Information processing apparatus stopping power supply to hardware connected to a socket

The present invention provides an information processing apparatus capable of mounting an optional hardware. The information processing apparatus comprises a processor, an image processing circuit and a socket to which the optional hardware is to be mounted, wherein the optional hardware being connected to the socket communicates with the image processing circuit. The processor transmits a predetermined packet to the optional hardware mounted to the socket, receive a response packet to the predetermined packet from the image processing circuit, determines whether or not the received response packet is an expected response packet, and controls supplying power to the optional hardware in accordance with a determination result of the received response packet.

BACKGROUND OF THE INVENTION

Field of the Invention

The present invention relates to an information processing apparatus, and a method of controlling the information processing apparatus.

Description of the Related Art

An image forming apparatus is known in which a semiconductor for processing image data obtained from a scanner or an external device is mounted on a controller board. For the purpose of reducing the price of such image forming apparatuses, a component capable of achieving a function matching the model is allowed to be mounted without fixing a part of functions of the controller board instead of creating the controller board for each model of the image forming apparatuses. Thus, multiple types of image forming apparatuses can be supported with a controller board of a single type. Such a component capable of achieving a function matching the model is typically mounted to a socket on a controller board, but the component can be replaced also after shipment. For example, Japanese Patent No. 5453324 discloses a technique for identifying and disabling a false module operating on an information processing apparatus.

On the other hand, there is an attack that utilizes a socket on a controller board, and, for example, it is possible to easily analyze the behavior of a device by mounting a debug tool to a debug socket of the controller board. Also, internal signals of the controller board can be obtained via such a socket. Consequently, when such information acquisition is continuously obtained via the socket, the signal patterns in the controller board can be analyzed, and the analysis results can be used to fraudulently obtain information from the device, or to alter the information in the controller board. A fraudulent module is identified by detecting alterations made by the fraudulent module in Japanese Patent No. 5453324; however, a technique capable of more easily detecting fraudulent hardware (attacking hardware) has been demanded.

SUMMARY OF THE INVENTION

An aspect of the present invention is to eliminate the above-mentioned problem with conventional technology.

The feature of the present invention is to provide a technique of detecting attacking hardware and then suppressing the activation of the attacking hardware.

According to a first aspect of the present invention, there is provided an information processing apparatus capable of mounting an optional hardware, the information processing apparatus comprising: an image processing circuit; a socket to which the optional hardware is to be mounted, wherein the optional hardware being connected to the socket communicates with the image processing circuit; a memory that stores instructions; and a processor that executes the instructions stored in the memory to: transmit a predetermined packet to the optional hardware mounted to the socket; receive a response packet to the predetermined packet from the image processing circuit; determine whether or not the received response packet is an expected response packet; and control supplying power to the optional hardware in accordance with a determination result of the received response packet.

According to a second aspect of the present invention, there is provided a method of controlling an information processing apparatus including an image processing circuit and a socket capable of mounting an optional hardware, wherein the optional hardware being connected to the socket communicates with the image processing circuit, the method comprising: transmitting a predetermined packet to the optional hardware connected to the socket; receiving a response packet to the predetermined packet from the image processing circuit; determining whether or not the response packet is an expected response packet; and controlling supplying power to the optional hardware in accordance with a determination result.

According to a third aspect of the present invention, there is provided An information processing apparatus, comprising: an image processing circuit; a socket that is capable of connecting an optional hardware, wherein the optional hardware being connected to the socket communicates with the image processing circuit; and a processor, wherein the processor transmits a predetermined packet to the optional hardware being connected to the socket, upon receiving a response packet produced by the optional hardware and the image processing circuit by processing the predetermined packet, the processor determines whether or not the response packet is an expected response packet, and the processor controls supplying power to the optional hardware in accordance with a determination result of the response packet.

DESCRIPTION OF THE EMBODIMENTS

FIG. 1is a block diagram for describing a hardware configuration of an image forming apparatus100according to the embodiment.

A scanner102optically reads an image of an original document and converts the image into a digital image data. A printer unit104prints an image on a sheet based on digital image data. A console unit105includes a display unit that receives user operations and presents various information to the user, the display unit provides a user interface (UI). Note that the display unit may have a touch panel function. A hard disk drive (HDD)106stores various data such as image data, control programs, and the like. A fax unit107transmits and/or receives facsimile signals via a telephone line. A controller (control unit)103is connected with the above-mentioned components, and transmits and/or receives control signals and the like to/from the above-mentioned components to perform a job in the image forming apparatus100. Also, the controller103can perform input/output of digital image data, issuing of a job, an instruction to devices and/or the like to/from a computer109via a LAN108.

