INFORMATION PROCESSING SYSTEM AND NON-TRANSITORY COMPUTER READABLE MEDIUM

An information processing system includes a processor configured to: switch, in response to an instruction from a user, between a normal use mode with security guaranteed by using a predetermined security service over Internet and a temporary use mode in which communication in a directly connected state is allowed with communications over the Internet disabled; and allow use of an external terminal device only during an operation under the temporary use mode.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is based on and claims priority under 35 USC 119 from Japanese Patent Application No. 2023-136141 filed Aug. 24, 2023.

BACKGROUND

(i) Technical Field

The present disclosure relates to an information processing system and a non-transitory computer readable medium.

(ii) Related Art

In recent years, in order to protect an in-house network established by using a LAN or the like from security threats, companies have been shifting from a boundary-based defense model using a firewall to a zero trust-based defense model using neither a LAN nor a firewall. This is because it has become more and more difficult to protect company assets with the border-based defense model due to diversified working patterns through recent introduction of remote working, shared offices, and the like.

Solutions for realizing zero trust security based on the “zero trust” concept meaning that nothing is trusted without authentication include Secure Access Service Edge (SASE), Endpoint Detection and Response (EDR), and the like. With a concept of a new security framework “SASE”, security functions and network functions in an IT environment are integrated into one cloud service. In addition, “EDR” is an endpoint security solution that collects log data from endpoints connected to a network in an organization from a cloud, detects suspicious behaviors and cyber attacks by analyzing the log data, and notifies an administrator of the suspicious behaviors and cyber attacks.

An increasing number of companies tend to use cloud services with SASE, EDR, or the like in a zero trust network access (ZTNA) environment established based on the concept of zero trust. Furthermore, in order to make a multifunction peripheral installed in the on-premise environment of a company compatible with the ZTNA environment, an agent for SASE or EDR is installed in the multifunction peripheral.

In Japanese Unexamined Patent Application Publication No. 2022-132074, a technique has been proposed in which, as one function of a multifunction peripheral that only receives data from an external device guaranteed to be safe in advance using an SSL (TLS) certificate, the multifunction peripheral transitions to a zero trust mode in which one or a plurality of network ports are forcibly blocked, a user, the external device, and the multifunction peripheral are authenticated in response to a user authentication request from the external device, and then the multifunction peripheral executes printing in response to a print request received via a network port that is not blocked under the zero trust mode. With this related art, a reliable external device is allowed to temporarily use the multifunction peripheral through various kinds of authentication.

SUMMARY

A terminal device brought in by an outsider does not necessarily have settings for guaranteeing safety. Therefore, usually, a terminal device brought in from the outside is not allowed to use an information processing system normally operated under a mode with security guaranteed. Still, it is convenient in some cases to at least temporarily enable a terminal device for which security may not be guaranteed to use the information processing system. Examples of such a case include that where data related to collaborative development stored in a terminal device brought by a collaborative developer is desired to be shared, and the like.

Aspects of non-limiting embodiments of the present disclosure relate to enabling an information processing system that is normally operated under a mode with security guaranteed to be temporarily used by a terminal device for which security may not be guaranteed.

According to an aspect of the present disclosure, there is provided an information processing system including a processor configured to: switch, in response to an instruction from a user, between a normal use mode with security guaranteed by using a predetermined security service over Internet and a temporary use mode in which communication in a directly connected state is allowed with communications over the Internet disabled; and allow use of an external terminal device only during an operation under the temporary use mode.

DETAILED DESCRIPTION

Hereinafter, a preferred exemplary embodiment of the present disclosure will be described with reference to the drawings.

FIG.1is an overall configuration diagram illustrating a network system1according to the present exemplary embodiment.FIG.1illustrates a configuration in which a cloud2and an on-premise environment3are connected to each other via Internet4. The cloud2provides a cloud service5with SASE, EDR, or the like for supporting establishment of a ZTNA environment (hereinafter, referred to as a “zero trust environment”) to a company or the like that aims to establish the zero trust environment based on the “zero trust” concept meaning that nothing is trusted without authentication.

