JP7205134B2 - Information processing device and program - Google Patents

Description

The present invention relates to an information processing device and program.

In Patent Document 1, authentication processing corresponding to a security policy, firewall settings, and personal attribute information are managed, and when an access request is received, permission/non-permission is determined based on the managed security policy. An access control method for determining is disclosed.

In Patent Document 2, the person's work schedule is registered in advance, and if there is an access to a certain file that conflicts with the work schedule, the access is determined to be unauthorized access, and the file is accessed. An unauthorized access control system is disclosed that denies access to

In Patent Document 3, a plurality of accounts with different access privileges are associated with one authentication ID, and an account for logging in to a service is controlled according to the physical location information of the terminal and the location information on the network. An account management method is disclosed.

JP 2005-004549 A JP-A-2005-234729 JP 2016-066186 A

An object of the present invention is to allow a user who is granted access rights to certain information depending on the access situation to access the information while reducing the possibility of lowering the security level even if the access rights to the information are not granted. It is an object of the present invention to provide an information processing device and a program that make it possible.

[Information processing device]
According to the first aspect of the present invention, setting information in which a required security level for determining whether or not to permit access to information under what kind of access status for each piece of information being managed is set in advance. a first storage means for storing
a second storage means for storing user information of a user who has access rights to the information for each of the managed information;
When a first user requests access to certain information, and the first user has access rights to the information in the user information stored in the second storage means, When the access status of the first user is such that access is not permitted in the setting information stored in the first storage means, the access right to the information is set in the user information stored in the second storage means. a permission requesting means for requesting permission from a second user having
When the second user permits the first user to access the information in response to a request by the permission requesting means, control is performed to permit the first user to access the information. and access control means.

In the present invention according to claim 2, the access status is based on an access route to information to be accessed, an access terminal that has requested access to the information, and robustness of authentication information at the time of making the access request. 2. The information processing apparatus according to claim 1, wherein the determination is made by

In the present invention according to claim 3, the access route is determined based on whether the access route is via a public network or via a network within a specific organization, and the determination is based on whether the access terminal is a pre-registered terminal. 3. The information processing apparatus according to claim 2, wherein the robustness of the authentication information is determined by the number of characters or character type of the authentication information.

In the present invention according to claim 4, when there are a plurality of second users who have access rights to the information, the permission requesting means determines whether the second users among the plurality of second users have a predetermined condition. 4. The information processing apparatus according to any one of claims 1 to 3, wherein permission for access to the information is requested for only one user.

In the present invention according to claim 5, when there are a plurality of second users who have access rights to the information, the permission requesting means sends the information to the user with the highest authority among the plurality of second users. 5. The information processing apparatus according to claim 4, wherein permission for access to is requested.

In the present invention according to claim 6, when there are a plurality of second users who have access rights to the information, the permission requesting means requests the user having the highest security level among the plurality of second users. 5. The information processing apparatus according to claim 4, wherein permission to access information is requested.

In the present invention according to claim 7, when there are a plurality of second users who have access rights to the information, the permission requesting means asks users who belong to the same organization as the user who made the access request to access the information. 5. The information processing apparatus according to claim 4, wherein permission for access to is requested.

According to an eighth aspect of the present invention, when there are a plurality of second users who have access rights to the information, the permission requesting means requests a user registered in advance as an approver of the user who has made the access request. 5. The information processing apparatus according to claim 4, wherein permission for access to the information is requested.

According to a ninth aspect of the present invention, when there are a plurality of second users who have access rights to the information, the permission requesting means is registered as a creator or administrator of the information requested for access. 5. The information processing apparatus according to claim 4, wherein the user is requested to permit access to the information.

[program]
In the present invention according to claim 10, setting information in which a required security level for determining whether or not to permit access to information under what kind of access status for each information under management is set in advance. a first storing step of storing
a second storage step of storing user information of users who have access rights to the information for each of the managed information;
When a first user requests access to certain information, and the first user has access rights to the information in the user information stored in the second storing step, If the access status of the first user is such that access is not permitted in the setting information stored in the first storage step, the access right to the information in the user information stored in the second storage step. a permission requesting step of asking permission from the second user having
When the second user permits the first user to access the information in response to the request in the permission requesting step, control is performed to permit the first user to access the information. A program for causing a computer to execute an access control step.

