JP2025083891A - Information processing device, vulnerability information utilization method, and vulnerability information utilization program - Google Patents

Abstract

To extract vulnerability information suitable for an image forming apparatus.SOLUTION: An information processing device that manages an image forming apparatus includes a vulnerability information acquiring unit 51 that acquires vulnerability information related to vulnerabilities, a function information acquiring unit 53 that acquires function information related to functions that can be executed by the image forming apparatus, and a determining unit 57 that determines the validity of the vulnerability information on the basis of the function information.SELECTED DRAWING: Figure 4

Description

This invention relates to an information processing device, a vulnerability information utilization method, and a vulnerability information utilization program, and in particular to an information processing device that manages an image forming device that executes a program, a vulnerability information utilization method executed by the information processing device, and a vulnerability information utilization program that causes a computer to execute the vulnerability information utilization method.

In recent years, image forming equipment installed in workplaces is connected to the Internet. For this reason, it is necessary to prevent attacks such as computer viruses that are expected to invade from the Internet. Security information indicating vulnerabilities is published on the Internet. Since there is a huge amount of this security information, it is difficult to select the necessary security information from among it.

For example, Japanese Patent Application Laid-Open No. 2003-256370 describes a security information distribution method that includes a step of searching information providing sites to acquire security information, a step of selecting, for each user, from the acquired security information by referring to user information, information to be notified, and a step of transmitting the selected security information to the notification destination, in which the step of selecting security information selects information to be notified based on the reliability of each information providing site assigned to that information providing site and the risk of the security information itself.

However, in the security information distribution method described in JP 2003-256370 A, in order to select security information, the reliability of each information providing site and the risk of the security information itself must be registered in advance. Also, in a device for which security is to be strengthened, unnecessary security information may be selected, in which case the device will be confronted with unnecessary security information.

JP 2003-256370 A

This invention has been made to solve the above-mentioned problems, and one of the objects of this invention is to provide an information processing device capable of extracting vulnerability information suitable for an image forming device.

Another object of the present invention is to provide a method for using vulnerability information that can extract vulnerability information suitable for an image forming device.

Yet another object of the present invention is to provide a vulnerability information utilization program capable of extracting vulnerability information suitable for an image forming device.

According to one aspect of the present invention, in order to achieve the above-mentioned object, an information processing device is an information processing device that manages an image forming device, and includes a vulnerability information acquisition means that acquires vulnerability information related to vulnerabilities, a function information acquisition means that acquires function information related to functions that the image forming device can execute, and a determination means that determines the validity of the vulnerability information based on the function information.

According to another aspect of the present invention, a vulnerability information utilization method is a vulnerability information utilization method executed by an information processing device that manages an image forming device, and causes the information processing device to execute a vulnerability information acquisition step of acquiring vulnerability information related to vulnerabilities, a function information acquisition step of acquiring function information related to functions that the image forming device can execute, and a determination step of determining the validity of the vulnerability information based on the function information.

According to yet another aspect of the present invention, the vulnerability information utilization program is a vulnerability information utilization program executed by a computer that manages an image forming device, and causes the computer to execute a vulnerability information acquisition step of acquiring vulnerability information related to vulnerabilities, a function information acquisition step of acquiring function information related to functions that the image forming device can execute, and a determination step of determining the validity of the vulnerability information based on the function information.

1 is a diagram showing an example of an overall outline of an image forming system according to an embodiment of the present invention; 2 is a block diagram showing an example of an outline of the hardware configuration of a PC according to the present embodiment. FIG. 1 is a block diagram showing an outline of a hardware configuration of an MFP according to an embodiment of the present invention. 2 is a block diagram showing an example of functions of a CPU included in a PC according to the present embodiment. FIG. FIG. 11 is a diagram illustrating an example of function information. FIG. 4 is a diagram illustrating an example of program information. FIG. 13 is a diagram illustrating an example of a common keyword. 13 is a flowchart showing an example of the flow of a vulnerability information utilization process. 13 is a flowchart showing an example of the flow of a function keyword generation process.

Below, an embodiment of the present invention will be described with reference to the drawings. In the following description, identical parts are given the same reference numerals. Their names and functions are also the same. Therefore, detailed descriptions thereof will not be repeated.

FIG. 1 is a diagram showing an example of an overall overview of an image forming system according to one embodiment of the present invention. Referring to FIG. 1, image forming system 1 includes one or more MFPs (Multi Function Peripherals) 100 and a personal computer (hereinafter referred to as "PC") 200. Here, an example will be described in which image forming system 1 includes five MFPs 100, 100A to 100D. MFPs 100, 100A to 100D have in common the fact that they have the same hardware configuration, but the programs installed therein may be the same or different. The programs installed in each of MFPs 100, 100A to 100D include programs for controlling the hardware included therein, as well as programs for processing image data and other application programs. Note that the hardware configurations of MFPs 100, 100A to 100D may differ from each other.

PC 200 is an example of an information processing device, and is a general computer. MFPs 100, 100A to 100D are examples of image forming devices. MFPs 100, 100A to 100D and PC 200 are each connected to network 3. Therefore, MFPs 100, 100A and PC 200 can communicate with each other.

Network 3 is a local area network (LAN). Note that network 3 is not limited to a LAN, and may be a wide area network (WAN) or the Internet. Network 3 is connected to Internet 5 via G/W 7. Server 300 is connected to Internet 5. Therefore, MFP 100, 100A, and PC 200 can communicate with server 300 connected to Internet 5 via G/W 7.