The on-premise environment3is an in-house system environment of a company. In the on-premise environment3, a PC6individually used by a user such as an employee and a multifunction peripheral10shared by users are installed. Note that although one PC6and one multifunction peripheral10are illustrated inFIG.1, the number of these devices installed is not limited to this example, and may be any number that is one or more. The on-premise environment3according to the present exemplary embodiment is not provided with a firewall as illustrated inFIG.1in order to be adapted to the zero trust environment. Furthermore, permanent installation of LAN is avoided as much as possible. The PC6and the multifunction peripheral10are individually connected to the Internet4via a secure web gateway (SWG)7. The SWG7is a proxy for safe access to external communications such as the Internet4. The SWG7serves to protect a user from threats on the Internet4when the user uses a PC or the like not only in the on-premise environment3but also outside the on-premise environment3such as at home or in a shared office.

For the connection to the Internet4, for example, a mobile data communication technology may be used. An SASE agent or an EDR agent for using the cloud service5with SASE, EDR, or the like is installed in the information processors such as the PC6or the multifunction peripheral10installed in the on-premise environment3, for adaption to the zero trust environment.

The PC6may be implemented by a conventional general-purpose hardware configuration. That is, the PC6includes storage means such as a ROM, a RAM, and an HDD, user interfaces such as a mouse, a keyboard, and a touch panel, a network interface for performing data communications over the Internet4, wireless communication means for performing near field communications using WiFi (registered trademark), BLE, or the like with another PC6or the multifunction peripheral10present in the same on-premise environment3, and the like.

The multifunction peripheral10is one form of an image forming apparatus having various functions such as a print function, a copy function, and a scanner function, and having a built-in computer. The multifunction peripheral10according to the present exemplary embodiment may be implemented by a conventional general-purpose hardware configuration. That is, the multifunction peripheral10includes storage means such as a ROM, a RAM, and an HDD, a user interface such as an operation panel, a scanner or a printer for executing the above-described various functions, a network interface for performing data communications over the Internet4, wireless communication means for performing near field communications using WiFi, BLE, or the like with the PC6or another multifunction peripheral10present in the same on-premise environment3, and the like.

The following operation modes are prepared for the multifunction peripheral10according to the present exemplary embodiment: a “zero trust mode” as a normal operation mode; and a “guest mode” in which a mobile terminal device brought into the on-premise environment3from the outside is connected to the multifunction peripheral10so as to be temporarily available. Of course, other operation modes may be prepared.

The “zero trust mode” corresponds to a security mode with security guaranteed. In the multifunction peripheral10according to the present exemplary embodiment, the zero trust mode corresponds to an operation mode during the normal operation, that is, a normal use mode. The zero trust mode is an operation mode in which the cloud service5with SASE, EDR, or the like is available as a predetermined security service used over the Internet4in order to guarantee security.

A device having a network communication function, such as the PC6or the multifunction peripheral10illustrated inFIG.1, generally has one or a plurality of network ports, and performs data communications with another device via a predetermined network port. Still, in the zero trust environment using no firewall, a network port kept open leads to a risk of external attack. For this reason, under the zero trust mode, control is performed for reducing the open network ports as much as possible. Thus, only the network ports used for the use of the cloud service5or the like are opened, for example. In other words, control for forcible blocking is performed on the network ports other than the minimum necessary network ports. Thus, under the zero trust mode, restricting the opening of the network ports is a requirement for guaranteeing security. Note that other requirements for ensuring security include installation of an SASE or an EDR agent and the like.

As described above, the “guest mode” is an operation mode in which a mobile terminal device brought into the on-premise environment3from the outside can be connected to the multifunction peripheral10to be temporarily available. The guest mode corresponds to a temporary use mode in which communication in a directly connected state is allowed with communications over the Internet4disabled. The guest mode enables the use of a mobile terminal device brought in from the outside, meaning that the degree of guarantee of security should not be high as compared with the zero trust mode. Still, in order to maintain security as much as possible under the zero trust environment, various contrivances are made for environment settings.

Now, a comparison is made between the operation modes, that is, the zero trust mode and the guest mode. The difference between the operation modes is illustrated inFIG.2. It should be noted that, in the present exemplary embodiment, “deactivate”, “disable”, “prohibit”, and the like refer to states in which the functions cannot be exhibited, and all of them mean a “disabled” state. On the other hand, “start”, “enable”, “allow”, and the like refer to states in which the functions can be executed, and all of them mean an “enabled” state.

