JP2004164415A - Login restriction method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a login restriction method that increases a security level of an information processing device by preventing unauthorized access to the information processing device by brute force attack on a character string without addition of new hardware. <P>SOLUTION: The login restriction method, which restricts logins to an image processing device or the like, upon a connection request from another device, restricts a login to the image processing device 204 at a port restriction part 102 in dependence on the type of a communication protocol used in the connection request. Next user information inputted for the login to the image processing device 204 from the other device or directly is received. A user authentication part 104 checks, for authentication, the received user information against identification information about users permitted in advance to use the image processing device 204, and according to the authentication result, permits or prohibits the login to the image processing device 204. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to increasing the security level of an information processing device connected to a network.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, in order to enhance the security of an information processing apparatus, various methods have been known in which user authentication is performed using a user ID and a password, thereby permitting use of each information processing apparatus and permission to input a job. .
[0003]
[Problems to be solved by the invention]
However, since the user authentication using the user ID and the password is performed by a combination of character strings such as alphanumeric characters, there is a problem that it is easily determined by a brute force attack of the combination of alphanumeric characters.
[0004]
For example, when a brute force attack or the like for determining a user ID or a password is performed during a time when no one is in the night, the conventional information processing device has no guard means against the brute force attack at all. was there. Further, even if the information processing apparatus connected to the network is stolen from the user ID or the password by eavesdropping on the network or the like, there is also a problem that the information processing apparatus has no guard means.
[0005]
The present invention has been made in view of such circumstances, and can prevent unauthorized access by a brute force attack on a character string without adding new hardware such as a fingerprint authentication system. The purpose is to provide a login restriction method that can increase the level.
[0006]
[Means for Solving the Problems]
In order to solve the above problem, the present invention is a method for restricting login of an information processing device connectable from another device via a network, wherein when there is a connection request from the other device, the connection request is In accordance with the type of communication protocol used, login to the information processing apparatus is restricted, and user information input to log in to the information processing apparatus from the other apparatus or directly is received, and the information processing is performed in advance. Performs authentication of the identification information relating to the user permitted to use the device and the received user information, and, based on the authentication result of the identification information and the user information, permits login to the information processing device or It is characterized by being rejected.
[0007]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. In the following embodiment, an image processing apparatus that is connected to a network and has a function of preventing unauthorized login from another apparatus or the like and also has a function of printing, a scanner, or the like will be described as an example.
[0008]
FIG. 1 is a block diagram illustrating components provided in an image processing apparatus according to an embodiment of the present invention for performing a function of preventing unauthorized login.
[0009]
In FIG. 1, reference numeral 101 denotes a communication unit, which is connected to clients on a network (for example, information processing apparatuses 201 and 202 which are client PCs shown in FIG. 2) via a network interface cable 113 such as Ethernet (registered trademark). , And exchange data such as print instructions and download / upload of various data.
[0010]
Reference numeral 102 denotes a port control unit that interprets various communication protocols such as TCP / IP and UDP and controls a usable time set for each communication protocol. An example of the usable time set for each communication protocol is shown in FIG. 6 as described later.
[0011]
Reference numeral 103 denotes an MMI unit that interactively uses the LCD display 309 and the keyboard 310 to issue print instructions and perform various operations. Note that the MMI unit 103 corresponds to the user interface unit 308 in FIG.
[0012]
A user authentication unit 104 uses a user management table (details are shown in FIG. 4) for a user who has performed an authentication operation for obtaining permission to use the device via the communication unit 101 and the MMI unit 103. This part determines whether the device can be used.
[0013]
Reference numeral 105 denotes a processing restriction unit that restricts a usable time zone using an operation restriction table (details are shown in FIG. 5) for each type of processing supported by the image processing apparatus, such as copying, scanning, and printing. It is.
[0014]
Reference numeral 106 denotes a brute force attack detection unit that detects a brute force attack using a combination of character strings such as alphanumeric characters for the purpose of user ID and password cancellation. The details of the operation of the brute force attack detection unit 106 will be described later with reference to the flowchart shown in FIG.
