WO2015025373A1 - Oa apparatus suitable for providing management security service, and security service provision method using said oa apparatus - Google Patents

Abstract

The purpose of the present invention is to provide a management security service (MSS) that is easy to introduce into even small and medium-sized enterprises, by standardizing and packaging MSS monitoring programs and services to be provided and thereby accommodating these monitoring programs and services to the hardware of a multifunction machine or the like. An OA apparatus, such as a multifunction machine, in which a security appliance including a predetermined security means is stored in, for example, a sheet tray type enclosure, is used as the center of an information system. Software and services to be provided are packaged based on the configuration of this multifunction machine. In response to a query from an operation management center, the OA apparatus transmits security information to the operation management center, thereby allowing the operation management center to smoothly manage the information system. With this mechanism, even enterprises and organizations that do not have an IT manager or the like can smoothly receive a supply of MSS.

Description

OA device suitable for providing management security service, and security service providing method using the OA device

The technical field of the present invention relates to the provision of so-called management security services (hereinafter sometimes abbreviated as MSS). More particularly, the present invention relates to providing this improved MSS.

(1) About MSS In recent years, security services called MSS (management security service) have been provided for the purposes of ensuring security for information systems, quickly spreading from failures, protecting against external attacks, and quickly recovering. Yes.

Terminology: “provider” and “user”
In the explanation of the text, the person who provides the MSS service (and the person who provides the hardware, software resources, facilities, etc.) is called the “provider”, and the “MSS service provider” Employ expressions such as “provider side”. In general, “providers” of MSS services are information security companies, IT companies, and the like.

Also, a person who receives an MSS service is referred to as a “user” of the MSS service, and is simply referred to as a “user”, or an expression such as “system on the service user side” to be monitored is adopted. In general, a “user” of an MSS service is a company that uses an information system, and the information system of the company is the “system on the user side of the service”.
The “user-side system” to be monitored includes not only a system provided in the company but also a user-side system located outside. For example, when the company uses an external server, and the external server is also a monitoring target of the MSS service, the external system is also the above-mentioned “user side system”. . In some cases, a provider who provides the MSS also provides an external server or the like at the same time. In some cases, an MSS service is provided simultaneously with a data server provided by a data center or the like.
The “user-side system” to be monitored may be simply referred to as “information system”. In particular, a preferred example of the “information system” in the claims is a “user-side system” that is a monitoring target.
In the following, in order to make the explanation easy to understand, only a part belonging to the user side network in the company is explained as an example of the “user side system” to be monitored. However, as a matter of course, the scope of the present invention includes the case where the user-side system to be monitored is located outside the company.

In a general conventional MSS, an MSS service provider often provides the following service to an information system on the user side who receives the service.

-Perform remote monitoring via the network.
-Monitor the data passing through the network and accumulate the log.
-The service provider acquires the above logs via the network and analyzes them.
・ Provide analysis results to users regularly or irregularly.
-Update and adjust the user's security system via the network.
-Respond quickly when a hardware failure such as a security system failure occurs.
-Respond quickly in the event of a security breach accident (including signs of occurrence).
Others Note that such MSS (Management Security Service) corresponds to a preferred example of the security service in the claims.

Basic concept of security services Such security services are generally provided in the installation (Plan), operation (Do), analysis (Check), and improvement (Act) cycle (hereinafter also referred to as steps). Many. This is commonly referred to as a PDCA cycle.

In the installation step, predetermined security devices and communication devices are installed in the user information system. Or there may be equipment already installed. In this installation step, connection setting (introduction) to the network is performed. This is the introduction of so-called hardware.
In this installation step, the rule part is also set. That is, the security policy is generally set. For this purpose, rule settings relating to packets that are allowed to pass or not, rule settings for events that are detection targets, and other security policy settings (including incident settings, etc.) are performed.

Next, in the operation step), equipment operation is monitored. When a failure or the like occurs in each device or is likely to fail, this is detected and the following processing is performed.

That is, polling is performed from the operation management center side, and the CPU and memory of devices belonging to the user side system are monitored and recorded. As a result of the monitoring, the operation management center can detect in real time when an abnormality or failure has occurred or is likely to occur.

Also performs security monitoring. A packet log from outside or inside the user network is acquired to detect whether there has been a security breach.

Thus, the MSS service detects device failures, security breaches, etc. during operation. In many cases, the user's information system is often managed remotely from an external management center connected via a network. This external management center is installed and provided by an MSS service provider.

