Information processing apparatus, control method for controlling the same and storage medium

An information processing apparatus includes a determination unit configured to determine whether a user has authority to set setting data, a reception unit configured to, in a case where it is determined that the user has the authority to set the setting data, receive a setting of the setting data, a generation unit configured to generate verification data on the received setting data, and a verification unit configured to, in a case where the information processing apparatus starts, verify the setting data using the verification data.

BACKGROUND

Field of the Disclosure

The present disclosure relates to an information processing apparatus such as a multifunction peripheral connected to a network.

Description of the Related Art

Multifunction peripherals (MFPs) of recent years include a network interface and have functions comparable to those of a personal computer (PC) or a server, such as a file server function and an email transmission/reception function. In such circumstances, the multifunction peripherals also have an issue such as the improper use of the apparatus by improper hacking similarly to the PC or the server. Particularly, an attack for ransom called ransomware influences a social infrastructure. It is difficult to create invulnerable apparatus, and therefore, measures assuming intrusions are generally taken.

In many cases, a built-in information processing apparatus such as a multifunction peripheral is designed to use only firmware assumed before shipment. In such a case, the following measures are discussed. Verification data on an individual file of available firmware is stored in advance. When firmware is used, a start time falsification detection function verifies the falsification of the firmware using the verification data, and then makes only proper firmware available, thereby preventing an improper operation (see Japanese Patent Application Laid-Open No. 2019-212114).

The firmware falsification detection function of the conventional apparatus can prevent an irregular change in firmware. However, setting data for setting functions included in the firmware can be freely changed by a user, and therefore, verification data cannot be created in advance at the factory. Thus, the firmware falsification detection function cannot deal with an improper falsification. Meanwhile, the values of the above settings include many settings that influence security, such as a port opening setting and a user authentication setting. There is an issue that an attacker capable of falsifying the firmware can disable a security function by rewriting the setting values of the apparatus without falsifying the firmware using the conventional falsification detection function.

SUMMARY

In view of the above circumstances, the present disclosure is directed to providing a technique capable of, even if a setting value of an apparatus is improperly rewritten, preventing the apparatus from being improperly used.

According to an aspect of the present disclosure, an information processing apparatus includes a determination unit configured to determine whether a user has authority to set setting data, a reception unit configured to, in a case where it is determined that the user has the authority to set the setting data, receive a setting of the setting data, a generation unit configured to generate verification data on the received setting data, and a verification unit configured to, in a case where the information processing apparatus starts, verify the setting data using the verification data.

DESCRIPTION OF THE EMBODIMENTS

With reference to the drawings, various embodiments for carrying out the present disclosure will be described below. In a first exemplary embodiment, an example is illustrated where a multifunction peripheral (MFP) is used as an information processing apparatus.

FIG.1is a block diagram illustrating the configuration of the present exemplary embodiment.FIG.1illustrates a multifunction peripheral101and a personal computer (PC)125. The multifunction peripheral101and the PC125are connected together by a network126.

For example, the PC125creates image data desired by a user, using document creation software, generates print data, transmits the print data to the multifunction peripheral101, and gives a print instruction to the multifunction peripheral101. The PC125includes a network communication unit118that communicates with the network126, a central processing unit (CPU)119that controls the operation of the entirety of the PC125, and a random-access memory (RAM)120that records temporary information regarding the PC125. Further, the PC125includes a storage device122that permanently records information, and an input unit123such as a keyboard and a mouse that receives an input from the user.

The multifunction peripheral101includes a network communication unit102that communicates with the PC125via the network126, and a user interface (UI) operation unit103that receives an input from the user and provides an output to the user using a liquid crystal display, a touch panel, and a hardware key. The multifunction peripheral101also includes a CPU105that controls the operation of the multifunction peripheral101, such as the interpretation of print data and the conversion of the print data to a raster image, a RAM106that records temporary information regarding the multifunction peripheral101, and a storage device107that permanently records information. The multifunction peripheral101also includes a print engine108that receives a raster image calculated by the CPU105and prints the raster image on a sheet medium, and a scanner engine114that reads an image written on a print document as a raster image, using an optical reading technique, and writes the raster image to the RAM106.

FIG.5is a block diagram of programs that operate on the multifunction peripheral101.