[0015]
Reference numeral 107 denotes an impersonation prevention unit which uses a MAC address or secret information known as zero-knowledge proof that can be known only by the user in addition to the user ID and password in user authentication. This makes it extremely difficult to impersonate a person if it is stolen. The details of the operation of the spoofing prevention unit 107 will be described later with reference to the flowchart shown in FIG.
[0016]
Reference numeral 108 denotes a control unit that operates the printer engine 306 and the scanner engine 312 via the printer interface 305 and the scanner interface 311 to actually perform operations such as printing and copying. Here, reference numeral 109 denotes a scanner control unit, which is a unit for reading a document by operating the scanner engine 312 via the scanner interface 311. Reference numeral 110 denotes a printer control unit which operates the printer engine 306 via the printer interface 305 to print an image on paper. A document / resource management unit 111 manages resources such as documents and fonts in the device. Reference numeral 112 denotes a user management unit that manages various types of information necessary for the user authentication process. An example of the user information managed by the user management unit 112 is shown in FIG.
[0017]
In FIG. 1, reference numeral 113 denotes a network interface cable, which is realized by a communication medium such as Ethernet (registered trademark).
[0018]
FIG. 2 is a diagram illustrating a configuration of an information processing system including an image processing device according to an embodiment of the present invention. As shown in FIG. 2, in the present embodiment, client-side information processing apparatuses 201 and 202 are communicably connected via a network 203 to an image processing apparatus 204 having the above-described unauthorized access prevention function. ing.
[0019]
In the present embodiment, a personal computer (PC) is used as the information processing apparatuses 201 and 202, a multi-function peripheral (MFP) is used as the image processing apparatus 204, and an Ethernet (registered trademark) is used as the network 203. .
[0020]
Communication between the client-side information processing apparatuses 201 and 202 and the image processing apparatus 204 via the network 203 is performed by specifying an IP address and a port number and by using IP packet data.
[0021]
In this embodiment, for simplicity of description, the configuration of the information processing system is configured such that the two client-side information processing apparatuses 201 and 202 and one image processing apparatus 204 are connected via the network 203. The application of the present invention is not limited to the number of connected devices described above. Also, in the present embodiment, a description will be given assuming that the terminal device on the client side is a PC, the image processing device is an MFP, and the network is Ethernet (registered trademark). However, this is merely an example, and is limited. Not something.
[0022]
FIG. 3 is a diagram illustrating a hardware configuration of the image processing apparatus 204 according to the present embodiment. As shown in FIG. 3, the CPU 301 communicates via a bus 313 with a memory (RAM) 302, a ROM 303, a storage device (HD) 304, a printer interface 305, a scanner interface 311 and a user interface (operation unit). 308 and a network interface 313. The program executed by the CPU 301 is read from the ROM 303, the storage device 304, the network interface 307, and the like to the memory 302.
[0023]
The user interface 308 controls the LCD display 309 and the keyboard 310 to exchange various kinds of information with the device operator as a user. The network interface 307 performs processing of a physical layer (physical packet) of a network packet, that is, extracts a transport packet from the physical packet and generates a physical packet from the transport packet.
[0024]
A printer interface 305 manages printer resources and executes and controls jobs using the printer. The printer engine 306 is a part that prints out an image created by a program executed by the CPU 301 on a print medium such as paper.
[0025]
The scanner interface 311 manages scanner resources and executes / controls jobs using the scanner. The scanner engine 312 is a part that reads image data into the memory 302 or the storage device 304 by a program executed by the CPU 301.
[0026]
FIG. 4 is a diagram illustrating an example of a user management table storing user authentication information managed by the user management unit 112 in FIG. The user management table holds information necessary to permit only a specific user to use the image processing apparatus. As shown in FIG. 4, in the present embodiment, a user ID 401 composed of a seven-digit character string, a password 402 composed of a five-digit character string, and personal identification information for reconfirming whether or not the user is an individual. 403 is used to authenticate the user. The number of digits of the user ID and the password and the contents of the personal identification information 403 are not limited to the above example.