Next, in the analysis step, an equipment failure is analyzed from the acquired log. In addition, security analysis is performed to analyze the presence or absence of security breaches or inappropriate access from outside or inside. These analyzes are mainly performed at the external management center described above. However, this analysis result is also reported to the security administrator who is in charge of the user side, but in principle, the analysis is performed by an external administrator.

The operation of such an analysis step is divided into various patterns.

(For large large companies)
In the case of a relatively large company, an internal administrator has specialized knowledge about information systems and can often set a firewall or the like. Such an administrator is called an “IT administrator”.

Also, with regard to security, there are cases where “security administrators” with basic knowledge are deployed, but there are many cases where detailed technical knowledge is not available. As a result, they do not have enough knowledge to run the so-called PDCA cycle described above. Therefore, in terms of analysis, it is often preferable to outsource to an external expert who has expertise in security, both in terms of cost and labor. In other words, the MSS service is often used by outsourcing to an external supplier.

(For large companies)
Moreover, in the case of a medium-sized large company, an IT manager of an information system is arranged inside, but the IT manager is an administrator for information management to the last, and is often not familiar with security. That is, this IT administrator knows the network configuration method and the like but does not have much knowledge about security. In other words, there are many companies that do not have “security managers” in mid-sized companies. In the case of such a company, if the MSS is used by outsourcing to an external contractor, there is an advantage that the PDCA cycle can be more easily performed.

As described above, in many cases, it is preferable to perform analysis using an external administrator (expert) while an administrator is placed inside a company.

Here, various roles can be considered between the internal administrator and the external administrator. For example, there are companies that allow the information system to be reset from the outside, and some companies have a policy that refuses to be reset from the outside. In the case of a company that refuses resetting from the outside, the external manager contacts the internal manager and requests the resetting.

Similarly, with regard to server rules, there are companies that adopt a mechanism to change rules after an internal administrator considers a proposal to change rules from an external administrator. Some companies leave the server rules to the external administrator.

Next, in the improvement step, if a device failure occurs, recovery from the device failure is performed.

Also, based on the analysis results described above, the security rules set for the device are reviewed and improved. This includes reviewing and improving internal rules.
These processes are not performed at the same time. Recovery from equipment failures and review of security rules, etc. (which may occur at the same time) are basically done at different independent times.

This so-called “PDCA cycle” is often based on the assumption that there is an IT administrator or an IT administrator and a security / operation administrator. Management of information systems and networks on the user side is often performed remotely at the operation management center on the service provider side. However, depending on the situation, operations and improvement steps may be performed with the security / operation manager at the site. Sometimes it is necessary to do this together. As described above, there is a case where cooperation is not necessarily required here.

However, in general, in the conventional MSS, it is desirable that an IT administrator is arranged on the user side to receive the service, and further, a security administrator (also referred to as a “security / operation administrator”). ) Is even more desirable.

Actually, if the MSS service has not been introduced so far, the security / operation manager on the user side could not be established due to various reasons such as human resources, etc. In some cases, it may be impossible to realize the steps of operation (Do), analysis (Check), and improvement (Act). An example of a PDCA cycle in the case where neither an IT administrator nor a security administrator is arranged on such a user side is shown in the conceptual diagram of FIG.

Operation management center (conventional technology)
In the MSS service, in order to reduce the burden on the user side as much as possible, as described above, the information system on the user side is often monitored from an external operation management center via a communication line such as the Internet. Have been widely used.

FIG. 7 shows an explanatory diagram of an outline of providing a conventional general MSS by such an operation management center 10. That is, FIG. 7 is a diagram illustrating an example of a conventionally known MSS.

The information system on the user side to be monitored is referred to as a user side network 12 (see FIG. 7). The user side network 12 includes, for example, a DMZ server group 12a and an internal segment 14 (see FIG. 7).

As described above, the user-side network 12 includes an external server or the like, but for the sake of convenience of explanation, FIG. 7 shows an example of the external server and the like. Absent.