FIG. 2 is a block diagram showing an example of an outline of the hardware configuration of a PC in this embodiment. Referring to FIG. 2, the PC 200 includes a CPU 201 for controlling the entire PC 200, a ROM 202, a RAM 203, a hard disk drive (HDD) 204, a communication unit 205, a display unit 206, an operation unit 207, and an external storage device 209.

The ROM 202 stores programs to be executed by the CPU 201. The RAM 203 is used as a working area for the CPU 201. The HDD 204 is a large-capacity storage device that stores data in a non-volatile manner. A solid-state drive (SSD) may be used instead of the HDD 204. The communication unit 205 connects the CPU 201 to the network 3. The operation unit 207 accepts operations input by a user. The display unit 206 is, but is not limited to, a liquid crystal display device. Note that an organic electroluminescence (EL) display may be used instead of the liquid crystal display device.

A CD-ROM (Compact Disk Read Only Memory) 209A is attached to the external storage device 209. In this embodiment, an example will be described in which the CPU 201 executes a program stored in the ROM 202. However, the CPU 201 may also control the external storage device 209 to read a program for the CPU 201 to execute from the CD-ROM 209A, store the read program in the RAM 203, and execute it.

The recording medium for storing the programs executed by CPU 201 is not limited to CD-ROM 209A, but may be a medium such as a flexible disk, cassette tape, optical disk (MO (Magnetic Optical Disc)/MD (Mini Disc)/DVD (Digital Versatile Disc)), IC card, optical card, mask ROM, semiconductor memory such as EPROM (Erasable Programmable ROM). Furthermore, CPU 201 may load a program stored in HDD 204 into RAM 203 and execute it by CPU 201. The programs stored in HDD 204 include programs downloaded by CPU 201 from a computer connected to the Internet, or programs written to HDD 204 by a computer connected to the Internet. The programs referred to here include not only programs that can be executed directly by the CPU 201, but also source programs, compressed programs, encrypted programs, etc.

In this embodiment, MFPs 100 and 100A to 100D have the same hardware configuration. Here, the hardware configuration will be explained using MFP 100 as an example.

Fig. 3 is a block diagram showing an outline of the hardware configuration of the MFP in this embodiment. Referring to Fig. 3, the MFP 100 includes a main circuit 110, a document reading unit 130, an automatic document feeder 120, an image forming unit 140, a paper feed unit 150, and an operation panel 160. The document reading unit 130 reads a document. The automatic document feeder 120 transports the document to the document reading unit 130. The image forming unit 140 forms an image on paper or the like based on image data that the document reading unit 130 reads and outputs from the document. The paper feed unit 150 supplies paper to the image forming unit 140. The operation panel 160 is a user interface.

The automatic document feeder 120 automatically transports multiple documents set on a document tray one by one to a predetermined document reading position set on the platen glass of the document reading unit 130. The automatic document feeder 120 discharges the document, from which the image formed on the document has been read by the document reading unit 130, to a document output tray. The document reading unit 130 includes a light source that irradiates light onto the document transported to the document reading position, and a photoelectric conversion element that receives light reflected by the document, and scans the document image according to the size of the document. The photoelectric conversion element converts the received light into image data, which is an electrical signal, and outputs it to the image forming unit 140. The paper feed unit 150 transports paper stored in the paper feed tray to the image forming unit 140.

The image forming unit 140 forms an image by a known electrophotographic method. The image forming unit 140 performs various data processing such as shading correction on the image data input from the document reading unit 130. The image forming unit 140 forms an image on paper transported by the paper feed unit 150 based on the image data after data processing or image data received from the outside, and discharges the paper on which the image has been formed to a paper output tray. The image forming unit 140 has a paper inversion path and can form images on both sides of the paper. The paper inversion path is a path that inverts the front and back of a paper on which an image has been formed on one side (front side) by the image forming unit 140 and leads the paper to the image forming unit 140. As a result, the image forming unit 140 forms an image on the other side (back side) of the paper supplied from the paper inversion path.

The main circuit 110 includes a CPU 111, a communication interface (I/F) unit 112, a ROM 113, a RAM 114, a HDD 115, a facsimile unit 116, and an external storage device 117. The HDD 115 is a large-capacity storage device. A solid-state drive (SSD) may be used instead of the HDD 115. The CPU 111 is connected to the automatic document feeder 120, the document reading unit 130, the image forming unit 140, the paper feed unit 150, and the operation panel 160, and controls the entire MFP 100.

Facsimile unit 116 is connected to the public switched telephone network (PSTN) and transmits facsimile data to the PSTN. Facsimile unit 116 also receives facsimile data from the PSTN. Facsimile unit 116 stores the received facsimile data in HDD 115, converts it to print data that can be printed by image forming unit 140, and outputs it to image forming unit 140. As a result, image forming unit 140 forms an image on paper from the facsimile data received by facsimile unit 116. Facsimile unit 116 also converts the data stored in HDD 115 into facsimile data and transmits it to a facsimile device connected to the PSTN.

The communication I/F unit 112 is an interface for connecting the MFP 100 to the network 3. The communication I/F unit 112 communicates with the PC 200 connected to the network 3 using a communication protocol such as TCP (Transmission Control Protocol) or FTP (File Transfer Protocol).

