JP2016206861A - Information processing device and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide means for correctly notifying, when it is determined that an information processing device cannot provide a function corresponding to a setting value of a security policy which is determined by a security manager, the security manager of the situation.SOLUTION: An information processing device 100 includes: a function configuration holding unit 305 that holds a security function provision state as function configuration information; a security setting holding unit 303 that holds a security-related setting value; and a security setting management unit 302 that determines whether the security function validated by a security policy is in an available state and, if it is in an unavailable state, notifies a security manager of the situation.SELECTED DRAWING: Figure 3

Description

  The present invention relates to a control when a setting value cannot be updated and a method for notifying the security administrator in an information processing apparatus in which a security administrator can update setting values related to security collectively.

  Information processing devices such as PCs (personal computers) connected to networks such as offices and multifunction devices with printing functions (digital multifunction devices / MFPs / Multi Function Peripherals) are operated according to the information security management policy determined for each office. It is desirable. The information security management policy is a summary of countermeasure policies for preventing unauthorized use or leakage of information, and is determined by the security administrator.

  Operating an information processing device according to the information security management policy indicates that operation is restricted to prevent unauthorized use of information or information leakage, such as requiring user authentication when operating the information processing device. .

  In the prior art, in order to operate the information processing apparatus according to the information security management policy, there is a technology that collects a list of setting items related to security among the setting items of software, and enables acquisition / change of setting values. is there. The security administrator uses this technique to determine the setting values of the security-related setting items in accordance with the information security management guidelines and apply them to the information processing apparatus. The set of setting values is called a security policy.

  In addition, this technology has a function that allows a security administrator to remotely access via a network and apply a security policy to an information processing apparatus. As a result, various security measures for preventing information leakage and unauthorized access from outside can be easily enhanced without omission.

  When managing a plurality of information processing devices connected to a network in the same office, the setting values of setting items related to the security of each information processing device may differ depending on the individual information processing devices. For example, there is a risk that an information processing apparatus having a setting value with low security, such as permitting use of a compromised cryptographic algorithm, becomes a security hole and exposes the entire office network to a threat. For this reason, it is important for management to apply a common security policy to the setting items related to the security of the information processing apparatus in the same office.

  Some of the setting items related to security are, for example, encryption processing using an algorithm compliant with FIPS (Federal Information Processing Standardization), which is a US evaluation / authentication program for confirming whether the encryption algorithm is implemented as specified. The setting items to be forced may be included. Alternatively, a setting item for forcing key management using a TPM (Trusted Platform Module) compliant with the TCG (Trusted Computing Group: “http: www.trustedcomputinggroup.org”) standard may be included.

  The TPM is a security chip having tamper resistance that enables safe management of encryption keys. In general, a device equipped with a TPM encrypts and decrypts confidential data such as a common key, a key pair, and a certificate using a TPM key in the TPM chip. Since the TPM key for decrypting the confidential data cannot be extracted from the TPM chip, the confidential data can be managed safely.

  However, since the installation of the TPM depends on the hardware configuration of the information processing apparatus, not all information processing apparatuses connected to the network are necessarily provided. As a means for providing a secure key management function even to an information processing apparatus not equipped with a TPM, a server on the network has a TPM key management function, and the TPM is remotely accessed from the information processing apparatus on the same network. There are also forms that use.

  Patent Document 1 presents means for using a TPM management console and a TPM server via a network instead of a local TPM when a local TPM is not available or is selected not to be used.

JP 2011-258199 A

  The security administrator enforces the use of security functions (such as TPM) in the security policy applied to the security-related setting items of the information processing device in order to strengthen and uniformly manage the security of the information processing device in the network. May include. However, in reality, some information processing devices cannot be used because they do not have the security function, and there may be no setting items. Therefore, it is necessary to allow operations that exempt the applicable equipment as an exception. is there.