The DMZ server group 12a includes, for example, a firewall 12b and various DMZ servers as security devices. Various other security devices can be included.
Although not shown, the Web server 12a1 may include a WAF (Web Application Firewall) or the like, for example. In some cases, a mail security device for preventing mail SPAM is placed in front of the mail server 12a2. In some cases, IPS or IDS is placed before these WAFs. In some cases, a mechanism called UTM that integrates these functions is installed in the firewall 12b. Furthermore, even when UTM is placed, IPS may be placed separately.
As described above, each company has various security device configurations, and as a result, MSS services are also infinitely different. As a result, it may be difficult for small companies to use MSS. Therefore, as will be described later. The present invention employs a mechanism for providing an MSS using a configuration in which a UTM or the like is included in an MFP or the like.
DMZ (Demilitarized Zone) originally means a “demilitarized zone”, but on an information system, means a segment placed between an untrusted network such as the Internet and a trusted network such as an in-house network.
However, there are many cases where such a DMZ server group 12a does not exist in the company in the case of a company in which an operation manager is not arranged inside. In other words, this is a case where a mail server, a WEB server, or the like is outsourced to the ISP used.

Generally, a DMZ server group 12 a is placed below the firewall 12. Here, the firewall 12a may be configured by a UTM (not shown). When UTM is used, IPS, WAF, or the like may be provided below (located before the DMZ server).

The DMZ server 12a includes a WEB server 12a1, a mail server 12a2, an FTP server 12a3, a DNS server 12a4, and the like. Which servers are included depends on each company and each system. FIG. 7 shows only a group of servers considered to be general, and is not limited to these.

These server groups that have to be disclosed to the Internet are generally arranged in the DMZ segment, and here they are called DMZ server group 12a. These DMZ server groups 12a are connected to the Internet 20 via a firewall 12b.

The internal segment 14 includes client terminals 14a, 14b, 14c, and 14d, and is not open to the Internet 20 without restriction.

Generally, in the firewall 12b, access from the external Internet 20 is permitted only to the DMZ server group 12a (pass the packet), and access to the internal segment 14 is not permitted in principle. The firewall 12b also checks the packet contents (source / destination, etc.) for access to the DMZ server group 12a and does not allow unauthorized packets to pass through. Further, the firewall 12b does not permit the access from the DMZ server group 12a to the internal segment 14 in principle, but the access from the internal segment 14 is in principle for both the external Internet 20 and the DMZ server group 12a. As allowed. However, access to an unauthorized site is not permitted even from the internal segment 14. The operation and function of such a firewall 12b are basically the same in the embodiments described later. Since operations such as IPS and WAF are well known in the art, description of the operations is omitted here.

Now, as shown in FIG. 7, the user-side network 12 that is this user-side information system may be monitored for 24 hours 365 days from the operation management center 10 via the Internet. A security engineer is stationed at the operation management center 10 for 24 hours, and literally monitors for 24 hours. As a result, even when a dedicated administrator is not present on the user side, the attack and failure on the user side network 12 are monitored and analyzed. Based on the analysis results, appropriate measures are taken.

Conventionally, failure analysis response and recovery in the operation management center 10 has been performed by, for example, reporting a failure report and details of the recovery to a person in charge using e-mail. In the case of matters that can be dealt with on the operation management center 10 side, such as setting changes of various network devices, the above-mentioned mail will be a mail reporting that such a countermeasure has been taken. In particular, if there is something that must be executed by the user, it will be included in the email. For example, it is an email indicating that the user must restart the server.

Furthermore, the operation management center 10 often provides a web portal site that can be browsed by the user using a web server dedicated to the user. Through this Web portal site, the monitoring status and logs of the information network 12 on the user side are provided to the user side.

In addition, the user can make a consultation / inquiry about security to the operation management center 10.

(2) Use of MFPs In recent years, so-called MFPs that incorporate a FAX function or a scanner function have been widely used in copy machines, and have become one of typical OA devices. Further, with the progress of the Internet environment in recent years, various types of multifunction devices in which this multifunction device has a so-called LAN connection function are also known.

However, it is considered that there is a security problem if the MFP having such a LAN connection function is directly connected to the Internet. Therefore, it is conceivable to give the multifunction device a security function. For example, Japanese Unexamined Patent Application Publication No. 2012-74935 discloses a multi-function machine that is configured to output image data by authentication of a plurality of people and prevent information leakage. Japanese Patent Application Laid-Open No. 2011-19099 discloses a multifunction peripheral that restricts the functions of the multifunction peripheral when an abnormality is found in the firmware.