To begin with, connection to the Internet4is enabled under the zero trust mode, because the cloud service5with SASE, EDR, or the like or an Identity Provider (IdP) needs to be used for guaranteeing security. On the other hand, under the guest mode, connection to the Internet4is disabled in order to prevent information leakage or the like to the outside during use of a mobile terminal device brought in by a third party.

Near field communications are disabled under the zero trust mode, in order to more consistently guarantee security. In the present exemplary embodiment, the near field communications are assumed to be wireless communications by wireless LAN connection using WiFi Direct (registered trademark) (hereinafter, simply referred to as “WiFi connection”) or short-range wireless communication by Bluetooth (registered trademark) Low Energy (BLE). Of course, if the multifunction peripheral10can use other wireless communication functions, such functions are also included. On the other hand, under the guest mode, near field communications are enabled for realizing connection with a mobile terminal device brought in by a third party.

A zero trust agent function is active under the zero trust mode for guaranteeing security, but is inactive under the guest mode since the cloud service5cannot be used over the Internet4.

Under the zero trust mode and the guest mode, the minimum necessary network ports required for data communications are open and the other network ports are blocked.

Under the zero trust mode, the IdP can be used over the Internet4, and thus it is possible to identify which user has accessed what. On the other hand, under the guest mode, since the cloud service5cannot be used over the Internet4, basically, it is not possible to identify who has accessed what.

Note that the above comparison between the operation modes corresponds to the current technology for establishing the zero trust environment, and there may be a change driven by the development of the technology in the future. For example, improvement in the function of the SASE or EDR agent may enable the use of the zero trust agent function also under the guest mode. Furthermore, improvement in security may lead to the near field communications allowed under the zero trust mode. As described above, the difference in the setting items between the operation modes is not limited to that described above.FIG.2illustrates items related to the description of the present exemplary embodiment, and the same does not apply to the other items not illustrated inFIG.2.

FIG.3is a block configuration diagram illustrating the multifunction peripheral10according to the present exemplary embodiment. The multifunction peripheral10includes a user interface (UI) unit11, a setting processing unit12, a mode switching processing unit13, an Internet communication control unit14, a near field communication control unit15, a job execution control unit16, a control unit17, a transition setting information storage unit21, a job information storage unit22, and a backup storage unit23. Note that components not used in the description of the present exemplary embodiment are omitted in the drawings.

The user interface unit11receives a user input on an operation panel, and performs display on the operation panel. The setting processing unit12sets processing to be executed at the time of transition of each operation mode in response to an instruction from a user such as an administrator. The content set by the setting processing unit12is saved in the transition setting information storage unit21as transition setting information. The mode switching processing unit13switches the operation mode of the multifunction peripheral10in response to an instruction from a user of the multifunction peripheral10. In the case of the present exemplary embodiment, the switching is performed between the zero trust mode and the guest mode. The Internet communication control unit14performs communication control such as switching between the enabling and disabling of data communications over the Internet4. The near field communication control unit15performs communication control such as switching between the enabling and disabling of data communications using short-range wireless communication means. The near field communication control unit15according to the present exemplary embodiment is assumed to perform communication control to be executed by establishing WiFi connection with a mobile terminal device8brought in by an outsider.

The job execution control unit16controls execution of a job sent to the multifunction peripheral10. The job information storage unit22stores the sent job, job log, and the like. The control unit17controls operation of the components11to16described above. The backup storage unit23stores a backup file generated at the time of transition to the guest mode.

Each of the components11to17in the multifunction peripheral10is implemented by a cooperative operation of a computer provided in the multifunction peripheral10and a program operated by a CPU provided in the computer. Furthermore, each of the storage units21to23is implemented by an HDD provided in the multifunction peripheral10. Alternatively, a RAM may be used or, if possible, external storage means may be used via a network.

A program used in the present exemplary embodiment can be not only provided by communication means, but also provided by being stored in a computer-readable recording medium such as a USB memory. The programs provided from the communication means or the recording medium are installed in the computer, and the CPU of the computer sequentially executes the programs to implement various kinds of processing.