  If each information processing device performs its own exception handling to determine whether a security policy is applicable and exempts it from being applied, it is a security that there is an unsafe device in the network. The administrator may not be able to recognize it. Operating the information processing apparatus in such a state makes the risk of unauthorized access and information leakage latent, making it difficult to centrally manage the security of the information processing apparatus.

  Further, even in an information processing apparatus having a function capable of remotely using a security function (such as TPM) as in Patent Document 1, the information processing apparatus temporarily falls into a state where it cannot be used depending on the operation state of a remotely accessed server or network environment. there is a possibility. Even in such a case, if the security administrator cannot recognize that the safety is temporarily lowered, there is a risk of a security risk.

  The present invention provides means for correctly notifying the security administrator of the situation when it is determined that the information processing apparatus cannot provide the corresponding function for the setting value of the security policy determined by the security administrator as described above. The purpose is to do.

  In order to achieve the above object, an information processing apparatus of the present invention is an information processing apparatus having software setting means for a security function such as use of a TPM or FIPS compliant algorithm, and the setting items for the security function Security setting value holding means for holding a setting value in a nonvolatile storage medium, security policy input means for allowing a security administrator to input a security policy, and a security policy value input by the security policy input means, Information on security setting value changing means for changing setting values of related setting items, security setting value display means for displaying / checking setting values of setting items related to the security function in a list, and information on security functions provided in the information processing apparatus Security function configuration holding means held in a non-volatile storage medium; means for forcing the use of the security function for the operation of the information processing apparatus based on the setting value of the setting item for the security function; and the setting item for the security function The setting value of the setting item for the security function can be changed from the combination of the setting value of the security function and the security function configuration. When it is determined that the security function cannot be validated as described above, the security administrator who has input the security policy is notified of this.

  According to the present invention, it is possible to easily find out that a security policy input by a security administrator to an information processing device cannot be observed by a security function installed in the information processing device, and to recognize security risks of the entire network at an early stage. Enable.

The figure which shows the information processing system which concerns on one Embodiment of this invention. The figure which shows the hardware constitutions of information processing apparatus The figure which shows the software structure of information processing apparatus The figure which shows an example of the function structure information of information processing apparatus The figure which shows an example of the setting value concerning the security function of information processing apparatus The flowchart which shows the setting process of "use of TPM" in Example 1 The flowchart which shows the setting process of "use of TPM" in Example 2 The figure which shows the security policy setting screen when accessing the information processing device from PC The figure which shows the security policy setting status display screen in Example 1 The figure which shows an example of the TPM server list | wrist in Example 2. The figure which shows the security policy setting status display screen in Example 2.

  Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings.

  As shown in FIG. 1, the information processing system includes an information processing apparatus 100 (for example, an MFP) connected to the network 101 and a PC 102 connected to the network 101. The PC 102 can transmit and receive data to and from the information processing apparatus 100 via the network 101 and can operate the information processing apparatus 100 by remote access. When there are a plurality of information processing apparatuses 100, the PC 102 can individually access and operate each information processing apparatus 100. The information processing apparatus 100 is not necessarily provided with the configuration of the entire MFP, and may function as a control apparatus incorporated in the MFP.

  The hardware configuration of the information processing apparatus 100 will be described with reference to FIG. The control unit 200 is connected to a scanner 201 as an image input device and a printer 202 as an image output device. On the other hand, the control unit 200 is connected to the network 101 and the public line 204 to input / output image information and device information.

  A CPU 205 is a processor that controls the entire information processing apparatus 100. A RAM 206 is a system work memory for the CPU 205 to operate, and is also a memory for temporarily storing confidential information such as image data, user information, and passwords. A ROM 207 is a boot ROM, and stores a system boot program. An HDD 208 is a hard disk drive that stores system software, applications, and image data. A program for executing a flowchart described later in the embodiment is also stored in the HDD 208. Each step of the flowchart of the embodiment is executed by a program stored in the HDD 208 by the CPU 205. However, a processor other than the CPU 205 may execute the steps of the flowchart, or the CPU 205 and another processor may cooperate to execute the processing of the flowchart.

