrite security settings without falsifying firmware, compromising security functions.
Innovation Solution
An information processing apparatus is equipped with a determination unit to verify user authority for setting data, a reception unit to receive and generate verification data for the setting data, and a verification unit to verify the setting data upon startup, using hash calculations and encryption to detect and prevent unauthorized changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firmware falsification detection function is implemented using verification data stored in advance, then firmware irregular changes can be prevented, but setting data can still be freely changed by users without verification
Solution Approach 1:
The patent divides verification into two independent segments: firmware verification (using pre-stored verification data) and setting data verification (using dynamically generated verification data). This allows firmware to remain secure while setting data can be flexibly changed with proper verification, resolving the contradiction between reliability and ease of operation.
Solution Approach 2:
The patent implements preliminary verification of user authority before allowing setting data changes. The determination unit checks whether a user has authority to set setting data in advance, and only then does the reception unit receive the setting. This preliminary action prevents unauthorized changes while allowing authorized users to modify settings freely.
2Ease of operation
If setting data can be freely changed by users, then ease of operation is improved, but security functions can be disabled by attackers rewriting setting values
Solution Approach 1:
The patent implements a feedback mechanism where the verification unit continuously monitors setting data changes and compares them against verification data. When setting data is modified, the system generates new verification data and checks for consistency. This feedback loop allows users to change settings freely while automatically detecting and preventing unauthorized security compromises.
Solution Approach 2:
The determination unit performs preliminary verification of user authority before allowing any setting data changes. This preliminary check ensures that only authorized users can modify settings, preventing attackers from disabling security functions while maintaining ease of operation for legitimate users.
3Reliability
If verification data is generated dynamically for setting data, then setting data security is improved, but device complexity increases due to additional determination, reception, and generation units
Solution Approach 1:
The verification unit serves multiple functions: it verifies setting data authenticity, generates verification data dynamically, and compares against stored data. By making the verification unit multi-functional, the patent reduces the need for separate dedicated components, thereby limiting the increase in device complexity while maintaining high security.
Solution Approach 2:
The patent combines the determination unit, reception unit, and generation unit into an integrated verification system. These units work together as a cohesive mechanism rather than separate independent systems, reducing overall complexity while achieving comprehensive security verification for setting data.
Data Source
AI summary
An information processing apparatus includes a determination unit configured to determine whether a user has authority to set setting data, a reception unit configured to, in a case where it is determined that the user has the authority to set the setting data, receive a setting of the setting data, a generation unit configured to generate verification data on the received setting data, and a verification unit configured to, in a case where the information processing apparatus starts, verify the setting data using the verification data.