According to the present invention of claim 1, even if a user who is authorized to access certain information depending on the access situation is not authorized to access the information, it is possible to reduce the possibility of lowering the security level. An information processing device that enables access to the information can be provided.

According to the present invention of claim 2, even if a user who is granted access rights to certain information depending on the access route, access terminal, or robustness of authentication information is not granted access rights to the information, security It is possible to provide an information processing apparatus that enables access to information while reducing the possibility of lowering the level.

According to the third aspect of the present invention, even if a user who is granted access rights to certain information depending on the access route, access terminal, or robustness of authentication information is not granted access rights to the information, security It is possible to provide an information processing apparatus that enables access to information while reducing the possibility of lowering the level.

According to the fourth aspect of the present invention, when there are a plurality of second users who have access rights to information for which an access request has been made, it is possible to prevent requesting access permission from a plurality of users. An information processing device can be provided.

According to the fifth aspect of the present invention, when there are a plurality of second users who have access rights to information for which an access request has been made, it is possible to prevent requesting access permission from a plurality of users. An information processing device can be provided.

According to the sixth aspect of the present invention, when there are a plurality of second users who have access rights to the requested information, it is possible to prevent requesting access permission from a plurality of users. An information processing device can be provided.

According to the present invention of claim 7, when there are a plurality of second users who have access rights to information for which an access request has been made, it is possible to prevent requests for access permission from a plurality of users. An information processing device can be provided.

According to the eighth aspect of the present invention, when there are a plurality of second users who have access rights to information for which an access request has been made, it is possible to prevent requesting access permission from a plurality of users. An information processing device can be provided.

According to the ninth aspect of the present invention, when there are multiple second users who have access rights to information for which an access request has been made, it is possible to prevent requests for access permission from multiple users. An information processing device can be provided.

According to the tenth aspect of the present invention, even if a user who is authorized to access certain information depending on the access situation is not authorized to access the information, it is possible to reduce the possibility of lowering the security level. A program can be provided that allows access to that information.

1 is a diagram showing the configuration of an access control system according to a first embodiment of the present invention; FIG. FIG. 10 is a diagram for explaining a situation when user A accesses information asset X from inside the company; FIG. 10 is a diagram for explaining a situation when user A accesses information asset X from outside the company; 2 is a block diagram showing the hardware configuration of an information management server 10 according to one embodiment of the present invention; FIG. 2 is a block diagram showing the functional configuration of an information management server 10 according to one embodiment of the present invention; FIG. 3 is a diagram showing an example of a security level management table stored in a security level management table storage unit 33; FIG. 3 is a diagram showing an example of an access right management table stored in an access right management table storage unit 34; FIG. 8 is a functional block diagram for explaining the detailed configuration of an access control unit 32 shown in FIG. 7; FIG. 4 is a flow chart for explaining the operation of the access control unit 32 according to the first embodiment of the present invention; 4 is a sequence chart for explaining the operation of the access control system according to the first embodiment of the present invention; FIG. FIG. 9 is a functional block diagram for explaining the detailed configuration of an access control unit 32a according to the second embodiment of the present invention;

Next, embodiments of the present invention will be described in detail with reference to the drawings.

[First Embodiment]
FIG. 1 is a diagram showing the configuration of an access control system according to the first embodiment of the present invention.

The access control system of this embodiment, as shown in FIG. It is composed of a mobile terminal device 70 such as a smart phone that can be connected via the Internet communication network 50 .

In this embodiment, only the terminal devices 20A and 20B of users A and B are connected to the internal network 30 for the sake of simplicity. It is connected to the company network 30 .

The information management server 10 controls access to the information assets X, Y, and Z stored in the file storage device 40, and accesses users who request access to the information assets X, Y, and Z. is an information processing device that performs control for permitting or prohibiting

In the access control system as shown in FIG. 1, users A and B make requests to the information management server 10 for access to the information assets stored in the respective terminal devices 20A and 20B or the file storage device 40. Information assets can be browsed when permitted.

Here, there are cases where each user wants to view information assets even outside the company. For this reason, for example, the user A operates the portable terminal device 70 to connect to the company network 30 via the wireless LAN terminal 60 and the Internet communication network 50, which is a public network, to view the information assets stored in the file storage device 40. can be done.