As mentioned above, especially in the case of small and medium-sized enterprises, the internal network is also small, so there are many cases where an internal network is built around multifunction devices with such a network connection function, and the security function of the multifunction device is important. It is thought that. This is because this multi-function machine becomes the central part of the company's network connection, and PCs and various smart devices are connected to it to build an in-house network.
In the embodiment of the present invention to be described later, an improved multifunction device is described. However, a housing for storing the security appliance used therein is configured separately from the main body of the multifunction device. There is a case. Details thereof will be described in an embodiment described later.

(3) PDCA cycle and MSS customization In the case of a very large large company, so-called IT administrators are also deployed, and there are many cases where security administrators are also deployed. However, in order to smoothly run the PDCA cycle described above, the MSS service may be used.

In addition, in the case of a medium-sized large company that has only IT managers, it is generally preferable to use the MSS service to rotate the PDCA cycle because there are few people who have security expertise. And there was actually such use.

On the other hand, in the case of small businesses and organizations such as small and medium enterprises, it is difficult to provide a so-called IT administrator, and it is sometimes difficult to run the above-described PDCA cycle.

However, it is also desirable for such an in-house network such as SMEs to use the MSS service described in (1) above and rotate the PDCA cycle. However, existing conventional MSS services are often premised on the presence of at least an IT administrator on the user side as described above. In other words, the use in small and medium enterprises was hardly considered.

In particular, conventionally, MSS has to be customized and tuned according to the user's information system.
In the case of a very large ultra-large company, the equipment used may be special, and the MSS service provided will adopt a monitoring method that matches the company's requirements and a monitoring system that meets the company's requirements. Sometimes it is necessary (this is called customization here).

User information systems vary greatly from user to user. The number and type of clients, the number and type of firewalls, the number and types of other security devices, and the number and types of servers. (That is, the network configuration is various), and the OS of the server is also various. The manufacturers are also diverse. Therefore, customization as described above is required. Further, for example, adjustment of whether UNIX (registered trademark) is used or not is one of customizations described here.
Furthermore, the degree and content of monitoring desired by users varies greatly from user to user (what is monitored and what is monitored for the network configuration), so conventional MSS is tuned for each user. There was a need to build. For example, adjustment of what value the threshold value for determining as dangerous is one type of tuning. As described above, adjustment of the threshold value is mainly called tuning.

Also, adjustment of contact and alert methods is a kind of tuning. Coordination system adjustment between the internal IT administrator and the external center administrator at the time of renovation is also a kind of tuning.

Since it is necessary to perform customization and tuning in this way, the cost of services tends to rise inevitably, and the use of MSS by SMEs etc. has been difficult to consider.

(4) Prior Patent Literature For example, Patent Literature 1 below discloses a status notification system that confirms the status of an electrical device and communicates the confirmed information using communication means. With such a configuration, it is said that convenience and security can be improved.

Further, Patent Document 2 below discloses a method for performing risk analysis in real time. Specifically, it provides a technical interpretation of business activities within a computer-based business application subsystem and, based on this interpretation, generates tasks that cause business activities to be performed in violation of operational guidelines (risk analysis). ) Has been proposed.

Also, Patent Document 3 below discloses a monitoring server that connects to a mail server or a Web server and monitors a specific user. A technique is disclosed in which data corresponding to a predetermined keyword is extracted from e-mails related to the specific user and transmitted to a report destination user. It is said that parents can monitor the behavior of children.

Also, Patent Document 4 below discloses a multi-function machine that is configured to output image data by authentication of a plurality of people to prevent information leakage. Further, Patent Document 5 below discloses a multifunction device that restricts the functions of the multifunction device when an abnormality is found in the firmware. *

JP 2009-151459 A JP 2011-76629 A JP 2012-73798 A JP 2012-74935 A JP 2011-19099 A

Thus, with the conventional MSS service,
(A1) In addition to IT administrators, there are security managers, but the security managers are companies that have only weak knowledge about security,
(A2) In addition to IT administrators, there are security administrators, but companies that want to strengthen security
(B) Companies with IT administrators but no security managers,
Had been offered as the main customer. (C) A company that does not have an IT administrator, or a company that has an IT administrator but the IT administrator has only weak knowledge,
There were few MSS services.

Therefore, the inventor of the present application has studied the mechanism that can use the service of MSS even if the company does not have an IT administrator as in (c) above, and has come to make the present invention. That is, the main object of the present invention is to provide an MSS service that can be easily used even by a small and medium-sized company without an IT administrator, and to provide related equipment.