[0027]
In the present embodiment, the identification information 403 includes learning 404 for selecting whether to fix the MAC address of the device to be authenticated or storing the MAC address of the last authenticated device, and specifying the authentication device on the network. And a zero-knowledge certificate 406 that identifies the user as information that only the user can know (for example, a question about the family structure and its correct answer, etc. stored as a character string). I made it. It should be noted that the MAC address (Media Access Control address) is a unique number having only one in the world, but the details thereof are publicly known and will not be described here.
[0028]
In this embodiment, when the learning 404 is ON, the MAC address of the last authenticated device is always stored. On the other hand, when the learning 404 is OFF, the authentication is permitted only by the MAC address stored in the MAC address 404 to which the authentication is permitted.
[0029]
FIG. 5 is a diagram illustrating an operation restriction table used for processing in the processing restriction unit 105 in FIG. 1, in which work supported by the image processing apparatus and time periods during which the work can be used are stored in a table format. are doing. In the operation restriction table according to the present embodiment, as illustrated in FIG. 5, a work 501 indicating a process category such as a copy process and a print process, and an available time zone indicating a time zone in which the process described in the work 501 can be used. 502 are held in pairs in a table format.
[0030]
In FIG. 5, as an example, what is described as “always available” in the available time zone 502 indicates that the available time zone is not limited, and the time range is set to “08: 00 to 22:00” or the like. The description indicates that the function can be used only during the described time (for example, from 8:00 to 22:00), and the function that can be used is limited.
[0031]
FIG. 6 is a diagram showing a protocol restriction table for restricting a usable time zone of each communication protocol used in the processing in the port control unit 102 in FIG. 1, and can be used for each communication protocol supported by the device. Keep time zones in tabular format. As shown in FIG. 6, the protocol restriction table includes a pair of a communication protocol 601 for identifying a communication protocol such as TCP / IP or UDP and a time zone 602 in which the communication protocol described in the communication protocol 601 can be used. It is kept in table format.
[0032]
In the present embodiment, as shown in FIG. 6, a description that “usually available” is described in the available time zone 602 indicates that the available time zone is always available without limiting the available time zone. The description indicates that the corresponding communication protocol cannot be used at all times, and the description of the time range such as "08: 00-22: 00" indicates that the communication protocol is within the described time (for example, from 8:00 to 22:00). For example, a communication protocol that can be used for a limited time is used.
[0033]
FIG. 7 is a diagram illustrating a communication packet structure in data exchanged with another information processing apparatus via the network interface 307. As shown in FIG. 7, a communication packet according to the present embodiment includes a packet header 701 indicating the head data of the communication packet, a packet version 702 indicating the structure version of the communication packet, and one meaningful data being converted into a plurality of packets. When divided, a continuation flag 703 indicating whether or not the end is obtained, an operation code 704 indicating processing contents such as a print instruction and a data upload instruction, a block number 705 storing a processing order of communication packets, and data from a packet header 701. A packet length 706 for storing a data length up to 702, a user ID 707 and a password 708, which are authentication information for determining whether or not the device can be used, a MAC address 709 for identifying a device that issued a communication packet, a request, a report, a notification, etc. Indicates the nature of the packet Status 710, and a data 711 Metropolitan storing data necessary for processing of the operation code 704.
[0034]
FIG. 8 is a flowchart illustrating an example of a data processing procedure in the image processing apparatus according to an embodiment of the present invention. First, the process waits for an operation instruction to the image processing apparatus from the network interface 307 or the user interface 308 (step S801). Then, when an operation instruction is issued, it is checked whether or not the operation instruction source is via the network interface 307 (step S802). As a result, in the case of an operation instruction via the network interface 307 (YES), a communication protocol (for example, a communication protocol such as TCP / IP, UDP, or HTTP) used for the operation instruction is checked (step S803).
[0035]
Next, it is checked whether the communication protocol determined in step S803 is usable (step S804). That is, in the present embodiment, first, it is checked whether or not there is data whose communication protocol obtained in step S803 matches the communication protocol 601 in the protocol restriction table shown in FIG. As a result, if there is no match, the protocol is determined to be usable because it is an unrestricted protocol. On the other hand, if matching data exists, the current time is determined from the timer of the device, and it is checked whether or not the time is included in the available time zone 602. First, the protocol is determined to be usable, and if it is out of the time zone, the protocol is determined to be unusable.