The “information processing system” is assumed to be configured by one multifunction peripheral10in the present exemplary embodiment as an example, but may be configured by a plurality of devices.

Next, an operation in the present exemplary embodiment will be described.

In the present exemplary embodiment, the operation mode of the multifunction peripheral10is set to the zero trust mode or the guest mode for operation according to the purpose of use. In the present exemplary embodiment, the operation mode is switched in response to an operation instruction from the user.

Note that in the present exemplary embodiment, in which two kinds of operation modes are prepared, “switching” the operation mode to the zero trust mode or the guest mode is synonymous with “transition” from one operation mode to another operation mode, that is, from the zero trust mode to the guest mode, or from the guest mode to the zero trust mode.

In the present exemplary embodiment, processes to be executed for transition of the operation mode to another operation mode are set in advance by an administrator or the like.

FIG.4is a diagram illustrating an example of a guest mode transition processing setting screen in the present exemplary embodiment. The setting processing unit12displays the guest mode transition processing setting screen on the operation panel in response to a predetermined operation by the administrator. To be precise, the user interface unit11receives an operation performed on the operation panel by the administrator, acquires the guest mode transition processing setting screen to be displayed in response to the operation from the setting processing unit12, and displays the guest mode transition processing setting screen on the operation panel. However, in the present exemplary embodiment, for convenience of description, the operation of the user interface unit11is omitted.

On the guest mode transition processing setting screen illustrated inFIG.4, processes to be executed in the processing of transition from the zero trust mode to the guest mode are displayed according to the order of execution of the processes. Among the processes to be executed, “disable Internet connection”, “deactivate agent”, and “enable near field communication” corresponding to black dots42are essential processes to be always executed at the time of transition to the guest mode. On the other hand, “security setting backup” and “cancel job under execution”, which are displayed in association with check boxes44, are additional processes. In the present exemplary embodiment, the administrator checks the check boxes44to select execution targets. The check boxes44on the guest mode transition processing setting screen illustrated inFIG.4correspond to an example where “security setting backup” is selected and “cancel job under execution” is not selected. Note that the detailed description of the processes will be given together with the description of the operation.

After setting the processes to be execution targets on the guest mode transition processing setting screen, the administrator selects an OK button46. In response to the selection of the OK button46, the setting processing unit12stores the contents set on the guest mode transition processing setting screen in the transition setting information storage unit21as guest mode transition setting information.

FIG.5is a view illustrating an example of a zero trust mode transition processing setting screen in the present exemplary embodiment. The setting processing unit12displays the zero trust mode transition processing setting screen on the operation panel in response to a predetermined operation by the administrator.

On the zero trust mode transition processing setting screen illustrated inFIG.5, processes to be executed in the processing of transition from the guest mode to the zero trust mode are displayed according to the order of execution of the processes. Among the processes to be executed, “disable near field communication”, “delete job-related data”, “activate agent”, and “enable Internet connection” corresponding to the black dots42are essential processes to be always executed at the time of transition to the zero trust mode. On the other hand, “check change in security setting” and “restore security setting”, which are displayed in association with the check boxes44, are additional processes. The check boxes44on the zero trust mode transition processing setting screen illustrated inFIG.5correspond to an example where “restore security setting” is selected by the administrator, and “check change in security setting” is not selected by the administrator. Note that the detailed description of the processes will be given together with the description of the operation.

Note that in the present exemplary embodiment, the check boxes44are associated with some processes so that the administrator can select processes to be executed at the time of transition of the operation mode, but the processing is not necessarily performed so as to be selected, and may be automatically performed like the processes corresponding to the black dots42.

After setting the processes to be execution targets on the zero trust mode transition processing setting screen, the administrator selects an OK button48. In response to the selection of the OK button48, the setting processing unit12stores the contents set on the zero trust mode transition processing setting screen in the transition setting information storage unit21as zero trust mode transition setting information.

As is clear from reference to the respective setting screens illustrated inFIG.4andFIG.5, the processes executed in the zero trust mode transition processing are basically paired with the processes executed in the guest mode transition processing, to restore the setting for enabling/disabling activating/deactivating in the guest mode transition processing. Furthermore, the order of the processes executed in the zero trust mode transition processing is basically opposite to the order of the processes executed in the guest mode transition processing.