The ROM 113 stores the programs executed by the CPU 111, or data necessary to execute the programs. The RAM 114 is used as a working area when the CPU 111 executes the programs. The RAM 114 also temporarily stores the scanned images continuously sent from the document reading unit 130.

Operation panel 160 is provided on the top surface of MFP 100. Operation panel 160 includes display unit 161 and operation unit 163. Display unit 161 is, for example, a liquid crystal display (LCD), and displays an instruction menu for the user, information related to acquired image data, and the like. Note that instead of an LCD, for example, an organic EL display may be used as long as it is a device that displays images.

The operation unit 163 includes a touch panel 165 and a hard key unit 167. The touch panel 165 is of a capacitance type. Note that the touch panel 165 is not limited to a capacitance type, and other types such as a resistive film type, a surface acoustic wave type, an infrared type, and an electromagnetic induction type can be used. The hard key unit 167 includes a plurality of hard keys. The hard keys are, for example, contact switches.

CPU 111 executes a print job. When executing a print job, CPU 111 generates image data. CPU 111 executes image processing on the image data. CPU 111 outputs the image data after image processing to image forming unit 140, and causes image forming unit 140 to form an image of the image data on paper. The image data is, for example, raster data. A print job includes data to be printed and printing conditions. The data to be printed may be data in bitmap format or application data. The data to be printed includes data for one or more pages. The printing conditions include storage conditions, aggregation conditions, and forming surface conditions. The storage conditions are conditions that determine whether a print job is accumulated without being executed, or whether a print job is executed without being accumulated. The aggregation conditions are conditions that determine the number of pages on which images are formed on one sheet of paper. The forming surface conditions are conditions that determine whether an image is formed on both sides of the paper or on only the front side. The CPU 111 generates image data from the data to be printed, which is included in the print job, according to the printing conditions included in the print job, and outputs the image data to the image forming unit 140.

The external storage device 117 is controlled by the CPU 111, and has a CD-ROM 118 attached thereto. In this embodiment, an example will be described in which the CPU 111 executes a program stored in the ROM 113. Note that the CPU 111 may control the external storage device 117 to read a program from the CD-ROM 118 for the CPU 111 to execute, store the read program in the RAM 102, and execute it.

Figure 4 is a block diagram showing an example of the functions of a CPU included in a PC in this embodiment. The functions shown in Figure 4 may be realized by hardware. Also, the functions may be realized by CPU 201 included in PC 200 by having CPU 201 execute a vulnerability information utilization program stored in ROM 202, HDD 204, or CD-ROM 209A.

Referring to FIG. 4, the CPU 201 of the PC 200 has a vulnerability information acquisition unit 51, a function information acquisition unit 53, a keyword registration unit 54, an extraction unit 55, a determination unit 57, a notification unit 59, and a prohibition unit 61. The vulnerability information acquisition unit 51 acquires vulnerability information from the outside and outputs the acquired vulnerability information to the extraction unit 55. The vulnerability information is information including defects in information security caused by defects or design errors in the programs installed in the MFPs 100 and 100A to 100D. The programs installed in the MFPs 100 and 100A to 100D include an operating system, a control program, and application programs such as an image processing program. When a program with a vulnerability identified by the vulnerability information is executed in the MFP 100, there is a risk that the program may be used for unauthorized access or may be infected with a computer virus. The vulnerability information is information notifying the risk, and is provided by the vendor who created the program, the vendor of the antivirus software, etc. Generally, vulnerability information is often published by vendors on the Internet 5. It may also be sent by vendors via email, etc.

The vulnerability information acquisition unit 51 has an information acceptance unit 71 and an information receiving unit 73. The information acceptance unit 71 controls the operation unit 207 and accepts operations input by the user to the operation unit 207. The information acceptance unit 71 acquires vulnerability information based on the operations accepted by the operation unit 207. The user's operation may indicate the location where the vulnerability information is stored. The information acceptance unit 71 acquires vulnerability information based on the location. The location where the vulnerability information is stored includes a URL, which is a network address, and a file name indicating the location in the HDD 204. The vulnerability information stored in the HDD 204 includes information directly input by the user from the operation unit 207, as well as information downloaded from a server 300 connected to the Internet 5. The data format of the vulnerability information is not limited, but may be a web page such as HTML, text data, or PDF (Portable Document Format) data.

When the information receiving unit 71 receives a URL, it controls the communication unit 205 to download the vulnerability information identified by the URL. The downloaded vulnerability information is stored in the HDD 204. When the information receiving unit 71 receives a file name, it reads out the vulnerability information stored in the HDD 204.

The information receiving unit 73 receives vulnerability information from outside. For example, when vulnerability information is transferred as a file from outside, the information receiving unit 73 controls the communication unit 205 to receive the vulnerability information transmitted from outside and stores the received vulnerability information in the HDD 204. When vulnerability information is transmitted by email, the information receiving unit 73 controls the communication unit 205 to receive the email and stores the vulnerability information included in the received email in the HDD 204.

The function information acquisition unit 53 acquires function information from each of the MFPs 100, 100A to 100D. The function information acquisition unit 53 outputs the function information of each of the MFPs 100, 100A to 100D to the determination unit 57. The function information acquisition unit 53 includes a setting function acquisition unit 81 and a program information acquisition unit 83. The setting function acquisition unit 81 acquires function information from each of the MFPs 100, 100A to 100D.