One of the features of the present invention, that is, one of the main appeal points is that a security device such as a UTM is embedded in an OA device such as a multi-function device to function as an office security center. In addition to that, it is in the point of providing MSS services. Moreover, since it is packaged, cost reduction is expected.

(1) Security device In order to solve the above problems, the present invention includes an appliance means including a security device such as a UTM including a gateway in an OA device provided with a connection means with an external network, and the connection means includes: An OA device that is the gateway.

(2) Wireless LAN (Wi-fi) security In the OA device according to (1), the appliance means may optionally include means for detecting a Wi-fi access point around the OA equipment. It is an OA device characterized by comprising.

(3) Tray type In the OA device according to any one of (1) to (2), the present invention provides a shelf unit that stores a paper tray, and a paper tray type housing that is stored in the shelf unit. And the appliance means stored in the paper tray type housing.

(4) Tray type (not paper tray)
The present invention provides the OA device according to any one of the above (1) to (2), a tray type housing having substantially the same shape as a paper tray, and the appliance means stored in the tray type housing. OA equipment characterized by including.

(5) Backpack type In the OA device according to any one of the above (1) to (2), the present invention provides a backpack type casing that can be attached to the back surface of the OA device, and the backpack type. And an appliance means stored in a housing.

(6) Sub housing (sub unit type)
The present invention provides the OA equipment device according to any one of the above (1) to (2), wherein the main body of the OA equipment, a sub-housing separate from the main body, and the sub-housing And the stored appliance means.

(7) Computer rack type The present invention is the OA device according to the above (3) or (4), wherein the tray type casing includes a computer rack type open chassis. is there.

(8) Computer rack type | mold This invention is OA apparatus as described in said (5), The said backpack type | mold housing | casing is provided with the computer rack type | mold open chassis.

(9) Computer rack type The present invention is the OA device according to the above (6), wherein the sub casing includes a computer rack type open chassis.

(10)
The present invention provides the OA device according to any one of the above (1) to (9), wherein the OA device is a copier, a multifunction peripheral, a FAX device, a printer, a personal computer, a telephone related device, a NAS, An OA device characterized by being any one of the devices.

(11)
In the OA device described in (10) above, the telephone-related device is an OA device characterized in that it is one of a PBX and a key telephone.

(12)
The present invention provides a method of providing a security service to the information system by an operation management center monitoring the information system including the OA device described in (1) above. The operation management center includes a step of making an inquiry to the appliance means, and the appliance means returns security information to the inquiry, and the appliance means sends the security information to the OA device. In addition, security base software constructed in advance is installed, and the appliance means in which the base software is installed realizes a gateway including a security device such as the UTM. It is a method of providing a scan.

(13)
The present invention provides a method for providing a security service to the information system by an operation management center monitoring the information system including the OA device described in (2). A management center making an inquiry to the appliance means; and the appliance means returning information about the surrounding Wi-fi access point to the inquiry, the appliance means comprising: Is installed with Wi-fi security software for security built in advance for the OA device, and the appliance means with the Wi-fi security software installed detects the Wi-fi access point. Has realized the means to It is a method for providing a security service, wherein.

(14) UTM
The present invention provides a method of providing a security service to the information system by an operation management center monitoring the information system including the OA device described in (1) above. A security service comprising: a step in which appliance means transmits security information, which is information relating to security, to the operation management center; and a step in which the operation management center receives the transmitted security information. Is a way to provide

(15) Wi-fi
The present invention provides a method of providing a security service to the information system by an operation management center monitoring the information system with respect to the information system including the OA device described in (2). Means for transmitting information relating to the surrounding Wi-fi access point to an operation management center; and wherein the operation management center receiving the transmitted information relating to the Wi-fi access point. Is a method for providing a security service.

(16)
The present invention provides the security service providing method according to any one of the above (12) to (15), wherein the operation management center includes the configuration of the OA device and the software for security built in advance. Is a base service that is set in advance based on the content of the information system, and provides the security service characterized by providing the monitoring of the information system, the analysis of the operation status, and the countermeasure against the failure.

(17) Additional package software The present invention provides the security service providing method according to any one of (12) to (15), in addition to the base package including the base software and the base service. When a user who receives a security service requests an additional package, a step of installing additional software for pre-built security included in the additional package in the appliance means; and the appliance means includes the additional software. Transmitting the security-related information to be checked by the operation management center, and the operation management center receiving the transmitted security-related information. It is a method to provide security services.