  The operation unit interface 209 is an interface unit with the operation unit 210 having a touch panel, and outputs image data to be displayed on the operation unit 210 to the operation unit 210. Also, it serves to transmit information input by the system user from the operation unit 210 to the CPU 205. A network interface 211 is connected to the network 101 and inputs / outputs information. The MODEM 212 is connected to the public line 204 and inputs / outputs information. The SRAM 213 is a non-volatile recording medium that can operate at high speed. The RTC 214 is a real-time clock, and performs a process of continuously counting the current time even when the control unit 200 is not powered. The above devices are arranged on the system bus 215.

  The Image Bus I / F 216 is a bus bridge that connects the system bus 215 and an image bus 217 that transfers image data at high speed, and converts the data structure. The image bus 217 is configured by a PCI bus or IEEE1394. The following devices are arranged on the image bus 217. The RIP unit 218 is a raster image processor and develops a PDL code into a bitmap image. A device I / F unit 219 connects the scanner 201 and printer 202, which are image input / output devices, to the control unit 200, and performs synchronous / asynchronous conversion of image data. The scanner image processing unit 220 corrects, processes, and edits input image data. The printer image processing unit 221 performs printer correction, resolution conversion, and the like on the print output image data. The TPM 222 provides a function of encrypting / decrypting confidential information (common key, certificate, etc.) using the TPM encryption key.

  The upper part of FIG. 2 is a block diagram showing a schematic configuration of the PC 102. The PC 102 includes a PC operation unit 21 and a PC display unit 22, and connects to the network from the PC communication unit 23 to input / output information.

  FIG. 3 is a block diagram illustrating a software configuration of the information processing apparatus 100. The information processing apparatus 100 includes a user interface unit 301 (hereinafter abbreviated as a UI unit), a security setting management unit 302, a security setting holding unit 303, an operation function unit 304 (key management function unit), and a functional configuration holding unit 305. .

  The UI unit 301 receives a request from the user via the operation unit 210 and displays an operation screen on the operation unit 210. The security setting holding unit 303 holds various settings related to security. The operation function unit 304 is a predetermined function unit that operates based on the security setting held in the security setting holding unit 303. In this embodiment, the operation function unit 304 functions as a key management function unit that manages encryption keys using hardware such as TPM.

  The security setting management unit 302 manages the entire security setting operation by transmitting and receiving information to and from the UI unit 301 and the operation function unit 304. In addition, the function configuration of the information processing apparatus 100 can be dynamically confirmed by transmitting and receiving information to and from hardware and system software at the time of startup, and the confirmation result as illustrated in FIG. it can.

  The security setting holding unit 303 stores security related setting values. For example, as shown in FIG. 5, the security setting holding unit 303 can hold a setting value forcing the use of the TPM, a setting value forcing the use of the FIPS-compliant algorithm for encryption, and the like. Security-related setting items can be used as security policy items as they are, but all items do not always match.

  Note that the processing of the UI unit 301, the security setting management unit 302, and the operation function unit 304 is executed by the CPU 205 based on the system software stored in the HDD 208. The security setting holding unit 303 and the functional configuration holding unit 305 are stored in the HDD 208.

  Next, processing for applying a security policy forcing the use of the TPM will be described with reference to FIGS. 1, 2, 3, 4, 5, 6, 8, and 9. FIG. 6 is a flowchart showing a flow of processing for applying a security policy forcing use of the TPM. Note that the procedure shown in the flowchart is stored in any of the storage means of the RAM 206, the ROM 207, the HDD 208, and the SRAM 213 and executed by the CPU 205.

  The process of applying the security policy starts when the security administrator changes the security policy setting value using the PC 102 and transmits a security policy setting process start instruction together with the security policy setting value to the information processing apparatus 100.