The function information is information indicating which functions the device has and whether the functions can be executed. Here, the function information includes function identification information for identifying the functions that each of MFPs 100, 100A to 100D has, and setting information indicating whether the functions can be executed. The functions are determined by the programs installed in each of MFPs 100, 100A to 100D. For example, there is a program for sending and receiving e-mail, and when this program is executed, there are functions for receiving e-mail, encrypting received data, sending e-mail, and encrypting e-mail to be sent. There is also a program for sending and receiving data according to the S/MIME (Secure/Multipurpose Internet Mail Extensions) standard, and when this program is executed, there are functions for sending and receiving data, a digital signature function, a function for identifying the digital signature format, and a function for encrypting data.

The setting information includes, for a function, a setting value that indicates that the function is to be executed and a setting value that is set to execute the function.

The program information acquisition unit 83 acquires program information about the programs installed in each of the MFPs 100, 100A-100D. The program information is part of the function information. The program information includes program identification information for identifying the program and function information for the functions realized when the program is executed.

Figure 5 is a diagram showing an example of function information. The function information shown in Figure 5 shows an example of function information acquired from MFP 100. With reference to Figure 5, function identification information and setting values are associated with each function name.

The function name "E-mail Reception (POP)" is associated with the function identification information "E-mail Reception Settings (POP)" and "SSL Usage Settings." The setting value "Enabled" is associated with the function identification information "E-mail Reception Settings (POP)." This association indicates that the function for receiving e-mail using the standard defined by POP is enabled. The setting value "Enabled" is associated with the function identification information "SSL Usage Settings." This association indicates that data encrypted using the SSL (Secure Sockets Layer) protocol is supported when receiving e-mail using the protocol defined by POP (Post Office Protocol).

The function name "E-mail sending (SMTP)" is associated with the function identification information "E-mail sending settings (SMTP)" and "SSL usage settings." The setting value "enabled" is associated with the function identification information "E-mail sending settings (SMTP)." This association indicates that the function for sending e-mail using the protocol defined by SMTP (Simple Mail Transfer Protocol) is enabled. The setting value "enabled" is associated with the function identification information "SSL usage settings." This association indicates that encryption using SSL is supported when sending e-mail using the protocol defined by SMTP.

The function name "S/MIME" is associated with the function identification information "S/MIME communication settings," "digital signature," "digital signature format," and "encryption type of email body." The setting value "enabled" is associated with the function identification information "S/MIME communication settings." This association indicates that the function for sending and receiving email using the protocol defined by S/MIME (Secure/Multipurpose Internet Mail Extensions) is enabled. The setting value "enabled" is associated with the function identification information "digital signature." This association indicates that the standard for attaching a digital signature to email is supported. The setting value "SH-1" is associated with the function identification information "digital signature format." This association indicates that a digital signature is attached to email in the "SH-1" format. The setting value "3DES" is associated with the function identification information "encryption type of email body." This association indicates that the body of the email will be encrypted using the 3DES (Data Encryption Standard) standard.

The function name "LDAP" is associated with the function identification information "LDAP usage setting" and "SSL usage". The setting value "Disabled" is associated with the function identification information "LDAP usage setting". This association indicates that the function to access a directory service with LDAP (Lightweight Directory Access Protocol) is disabled. The setting value "Disabled" is associated with the function identification information "SSL usage setting". This association indicates that data is not encrypted when accessing a directory service with LDAP.

The function name "WebDAV client" is associated with the function identification information "WebDAV client settings" and "SSL/TLS settings". The setting value "enabled" is associated with the function identification information "WebDAV client settings". This association indicates that the WebDAV (Web-based Distributed Authoring and Versioning) function functions as a client to a web server. The setting value "enabled" is associated with the function identification information "SSL/TLS settings". This association indicates that when sending and receiving data as a client with WebDAV, data is encrypted according to the SSL/TSL (Secure Sockets Layer/Transport Layer Security) standard.

The function name "WebDAV Server" is associated with the function identification information "WebDAV Server Settings" and "SSL/TLS Settings". The setting value "Enabled" is associated with the function identification information "WebDAV Server Settings". This association indicates that the WebDAV function functions as a web server. The setting value "Enabled" is associated with the function identification information "SSL/TLS Settings". This association indicates that when the WebDAV sends and receives data as a server, the data is encrypted according to the SSL/TLS standard.

FIG. 6 is a diagram showing an example of program information. The program information shown in FIG. 6 shows an example of program information acquired from MFP 100. Referring to FIG. 6, function identification information and setting values are associated with each program identification information. The program identification information includes a program name and a version. Function identification information "WebDAV client", "WebDAV server" and "S/MIME" are associated with program identification information with a program name of "Program 1" and a version of "1.1.1". A setting value "enabled" is associated with the function identification information "WebDAV client". This association indicates that the WebDAV function functions as a client to a web server. A setting value "enabled" is associated with the function identification information "WebDAV server". This association indicates that the WebDAV function functions as a web server. A setting value "enabled" is associated with the function identification information "S/MIME". This association indicates that the ability to send and receive data using the protocol defined by S/MIME is enabled.

The function identification information "LDAP" is associated with the program identification information with the program name "Program 2" and the version "2.2.2". The setting value "Disabled" is associated with the function identification information "LDAP". This association indicates that the function for accessing the directory service via LDAP is disabled.

The program identification information with the program name "Program 3" and the version "3.3.3" is associated with the function identification information "SSL/TLS" with the setting value "Disabled." This association indicates that data will not be encrypted according to the SSL/TLS standard when it is sent or received.