The programs are stored in the storage device107and are loaded into the RAM106when used. Then, the CPU105causes the programs to operate. A file system (FS) access unit501accesses the storage device107. A hash calculation unit502calculates, from input data input to the hash calculation unit502, output data of a fixed size (e.g., 32 bytes) unique to the input data using a known hash calculation algorithm (e.g., SHA-256). The hash calculation algorithm is characterized by one-wayness in which it is easy to create output data from input data, but it is logically difficult to generate different input data to output the same output data.

An encryption processing unit503generates, from input data input to the encryption processing unit503, encrypted output data corresponding to the input data using a known encryption algorithm (e.g., the Advanced Encryption Standard (AES)). The encryption processing unit503is configured to have an encryption key unique to the multifunction peripheral101therein in advance so that the encryption key cannot be read from outside.

A verification data storage unit504saves correct verification values of a system file area and security setting data. The verification data storage unit504is placed in a setting data partition202in the storage device107. A software update unit505updates software when a failure or a vulnerability is found. A firmware falsification confirmation unit506confirms whether software is falsified or improper software is installed. A setting unit507is used by the user to set the multifunction peripheral101. A setting falsification confirmation unit508confirms whether a setting is improperly falsified.

As a firmware falsification detection method, the verification of a system partition is described below. This is an example of the firmware falsification detection method and is also applicable to another falsification detection method.

FIG.2is a block diagram illustrating the internal placement of the storage device107. Normally, the storage device107is composed of a single storage device (e.g., a hard disk drive), but the inside of the storage device107can be divided into logical units (partitions). In the example ofFIG.2, the storage device107is divided into three partitions. That is, a system file partition201indicates a partition that stores fixed data that does not change in normal use, such as various programs as illustrated inFIG.5and language data. The setting data partition202indicates a partition that stores various settings for causing the multifunction peripheral101to operate and setting data as temporary information. An image partition203indicates a partition that stores print data received by the multifunction peripheral101and raster image data to be used in the print engine108or the scanner engine114. This is merely an example, and the partitions may be further divided into more detailed partitions.

Since there is no room for changes in the various programs or the fixed data stored in the system file partition201in normal use (except for a software update), it can be assumed that the content of the system file partition201is always the same. On the other hand, the content of the setting data partition202or the image partition203is always rewritten by a change in a setting made by the user or a daily print or scan operation.

FIG.3Ais a schematic diagram illustrating an example where the system file partition201is physically placed in the storage device107.FIG.3Aillustrates the entirety of the system file partition201. A management area301manages the placement of a file in the system file partition201. A boot loader302determines a program to be booted when the multifunction peripheral101starts. A kernel303serves as the core of an operating system (OS). A device driver304causes the network communication unit102and the UI operation unit103to operate. A resident execution file305operates separately from firmware307. A shared library306separate from the firmware307is referenced and executed by the firmware307. The firmware307performs the operation of the multifunction peripheral101. A language file308is separated from the firmware307for the multifunction peripheral101to handle multiple languages. A HyperText Markup Language (HTML) file309is used when the multifunction peripheral101is referenced from outside using the Hypertext Transfer Protocol (HTTP). The above files302to309are termed “system files”. A shaded area310indicates an unused area in the partition.

Although a single system file is illustrated as each individual system file for ease of description, actually, a plurality of system files exists. For example, a plurality of device drivers exists according to devices connected to the multifunction peripheral101.

In the entirety of the system file partition201, the system files do not need to be orderly arranged. Actually, the individual system files are discretely placed as illustrated inFIG.3A. The physical placement of these system files is managed by the management area301, and the firmware307does not need to manage where the system files are physically placed. This means that even in the case of the firmware configuration of the same product and the same version, the placement of system files stored in the storage device107does not need to be exactly the same.

Next, the hash calculation of the system file partition201is described.

FIG.3Bis a schematic diagram illustrating the hash calculation of the entirety of the system file partition201.FIG.3Billustrates a range401of the hash calculation. Although the range401indicates the calculation range up to halfway for ease of description inFIG.3B, actually, the hash calculation is performed for the entirety of the system file partition201, and only a single hash value is saved as verification data. At this time, the entirety of the system file partition201also including the unused area310is the calculation target. This hash value is a value uniquely created based on the placement of data in the system file partition201. If the data in the entirety of the system file partition201changes by even one bit, a completely different hash value is calculated. Thus, it is possible to detect the falsification and the deletion of any program and the addition of a file that performs an improper operation.