The scanner102includes a document feeder121on which to load an original document bundle and a scanner unit122. The document feeder121can sequentially supply the documents to the scanner unit122. The scanner unit122outputs, to the controller103, digital image data obtained by scanning the original document.

The printer unit104includes a sheet feeder unit142capable of supplying sheets one by one from the loaded sheet bundle, a marking unit141that prints images on the supplied sheet, and a discharge unit143that discharges the printed sheet. The computer109provides an instruction to the controller103via the LAN108to cause the controller103to perform a job.

The image forming apparatus100is capable of performing a wide variety of jobs. Exemplary jobs are as follows.

Copy Function

Image data obtained from the scanner102is recorded in an HDD106and printing is performed using the printer unit104.

Image Sending Function

Image data obtained from the scanner102is transmitted to the computer109via the LAN108.

Image Storing Function

Image data obtained from the scanner102is recorded in the HDD106and image transmission and/or image printing is performed as necessary.

Image Print Function

For example, a page description language transmitted from the computer109is analyzed and printed in the printer unit104.

FIG. 2is a block diagram for describing a hardware configuration of the controller103according to the embodiment.

The controller103includes a main board200and a sub-board220. The main board200is a so-called general-purpose CPU system including a main CPU201that controls the entire board, a boot ROM202including a boot program, and a memory203that serves as a work memory used by the CPU201. Further, the main board200includes a bus controller204having a bridge function with an external bus, a non-volatile memory205in which the stored data is not lost even when the power source is turned off, and an RTC211having a clock function. In addition, there is provided a disk controller206that controls access to the HDD106, a flash disk (such as an SSD)207that is a relatively small volume non-volatile storage device composed of a semiconductor device, and a USB controller208capable of controlling a USB. The USB memory209, the console unit105, the HDD106, and the like are connected to the main board200.

The sub-board220includes a relatively small general-purpose sub-CPU system and an image processing hardware. The sub-board220includes a sub-CPU221that controls the entire board, a memory223that serves as a work memory used by the CPU221, a bus controller224having a bridge function with an external bus, and a non-volatile memory225in which the stored data is not lost even when the power source is turned off. The sub-board220further includes an image processing processor227that performs real-time digital image processing and an engine controller226. The scanner102and the printer unit104exchanges digital image data via the engine controller226. The sub-CPU221directly controls the FAX unit107. Note that this drawing is a block diagram, and is simplified. For example, the main CPU201, the sub-CPU221, and the like include many pieces of CPU peripheral hardware such as a chip set, a bus bridge and a clock generator, but they are simplified in the drawing, and the present invention is not limited to this block configuration.

Next, the operation of the controller103is described with an exemplary copying of original documents.

When the user instructs to copy an original document from the console unit105, the main CPU201sends a read command of the original document to the scanner102via the sub-CPU221. The scanner102then optically scans the original document to obtain the digital image data corresponding to the image of the original document, and inputs the image data to the image processing processor227via the engine controller226. The image processing processor227temporarily stores the digital image data in the memory223by DMA transfer. When confirming that all or a certain amount of the digital image data is stored in the memory223, the main CPU201outputs a print instruction to the printer unit104via the sub-CPU221. At this time, the sub-CPU221passes a read address of the image data of the memory223to the image processing processor227. As a result, the image processing processor227outputs the image data of the memory223to the printer unit104via the engine controller226in synchronization with a synchronization signal from the printer unit104. Thus, the printer unit104prints an image based on the image data of the original document.

When performing copying on multiple sheets, the main CPU201can store the image data of the memory223in the HDD106, and copying of the image data on the second and succeeding sheets can be performed by the printer unit104without receiving the image data from the scanner102.

FIGS. 3A and 3Bare block diagrams for describing image processing performed by the sub-CPU221and the image processing processor227in the sub-board220according to the embodiment.

For the sub-CPU221responsible for the image processing, an image processing CPU301, an image processing CPU (image processing circuit)302, an image processing CPU303, and a short board304or an option CPU305required for an image formation operation are connected in series via an image processing bus.

As described in the description of the related art, image forming apparatuses of a plurality of types can be supported with a controller board of a single type for the purpose of cost reduction. For example, the short board304(through which electric signals pass without change) is provided to the sub-board220in the embodiment as illustrated inFIG. 3A. Thus, by implementing an option CPU305(capable of performing an additional function) as illustrated inFIG. 3Bin place of the short board304in order to support a certain model, the function corresponding to the model can be achieved.