Returning to FIG. 4, the keyword registration unit 54 registers a common keyword. A common keyword is a keyword common to MFPs 100, 100A to 100D. The keyword registration unit 54 accepts a common keyword registered by a user, and registers the accepted common keyword. The keyword registration unit 54 stores the accepted common keyword in the HDD 204. The keyword registration unit 54 accepts a common keyword input by a user to the operation unit 207. Furthermore, when a user specifies data in which a common keyword is stored, the keyword registration unit 54 accepts the common keyword stored in the specified data. For example, the data in which the common keyword is stored is stored in, for example, CD-ROM 209A, and the keyword registration unit 54 controls the external storage device 209 to read out the data stored in CD-ROM 209A.

FIG. 7 is a diagram showing an example of a common keyword. Referring to FIG. 7, the common keyword includes the names of attacks such as hacking, malware, or unauthorized access, and the names of the attack methods. The keywords are terms related to functions possessed by any of MFPs 100, 100A to 100D. Among attacks such as hacking, malware, or unauthorized access, the keywords are the names of attacks and attack methods that may be used against functions possessed by any of MFPs 100, 100A to 100D. The common keywords do not have to be common to MFPs 100, 100A to 100D, and there may be multiple common keywords corresponding to each of MFPs 100, 100A to 100D.

Returning to FIG. 4, the extraction unit 55 receives a plurality of pieces of vulnerability information from the vulnerability information acquisition unit 51. The extraction unit 55 extracts one or more pieces of vulnerability information commonly related to the MFPs 100, 100A to 100D from the plurality of pieces of vulnerability information received from the vulnerability information acquisition unit 51 as a processing target. The extraction unit 55 receives a common keyword from the keyword registration unit 54. The extraction unit 55 extracts vulnerability information including the common keyword from the plurality of pieces of vulnerability information as a processing target. The common keyword may be a character string combining a plurality of words. If the common keyword stored in the HDD 204 is composed of a plurality of words, the extraction unit 55 generates each of the plurality of words as a new common keyword. Then, the extraction unit 55 uses the plurality of new common keywords to extract the vulnerability information to be processed from the plurality of pieces of vulnerability information. This makes it possible to reduce the number of common keywords registered in the HDD 204 and to extract appropriate vulnerability information from the plurality of pieces of vulnerability information as a processing target.

The determination unit 57 receives the vulnerability information selected as the processing target from the extraction unit 55 and the function information from the function information acquisition unit 53. The determination unit 57 determines whether the vulnerability information is related to the function information.

The function information corresponding to each of MFPs 100, 100A to 100D is input to the determination unit 57 from the function information acquisition unit 53. The determination unit 57 determines whether or not vulnerability information is associated with each of MFPs 100, 100A to 100D. Since the determination by the determination unit 57 is the same for each of MFPs 100, 100A to 100D, the determination of whether or not vulnerability information is associated with MFP 100 will be described here using MFP 100 as an example.

The determination unit 57 determines that the vulnerability information includes the function information of the MFP 100 as being related. The determination unit 57 identifies function information of the MFP 100 in which a setting value indicating that the corresponding function is executed is set in the setting information. The determination unit 57 determines the function identification information of the identified function information as a function keyword. The determination unit 57 also determines the setting value set in the setting information of the identified function information as a function keyword. Furthermore, if the function keyword is composed of multiple words, the determination unit 57 determines each of the multiple words as a new function keyword. If the vulnerability information includes at least one of the determined function keywords, the determination unit 57 determines that the vulnerability information is related to the MFP 100.

When multiple pieces of function information are input from the MFP 100, the determination unit 57 determines whether or not vulnerability information is associated with each of the multiple pieces of function information. Therefore, the determination unit 57 determines whether or not vulnerability information is associated with each device and each of one or more functions.

When the determination unit 57 determines that the vulnerability information is related to the MFP 100, it determines warning information including the device identification information, function identification information, and vulnerability information of the MFP 100. The determination unit 57 outputs the warning information to the notification unit 59 and the prohibition unit 61.

The notification unit 59 notifies the user in response to the input of the warning information. The notification unit 59 causes a warning message to be displayed on a device identified by the device identification information included in the warning information. Specifically, the notification unit 59 transmits the function identification information and vulnerability information included in the warning information to the MFP 100 identified by the device identification information included in the warning information, and causes the MFP 100 to display the function identification information and vulnerability information on the display unit 206. The notification unit 59 also transmits an e-mail containing a warning message including the function identification information and vulnerability information to an administrator who manages the MFP 100.

The prohibition unit 61 stops the function of the device in response to the input of the warning information. The prohibition unit 61 sets the device identified by the device identification information included in the warning information so that the function identified by the function identification information included in the warning information is not executed. Specifically, the prohibition unit 61 transmits a stop command including the function identification information included in the warning information to the MFP 100 identified by the device identification information included in the warning information, and sets the MFP 100 so that the function identified by the function identification information is not executed.

Figure 8 is a flow chart showing an example of the flow of vulnerability information utilization processing. The vulnerability information utilization processing is processing executed by CPU 201 of PC 200 as CPU 201 executes a vulnerability information utilization program stored in ROM 202, HDD 204 or CD-ROM 209A. Referring to Figure 8, CPU 201 of PC 200 determines whether vulnerability information has been received (step S01). The vulnerability information is received based on an operation input by a user to operation unit 207. The vulnerability information itself may be input, or a URL, which is location information of the vulnerability information on the network, may be received. CPU 201 downloads the vulnerability information using the URL and acquires the vulnerability information. If the vulnerability information has been received, the processing proceeds to step S03, but if not, the processing proceeds to step S02.