Note that the above-described configuration of the processes executed at the time of mode transition is merely an example, and should not necessarily be construed in a limiting sense. For example, the configuration may be made in accordance with the setting content at the time of establishing the zero trust environment in the future.

Next, the mode switching processing in the present exemplary embodiment will be described with reference to the flowchart illustrated inFIG.6.

The execution of the mode switching processing in the present exemplary embodiment starts in response to the activation of the multifunction peripheral10, and the mode switching processing is constantly executed while the multifunction peripheral10is in operation. Furthermore, the multifunction peripheral10according to the present exemplary embodiment operates and is managed under the zero trust mode during the normal operation (step S101). That is, the multifunction peripheral10is in a state with security guaranteed. Specifically, the SASE or EDR agent installed in the multifunction peripheral10effectively operates, and performs the soundness management or the like for the multifunction peripheral10in a state where the cloud service5with SASE or EDR can be used over the Internet4. Furthermore, the multifunction peripheral10can perform user authentication by using the IdP that is accessible over the Internet4. Furthermore, since the SASE or EDR agent is installed in an information processor that can use the multifunction peripheral10over the Internet4, security can be maintained. The multifunction peripheral10is in a state in which the multifunction peripheral10can execute the job sent thereto, under such a zero trust environment that can prevent and detect unauthorized access. On the other hand, the multifunction peripheral10disables the near field communication function to prohibit communications with devices directly connected to the multifunction peripheral10.

The operation under the zero trust mode described above continues until a mode switching instruction is given from the user (N in step S102).

Here, when a user who has brought the mobile terminal device8wants to use the multifunction peripheral10, the user operates the operation panel to display a guest mode transition instruction screen. It is assumed that the SASE or EDR agent is not installed in the mobile terminal device8.

FIG.7is a diagram illustrating an example of the guest mode transition instruction screen in the present exemplary embodiment. By referring to the guest mode transition instruction screen, the user recognizes that the multifunction peripheral10is currently operating under the zero trust mode, and if the user wants to make a transition from the zero trust mode to the guest mode, the user selects an execution button50.

The user interface unit11receives the selection of the execution button50on the guest mode transition instruction screen as a mode switching instruction. In this way, when the mode switching instruction is issued from the user (Y in step S102), the mode switching processing unit13executes the guest mode transition processing described below (step S103). That is, the mode switching processing unit13reads the guest mode transition setting information stored in the transition setting information storage unit21, and executes the guest mode transition processing according to the read guest mode transition setting information.

Referring to the setting example based on the display content on the guest mode transition processing setting screen illustrated inFIG.4as the guest mode transition setting information, the mode switching processing unit13first performs the security setting backup selected as an option. That is, the mode switching processing unit13acquires information on security currently set for the multifunction peripheral10, generates a backup file, and stores the backup file in the backup storage unit23.

In the present exemplary embodiment, the setting content to be backed up in the multifunction peripheral10is limited to the information related to the security for the sake of maintenance of the security guaranteed, but such a limitation may be lifted, and the information related to an attribute other than the security may be included, or all the settings for the multifunction peripheral10may be backed up.

Next, the mode switching processing unit13performs disconnection from the Internet4to stop the data communication over the Internet4. As a result, the multifunction peripheral10can no longer use the cloud service5using the SASE or EDR agent. Therefore, the mode switching processing unit13subsequently deactivates the agent. Finally, the mode switching processing unit13enables near field communications that are currently disabled.

When the execution of the guest mode transition processing in the mode switching processing unit13is finished, the multifunction peripheral10transitions to the guest mode, and the operation starts under the guest mode (step S104).

Note that while it is assumed that the mode transitions from the zero trust mode to the guest mode when the execution of the guest mode transition processing is finished, reboot may occur as necessary after the transition processing. Further, the current operation mode may be managed using flag data or the like. In this case, when the mode switching processing unit13finishes the execution of the last process, the control unit17may update the setting of the flag information for the mode management to notify other functions or other devices of the multifunction peripheral10, of the current operation mode being the guest mode.

Now, a case is described where “cancel job under execution” is selected, even though “cancel job under execution” is not executed in the guest mode transition processing according to the guest mode transition processing setting screen illustrated as an example inFIG.4.