Each of the image processing CPUs301to303and the option CPU305incorporate an image memory for storing temporary data. The image processing CPUs301to303may be implemented by an application specific integrated circuit (ASIC). Note that the memory223, the bus controller224, the non-volatile memory225, the engine controller226and the like in the sub-board220are not related with the present disclosure, and therefore are omitted inFIGS. 3A and 3B. The above-mentioned configurations are merely a part of modes for implementation of the present disclosure, and the actual product is not limited to the above embodiments.

In the image processing block of the sub-board220illustrated inFIGS. 3A and 3B, when the sub-CPU221receives an instruction from the main CPU201, each image processing CPU on the image processing bus is controlled. Here, the sub-CPU221transmits a request packet to the short board304via the image processing bus. The request packet describes a destination specifying an image processing CPU. For example, the sub-CPU221may transmit a request packet describing a destination specifying the image processing CPU301to request an initialization process or an inversion processing on the print data that is currently present on the image memory. Each image processing CPU that has received the request packet analyzes the packet and performs a process corresponding to the instruction of the packet when the packet is recognized to be addressed for itself. Then, a response packet is transmitted to the sub-CPU221via the image processing bus. For example, upon receiving a request packet addressed for itself, the image processing CPU301performs initialization, inversion processing of the indicated image data and the like, and returns a response packet to the sub-CPU221.

Further, in accordance with a determination that the request packet is not addressed to itself as a result of analysis of the request packet, each image processing CPU directly transmits the request packet to the image processing bus as it is without change. This allows, in the later stages, the image processing CPUs to receive the request packet and then perform an analysis and a process on the request packet.

In this manner, the sub-CPU221transmits the request packet via the image processing bus, and the image processing CPU indicated by the request packet returns the response packet, thereby completing through the communication. In the image forming apparatus100, in order to perform a single job (e.g., copying), the sub-CPU221communicates multiple times with each image processing CPU as described above.

FIG. 4is a diagram for describing an example of a typical attack on the image forming apparatus100. Note that, inFIG. 4, the components identical to those ofFIGS. 3A and 3Bare denoted with the same reference numerals.

As described above, the sub-CPU221controls each image processing CPU by using the packet via the image processing bus. Further, the existing short board304can be removed and the option CPU305can be mounted instead (seeFIG. 3B). Utilizing such a configuration, an attacker can attack the system by mounting attacking hardware401in place of the short board304as shown inFIG. 4. For example, the attacking hardware401can fraudulently obtain various information by intercepting information flowing on the image processing bus and by storing the information in an external device. It is also conceivable to break and stop the control sequence of the system by altering and then transmitting the packet flowing on the image processing bus.

In the product on the market, such controller board is incorporated. Accordingly, such attacks can be executed by removing a cover of the product to mount the attacking hardware401to the socket of the controller board.

FIG. 5is a block diagram for describing a configuration for detecting the attacking hardware401in the image forming apparatus100according to the embodiment.

The main CPU201transfers the program for the sub-CPU221to the memory223. The sub-CPU221operates in accordance with the program stored in the memory223. Further, here, a third CPU502capable of accessing the image processing bus in the same manner as the sub-CPU221, in additions to the main CPU201and the sub-CPU221, is provided. The third CPU502operates in accordance with a program for the third CPU stored in a ROM501for the third CPU. The third CPU502is capable of controlling on/off of a sub-board power source503.

FIGS. 6A, 6B, 7A and 7Bare diagrams for describing a method for detecting attacking hardware in the image forming apparatus100according to the embodiment.

As described above, the third CPU502operates in accordance with the program stored in the ROM501for the third CPU. As with the sub-CPU221, the third CPU502is capable of accessing the image processing bus, and is also capable of controlling the sub-board power source503. Further, at the time of initialization of the image forming apparatus100, the third CPU502transmits a request packet to each image processing CPU, and receives a response packet from each image processing CPU.

FIG. 6Adepicts a view illustrating a state where the option CPU305is additionally provided as inFIG. 3B, andFIG. 6Bdepicts a view illustrating a state where the attacking hardware401is mounted in place of the short board304as inFIG. 4.

FIG. 7Ais a flowchart for describing a method for detecting attacking hardware in the image forming apparatus100according to the embodiment.

First, in step S701, to confirm whether the option CPU305is mounted or, depending on the models, whether the short board304is mounted, the third CPU502transmits the request packet via the image processing bus to a side of the short board304. Then, if the option CPU305is mounted at the place of the short board304, the third CPU502can receive a predetermined packet including a predetermined characteristic value, for example, from the whole image processing CPU. Accordingly, in this case, the third CPU502quits the control to the image processing bus, and the sub-CPU221performs initialization.