[0036]
That is, the image processing apparatus 204 according to the present embodiment performs the image processing for each communication protocol (for example, TCP / IP, UDP, HTTP, etc.) supported by another apparatus (for example, the information processing apparatuses 201 and 202). It is characterized in that a time zone in which connection to the device 204 is possible is specified. As a result, in the image processing apparatus 204, as shown in the correspondence table between the protocol name 601 and the available time zone 602 shown in FIG. 6, the image processing apparatus 204 can be used for each communication protocol supported by the device such as TCP / IP, UDP and HTTP Time can be limited.
[0037]
As a result of performing the above-described processing in step S804, when it is determined that the communication protocol is an allowed communication protocol (YES), the process proceeds to step (805). On the other hand, if it is determined in step S804 that the communication protocol obtained in step S803 is unusable (NO), error processing is performed (step S808). For example, as an example of the error processing, after setting that the instructed work has not been performed in the status 710 of the communication packet illustrated in FIG. 7, the error may be reported to the operation instruction source via the network interface 307. Good. Then, after the error processing, the present processing ends. In the above-described error processing, a message indicating that the connection cannot be used is returned using a communication packet. However, a configuration may be employed in which a communication connection on a protocol is forcibly disconnected.
[0038]
On the other hand, in step S805, the instructed work contents such as copy and print are checked. In the present embodiment, in the case of an operation instruction from the network interface 307, the operation content can be identified by the operation code 704 shown in FIG.
[0039]
Next, it is checked whether or not the work is possible (step S806). In the present embodiment, first, it is determined whether there is data in which the current time of the device (image processing apparatus 204) and the work content obtained in step S805 match the work name 501 of the operation restriction table shown in FIG. Find out. As a result, it is determined that the operation is not restricted unless there is a match, and it is determined that the work content obtained in step S805) can be used. On the other hand, if there is matching data, the current time is determined from the timer of the device, and it is checked whether or not the time is included in the usable time zone 502. Here, if the current time is included in the usable time zone, it is determined that the operation is usable. Conversely, when the available time is out of the available time, the operation is determined to be an operation that cannot be used.
[0040]
If it is determined in step S806 that the operation is a permitted operation (YES), a user authentication & function execution process described later is performed (step S807), and the process ends.
[0041]
That is, the image processing device 204 according to the present embodiment performs various processes (for example, as shown in the correspondence table between the work name 501 and the available time period 502) that can be executed by the image processing device 204 (for example, A processing time zone is set for each process such as copying, facsimile transmission, and printing, and processing performed by the image processing apparatus 204 is permitted only in the set processing available time zone.
[0042]
On the other hand, if it is determined in step S806 that the work cannot be used (NO), the flow advances to step S808 to perform error processing, and informs the network interface 307 and user interface 308 that the instructed work has not been performed. After notifying the operation instruction source via this, the present processing ends. For example, as an example of the error processing, if the instruction is a work instruction via the network interface 307, the communication packet format having the configuration shown in FIG. It is assumed that data is reported to the information processing apparatuses 201 and 202 that are operation instruction sources via the network interface 307.
[0043]
As described above, the image processing apparatus 204 according to the present embodiment can be connected to another apparatus (for example, the information processing apparatuses 201 and 202) via the network 203, and logs in to the image processing apparatus 204. The following procedure is performed as a method for limiting. That is, when there is a connection request from another device, login to the image processing device 204 is restricted according to the type of communication protocol used for the connection request. Next, user information (for example, a user ID and a password) input to log in to the image processing apparatus 204 from another apparatus or directly is received. Then, authentication of identification information (for example, information described in a user management table shown in FIG. 4) relating to a user who is permitted to use the image processing apparatus 204 and received user information is performed, and the identification information and the user Based on the authentication result with the information, the login to the image processing apparatus 204 is permitted or not permitted.