FIG.4Ais a schematic diagram illustrating an example of the falsification of a program. If a legitimate program is falsified in a resident execution file501, the size of the program changes, and the program is rewritten. The change and the rewriting change the hash value by rewriting the entirety of the partition and therefore can be detected.

FIG.4Bis a schematic diagram illustrating an example of a case where an improper program is placed in the system file partition201. An improper file601is different from a legitimate system file. Since the unused area310is originally used as the hash calculation target, the placement of such an improper file also changes the hash value and therefore can be detected as an alteration.

FIG.4Cis a schematic diagram illustrating an example of a case where a legitimate file is deleted from the system file partition201by an improper operation. InFIG.4C, the language file308is improperly deleted. In such deletion, the management area301is rewritten. The rewriting changes the hash value of the entirety of the system file partition201and therefore can be detected.

Next, the calculation of the hash value of the system file partition201is described.

FIG.6is a flowchart illustrating an operation of the software update unit505. If the user performs a “firmware update instruction” operation using the UI operation unit103, the software update unit505starts to operate. InFIG.6, in step S601, the software update unit505performs a read/write (RW) mount on the system file partition201. The RW mount is a procedure for enabling reading and writing to and from the system file partition201. Normally, a read-only (RO) mount is performed because only reading is performed. However, writing needs to be performed only when a system file is updated, and therefore, the RW mount is performed. Next, in step S602, the software update unit505connects to an update server that stores an update file from the network communication unit102via the network126. Then, the software update unit505downloads a system file and temporarily copies the system file to the setting data partition202in the storage device107. The update server is a server placed on the Internet and provided by the manufacturer. The system file may be downloaded from a portable device such as a Universal Serial Bus (USB) memory, instead of the server. Next, in step S603, the software update unit505verifies the signature of the downloaded system file. The “signature” refers to a mechanism for assigning signature data signed using the private key of the manufacturer to a system file, verifying the signature data using a certificate (not illustrated) embedded in the multifunction peripheral101, and verifying whether the system file is a legitimate system file, thereby confirming whether an improper falsification is performed on a transfer path. In step S604, if the verification fails (No in step S604), the processing ends. If the verification is successful (Yes in step S604), then in step S605, the software update unit505updates the system file. The “update” refers to moving the system file placed in the setting data partition202in step S602to a predetermined position in the system file partition201. Further, in step S606, if the update is not successful (No in step S606), the processing ends. If the update is successful (Yes in step S606), the processing proceeds to step S607. In step S607, the software update unit505performs a mount on the system file partition201again (a remount) by a RO mount. At this timing, the rewriting of the system file partition201is completed. From this point onward, normally, the partition is not rewritten until the next update is performed. In step S608, the FS access unit501reads the system file partition201. In step S609, the hash calculation unit502calculates the hash value of the read system file partition201. Further, in step S610, the encryption processing unit503encrypts the hash value. In step S611, the verification data storage unit504stores the encrypted hash value. Then, the series of processes is completed.

The above calculation of the hash value uses, for example, the SHA-256 hash calculation algorithm. This algorithm creates a hash value of 32 bytes from input data of any size. The hash calculation algorithm is characterized by one-wayness in which it is easy to create output data from input data, but it is logically difficult to calculate different input data to output the same output data. Using this characteristic, it is realistically impossible to derive the same value as a hash value calculated from a legitimate system file partition from the result of an improper falsification. Thus, it is possible to verify the presence or absence of a falsification by verifying the hash value.

The above hash value is encrypted because, if the hash value is stored as plain text in the verification data storage unit504, the hash value may be rewritten by an improper attack. The encryption can prevent this area from being improperly rewritten. Next, the confirmation of the falsification of a system file placed in the system file partition201is described.

FIG.7is a flowchart illustrating the operation of the firmware falsification confirmation unit506.

The firmware falsification confirmation unit506is a module that, at a predetermined timing, confirms whether the system file partition201is falsified. The predetermined timing may be the time when the multifunction peripheral101starts by being powered on, or may be the time when an administrator operates the UI operation unit103. In a case where there is a clock, the firmware falsification confirmation unit506may start at a fixed time (e.g., midnight). In the present exemplary embodiment, if the user gives a falsification confirmation instruction using the UI operation unit103, the firmware falsification confirmation unit506operates.