However, if access to information assets from outside the company is easily permitted, there is a possibility that the content of the information assets will be acquired by a malicious third party. Therefore, in the access control system of this embodiment, when there is an access request to information assets, permission/refusal (non-permission) of the access request is determined based on the access status of the access request. A higher security level is set for access from outside than for access.

Therefore, for example, as shown in FIG. 2, even if the user A is permitted to access the information asset X stored in the file storage device 40 from within the company, as shown in FIG. Access to information asset X via 70 may not be permitted.

In FIGS. 2 and 3, the security level is determined by the access status of the user requesting access: (1) strength of password, (2) access terminal, and (3) access route. A case is shown in which the access is denied by the information management server 10 because the user A attempts to view the information asset X from outside the company using the personal portable terminal device 70 via the Internet communication network 50, which is a public network. .

Here, the toughness of a password (authentication information) is determined by, for example, the number of password characters or character types. Specifically, toughness is determined to be high when the number of characters is large, and toughness is determined to be high when the type of characters includes not only numbers but also alphabets and other symbols.

An access terminal is determined by whether or not the terminal requesting access to information assets is pre-registered, and whether the terminal is lent by a company or owned by an individual. be. Specifically, a terminal registered in advance is judged to have a higher security level, and a terminal lent by a company is judged to have a higher security level.

The access route indicates the route through which the information asset is to be accessed. If the access route is via a public network such as the Internet communication network 50, the security level is determined to be low. The security level is judged to be high when it is via a network within a specific organization such as

Although the file storage device 40 is connected to the information management server 10 in FIG. 1, it may be connected to the in-house network 30 .

Next, FIG. 4 shows the hardware configuration of the information management server 10 in the access control system of this embodiment.

As shown in FIG. 4, the information management server 10 transmits and receives data to and from external devices via a CPU 11, a memory 12, a storage device 13 such as a hard disk drive (HDD), and a network 30. It has a communication interface (IF) 14, a user interface (UI) device 15 including a touch panel or liquid crystal display and a keyboard. These components are connected to each other via a control bus 16 .

The CPU 11 executes predetermined processing based on control programs stored in the memory 12 or storage device 13 to control the operation of the information management server 10 . In this embodiment, the CPU 11 reads and executes a control program stored in the memory 12 or the storage device 13. It is also possible to provide

FIG. 5 is a block diagram showing the functional configuration of the information management server 10 realized by executing the above control program.

The information management server 10 of this embodiment includes a data transmission/reception unit 31, an access control unit 32, a security level management table storage unit 33, and an access right management table storage unit 34, as shown in FIG. there is

The data transmission/reception unit 31 receives access requests by transmitting/receiving data to/from the terminal devices 20A, 20B and the terminal device 70, and replies with permission/non-permission to the received access requests.

The security level management table storage unit 33 stores in advance a required security level for determining whether or not to permit access to information under what kind of access status for each information asset whose access is being managed. The security management table is stored as setting information.

An example of this security level management table is shown in FIG. In the security level management table shown in FIG. 6, the required security level for information asset X is set to "high", the required security level for information asset Y is set to "medium", and the required security level for information asset Z is set to "high". The required security level is set to "Low".

Here, the required security level is determined by the importance and confidentiality of the information asset, and the higher the required security level is, the more secure the access is, unless the access is permitted.

Here, the required security level is comprehensively determined by the combination of (1) password robustness, (2) access terminal, and (3) access route described above.

For example, for each of (1) password strength, (2) access terminal, and (3) access route, the degree of security is evaluated by points, and whether the total of the points exceeds a preset threshold It may be determined whether or not the required security level is satisfied. In this case, as a matter of course, the number of points serving as the threshold value increases in the order of "low", "medium", and "high" in the required security level.

The access right management table storage unit 34 stores an access right management table indicating which users have access rights to which information assets. In other words, the access right management table storage unit 34 stores, for each information asset whose access is managed, user information of users who have access rights to that information asset.

An example of this access right management table is shown in FIG. In the access right management table shown in FIG. 7, user A has access rights to information asset X, user B has access rights to information assets X and Y, and user C has access rights to information assets X and Y. It is indicated that the access right to the information asset Z is held. Here, it is merely exemplified whether or not each user has the access right to each information asset. It may also specify what operations are permitted on the The operation rights may be tiered, for example, user A may have read and write rights and user B may have read rights only. These information are typically used to authenticate a user attempting to access the information and, if the authentication is successful, confirming that the accessing user is a user stored in the table. , represents the operation that the user can perform on the information.