[0044]
Specifically, the image processing device 204 according to the present embodiment executes a predetermined image processing on a job input from another information processing device 201 or 202 connected to the network 203. For this purpose, an individual job operation environment set for each user who can submit a job is registered in the DISK 311 shown in FIG. Further, identification information for identifying a user, such as a user ID and a password, is stored and managed in the user management table shown in FIG. Then, user information including a user ID 401 and a password 402 shown in FIG. 4 necessary for user identification is received by input from the keyboard 304 shown in FIG. Then, by comparing the input user information with the identification information registered in the DISK 311 or the like, it is determined whether the use of the image processing apparatus 204 is permitted.
[0045]
As described above, according to the above-described image processing apparatus 204, by limiting the time during which the work and the communication protocol can be used, the available work can be limited without restricting the communication protocol, or conversely. It is possible to construct a flexible security system, for example, by limiting usable communication protocols without restricting work.
You.
[0046]
FIG. 9 is a flowchart for explaining a detailed processing procedure of the user authentication & function execution processing performed in step S807 in the flowchart for explaining the data processing procedure of the image processing apparatus 204 according to the present invention shown in FIG.
[0047]
First, a user ID and a password of the operation submitter are obtained (step S901). In the present embodiment, in the case of an operation instruction via the network interface 307, the operation is performed by acquiring the user ID 707 and the password 708 shown in the communication packet structure of FIG. Further, the user authentication inside the image processing apparatus 204 is obtained from the user interface 308 via the keyboard 310 in FIG.
[0048]
Next, it is checked whether the user ID and the password extracted in step S901 are valid (step S902). In the present embodiment, the user ID and the password acquired in step S901 are paired, and the user ID 401 and the password 402 in the user management table shown in FIG. 4 are compared to determine whether authentication is possible or not. As a result, when the authentication has been correctly performed (YES), the process proceeds to step S903, and an impersonation prevention process for confirming whether the user is an identity is performed. The details of the spoofing prevention process will be described later using steps S1001 to S1006 in FIG.
[0049]
Then, the processing result of the spoofing prevention processing in step S903 is confirmed (step S904). As a result, when the identification is normally performed (YES), the operation instructed in step S801 in FIG. 8 is performed by the control unit 108 in FIG. 1 (step S905), and then the process is terminated.
[0050]
On the other hand, if the personal authentication has not been correctly performed in step S904 (NO), the process advances to step S909 to perform error processing. That is, after the fact that the identity could not be confirmed is set in the status 710 of the communication packet shown in FIG. 7, it is reported to the operation instruction source via the network interface 307. After that, the process ends.
[0051]
On the other hand, if the personal authentication has not been correctly performed in step S902 (NO), the process advances to step S906 to acquire the MAC address of the device that has issued the authentication instruction. Note that the method of obtaining the MAC address uses a method standardized by the American National Standards Institute (ANSI) such as FDDI (Fiber Distributed Data Interface), and this method is publicly known and will not be described.
[0052]
Next, in step S907, it is checked whether or not the authentication operation from the MAC address acquired in step S906 has become NG multiple times. As a result, if the user authentication based on the user ID and the password is determined to be NG for a plurality of consecutive times (YES), a brute force attack handling process is performed (step S908), and the process is thereafter terminated.
[0053]
That is, the image processing apparatus 204 according to the present embodiment determines that the user is not permitted to use the image processing apparatus 204 in advance as a result of authenticating the identification information and the user information as shown in step S907. In this case, it is characterized by detecting whether or not a brute force attack is caused by a combination of character strings intended to determine the password of a user who can log in to the image processing apparatus 204.
[0054]
When a brute force attack is performed in this embodiment, the communication protocol acquired in step S803 in FIG. 8 is not accepted as a device (image processing apparatus 204). A configuration is adopted in which the applicable protocol is acquired from the name 601 and the available time zone 602 of the protocol is disabled so that a brute force attack is guarded.
[0055]
That is, when the image processing apparatus 204 according to the present embodiment detects a brute force attack, the type of the communication protocol used in the brute force attack is determined, and as shown in step S908, the communication protocol of the communication protocol is determined. It is characterized in that use is disabled.