When the firmware falsification confirmation unit506starts, then in step S701, the firmware falsification confirmation unit506reads the system file partition201from the FS access unit501. In step S702, the hash calculation unit502calculates the hash value. The hash calculation unit502uses the same hash calculation algorithm as the hash algorithm used in step S608(i.e., SHA-256). Next, in step S703, the firmware falsification confirmation unit506extracts encrypted verification data stored in the verification data storage unit504. In step S704, the firmware falsification confirmation unit506passes the encrypted verification data to the encryption processing unit503, and the encryption processing unit503decrypts the encrypted verification data. Next, in step S705, the firmware falsification confirmation unit506compares the hash value calculated in step S702and the verification data decrypted in step S704. If the hash value and the verification data match each other (Yes in step S705), the firmware falsification confirmation unit506does not perform anything in particular, and the processing ends. If the hash value and the verification data do not match each other (No in step S705), then in step S706, the firmware falsification confirmation unit506gives a warning that a falsification is performed. Examples of the warning method include a method for displaying the warning on the UI operation unit103, and a method for notifying the administrator of the warning by email using an email address registered in advance.

Next, the detection of the falsification of setting data is described. Setting data is data that is stored in the setting data partition202and determines the operation of a function of the multifunction peripheral101.

The setting data partition202is an area that stores the setting data. Examples of the stored setting data include information related to printing such as the setting of the sheet size and the setting of color when the multifunction peripheral101performs printing, transmission information such as the destination of a fax transmission, and also settings related to security such as the setting of user authentication and the setting of the use of encryption in communication.

The difference between a setting related to security and a setting unrelated to security in the setting data is described. The multifunction peripheral101may store a confidential document used in an office, and therefore needs to limit users allowed to access the confidential document. Normally, to operate the multifunction peripheral101, user authentication is performed in advance, and access authority is given to only a user allowed to access the confidential document, thereby preventing unauthorized access. To thus properly authenticate a user, a setting regarding the user authentication is made.

In a case that the multifunction peripheral101can be hacked, the setting of the user authentication can be changed or deleted. In this case, the user authentication itself can be disabled, or the authority to access the confidential document can be given to an unauthorized user.

Or suppose that measures are taken to set a communication system to perform encrypted communication using a known technique such as Transport Layer Security (TLS) so that even if a path is wiretapped, a confidential document flowing through the path is not leaked. Also in this case, the encrypted communication is turned off by rewriting the setting data, whereby it is also possible to transmit the confidential document as plain text and wiretap the path, thereby leaking information.

On the other hand, setting data unrelated to security refers to a setting related to the input and output of a document, such as the setting of the sheet size or the setting of whether to output a document in monochrome or color, and refers to a setting that influences the result of the output, but is not related to information leakage by hacking.

The setting data may be set through the input unit123, may be set through a network interface of the multifunction peripheral101, or may be imported from a backed up setting value. In any case, access control is performed so that only an administrator given authority through user authentication can set the setting data. An attacker skilled enough to attempt to falsify firmware can attempt to hack the multifunction peripheral101by taking advantage of an unreleased vulnerability of the multifunction peripheral101. Thus, the attacker may avoid the access control that is executed by performing the user authentication and improperly rewrite setting data related to security. A method for preventing improper rewriting is described below.

FIG.8is a schematic diagram illustrating the detection of the falsification of the setting data.

FIG.8illustrates the setting data partition202and pieces of security data801to805corresponding to security settings1to5related to security in the setting data. Actually, setting data other than that related to security is also stored in an area other than those of the pieces of security data801to805.

Coupled data810is obtained by extracting and coupling the pieces of security data801to805. A hash value820is the result of calculating a hash value from the coupled data810using a known hash function such as SHA-256. If any of the security settings1to5as the elements constituting the coupled data810is improperly changed, the hash value has a completely different value. Thus, a falsification can be detected.

FIG.9is a flowchart illustrating the operation of the setting unit (data setting unit)507when the multifunction peripheral101starts.

At the timing when the multifunction peripheral101is powered on, the setting unit507starts to operate. InFIG.9, in step S901, the setting unit507determines whether the multifunction peripheral101initially starts. If the multifunction peripheral101initially starts (Yes in step S901), then in step S902, the setting unit507clears all setting values. Next, in step S903, the setting unit507extracts pieces of data related to security settings from the setting data and couples the extracted pieces of data as the coupled data810. The coupled data810is temporarily stored in the RAM120.