  First, the security policy setting screen 0800 of FIG. The security administrator can change the validity / invalidity of the security policy setting value forcing the use of the TPM by selecting valid 0801 or invalid 0802 on the security policy setting screen 0800 using the PC operation unit 21 and pressing OK0805. Is possible. In the display of the security policy setting value, “valid” means “ON” of the security related setting value shown in FIG. 5, and “invalid” means “OFF” of the security related setting value.

  The security administrator uses the PC operation unit 21 to select the security policy setting screen 0800 valid 0803 or invalid 0804, and press OK 0805 to force the use of the FIPS-compliant algorithm for encryption. It is also possible to change the validity / invalidity of the value.

  When OK0805 is pressed on the security policy setting screen 0800, a security policy setting start instruction together with the security policy setting value is notified from the PC communication unit 23 to the information processing apparatus 100 via the network 101, and the process proceeds to step S601.

  In step S601, the security setting management unit 302 receives the security policy setting value received from the PC 102, and proceeds to step S602.

  In step S602, the security setting management unit 302 acquires the current security-related setting value from the security setting holding unit 303, and proceeds to step S603.

  In step S <b> 603, if the security setting management unit 302 determines that the setting item “use TPM” does not exist in the security setting holding unit 303, the process ends.

  In step S603, when the security setting management unit 302 determines that the setting item “use TPM” exists in the security setting holding unit 303, the security setting management unit 302 proceeds to step S604.

  In step S604, the security setting management unit 302 compares the security policy setting value received from the PC 102 with the security-related setting value held by the security setting holding unit 303 and determines that the setting value of “use TPM” is the same. Ends the process.

  If the security setting management unit 302 determines in step S604 that the security policy setting value received from the PC 102 is different from the security-related setting value held in the security setting holding unit 303, the process proceeds to step S605.

  If it is determined in step S605 that the value of “use TPM” is OFF among the security policy setting values received from the PC 102, the process proceeds to step S606.

  In step S606, the security setting management unit 302 overwrites and updates the setting value of “use TPM” in the security setting holding unit 303 with the security policy setting value, and proceeds to step S607.

  In step S607, the security setting management unit 302 notifies the operation function unit 304 including the key management function that the setting value of “use TPM” has been changed, and ends the process.

  If it is determined in step S605 that the setting value “use TPM” is ON among the security policy setting values received from the PC 102, the process proceeds to step S608.

  In step S608, the security setting management unit 302 acquires the function configuration information of the information processing apparatus 100 from the function configuration holding unit 305, and confirms whether the information processing apparatus 100 has the TPM chip 222 mounted. If it is determined that the TPM chip 222 is mounted, the process proceeds to step S606.

  If the security setting management unit 302 determines in step S608 that the TPM chip 222 is not mounted on the information processing apparatus 100, the process proceeds to step S609.

  In step S609, the security setting management unit 302 notifies the PC 102 of the value of the security related setting item, and displays the security policy setting status display screen 0900 on the PC display unit 22. Here, the setting item “Use TPM” is displayed as invalid 0901, and since the information processing apparatus 100 is not equipped with TPM, “Use TPM” cannot be enabled 0903, and security is displayed. Notify the administrator. When the security administrator confirms the notification and presses the OK0904 button, the security policy setting status display screen 0900 is closed and the processing is terminated.

  In this embodiment, the case where the use of the TPM is forced as an example of the setting item of the security policy has been described. However, the setting value cannot be observed by the security function of the information processing apparatus 100 even for other security-related setting items. If so, the same can be applied.

  When forcing the use of the FIPS-compliant algorithm for encryption in the setting item of the security policy, the setting value cannot be applied when the FIPS authentication module is not installed with reference to the function configuration holding unit 305 of the information processing apparatus 100 Can be notified to the security administrator.

  Thereby, the security administrator can easily find out that the security policy input to the information processing apparatus 100 cannot be observed by the security function installed in the information processing apparatus 100, and recognize the security risk of the entire network at an early stage. And measures such as reviewing the security policy and reconsidering the configuration of the information processing apparatus 100 can be taken.