[0056]
Therefore, in a system including the image processing apparatus 204 according to the present embodiment that performs user authentication by a combination of character strings such as a user ID and a password, by providing a protection function against a brute force attack on a character string, a new fingerprint authentication system or the like The level of security can be increased without additional hardware.
[0057]
On the other hand, if it is determined in step S907 that NG is not consecutively performed a plurality of times (NO), the process advances to step S909 to perform error processing. That is, the fact that the user authentication has failed is notified to the operation instruction source via the network interface 307 or the user interface 308. Then, after the error processing, this processing ends. For example, in the present embodiment, when the authentication operation is performed via the network interface 307, the authentication operation is set to the status 710 of the communication packet illustrated in FIG. The process ends.
[0058]
FIG. 10 is a flowchart for describing in detail the procedure of the spoofing prevention process in step S903 in the flowchart of the data processing procedure of the image processing apparatus according to the embodiment of the present invention.
[0059]
First, the MAC address of the authentication device is obtained (step S1001). Next, it is checked whether the MAC address acquired in step S1001 is equal to the MAC address 405 for which authentication is permitted shown in FIG. 4 (step S1002). As a result, when the MAC addresses are the same (YES), this processing is terminated normally.
[0060]
On the other hand, if it is determined in step S1002 that the MAC address is different from the authentication-permitted MAC address 405 shown in FIG. 4, the process proceeds to step S1003.
[0061]
In step S1003, OFF / ON of the learning 404 in FIG. 4 is checked. As a result, when the learning 404 is OFF (NO), authentication from any other than the registered MAC address is not accepted, and thus this process is abnormally terminated.
[0062]
On the other hand, if the learning 404 in FIG. 4 is ON in step S1003 (YES), the flow advances to step S1004 to verify the identity using the zero knowledge proof 406 that identifies the identity stored in the user management table shown in FIG. I do.
[0063]
In step S1005, it is determined whether the personal identification in step S1004 has been normally completed. If the identity cannot be confirmed, the process is abnormally terminated.
[0064]
That is, in the image processing apparatus 204 according to the present embodiment, as shown in FIG. 4, a user ID, a password, a MAC address of an apparatus for which authentication is permitted, and personal information ( For example, in the present embodiment, the zero-knowledge proof 406 for identifying the identity, which is secret information known only to the authenticator, is used.) In the case of an authentication request to the device 204, when authentication using a user ID and a password is permitted, login to the image processing device 204 is permitted or prohibited using personal information. . By confirming the identity in this way, the security level of user authentication is improved, and spoofing is prevented.
[0065]
If it is determined in step S1005 that the personal identification has been normally performed (YES), the MAC address of the authentication device is stored in the MAC address 405 for which authentication is permitted shown in FIG. 4 (step S1006), and then the process is terminated normally. .
[0066]
That is, in the image processing apparatus 204 according to the present embodiment, when login to the image processing apparatus 204 is permitted, the MAC address of the information processing apparatus to which the login is permitted is stored in the image processing apparatus 204, and subsequent authentication is performed. Sometimes, it is used as a MAC address of a device for which authentication is permitted. As described above, when the personal identification is normally performed, the MAC address of the device that has made the authentication request is newly learned and stored as the MAC address for which the image processing device 204 permits the authentication, so that the same device can be used next time. It is possible to omit the authentication operation from. Further, it is also possible to simplify the tracking of the MAC address of the last authenticated device and the input operation of the MAC address for which authentication is permitted (for example, corresponding to the MAC address 405 for which authentication is permitted shown in FIG. 4).
[0067]
Note that the present invention is applied to a system including a plurality of devices (for example, a host computer, an interface device, a reader, a printer, etc.), but a device including one device (for example, a copying machine, a facsimile machine, etc.). May be applied.