FIG.19illustrates an example of a file configuration on the storage device122that stores the setting data.

FIG.19illustrates an item name1901of the setting data. A security attribute1902indicates a security setting. If the security attribute1902is “Yes”, this corresponds to a setting regarding security. If the security attribute1902is “No”, this indicates a setting other than a setting regarding security.FIG.19also illustrates a setting value1903. In the rows, a setting1911indicates whether to perform user authentication, a setting1912indicates whether to encrypt a communication path, a setting1913indicates printing in color or monochrome, and a setting1904indicates the sheet size of a sheet on which printing is to be performed. These settings are merely examples, and normally, more setting items are included. Examples of a setting of which the security attribute1902is “Yes” (a security setting) include a password setting, an encryption setting, an authentication setting, and a wireless local area network (LAN) setting.

In step S1002of the flowchart inFIG.10, the determination of whether data to be currently set is related to security can be made by determining whether the security attribute1902is “Yes”.

Next, in step S904, the setting unit507creates the hash value820from the coupled data810. Next, in step S905, the setting unit507encrypts the hash value820using a predetermined encryption key. The encryption may be performed by a common key encryption method or a public key encryption method. The predetermined encryption key only needs to be a key stored in hardware according to Trusted Platform Module (TPM) that manages a key, and created with respect to each individual multifunction peripheral101, and any encryption method may be used as long as the method is capable of guaranteeing that an attacker cannot improperly use the encryption key.

Next, in step S906, the setting unit507stores the encryption result in the verification data storage unit504. If, on the other hand, it is determined in step S901that the multifunction peripheral101starts for the second or subsequent time (No in step S901), then in step S907, similarly to step S903, the setting unit507extracts pieces of data related to security settings from the setting data and couples the extracted pieces of data as the coupled data810. The coupled data810is temporarily stored in the RAM120. Next, in step S908, the setting unit507creates the hash value820from the coupled data810. Next, in step S909, the setting unit507encrypts the hash value820using the predetermined encryption key.

Next, in step S910, the setting unit507compares the hash value820with the result stored in the verification data storage unit504. If the hash value820matches the stored result (Yes in step S910), this indicates that the security settings are made by a legitimate method. Then, the start process ends. If the hash value820does not match the stored result (No in step S910), the setting unit507regards that a falsification is performed. Then, in step S911, the setting unit507gives a warning that a falsification is performed. Examples of the warning method include a method for displaying the warning on the UI operation unit103, and a method for notifying the administrator of the warning by email using an email address registered in advance.

FIG.10is a flowchart illustrating the operation of the setting unit (data setting unit)507in a case where a setting is changed using the data setting unit507. The setting data on the device may be directly input using the input unit123, or may be input through a web interface using HTTP via the network communication unit102. A setting may also be backed up or restored, or a setting value may also be imported from another individual multifunction peripheral101. In any case, the setting needs to be changed based on administrator authority, and the setting is made through the data setting unit507. An example is described where the user can set or change the setting data in a case where the user has the administrator authority. If, however, the user is not an administrator, but has authority to set the setting data, the user may be permitted to set or change the setting data.

InFIG.10, in step S1000, the data setting unit507confirms whether the administrator authority is authenticated. When the multifunction peripheral101is used, user authentication is performed using the input unit123. In the user authentication, identification of the user is confirmed by inputting a predetermined identifier (ID) and a predetermined password, or using biometrics information such as the input of a fingerprint. Specifically, if the input information regarding the user and information regarding a user having the administrator authority held in the apparatus match each other, the authentication is successful. If the authentication of the user as a user having the administrator authority is successful, it is determined that the administrator authority is authenticated. However, if not, the data setting unit507does not perform any processing at this time, and the processing is completed. If it is determined that the administrator authority is authenticated (Yes in step S1000), then in step S1001, the setting data is set in the setting unit507. Actually, the setting data is written to the storage device122. In the present exemplary embodiment, when the setting data is set, the setting can be received only from a user having the authority. Next, in step S1002, the data setting unit507determines whether the setting data to be currently set is setting data related to security. This comparison can be made by statically holding a security attribute according to the type of setting data. Also in this step, the determination can be made based on the value of the security attribute1902illustrated inFIG.19.