  Next, a second embodiment of the present invention will be described. In the first embodiment, it is determined whether or not the TPM chip 222 is mounted on the information processing apparatus 100 as a condition for enabling “use TPM” of the setting item of the security policy. However, as in the background art described above, even if the TPM chip 222 is not provided as the hardware of the information processing apparatus 100, the TPM server 103 is remotely accessed via the network and the TPM key management function is used. Is also possible. In that case, the availability of TPM may change due to complex and sudden factors such as the operating status of the TPM server and the operating status of the network, so the security policy must be flexibly operated according to the status. There is.

  In the second embodiment, the flow of processing for applying a security policy forcing the use of the TPM to the information processing apparatus 100 that does not have the TPM chip 222 and has a function of remotely accessing the TPM server 103 will be described with reference to FIGS. 10 and will be described with reference to FIG.

  In the process of FIG. 7 in the present embodiment, the processes of steps S709, S710, and S711 are added to the process of FIG. 6 of the first embodiment, and the processes of steps S701 and S712 are changed. The processing to be added or changed relates to determination of whether or not the TPM can be used when a device that does not include the TPM chip 222 remotely accesses the TPM server 103, and will be described in detail later.

  In the security policy setting process of the present embodiment, the security administrator changes the security policy setting value using the PC 102 as in the first embodiment, and transmits a security policy setting process start instruction together with the security policy setting value to the information processing apparatus 100. Start by doing. Since the operation procedure in the PC 102 is the same as that in the first embodiment, a description thereof will be omitted.

  In this embodiment, since there is a possibility that a device to which the security policy is applied may remotely access the TPM server 103, the security administrator lists in advance the TPM server 103 accessible by the information processing apparatus 100 in FIG. Such a TPM server list is transmitted to the information processing apparatus 100 together with a security policy setting process start instruction. The TPM server list has a TPM server address and a remote access permission value. The TPM server address indicates address information in the network such as the IP address and domain name of the TPM server 103. The purpose of the remote access permission is to control access permission from the information processing apparatus 100 to the TPM server 103 by notifying the information processing apparatus 100 by switching the security manager between ON and OFF. The TPM server list is also intended to provide the information processing apparatus 100 with an alternative access destination when the TPM server falls into service stop by listing a plurality of TPM servers that the information processing apparatus 100 can remotely access.

  The processing in steps S702 to S708 in the flowchart shown in FIG. 7 is the same as the processing in steps S602 to S608 described in the flowchart in FIG. In the present embodiment, parts that are not described, such as the configuration of the information processing apparatus 100 and processing for determining a change in the security policy setting value, are the same as those in the first embodiment.

  Hereafter, the part which changes in Example 2 from Example 1 is demonstrated.

  In the information processing apparatus 100, when the setting value of “Use TPM” in the received security policy is changed to ON and the TPM 222 is not installed, the security setting management unit 302 performs the processing up to step S709.

  In step S709, the security setting management unit 302 refers to the TPM server list received from the PC 102, finds TPM servers for which remote permission is ON sequentially from the top of the list, and proceeds to step S710.

  In step S710, remote access to the TPM server discovered in step S709 via the network 101 is attempted. Whether or not remote access is possible is determined by whether or not several conditions are satisfied. For example, the network 101 connected to the information processing apparatus 100 is functioning normally, and the information processing apparatus 100 can remotely access the TPM server 103 via the network 101. Furthermore, there may be conditions such that the TPM server 103 is operating normally and a service to the information processing apparatus 100 can be provided, and that the information processing apparatus 100 is authenticated. However, the conditions listed here are examples based on one form of key management using the TPM server, and the determination conditions differ depending on the network configuration and the function of the TPM server.

  If it is confirmed that the remote access has been successful, the process proceeds to step S706, and the subsequent processing is the same as the processing after step S606 in FIG. If the remote access to the TPM server 103 fails in step S710, the process proceeds to step S711.