The multifunction peripheral10executes the job accepted during the operation under the zero trust mode, but in a case where there is a job under execution when the mode switching instruction is received, the multifunction peripheral10can make a setting on how such a job under execution should be handled. That is, in a case where “cancel job under execution” is selected, if there is a job under execution, the mode switching processing unit13causes the job execution control unit16to forcibly cancel the job. Thus, the job under execution is controlled so as not to be executed in both the zero trust mode and the guest mode. When a job being executed during the operation under the zero trust mode continues to be executed under the guest mode, there is a risk in that the job under execution is altered with malicious intent during the operation under the guest mode. By preventing such a fraudulent act in advance, it is possible to prevent leakage of information held by the multifunction peripheral10in advance.

On the other hand, in a case where “cancel job under execution” is not selected, when there is a job under execution, the control unit17waits until the execution of the job ends without causing the job execution control unit16to forcibly cancel the job, and makes the operation mode transition from the zero trust mode to the guest mode after confirming the end of the execution of the job. Alternatively, the control unit17may perform control to implement the transition to the guest mode after waiting for the end of a process over the Internet4in the job, instead of the end of the job under execution. This is because the process over the Internet4may be non-cancelable before its completion, or a correct execution result of the job may fail to be obtained if the process over the Internet4is cancelled before its completion.

As described above, in order to perform control to prevent the job under execution from being executed in both the zero trust mode and the guest mode, the control unit17performs control to forcibly terminate the job under execution or to transition to the guest mode after the execution of the job is finished.

Alternatively, instead of controlling the execution of the job under execution as described above, the control unit17may perform control to stop the transition to the guest mode when there is a job under execution. When there is no job under execution, the control unit17does not need to perform special job-related control.

As described above, when the operation mode of the multifunction peripheral10is switched to the guest mode, the multifunction peripheral10is not allowed to perform data communications over the Internet4, and thus cannot use the cloud service5with SASE or EDR. On the other hand, the near field communication function is enabled. Therefore, the user performs a predetermined operation on the mobile terminal device8to establish a WiFi connection between the mobile terminal device8and the multifunction peripheral10. This connection may be established by a conventional method. When the mobile terminal device8is directly connected to the multifunction peripheral10, the user can use the multifunction peripheral10. For example, the user can transmit a job such as printing from the mobile terminal device8to the multifunction peripheral10to execute the job. The operation under the guest mode continues as long as a mode switching instruction is not issued from the user (N in step S105).

Here, when a user such as an outsider who has brought the mobile terminal device8finishes using the multifunction peripheral10, the user operates the operation panel to display a zero trust mode transition instruction screen.

FIG.8is a diagram illustrating an example of the zero trust mode transition instruction screen in the present exemplary embodiment. By referring to the zero trust mode transition instruction screen, the user recognizes that the multifunction peripheral10is currently operating under the guest mode, and if the user wants to make a transition from the guest mode to the zero trust mode, the user selects an execution button52.

The user interface unit11receives the selection of the execution button52on the zero trust mode transition instruction screen as a mode switching instruction. In this way, when the mode switching instruction is issued from the user (Y in step S105), the mode switching processing unit13executes the zero trust mode transition processing described below (step S106). That is, the mode switching processing unit13reads the zero trust mode transition setting information stored in the transition setting information storage unit21, and executes the zero trust mode transition processing according to the read zero trust mode transition setting information.

Referring to the setting example based on the display content of the zero trust mode transition processing setting screen illustrated inFIG.5as the zero trust mode transition setting information, the mode switching processing unit13first disables the near field communications currently enabled.

Subsequently, the mode switching processing unit13deletes, as job-related data, a job generated during operation under the guest mode, data generated by execution of the job, and the like. This is for preventing in advance destruction of information held in the multifunction peripheral10, the leakage of information over the Internet4to which connection is established after the transition to the zero trust mode, or the like in a case where data to be left in the multifunction peripheral10is an unauthorized application or the like. A log or the like generated through the normal use of a function of the multifunction peripheral10may not be deleted.

In the present exemplary embodiment, the data to be deleted is limited to the data related to the job, but such limitation may be lifted, and all the data generated during the operation under the guest mode, i.e., after the transition from the zero trust mode to the guest mode and before the transition to the zero trust mode again may be deleted.