If the setting data is unrelated to security (No in step S1002), the processing is completed. If the setting data is related to security (Yes in step S1002), the processing branches to step S1004. In step S1004, the data setting unit507extracts pieces of data related to security from the setting data and couples the extracted pieces of data as the coupled data810. The extraction of the pieces of data related to security is performed by extracting items of which the security attribute1902is “Yes”. The coupled data810is temporarily stored in the RAM120. Next, in step S1005, the data setting unit507creates the hash value820from the coupled data810. Next, in step S1006, the data setting unit507encrypts the hash value820using the predetermined encryption key. Next, in step S1007, the data setting unit507stores the encryption result in the verification data storage unit504.

As described above, in a case where the setting data is rewritten by a legitimate procedure, it is confirmed in step S1000that an administrator is authenticated. In a case where a security setting is changed, verification data is recalculated and saved. Due to this step, after the multifunction peripheral101starts next time, it can be determined by the verification process in step S910that the hash value820matches correct verification data. Thus, a proper operation can be performed.

On the other hand, a case is considered where data in the setting unit507is improperly rewritten by an act such as improper hacking. Even if an attempt is made to rewrite a setting using the data setting unit507, since the authentication process is not performed, it is determined that the administrator authority is not authenticated in step S1000, and the setting cannot be rewritten.

In a case where the setting unit507is directly rewritten, since steps S1004to S1007for calculating verification data are not performed, verification data cannot be updated. After the multifunction peripheral101starts next time, it can be clarified by the verification process in step S910that the hash value820does not match correct verification data. Thus, by giving a warning, it can be detected that the setting unit507is improperly rewritten. Even if an attempt is made to justify the falsification of the setting data by improperly rewriting verification data, the encryption key stored in a secure chip according to TPM cannot be extracted. Thus, the verification data cannot be forged, either.

Further, the program itself for the data setting unit507starts after the firmware falsification confirmation unit506confirms that a falsification is not performed. Thus, the processing of the flowcharts represented inFIGS.9and10cannot be changed. If the processing is changed, the change is considered as a falsification, and a warning is given in step S706.

As described above, at the timing when a setting value related to security is set, verification data on the security setting is generated, encrypted, and stored. When the multifunction peripheral101starts or at any timing, verification data is generated again. Then, the verification data is compared with the stored value. If the verification data does not match the stored value, it is determined that the setting value is falsified.

FIG.20illustrates examples of the influence of a change in a security setting. As illustrated inFIG.20, even if the firmware is not falsified, the multifunction peripheral101can be improperly used by changing a security setting.

Based on the above, in a case where setting data regarding security is falsified by a person other than a proper administrator using an improper method, the multifunction peripheral101cannot be caused to operate without a warning. Thus, the multifunction peripheral101can be used in the state where a security setting is proper.

In the first exemplary embodiment, to verify the setting data, the setting falsification confirmation unit508is included inside the multifunction peripheral101. As another configuration, the setting falsification confirmation unit508may be provided outside the multifunction peripheral101.

FIG.11is a block diagram of programs that operate on a multifunction peripheral1110and a server device1120according to a second exemplary embodiment. InFIG.11, the multifunction peripheral1110and the server device1120are connected together by a network1150. In the multifunction peripheral1110, an FS access unit1101accesses the storage device107. A software update unit1105updates software when a failure or a vulnerability is found. A firmware falsification confirmation unit1106confirms whether software is falsified or improper software is installed. A setting unit1107is used by the user to set the multifunction peripheral1110. A start processing unit1109initializes the multifunction peripheral1110when the multifunction peripheral1110starts.

In the server device1120, a verification data storage unit1121stores verification data unique to the multifunction peripheral1110. A verification data generation unit1123updates verification data when the multifunction peripheral1110properly updates the setting data. A hash calculation unit1124calculates, from input data input to the hash calculation unit1124, output data of a fixed size (e.g., 32 bytes) unique to the input data using a known hash calculation algorithm (e.g., SHA-256). The hash calculation algorithm is characterized by one-wayness in which it is easy to create output data from input data, but it is logically difficult to generate different input data to output the same output data. An encryption processing unit1125generates, from input data input to the encryption processing unit1125, encrypted output data corresponding to the input data using a known encryption algorithm (e.g., AES). A setting falsification confirmation unit1126confirms whether a setting is improperly falsified.