  In step S711, if there remains a TPM server that is not referred to on the TPM server list, the process proceeds to step S709, and the process of finding a remotely accessible TPM server from the TPM server list is repeated.

  If all the servers in the TPM server list have been confirmed in step S711 and there are no unreferenced TPM servers remaining, the process proceeds to step S712.

  In step S 712, the security setting management unit 302 notifies the PC 102 of information, and displays a security policy setting status display screen 1100 on the PC display unit 22. Here, it is displayed that the setting item “use TPM” is invalid 1101 and “use TPM” cannot be validated 1103 because the information processing apparatus 100 is in a state where the TPM cannot be utilized. The person in charge. When the security administrator confirms the notification and presses the OK 1104 button, the security policy setting status display screen 1100 is closed and the process is terminated.

  This makes it easy for the security administrator to be unable to access the TPM server 103 for some reason when the information processing device 100 tries to access the TPM server 103 in order to comply with the security policy input to the information processing device 100. It is possible to recognize the security risk of the entire network at an early stage, and to take measures such as reviewing the security policy and considering the recovery of the network 101 and the TPM server 103 at an early stage.

301 UI part 302 Security setting management part 303 Security setting holding part
304 operation function unit, 305 function configuration holding unit,
0800 Security policy setting screen, 0801 TPM use enable setting button,
0802 TPM use disable setting button,
0803 FIPS compliant algorithm use enable setting button,
0804 FIPS compliant algorithm use disable setting button,
0805 Security policy setting reflection execution button,
0806 Security policy setting cancel button,
0900 Security policy setting status display screen, 0901 TPM use setting,
0902 FIPS compliant algorithm usage setting, 0903 TPM usage ineffective notification,
0904 Security policy setting status display confirmation button,
1100 Security policy setting status display screen, 1101 TPM use setting,
1102 FIPS compliant algorithm usage setting, 1103 TPM usage not enabled notification,
1104 Security policy setting status display confirmation button

Claims (3)

An information processing apparatus having setting items related to a security function,
Security setting value holding means for holding a value of a setting value related to the security function;
Functional configuration holding means for holding configuration information about security functions provided in the information processing apparatus;
An operation function means for controlling the information processing apparatus based on a set value for the security function;
Security policy receiving means for receiving a security policy setting value for the setting item relating to the security function;
Security setting value acquisition means for acquiring a setting value related to a security function from the security setting value holding means;
Means for determining whether the setting item exists and the value is different when compared with the setting value for the security function when the security policy setting value is received;
Means for referring to information held by the functional structure holding means and determining whether a security function to which a set value is to be activated is installed;
Security setting value updating means for updating a setting value of the security setting value holding means with a security policy setting value;
Notification means for notifying the security administrator who has entered the security policy of the security-related setting item value and a warning that the setting value cannot be changed when it is determined that the security function is not installed according to the security policy setting value When,
An information processing apparatus comprising: An information processing apparatus having setting items related to a security function,
Security setting value holding means for holding a value of a setting value related to the security function;
Functional configuration holding means for holding configuration information about security functions provided in the information processing apparatus;
An operation function means for controlling the information processing device based on a set value for the security function;
Security policy receiving means for receiving a security policy setting value for the setting item relating to the security function;
A server list acquisition unit that acquires a set value related to a security function and a list of remotely accessible servers from the security setting value holding unit;
Means for determining whether the setting item exists and the value is different when compared with the setting value for the security function when the security policy setting value is received;
Means for referring to information held by the functional configuration holding means and determining whether a security function to which a set value is to be activated is installed;
A remote access permission determination means for determining whether a security function that is not installed in the information processing apparatus can be replaced by remotely accessing a function provided by the server;
Notification that notifies the security administrator who entered the security policy of the security-related setting item value and the warning that the setting value cannot be changed when it is determined that the security function cannot be enabled according to the security policy setting value Means,
An information processing apparatus comprising:   The program for functioning as each means of the information processing apparatus of Claim 1 or Claim 2.