The access control unit 32 controls whether to permit or deny the access request to the information assets received by the data transmission/reception unit 31 .

Specifically, the access control unit 32 in this embodiment, when a certain user requests access to a certain information asset, the access right management table storage unit 34 and the security level management table storage unit 33 store the It is determined whether or not to permit access to the information asset based on the security level management table (setting information).

When a certain user requests access to a certain information asset, the access control unit 32 determines whether the security level management table in which the user's access status is stored in the security level management table storage unit 33 accesses the information asset. is not permitted, the user information stored in the access right management table storage unit 34 requests another user who has the right to access the information asset for permission.

In response to this permission request, the access control unit 32 permits access to the information assets of the user when another user permits access to the information assets of the user making the access request. control to

In other words, when determining whether or not to permit access to an information asset, the access control unit 32, even if access to that information asset is denied in the determination based on the security level management table, does not allow access to that information asset. Other users who have the right to access the information asset are asked for permission, and if access to the information asset is permitted (approved), access is permitted to the information asset for which access has been denied.

Next, the detailed configuration of the access control unit 32 shown in FIG. 7 will be described with reference to the functional block diagram of FIG.

As shown in FIG. 8 , the access control unit 32 includes an access restriction release unit 41 , a security level determination unit 42 , an access right determination unit 43 , an access permission unit 44 and a user authentication unit 45 .

The user authentication unit 45 authenticates the user by, for example, matching the user ID and password information.

The access right determination unit 43 refers to the access right management table stored in the access right management table storage unit 34 so that the user who has made the access request has the access right to the information asset that has made the access request. It is determined whether or not there is.

The security level determination unit 42 refers to the security level management table stored in the security level management table storage unit 33 to determine whether or not the security level of the user making the access request satisfies the required security level. do.

The access permitting unit 44 determines whether or not to permit the access request to the information assets from the user authenticated by the user authenticating unit 45.

Specifically, the access permission unit 44 determines that the access requesting user has the access right to the information asset to be accessed by the access right determination unit 43, and the security level of the user is equal to the requested security level. is satisfied by the security level determination unit 42, the user requesting access is permitted to access the information asset.

Here, if the security level determination unit 42 determines that the security level of the user making the access request does not satisfy the required security level, the security level determination unit 42 notifies the access restriction release unit 41 to that effect. .

Then, the access restriction release unit 41 permits (approves) the user who made the access request to access the information asset to other users who have access rights to the information asset to be accessed. Make an inquiry as to whether or not

In FIG. 8, when user A requests access to information asset X and the access request is not permitted, access restriction release unit 41 requests user B to access information asset X, and user A accesses information asset X. A case is shown in which an inquiry is made as to whether or not to permit

Here, the access restriction release unit 41 refers to the access right management table storage unit 34 to specify a user who has the access right to the information asset to be accessed, for example, the information asset X, and to the specified user. to inquire whether or not the user A is permitted to access the information asset X.

When a user, for example, user B, who has received an inquiry from the access restriction release unit 41 permits access to the information asset X of the user A, the access restriction release unit 41 requests the access permission unit 44 to restrict the access. Make a cancellation request.

Then, the access permitting unit 44 temporarily permits the access request from the user A, which has not been permitted because the security level does not satisfy the required security level.

As a result, user A can access information asset X stored in file storage device 40 .

Next, the operation of the access control unit 32 in this embodiment will be described with reference to the flowchart of FIG.

First, user authentication is performed by the user authentication unit 45 (step S101), and the access permission unit 44 receives an access request from the authenticated user (step S102).

Then, the access right determination unit 43 determines whether or not the user making the access request has the right to access the information asset to be accessed (step S103).

If it is determined that the user does not have access rights to the information assets to be accessed (no in step S103), the access permitting unit 44 instructs the user to deny access to the information assets. A reply is sent (step S108).

Then, if it is determined that the user has the right to access the information asset to be accessed (yes in step S103), the security level determination unit 42 determines the security level of the user's access status as the access target information asset. It is determined whether or not the required security level required for the information asset is satisfied (step S104).