FIG.12is a flowchart illustrating the operation of the start processing unit1109. At the timing when the multifunction peripheral1110is powered on, the start processing unit1109starts to operate. InFIG.12, in step S1201, the start processing unit1109determines whether the multifunction peripheral1110initially starts. If the multifunction peripheral1110initially starts (Yes in step S1201), then in step S1202, the start processing unit1109clears all setting values. Next, in step S1203, the start processing unit1109extracts pieces of data related to security settings from the setting data and couples the extracted pieces of data as the coupled data810. The coupled data810is temporarily stored in the RAM120. Next, in step S1204, the start processing unit1109registers the coupled data810in the server device1120.

If, on the other hand, it is determined in step S1201that the multifunction peripheral1110starts for the second or subsequent time (No in step S1201), then in step S1205, similarly to step S1203, the start processing unit1109extracts pieces of data related to security settings from the setting data and couples the extracted pieces of data as the coupled data810. The coupled data810is temporarily stored in the RAM120. Next, in step S1206, the start processing unit1109transmits the coupled data810to the server device1120and requests the server device1120to verify the coupled data810. In step S1207, the start processing unit1109receives the verification result. Next, in step S1208, the start processing unit1109determines whether the verification result is correct. If the verification result is correct (Yes in step S1208), this indicates that the security settings are made by a legitimate method. Then, the start process ends. If the verification result is not correct (No in step S1208), the start processing unit1109determines that a falsification is performed. Then, in step S1209, the start processing unit1109gives a warning that a falsification is performed. Examples of the warning method include a method for displaying the warning on the UI operation unit103, and a method for notifying the administrator of the warning by email using an email address registered in advance.

FIG.13is a flowchart illustrating the operation of the setting unit (data setting unit)1107in a case where a setting is changed using the data setting unit1107. InFIG.13, in step S1301, the data setting unit1107confirms whether the administrator authority is authenticated. When the multifunction peripheral1110is used, user authentication is performed using the input unit123.

If the administrator authority is not authenticated (No in step S1301), the data setting unit1107does not perform any processing at this time, and the processing is completed. If the administrator authority is authenticated (Yes in step S1301), then in step S1302, the setting data is set in the setting unit1107. Actually, the setting data is written to the storage device122.

Next, in step S1303, the data setting unit1107determines whether the setting data to be currently set is setting data related to security. This comparison can be made by statically holding a security attribute according to the type of setting data. If the setting data is unrelated to security (No in step S1303), the processing is completed. If the setting data is related to security (Yes in step S1303), the processing branches to step S1304. In step S1304, the data setting unit1107extracts pieces of data related to security settings from the setting data and couples the extracted pieces of data as the coupled data810. The coupled data810is temporarily stored in the RAM120.

Next, in step S1305, the data setting unit1107transmits the coupled data810to the server device1120and registers the coupled data810in the server device1120.

FIG.14is a flowchart illustrating the operation of the verification data generation unit1123on the server device1120. The verification data generation unit1123starts to operate when the server device1120is powered on, and then, the verification data generation unit1123continues to operate until the server device1120is shut down. InFIG.14, in step S1401, the verification data generation unit1123receives the coupled data810. Next, in step S1402, the verification data generation unit1123generates the hash value820from the coupling result. Next, in step S1403, the verification data generation unit1123encrypts the hash value820using the predetermined encryption key. Next, in step S1404, the verification data generation unit1123stores the encryption result in the verification data storage unit1121. By following this procedure, the verification data generation unit1123calculates verification data on the multifunction peripheral1110.

FIG.15is a flowchart illustrating the operation of the setting falsification confirmation unit1126on the server device1120. The setting falsification confirmation unit1126starts to operate when the server device1120is powered on, and then, the setting falsification confirmation unit1126continues to operate until the server device1120is shut down. InFIG.15, in step S1501, the setting falsification confirmation unit1126receives the coupled data810. Next, in step S1502, the setting falsification confirmation unit1126generates the hash value820from the coupling result. Next, in step S1503, the setting falsification confirmation unit1126encrypts the hash value820using the predetermined encryption key. Next, in step S1504, the setting falsification confirmation unit1126verifies whether the hash value820matches the result stored in the verification data storage unit1121. If the hash value820matches the stored result (Yes in step S1504), then in step S1505, the setting falsification confirmation unit1126notifies the multifunction peripheral1110that the verification is successful. If the hash value820does not match the stored result (No in step S1504), then in step S1506, the setting falsification confirmation unit1126notifies the multifunction peripheral1110that the verification fails.