Subsequently, the mode switching processing unit13performs security setting restoration selected as an option. That is, the mode switching processing unit13retrieves and restores the backup file generated at the time of transition to the guest mode and stored in the backup storage unit23. Thus, even if the security-related information is rewritten during the operation under the guest mode, the rewritten content can be restored to the setting before the transition to the guest mode, that is, during the operation under the immediately preceding zero trust mode without being reflected in the operation under the zero trust mode after the transition. Thus, it is possible to avoid the influence of the content whose setting has been changed during the operation under the guest mode. Since the backup file includes at least information related to security for the sake of maintenance of the security guaranteed, at least a state with security guaranteed is ensured after the transition to the operation under the zero trust mode.

Subsequently, the mode switching processing unit13activates the agent. Finally, the mode switching processing unit13enables the connection to the Internet4, thereby enabling data communication over the Internet4. Thus, the multifunction peripheral10becomes able to use the cloud service5using the SASE or EDR agent activated, and a state with security guaranteed is restored.

When the execution of the zero trust mode transition processing in the mode switching processing unit13is finished, the multifunction peripheral10transitions to the zero trust mode, and the operation under the zero trust mode starts (step S101). When the mode switching processing unit13finishes the execution of the last process, the control unit17may update the setting of the above-described flag information for the mode management to notify other functions or other devices of the multifunction peripheral10, of the current operation mode being the zero trust mode.

Now, a case is described where “check change in security setting” is selected, even though “check change in security setting” is not executed in the zero trust mode transition processing according to the zero trust mode transition processing setting screen illustrated as an example inFIG.5.

Similarly to the above-described “restore security setting”, “check change in security setting” is a process for preventing a change in the setting content made during the operation under the guest mode from being reflected on the operation under the zero trust mode after the transition. In addition, as in the case of the above-described “restore security setting”, the backup file generated at the time of the guest mode transition processing is also required in this process. In other words, unless “security setting backup” is selected on the guest mode transition processing setting screen, “check change in security setting” and “restore security setting” are processes that cannot be executed.

Similarly to the backup of the security setting at the time of the guest mode transition processing, the mode switching processing unit13backs up the security setting under the current guest mode, in other words, the security setting before the transition to the zero trust mode. Next, the mode switching processing unit13checks the backup file thus acquired with the backup file stored in the backup storage unit23. In a case where there is a difference in the setting content of the multifunction peripheral10between before and after the operation under the guest mode, in other words, in a case where there is inconsistent information, the mode switching processing unit13executes a predetermined process. As the predetermined process, the mode switching processing unit13extracts, for example, inconsistent information and displays the information in the form of a list on the operation panel. Alternatively, the information may be written and saved in a log file. In this way, the administrator is notified of the difference in the setting content of the multifunction peripheral10between before and after the operation under the guest mode. The administrator can check the item whose setting value has been changed by referring to the operation panel or the log file. If the change in the setting value has been fraudulently made, the fraud can be recognized. Alternatively, the mode switching processing unit13may stop the transition to the zero trust mode as the predetermined process. As a result, it is possible to prevent in advance a failure to operate normally after the transition to the zero trust mode. In this case, the administrator needs to take some measures for the transition to the zero trust mode.

During the operation under the guest mode, the cloud service5with SASE or the like is not available and thus the multifunction peripheral10does not correspond to the zero trust environment. Such a situation cannot be regarded as a state with security sufficiently guaranteed. Still, such a situation is free of attack over the Internet4. Since only access from the mobile terminal device8is accepted, if any fraud is detected, it can be estimated to be a fraud using the mobile terminal device8.

In a case where the administrator selects “restore security setting”, the state at the time of the operation under the zero trust mode immediately before the transition to the guest mode is unconditionally restored. Therefore, even in a case where the setting content is changed during the operation under the guest mode, such a change imposes no influence at all. Still, the change in the setting content made during the operation under the guest mode is not detected. Thus, whether a change is made cannot be detected.

On the other hand, when the administrator selects “check change in security setting”, a change in the setting content made during the operation under the guest mode can be detected, and the content, that is, the setting values before and after the change can also be checked. However, regardless of whether the changed setting content is reflected at the time of operation under the zero trust mode or the original setting content is restored without reflecting the changed setting content, it is necessary to take some measures before transition to the zero trust mode.