Next, the process proceeds to step S702, and the third CPU502determines whether or not the predetermined response packet has been received. At this time, if the attacking hardware401is mounted on the short-board304for example, the attacking hardware401cannot return the response packet unlike the option CPU305. Accordingly, the third CPU502cannot receive the predetermined response packet, and therefore the process proceeds to step S703. In step S703, the third CPU502can stop the activation of the sub-board220by shutting off the power supply from the sub-board power source503.

On the other hand, if the third CPU502receives the predetermined response packet in step S702, the process proceeds to step S704, and the third CPU502continues processing to perform the activation process of the sub-board220by turning on the power supply from the sub-board power source503.

FIG. 7Bis a diagram for describing an example of a packet format used in communication between the CPUs described above.

This packet includes a header705and a body706. The header705describes destination device numbers, packet sizes, and the like. Responses from the image processing CPUs are contained in Byte1to ByteN of the body706. The third CPU502analyzes the packet and determines whether or not predetermined information is contained.

In this manner, the activation of the sub-board220is stopped if the attacking hardware is mounted, and thus attacks by the attacking hardware can be prevented. Since the sub-board220is not activated when the attacking hardware is mounted as described above, job-related request packets are not transmitted from the sub-CPU221when the attacking hardware is mounted, and therefore the information is not intercepted or altered.

The request packet transmitted by the third CPU502and the response packet information transmitted by each image processing CPU and the option CPU305are stored in the memory (not illustrated) of the third CPU502.

FIG. 8is a diagram for describing an exemplary embodiment for a countermeasure against an attack of a communication detection device (of so-called sniffer type).

WhileFIGS. 5 to 7Aillustrate examples of detection of the attacking hardware in the case where the option CPU305is removed and then the attacking hardware401is mounted instead,FIG. 8depicts a view illustrating an attack of another type and the countermeasures against such an attack.

As illustrated inFIG. 8, the option CPU305is connected with the image processing bus via the attacking hardware401(e.g., via a conversion cable). The attacking hardware401connects an attacking storage801and can store information in the attacking storage801. Here, the attacking hardware401transmits, directly to the next option CPU305, the request packet flowing on the image processing bus. At this time, the response packet that the third CPU502receives is the same as in a normal case (a case where no attacking hardware is present), and consequently the third CPU502cannot detect the attacking hardware401. The attacking hardware401can store the obtained communication packets in the attacking storage801and can identify the communication protocol (types of packets and timings in transmission and/or reception) of the image processing bus by analyzing the obtained communication packets. On the basis of the analyzed information, it is possible to create attacking hardware capable of transmitting and/or receiving the same packet as that of the option CPU305and extract data using the created attacking hardware without being detected.

As a counter measure against such a communication detection function, the third CPU502generates a request packet including encrypted additional information based on the date, time, model, serial number of the machine and the like, and then transmits the generated request packet to each image processing CPU. Each image processing CPU having received the request packet including the additional information analyzes the received packet and then generates a response packet including individual additional information to transmit it to the third CPU502.

For example, when the date and time of the transmission is “10:59, Aug. 9, 2017” and the model number is “001”, the following request packet is transmitted.

Here, “1108” is a character string obtained from the year “2017” by subtracting 1 from each even-numbered digit and by adding 1 to each odd-numbered digit. “0908” is a character string obtained by reversing the month and date “0809”. “8941” is a complement of the transmission time “1059”. Further, “001” is the model number “001” itself.

Each image processing CPU having received the request packet analyzes the received request packet, and then decrypts it to the original “2017-0809-1059” to transmits it in addition to the response packet.

On the other hand, the attacking hardware401does not know the creation logic of such a response packet, and therefore cannot generate the above-mentioned response packet including the additional information for the request packet.

When receiving a correct response packet, the third CPU502continues the activation of the sub-board220. When the correct response packet cannot be received, it is determined that the attacking hardware401is connected, and then the activation of the sub-board220is stopped by shutting off the power supply from the sub-board the power source503. In this manner, the addition of additional information to the request packet can significantly increase the difficulty of the communication analysis by the attacker and can protect it from the attack of the attacking hardware. Note that the addition of information is merely an example, and the present invention is not limited to this example.

As described above, according to the embodiments, even when a fraudulent attacking hardware is connected as an option, the activation of the hardware can be prevented.

Additionally, in the embodiment, when attacking hardware is mounted, the control board connecting it is not activated, thus providing an effect that the information is not intercepted or altered by the attacking hardware.

Also, for example, even when the information is intercepted by the attacking hardware, the information may not be used for other models since the information contains at least the model number. Thus, it is possible to prevent spread of the damage due to the fraudulent module based on information obtained by the attacking hardware.

Other Embodiments

This application claims the benefit of Japanese Patent Application No. 2018-135220, filed Jul. 18, 2018, which is hereby incorporated by reference herein in its entirety.