In step S02, it is determined whether or not vulnerability information has been received. If vulnerability information is sent from an external source by email, the vulnerability information attached to the email is received. If an external computer stores vulnerability information in HDD 204, vulnerability information is received from the external computer. If vulnerability information has been received, processing proceeds to step S03; if not, processing returns to step S01.

In step S03, the common keyword is acquired, and the process proceeds to step S04. The CPU 201 reads out the common keyword stored in the HDD 204. In step S04, a processing target is extracted from the vulnerability information accepted in step S01 or the vulnerability information received in step S02, and the process proceeds to step S05. If the vulnerability information includes the common keyword, the vulnerability information is extracted. If there are multiple common keywords, and the vulnerability information includes at least one of the multiple common keywords, the vulnerability information is selected as the processing target. Note that there are cases in which the vulnerability information is not extracted as the processing target. In such cases, the process returns to step S01.

In step S05, a device to be processed is selected, and processing proceeds to step S06. In this embodiment, PC 200 manages MFPs 100, 100A to 100D. CPU 201 selects one of MFPs 100, 100A to 100D as the processing target. Below, an example will be described in which MFP 100 is selected as the processing target.

In step S06, a function keyword generation process is executed, and the process proceeds to step S07. The function keyword generation process is described in detail below, but is a process for generating one or more function keywords corresponding to the MFP 100 selected as the processing target. The function keywords correspond to functions possessed by the MFP 100.

In step S07, a functional keyword to be processed is selected, and processing proceeds to step S08. One of the one or more functional keywords generated in step S06 is selected to be processed. In step S08, it is determined whether the vulnerability information includes the functional keyword. It is determined whether the vulnerability information extracted as the processing target in step S04 includes the functional keyword selected as the processing target in step S07. If the vulnerability information includes the functional keyword, processing proceeds to step S09, and if not, processing proceeds to step S11.

In step S09, the administrator of the device selected for processing is notified, and processing proceeds to step S10. In step S05, the administrator managing the MFP 100 selected for processing is notified of the function identification information that identifies the function corresponding to the function keyword selected for processing, and the vulnerability information. For example, the CPU 201 causes the MFP 100 to display the function identification information and the vulnerability information on the display unit 161. The CPU 201 also sends a warning message including the function identification information and the vulnerability information to the administrator of the MFP 100.

In step S10, the corresponding function is set to be prohibited from being executed, and processing proceeds to step S11. The function corresponding to the function keyword selected in step S07 is identified, and the function is set to not be executed in the MFP 100 selected for processing. The CPU 201 sends the MFP 100 a command to prohibit execution, including function identification information that identifies the function. This makes it possible to prevent the MFP 100 from executing the function identified as vulnerable in the vulnerability information.

In step S11, it is determined whether or not there are any function keywords that were not selected for processing in step S07. If there are any unselected function keywords, the process returns to step S07, otherwise the process proceeds to step S12. In step S12, it is determined whether or not there are any unselected devices. If there are any devices among MFPs 100, 100A-100D that were not selected for processing in step S05, the process returns to step S05, otherwise the process ends.

Figure 9 is a flowchart showing an example of the flow of the function keyword generation process. The function keyword generation process is a process executed in step S06 of the vulnerability information utilization process. Before the function keyword generation process is executed, the MFP 100 is selected as the device to be processed.

Referring to FIG. 9, the CPU 201 of the PC 200 acquires function information from the MFP 100 and proceeds to step S22. The acquired function information includes program information. In step S22, the function information to be processed is selected, and the process proceeds to step S23.

In step S23, it is determined whether the selected function is set to be executable. If the function is set to be executable, the process proceeds to step S24, but if not, the process proceeds to step S25. Based on the setting information of the function information, the CPU 201 determines whether the function identified by the function identification information of the function information is set to be executable in the MFP 100.

In step S24, a function keyword is generated, and the process proceeds to step S25. The function identification information of the function information is determined as the function keyword. Also, the setting value set in the setting information of the function information is determined as the function keyword. If the function keyword is composed of multiple words, each of the multiple words is determined as a function keyword. The function keyword is associated with the function information selected in step S22.

In step S25, it is determined whether or not there is any unselected function information. It is determined whether or not there is any function information that has not been selected for processing in step S22 among the function information acquired from MFP 100 in step S21. If there is any unselected function information, the process returns to step S22, but if not, the process returns to the vulnerability information utilization process.

As described above, PC 200 in this embodiment functions as an information processing device that manages MFPs 100, 100A-100D. CPU 111 included in PC 200 acquires vulnerability information related to vulnerabilities, acquires function information related to functions that can be executed by each of MFPs 100, 100A-100D, and determines the validity of the vulnerability information based on the function information. Therefore, vulnerability information related to functions that cannot be executed by any of MFPs 100, 100A-100D can be eliminated, and the validity of vulnerability information related to functions that can be executed by each of MFPs 100, 100A-100D can be determined. Therefore, vulnerability information suitable for each of MFPs 100, 100A-100D can be extracted.

The PC 200 notifies the MFPs 100, 100A to 100D of the result of the judgment, so that the MFPs 100, 100A to 100D can be notified of valid vulnerability information suitable for each of them.