(18) Additional Package Appliance The present invention provides the security service providing method according to any one of (12) to (15) above, in addition to the base package including the base software and the base service. When a user who receives a security service requests an additional package, the step of adding an additional appliance included in the additional package to the appliance means, and the appliance means includes information on security checked by the additional appliance. A method of providing a security service, comprising: a step of transmitting to the operation management center; and a step of the operation management center receiving the transmitted information relating to the security.

(19) Additional package software The present invention is the method for providing a security service according to (17) above, wherein the operation management center is an additional service included in the additional package, and is preset according to the software. Providing a security service characterized by providing an additional service.

(20) Additional package appliance The present invention is the method for providing a security service according to (18), wherein the operation management center is an additional service included in the additional package, and is set in advance according to the additional appliance. A method for providing a security service characterized by providing an additional service.

As described above, according to the present invention, since the office information device provided with the firewall or the like serving as the center of the information system is provided, it can be used as the center of the information system for a predetermined company / organization. .

In addition, according to the present invention, since the MSS is provided by a packaged service based on the configuration of the office information device, it is possible to provide an MSS service that is easier for the user to understand. Similarly, it is possible to receive services more quickly by packaging.

1 is an external view of an MFP according to the present embodiment (tray type). FIG. It is an external view of the tray type | mold housing | casing provided with the FW / UTM security appliance concerning this Embodiment. 1 is an external view of an MFP according to the present embodiment (backpack type). FIG. 1 is an external view of an MFP according to an embodiment (subunit type). FIG. It is a conceptual diagram of provision of the service of MSS at the time of using MFP concerning this Embodiment. It is a conceptual diagram which shows the mode of the general security service which provides a management security service in the cycle of installation (Plan), operation (Do), analysis (Check), and improvement (Act) when there is no security administrator. It is a schematic diagram showing the operation | movement outline | summary of MSS, ie, the mechanism which monitors the user side network which is a user side information system from the operation management center.

Hereinafter, preferred embodiments of the present invention will be described with reference to the drawings.

Chapter 1 MFPs
In the first embodiment, first, a multifunction peripheral (referred to as MFP) 200 with an improved security function is proposed.

As described above, an MFP (MFP) is a conventional copier with functions such as a FAX, a scanner, and a printer, and is currently widely used from small and medium businesses to large enterprises. In recent years, more and more functions have been developed, and many devices with communication functions have been proposed. Connection to the Internet is widely realized, and it is possible to send and receive mail and connect to the web. .

In particular, what is considered as a target in this embodiment is that even if there is a company / organization that does not have an IT administrator or a security operation manager, or an IT administrator (or a security operation manager), it remains resident for 24 hours. Targeting companies and organizations that have not.

In order to become an infrastructure center for companies and organizations where IT managers are absent, Internet security functions are provided in addition to existing conventional MFP functions. This Internet security function includes cloud security and mobile security.

1-1: FW / UTM Security Appliance In particular, the MFP 200 proposed in the present embodiment has a tray-type housing 202a having the same shape as the paper tray instead of the paper tray, instead of the paper tray. A contained FW / UTM security appliance 202 is provided. FIG. 1 shows an external view of the MFP 200 provided with the tray-type housing 202a.

(1) Tray-type casing An external view of a tray-type casing 202a provided with the FW / UTM security appliance 202 is shown in FIG. As shown in FIG. 2, the tray-type housing 202a includes a 1U rack-type open chassis 202a-1 and a front bezel 202a-2.

The front bezel 202a-2 includes an MFP tray type, a backpack type, and a subunit type. In FIG. 2, the MFP tray type is shown. The backpack type and subunit type will be described later. 2 is a front bezel having the same appearance as the paper tray of the MFP 200, and can be attached to the MFP 200 by the front bezel 202a-2 in the same manner as the paper tray.
As will be described later, the MFP tray type has the same shape as the paper tray, but it does not have to be a “paper” tray as long as it is approximately the same size. The FW / UTM security appliance 202 is installed behind the front bezel 202a-2 (see FIG. 2).

Thus, in this embodiment, since the FW / UTM security appliance 202 is stored in the paper tray type casing 202a, it can be easily attached to the MFP 200 like the MFP paper tray. It can be done. With such a configuration, an existing MFP can be easily provided with an Internet security function.