If it is determined that the access status of the user making the access request satisfies the required security level (yes in step S104), the access permitting unit 44 sends the access request to the effect that access to the information asset is permitted. (step S105).

If it is determined that the access status of the user making the access request does not satisfy the required security level (no in step S104), the access restriction release unit 41 allows other users who have the right to access the information asset to be accessed. The user is requested to approve whether or not to permit access to the information asset (step S106).

Then, when receiving permission of access from other users (yes in step S107), the access restriction release unit 41 requests the access permission unit 44 to release the access restriction. As a result, the access permitting unit 44 replies to the user who made the access request that the access request from the user, which was once determined to be not permitted, is permitted (step S105).

It should be noted that, when receiving a notification that access is not permitted from other users (no in step S107), access restriction release unit 41 does not request access permission release unit 44 to release the access restriction. As a result, the access permitting unit 44 replies to the user that access to the information asset is denied (step S108).

Next, the operation of the access control system according to this embodiment will be described with reference to the sequence chart of FIG.

In FIG. 10, when the user A requests access to the information asset X from the terminal device 70, the information management server 10 determines whether or not the user B is permitted to access the information asset X of the user A. , and User B permits User A to access information asset X.

First, the user A authenticates the user to the information management server 10 (step S201), and requests access to the information asset X (step S202).

Then, in response to the access request from user A, the information management server 10 determines the access right of user A (step S203) and determines the security level based on the access status of user A (step S204).

Here, since user A is requesting access to information asset X using a personal mobile terminal device 70 via a public network in society, the required security level set for information asset X cannot be satisfied. shall be judged.

Then, the information management server 10 once replies to the user A to the effect that the received access request is not permitted (step S205).

However, the information management server 10 issues an access approval request to user B, who has the right to access information asset X, to inquire whether or not user A's access to information asset X is permitted (step S206).

Then, in response to this access approval request, when user B approves user A's access to information asset X (step S207), the information management server 10 transmits an access permission notice to user A (step S208).

As a result of such processing, the user A is permitted to access the information asset X and can browse the information asset X. FIG.

In other words, even if the user A cannot access the information asset X from the portable terminal device 70 via the public network because the required security level originally set for the information asset X is not satisfied, , User B, who has the right to access information asset X, approves it, allowing user A to access information asset X and view its contents.

In the access control system of this embodiment, for example, if user B is a colleague or boss of user A, it can be determined that user A is currently on a business trip outside the company and there is a need to access information asset X. Therefore, user A is permitted to access information asset X with user B's approval.

Conversely, even if a malicious person impersonates User A and tries to access information asset X, if User B knows that User A should be in the company, access to information X is not permitted. By denying the request, unauthorized access to the information asset X by a malicious person can be prevented.

[Second embodiment]
Next, an access control system according to a second embodiment of the invention will be described.

The access control system of this embodiment differs from the access control system described above only in that the access control unit 32 is replaced with an access control unit 32a as shown in FIG.

FIG. 11 is a functional block diagram for explaining the detailed configuration of the access control unit 32a in this embodiment.

In the first embodiment described above, the case where there is only one user for whom the access restriction release unit 41 issues an access approval request has been described. A description will be given of processing when a plurality of users have the ID.

If there are a plurality of other users who have access rights to the information asset, the access control unit 32a will allow one of the plurality of other users, who is determined based on a preset condition, to access the information asset. Ask for permission to access that information asset.

For example, when there are a plurality of other users who have access rights to the information asset, the access control unit 32a allows the user with the highest authority among the plurality of other users to access the information asset. demand.

Further, when there are a plurality of other users who have access rights to the information asset, the access control unit 32a permits the user with the highest security level among the plurality of other users to access the information asset. You can ask for it.
In addition, if there are multiple other users who have access rights to the information asset, the access control unit 32a asks users who belong to the same organization as the user who made the access request for permission to access the information asset. You can do it.

In addition, when there are a plurality of other users who have access rights to the information asset, the access control unit 32a allows a user registered in advance as an approver of the user who requested access to access the information asset. You may ask for permission from

Furthermore, if there are multiple other users who have access rights to the information asset, the access control unit 32a sends the information to the user registered as the creator or administrator of the requested information asset. Permission to access the asset may be requested.

The access control unit 32a of the present embodiment shown in FIG. 11 differs from the access control unit 32 of the first embodiment shown in FIG. 8 in that a user information storage unit 46 is provided.