When the judgment result for each of the MFPs 100, 100A to 100D indicates that the device is valid, the PC 200 causes the device to set a setting value that disables the function specified in the function information corresponding to the device. This makes it possible to strengthen the security of each of the MFPs 100, 100A to 100D.

The PC 200 acquires the vulnerability information or identification information for identifying the vulnerability information input by the user. This makes it easier to acquire the vulnerability information.

Furthermore, the function information includes function identification information for identifying the functions possessed by each of MFPs 100, 100A to 100D, and PC 200 determines whether the vulnerability information includes at least some of the keywords of the function identification information included in the function information. Therefore, it is possible to extract vulnerability information related to the functions possessed by each of MFPs 100, 100A to 100D.

Furthermore, the function information includes a setting value indicating whether or not the function identified by the function identification information is executable, and PC 200 determines whether or not the setting value corresponding to the function identification information included in the vulnerability information indicates that the function is executable. Therefore, it is possible to extract vulnerability information related to functions that each of MFPs 100, 100A to 100D has and that are set to be executable.

Furthermore, the function information includes program identification information that identifies the program that executes the function, and PC 200 determines whether the vulnerability information includes at least some of the keywords of the function identification information for identifying the function realized by the program. This makes it possible to extract vulnerability information related to the programs installed in each of MFPs 100, 100A to 100D.

Furthermore, the function information includes a setting value indicating whether or not a function realized by the program is executable, and PC 200 determines whether or not the setting value corresponding to the function realized by the program indicates that the function is executable. Therefore, it is possible to extract vulnerability information related to functions that are realized by programs installed in each of MFPs 100, 100A-100D and that are set to be executable.

The PC 200 extracts assessment targets that contain predetermined keywords from the acquired vulnerability information, and judges the validity of the vulnerability information extracted as the assessment target. Therefore, since the vulnerability information to be assessed is extracted from multiple pieces of vulnerability information, it is possible to eliminate unnecessary vulnerability information that is not related to the MFPs 100, 100A-100D to be managed. This makes it possible to reduce the load on the PC 200.

<Summary of the embodiment>
(Item 1) An information processing device for managing an image forming device,
A vulnerability information acquisition means for acquiring vulnerability information relating to a vulnerability;
a function information acquiring unit for acquiring function information relating to functions that the image forming apparatus can execute;
and determining means for determining validity of the vulnerability information based on the function information.

According to this aspect, function information related to functions that the image forming device can execute is obtained, and the validity of the vulnerability information is determined based on the function information. Therefore, vulnerability information related to functions that the image forming device cannot execute can be eliminated, and the validity of vulnerability information related to functions that the image forming device can execute can be determined. As a result, an information processing device capable of extracting vulnerability information suitable for the image forming device can be provided.

(Item 2) The information processing device according to Item 1, further comprising a notification means for notifying the result of the determination made by the determination means.

In accordance with this aspect, it is possible to notify valid vulnerability information suitable for the image forming device.

(Item 3) The information processing device according to item 1, further comprising a prohibition means for causing the image forming device to set a setting value that makes the function specified by the function information unexecutable when the result of the judgment by the judgment means indicates that the function information is valid.

By following this aspect, the security of the image forming device can be enhanced.

(Item 4) The information processing device according to Item 1, wherein the vulnerability information acquisition means acquires the vulnerability information input by a user or identification information for identifying the vulnerability information.

This aspect makes it easier to obtain vulnerability information.

(Item 5) The function information includes function identification information for identifying a function of the image forming apparatus,
2. The information processing apparatus according to claim 1, wherein the determining means determines whether or not the vulnerability information contains at least a part of keywords of function identification information contained in the function information.

According to this aspect, it is possible to extract vulnerability information related to the functions of the image forming device.

(Item 6) The function information further includes a setting value indicating whether the function specified by the function identification information is executable or not;
6. The information processing apparatus according to claim 5, wherein the determining means determines whether the setting value corresponding to the function identification information included in the vulnerability information indicates that the function is executable.

According to this aspect, it is possible to extract vulnerability information related to functions that are possessed by the image forming device and that are set to be executable.

(Item 7) The function information includes program identification information that identifies a program that executes the function,
2. The information processing apparatus according to claim 1, wherein the determining means determines whether or not the vulnerability information includes at least a part of a keyword of function identification information for identifying the function realized by the program.

In accordance with this aspect, it is possible to extract vulnerability information related to programs installed on an image forming device.

(Item 8) The function information further includes a setting value indicating whether the function realized by the program identified by the program identification information is executable,
8. The information processing apparatus according to claim 7, wherein the determining means determines whether or not the setting value corresponding to the function realized by the program specified by the program identification information indicates that the function is executable.

In accordance with this aspect, it is possible to extract vulnerability information related to functions that are realized by programs installed in the image forming device and that are set to be executable.

(Item 9) The method further includes extracting means for extracting a judgment target including a predetermined keyword from the vulnerability information acquired by the vulnerability information acquisition means,
2. The information processing apparatus according to claim 1, wherein the determining means determines validity of the vulnerability information extracted as a determination target by the extracting means.

According to this aspect, vulnerability information that contains a predetermined keyword is extracted as a judgment target, and the validity of the vulnerability information extracted as a judgment target is judged. Therefore, since the vulnerability information to be judged is extracted from multiple pieces of vulnerability information, unnecessary vulnerability information can be eliminated. This reduces the judgment load.