According to the present exemplary embodiment, even an outsider can temporarily use the multifunction peripheral10by allowing the multifunction peripheral10to operate under the guest mode. Under the guest mode, the security is maintained as much as possible, by accepting and executing only a job from the mobile terminal device8directly connected to the multifunction peripheral10, disabling connection to the Internet4, and the like. Still, as described above, the on-premise environment3is not a zero trust environment during the operation under the guest mode. Therefore, reliable defense against fraud performed by the user of the mobile terminal device8may fail to be achieved.

In view of this, in the present exemplary embodiment, the function of deleting the data generated during the operation under the guest mode, the function of restoring the backup file generated during the operation under the zero trust mode to restore the original setting, and the function of detecting a change made in the setting of the multifunction peripheral10are provided before the transition from the guest mode to the zero trust mode. Thus, the information generated and the setting changed during the operation under the guest mode can be prevented from being reflected under the zero trust mode. As a result, under the zero trust mode, a state with security guaranteed can be firmly maintained.

In the above exemplary embodiment, the processor refers to a processor in a broad sense, and includes a general-purpose processor (such as, for example, a central processing unit (CPU)) and a dedicated processor (such as, for example, a graphics processing unit (GPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or a programmable logic device).

The operation of the processor in the above-described exemplary embodiment may be performed not only by one processor but also by a plurality of processors located at physically separated positions and cooperating with each other. Furthermore, the order of the operations of the processor is not limited to the order described in the above exemplary embodiment only, and may be appropriately changed.

APPENDIX

An information processing system comprising: a processor configured to:switch, in response to an instruction from a user, between a normal use mode with security guaranteed by using a predetermined security service over Internet and a temporary use mode in which communication in a directly connected state is allowed with communications over the Internet disabled, andallow use of an external terminal device only during an operation under the temporary use mode.(((2)))

The information processing system according to (((1))), wherein the information processing system transitions to the temporary use mode after the processor backs up a setting content of the information processing system during an operation under the normal use mode.(((3)))

The information processing system according to (((1)) or (((2))), wherein, when the information processing system transitions from the temporary use mode to the normal use mode, the processor is configured to perform a process to prevent a change in a setting content made under the temporary use mode from being reflected under the normal use mode.(((4)))

The information processing system according to (((3))), wherein, when the information processing system transitions from the temporary use mode to the normal use mode, the processor is configured to restore the backed-up setting content in the information processing system and then starts the operation under the normal use mode.(((5)))

The information processing system according to (((3))), wherein, when the information processing system transitions from the temporary use mode to the normal use mode, the processor is configured to execute a predetermined process in a case where the setting content of the information processing system operating under the temporary use mode is different from the backed-up setting content.(((6)))

The information processing system according to (((5))), wherein the predetermined process is a process of issuing a notification to an administrator.(((7)))

The information processing system according to (((5))), wherein the predetermined process is a process of stopping the transition to the normal use mode.(((8)))

The information processing system according to any one of (((1))) to (((7))), wherein, in a case where there is a job under execution when the information processing system transitions from the normal use mode to the temporary use mode, the processor is configured to perform control to prevent the job from being executed in both the normal use mode and the temporary use mode.(((9)))

The information processing system according to (((8))), wherein the processor is configured to perform control to implement the transition to the temporary use mode after waiting for end of the job under execution or end of a process performed over the Internet in the job.(((10)))

The information processing system according to (((8))), wherein the processor is configured to perform control to stop the transition to the temporary use mode.(((11)))

The information processing system according to (((8))), wherein the processor is configured to forcibly terminate the job under execution.(((12)))

The information processing system according to any one of (((1))) to (((11))), wherein, when the information processing system transitions from the temporary use mode to the normal use mode, the processor is configured to delete data generated during the operation under the temporary use mode.(((13)))

A program causing a computer to execute a process comprising:switching, in response to an instruction from a user, between a normal use mode with security guaranteed by using a predetermined security service over the Internet and a temporary use mode in which communication in a directly connected state is allowed with communications over the Internet disabled; andallowing use of an external terminal device only during an operation under the temporary use mode.