The user information storage unit 46 stores user information such as attribute information of each user and access history to information assets of each user.

The access restriction release unit 41 refers to various types of information such as user attribute information stored in the user information storage unit 46, and selects an access authorization request from among a plurality of users who have access rights to the information assets to be accessed. selects the user most suitable to perform the above-described criteria, and issues an access authorization request to the selected user.

In addition, the security level determination unit 42 determines the security level by referring to the password strength, access terminal, access route, attribute information of the user who requested access, past access history, etc. You can do it.

For example, the security level may be determined such that the criteria for permitting access to users belonging to other companies are stricter than those belonging to the company. In addition, the security level is not strictly determined for users who have access history to the information asset in the past, but the security level is not strictly determined for users who have never accessed the information asset in the past. It is also possible to make a determination that makes the

Further, the access authorization request by the access restriction releasing unit of the present embodiment may be limited to those whose security level originally set for the information to be accessed is below a certain level.

10 image forming apparatus 11 CPU
12 memory 13 storage device 14 communication interface (IF)
15 User interface (UI) device 16 Control bus 20A, 20B Terminal device 30 Company network 31 Data transmission/reception unit 32, 32a Access control unit 33 Security level management table storage unit 34 Access right management table storage unit 40 File storage device 41 Release of access restriction Unit 42 Security level determination unit 43 Access right determination unit 44 Access permission unit 45 User authentication unit 46 User information storage unit 50 Internet communication network 60 Wireless LAN terminal 70 Portable terminal device

Claims (10)

a first storage means for storing setting information in which a required security level for determining whether or not access to the information is permitted under what kind of access status for each information under management is set in advance;
a second storage means for storing user information of a user who has access rights to the information for each of the managed information;
When a first user requests access to certain information, and the first user has access rights to the information in the user information stored in the second storage means, When the access status of the first user is such that access is not permitted in the setting information stored in the first storage means, the access right to the information is set in the user information stored in the second storage means. a permission requesting means for requesting permission from a second user having
When the second user permits the first user to access the information in response to a request by the permission requesting means, control is performed to permit the first user to access the information. access control means;
Information processing device with 2. The access status according to claim 1, wherein the access status is determined based on an access route to the information to be accessed, an access terminal that requested access to the information, and robustness of authentication information when the access request was made. Information processing equipment. The access route is determined based on whether the access route is via a public network or via a network within a specific organization, and is determined based on whether the access terminal is a pre-registered terminal. 3. The information processing apparatus according to claim 2, wherein the determination is made based on the number of characters or character types of . When there are a plurality of second users who have access rights to the information, the permission requesting means requests one of the plurality of second users determined based on a preset condition to access the information. 4. The information processing apparatus according to any one of claims 1 to 3, wherein permission to access information is requested. 3. When there are a plurality of second users who have access rights to the information, the permission requesting means requests a user with the highest authority among the plurality of second users to permit access to the information. 5. The information processing device according to 4. When there are a plurality of second users who have access rights to the information, the permission requesting means requests a user with the highest security level among the plurality of second users for permission to access the information. Item 5. The information processing device according to item 4. 5. When there are a plurality of second users who have access rights to the information, the permission requesting means requests a user who belongs to the same organization as the user who made the access request for permission to access the information. The information processing device described. When there are a plurality of second users who have access rights to the information, the permission requesting means requests a user registered in advance as an approver of the user who requested access to access the information. 5. Information processing apparatus according to claim 4. When there are a plurality of second users who have access rights to the information, the permission requesting means requests a user who is registered as a creator or administrator of the requested information to access the information. 5. The information processing apparatus according to claim 4, wherein permission for a first storing step of storing setting information in which a required security level for determining whether or not access to the information is permitted under what kind of access status for each information under management is set in advance;
a second storage step of storing user information of users who have access rights to the information for each of the managed information;
When a first user requests access to certain information, and the first user has access rights to the information in the user information stored in the second storing step, If the access status of the first user is such that access is not permitted in the setting information stored in the first storage step, the access right to the information in the user information stored in the second storage step. a permission requesting step of asking permission from the second user having
When the second user permits the first user to access the information in response to the request in the permission requesting step, control is performed to permit the first user to access the information. an access control step;
A program that causes a computer to run

Images