[0068]
Further, an object of the present invention is to supply a recording medium (or a storage medium) recording a program code of software for realizing the functions of the above-described embodiments to a system or an apparatus, and to provide a computer (or a CPU or a CPU) of the system or the apparatus. Needless to say, the present invention can also be achieved by the MPU) reading and executing the program code stored in the recording medium. In this case, the program code itself read from the recording medium implements the functions of the above-described embodiment, and the recording medium on which the program code is recorded constitutes the present invention. When the computer executes the readout program code, not only the functions of the above-described embodiments are realized, but also an operating system (OS) running on the computer based on the instruction of the program code. It goes without saying that a part or all of the actual processing is performed and the functions of the above-described embodiments are realized by the processing.
[0069]
Further, after the program code read from the recording medium is written into a memory provided in a function expansion card inserted into the computer or a function expansion unit connected to the computer, the function expansion is performed based on the instruction of the program code. It goes without saying that the CPU or the like provided in the card or the function expansion unit performs part or all of the actual processing, and the processing realizes the functions of the above-described embodiments.
[0070]
When the present invention is applied to the recording medium, the recording medium stores program codes corresponding to the flowcharts described above.
[0071]
As described above, in the image processing apparatus 204 according to the present embodiment, since the authentication condition in the case where the user ID and the password are leaked is added, it is possible to prevent the login by the unauthorized impersonation, and to set the security level as the device. For example, the security of the user authentication level can be increased. Further, when a brute force attack using a combination of character strings such as alphanumeric characters is performed, the attack is detected and operation from the attack source device is rejected. Furthermore, even if the user ID or password is stolen, the MAC address of each device that is the authentication request source is limited, and the accuracy of confirming whether or not the user is authenticated is improved. Can be prevented. Furthermore, by limiting the operations that can be performed and the communication protocols that can be used during a time when no one is present, such as at night, an attack to determine the user ID and the password can be prevented.
[0072]
【The invention's effect】
As described above, according to the present invention, unauthorized access due to a brute force attack on a character string can be prevented without adding new hardware such as a fingerprint authentication system, and the security level can be increased. .
[Brief description of the drawings]
FIG. 1 is a block diagram illustrating components provided in an image processing apparatus according to an embodiment of the present invention for performing a function of preventing unauthorized login.
FIG. 2 is a diagram illustrating a configuration of an information processing system including an image processing device according to an embodiment of the present invention.
FIG. 3 is a diagram showing a hardware configuration of the image processing apparatus 204 according to the embodiment.
FIG. 4 is a diagram illustrating an example of a user management table storing user authentication information managed by the user management unit 112 in FIG. 1;
FIG. 5 is a diagram showing an operation restriction table used for processing in a processing restriction unit 105 of FIG. 1;
FIG. 6 is a diagram showing a protocol restriction table for restricting a usable time zone of each communication protocol used in processing in the port control unit 102 of FIG. 1;
FIG. 7 is a diagram illustrating a communication packet structure in data exchanged with another information processing apparatus via a network interface 307.
FIG. 8 is a flowchart illustrating an example of a data processing procedure in the image processing apparatus according to an embodiment of the present invention.
9 is a flowchart for explaining a detailed processing procedure of a user authentication & function execution processing performed in step S807 in the flowchart for explaining a data processing procedure of the image processing apparatus 204 according to the present invention shown in FIG.
FIG. 10 is a flowchart for explaining in detail a procedure of a spoofing prevention process in step S903 in the flowchart of the data processing procedure of the image processing apparatus according to the embodiment of the present invention.
[Explanation of symbols]
101 Communication unit
102 Port control unit
103 MMI section
104 User recognition unit
105 Processing limiter
106 brute force attack detection unit
107 Spoof prevention unit
108 control unit
109 Scanner control unit
110 Printer control unit
111 Document / Resource Management Department
112 User management unit

Claims (1)

A login restriction method for an information processing device connectable from another device via a network,
If there is a connection request from the other device, restrict login to the information processing device according to the type of communication protocol used for the connection request,
From the other device or directly, accepts user information input to log in to the information processing device,
Perform identification of identification information on a user who is permitted to use the information processing device in advance, and the received user information,
A login restriction method comprising: permitting or disallowing a login to the information processing apparatus based on an authentication result of the identification information and the user information.

Images