(Item 10) An information processing device according to any one of items 1 to 9;
and an image forming unit for forming an image on a recording medium.

In accordance with this aspect, it is possible to provide an image forming device capable of extracting effective vulnerability information.

(Item 11) A vulnerability information utilization method executed in an information processing device that manages an image forming device, comprising:
a vulnerability information acquisition step of acquiring vulnerability information regarding a vulnerability;
a function information acquisition step of acquiring function information regarding functions that the image forming apparatus can execute;
a determining step of determining validity of the vulnerability information based on the function information; and a vulnerability information utilization method executed by the information processing device.

In accordance with this aspect, it is possible to provide a method for utilizing vulnerability information that can extract vulnerability information suitable for an image forming device.

(Item 12) A vulnerability information utilization program executed on a computer that manages an image forming apparatus, comprising:
a vulnerability information acquisition step of acquiring vulnerability information regarding a vulnerability;
a function information acquisition step of acquiring function information regarding functions that the image forming apparatus can execute;
a determining step of determining validity of the vulnerability information based on the function information; and a vulnerability information utilization program executed by the computer.

In accordance with this aspect, it is possible to provide a vulnerability information utilization program capable of extracting vulnerability information suitable for an image forming device.

(13) The information processing device according to item 1, wherein the identification information receives a network address indicating a location where the vulnerability information is stored.

(14) The vulnerability information is in PDF (Portable Document Format) or text data format.

The embodiments disclosed herein should be considered to be illustrative and not restrictive in all respects. The scope of the present invention is indicated by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

1 Image forming system, 100, 100A, 100B, 100C, 100D MFP, 200 PC 200, 300 Server, 3 Network, 5 Internet, 51 Vulnerability information acquisition unit, 53 Function information acquisition unit, 54 Keyword registration unit, 55 Extraction unit, 57 Determination unit, 59 Notification unit, 61 Prohibition unit, 71 Information reception unit, 73 Information reception unit, 81 Setting function acquisition unit, 83 Program information acquisition unit, 102 RAM, 111 CPU, 112 Communication I/F unit, 113 ROM, 114 RAM, 115 HDD, 116 Facsimile unit, 117 External storage device, 118 CD-ROM, 120 Automatic document feeder, 130 Document reading unit, 140 Image forming unit, 150 Paper feeding unit, 160 Operation panel, 161 Display unit, 163 operation unit, 165 touch panel, 167 hard key unit, 201 CPU, 202 ROM, 203 RAM, 204 HDD, 205 communication unit, 206 display unit, 207 operation unit, 209 external storage device, 209A CD-ROM.

Claims (12)

An information processing device for managing an image forming device,
A vulnerability information acquisition means for acquiring vulnerability information relating to a vulnerability;
a function information acquiring unit for acquiring function information relating to functions that the image forming apparatus can execute;
and determining means for determining validity of the vulnerability information based on the function information. The information processing device according to claim 1, further comprising a notification means for notifying the result of the determination made by the determination means. The information processing device according to claim 1, further comprising a prohibition means for causing the image forming device to set a setting value that makes the function specified by the function information unexecutable when the result of the judgment by the judgment means indicates that the function information is valid. The information processing device according to claim 1, wherein the vulnerability information acquisition means acquires the vulnerability information input by a user or identification information for identifying the vulnerability information. the function information includes function identification information for identifying a function of the image forming apparatus,
The information processing apparatus according to claim 1 , wherein the determining means determines whether or not the vulnerability information contains at least a part of a keyword of the function identification information contained in the function information. The function information further includes a setting value indicating whether the function specified by the function identification information is executable or not;
The information processing apparatus according to claim 5 , wherein the determining means determines whether the setting value corresponding to the function identification information included in the vulnerability information indicates that the function is executable. the function information includes program identification information that identifies a program that executes the function;
The information processing apparatus according to claim 1 , wherein the determining means determines whether or not the vulnerability information includes at least a part of a keyword of function identification information for identifying the function realized by the program. The function information further includes a setting value indicating whether the function realized by the program identified by the program identification information is executable or not;
The information processing apparatus according to claim 7 , wherein said determining means determines whether or not said setting value corresponding to said function realized by said program specified by said program identification information indicates that said function is executable. The vulnerability information acquisition unit further includes an extraction unit that extracts a determination target including a predetermined keyword from the vulnerability information acquired by the vulnerability information acquisition unit,
The information processing apparatus according to claim 1 , wherein the determining means determines validity of the vulnerability information extracted by the extracting means as the determination target. An information processing device according to any one of claims 1 to 9,
and an image forming unit for forming an image on a recording medium. A vulnerability information utilization method executed in an information processing apparatus that manages an image forming apparatus, comprising:
a vulnerability information acquisition step of acquiring vulnerability information regarding a vulnerability;
a function information acquisition step of acquiring function information regarding functions that the image forming apparatus can execute;
a determining step of determining validity of the vulnerability information based on the function information; and a vulnerability information utilization method executed by the information processing device. A vulnerability information utilization program executed on a computer that manages an image forming apparatus,
a vulnerability information acquisition step of acquiring vulnerability information regarding a vulnerability;
a function information acquisition step of acquiring function information regarding functions that the image forming apparatus can execute;
a determining step of determining validity of the vulnerability information based on the function information; and a vulnerability information utilization program executed by the computer.

Images