If the notification reaches the multifunction peripheral1110, then in step S1208, the start processing unit1109determines whether the verification result is correct. If the setting data is falsified (No in step S1208), then in step S1209, the start processing unit1109gives an alert (warning).

As described above, in the configuration where the verification mechanism is separated from the multifunction peripheral1110, a server stored in a physically safe place can hold verification data more safely, and it is possible to detect a falsification.

In the first exemplary embodiment, if it is detected that the setting data is falsified, the multifunction peripheral101is configured to merely give an alert. In a third exemplary embodiment, a method for automatically restoring proper data is described.

FIG.16is a flowchart illustrating the operation of a setting unit (data setting unit) according to the present exemplary embodiment.

FIG.16is a variation ofFIG.9, and only the differences fromFIG.9are described. In step S1604, the setting unit saves a backup for the coupled data810on the storage device122. Further, after a falsification is detected, then in step S1613, the setting unit restores the coupled data810from the backup.

FIG.17is a flowchart illustrating the operation of the data setting unit according to the present exemplary embodiment.

FIG.17is a variation ofFIG.10, and only the differences fromFIG.10are described. In step S1705, the data setting unit saves a backup for the coupled data810on the storage device122. In step S1613, the backup saved in this step is subjected to the restoration process.

As described above, if setting data related to security is updated by a proper procedure, a backup is saved. Then, if, upon the detection of the falsification of the setting data, it is detected that the setting data is improperly updated, proper data is restored from the backup, whereby the setting data can also be restored by a method other than giving an alert. Thus, it is possible to reduce the downtime of the multifunction peripheral110.

In the first exemplary embodiment, the falsification of the setting data is confirmed only once when the multifunction peripheral110starts. However, some falsification may be irregularly performed, and the setting data may be reflected on the function every time a change is made. Thus, in a fourth exemplary embodiment, a method for detecting a falsification during the operation of the multifunction peripheral110is added. A periodic falsification confirmation unit is added to the system according to the first exemplary embodiment. Processes other than that of the periodic falsification confirmation unit are similar to those in the first exemplary embodiment.

FIG.18is a flowchart illustrating the operation of the periodic falsification confirmation unit. The periodic falsification confirmation unit starts to operate when the multifunction peripheral110starts, and then, the periodic falsification confirmation unit continues to operate until a falsification is detected or the multifunction peripheral110is shut down. InFIG.18, in step S1801, the periodic falsification confirmation unit waits a certain time. The certain time may be a setting included in the multifunction peripheral110. The certain time is long enough not to impair the performance of the multifunction peripheral110by frequently confirming a falsification.

Next, in step S1802, the periodic falsification confirmation unit extracts pieces of data related to security settings from the setting data and couples the extracted pieces of data as the coupled data810. The coupled data810is temporarily stored in the RAM120. Next, in step S1803, the periodic falsification confirmation unit creates the hash value820from the coupled data810. Next, in step S1804, the periodic falsification confirmation unit encrypts the hash value820using the predetermined encryption key. Next, in step S1805, the periodic falsification confirmation unit compares the hash value820with the result stored in the verification data storage unit504. If the hash value820matches the stored result (Yes in step S1805), this indicates that the security settings are made by a legitimate method. Then, the processing returns to step S1801. If the hash value820does not match the stored result (No in step S1805), the periodic falsification confirmation unit determines that a falsification is performed. Then, in step S1806, the periodic falsification confirmation unit gives a warning that a falsification is performed.

As described above, the falsification of the setting data is confirmed every certain time even in the state where the multifunction peripheral110is operating. With this configuration, it is possible to minimize and prevent an improper operation on the multifunction peripheral110due to improper setting data.

According to the above exemplary embodiments, in a case where a setting value related to security is improperly rewritten, it is possible to detect the improper rewriting. The operation of an information processing apparatus is stopped, whereby it is possible to prevent the operation of the information processing apparatus in an improper setting state.

According to the above exemplary embodiments, even if a setting value of an apparatus is improperly rewritten, it is possible to prevent the apparatus from being improperly used.

Other Embodiments

This application claims the benefit of Japanese Patent Application No. 2021-173743, filed Oct. 25, 2021, which is hereby incorporated by reference herein in its entirety.