In FIG. 2, the FW / UTM security appliance 202 is installed in the same shape as the paper tray. However, the FW / UTM security appliance 202 is not necessarily a “paper” tray but a general-purpose tray other than paper. Installation is also preferable. Further, it is not necessary to be a tray, and it is sufficient if it has almost the same size and shape as the paper tray.

Also, instead of replacing the existing paper tray with the FW / UTM security appliance 202 for an MFP having one or more paper trays, an additional tray-like size of the paper tray is added. It is also preferable to add / add FW / UTM security appliance 202.

Also, a utility module 202a-3 is provided on the back side of the tray-type casing 202a (the side opposite to the front bezel 202a-2), and various devices are stored (see FIG. 2).

(2) 1U rack type open chassis The 1U rack type open chassis 202a-1 which is a frame portion constituting the tray type casing 202a is a chassis of a computer rack shape capable of mounting a so-called 1U size device. As a result, it is possible to store (mount) a device up to the size of a so-called 1U device. That is, the tray-type housing 202a according to the present embodiment can store (mount) the FW / UTM security appliance 202 having a size up to 1U. If the size is up to 1U, other devices can be stored (mounted). For example, it is also possible to store a 1U size hard disk, a device related to Wi-fi, or the like.

Since the tray type casing 202a is configured by using such a 1U rack type open chassis 202a-1, there is an advantage that it is easy to install the existing 1U type equipment. Conventionally, since 1U-sized security-related devices are often used, it is possible to configure the FW / UTM security appliance 202 by modifying them, and the MFP 200 can be configured more simply.

The 1U rack type open chassis 202a-1 corresponds to a preferred example of the computer rack type open chassis in the claims. The 1U rack type open chassis 202a-1 is also used in the backpack type described later.

(3) Function of FW / UTM security appliance The FW / UTM security appliance 202 is literally a device having a UTM function including a firewall. UTM (Unified Threat Management) is based on firewall and VPN functions, such as anti-virus, intrusion prevention (IDS, IPS), Web content filtering (also simply called Web filtering), anti-spam, etc. It is a complex security function with functions. The FW / UTM security appliance 202 incorporates these functions as a security appliance in the gateway.

(Appliance means a device such as a computer whose function is specialized for a specific purpose. Here, it represents a computer specialized in a security function.)
In addition, since the FW / UTM security appliance 202 is intended to be a center of information systems for users such as SMEs, it basically has a router function, and further, as described above. Is equipped with a firewall.

The FW / UTM security appliance 202 is a device having a UTM function including a firewall.

What functions are included as UTM functions is case by case and varies. For example, if there is an anti-spam function in this UTM, illegal functions such as unauthorized mail ( emails posted on the blacklist etc. that have been rejected) , spam mail, etc. Stored in the storage means. The stored information such as illegal mail and spam mail is typical security information. Information on security, various threats, and fraudulent information (information on fraudulent mail and spam mail) in general are called security information. In some cases, it is possible to view such security information as required by an external request (such as an operation by an administrator).

This UTM corresponds to a preferred example of the security device in the claims.

With such a device, it is possible to achieve security of the information system. Note that the security information stored in the storage means may be referred to as a so-called “log”.
In addition to a request from the outside, a warning may be issued spontaneously when a serious failure, error, unauthorized access, or the like occurs. It is also preferable to turn on an email to report to the administrator or a lamp indicating danger.
In particular, the present embodiment is characterized by a function of providing security information to the outside in response to an inquiry from the outside (for example, the operation management center 10) via a network or the like. That is. The security information includes various threats detected by various functions of the UTM in addition to the various threats detected by the firewall. These are stored as logs in the table described above, and the information is provided in response to a request from the outside (operation management center 10).

Also, not only a request from the outside (operation management center 10) but also a warning may be issued spontaneously when a serious failure, error, unauthorized access, etc. occurs. It is also preferable to periodically send security information to the outside (operation management center 10) via a network. When a certain condition is detected. Since a mechanism for sending an email to the outside, a mechanism for updating data on an HTML basis, and the like have been known, warnings and information are automatically sent to the outside (operation management center 10) using such means. Can be transmitted.

Since such a function is provided, as will be described later, it is possible to monitor the security information of the information system, for example, from the external operation management center 10 periodically or at any time (irregularly).

(3-2) FW Security Appliance In the above example, integrated security can be achieved by using the FW / UTM security appliance 202. However, in a small company or organization, UTM (Unified Threat Management) Sometimes it doesn't require as much security. For such a small company or organization, considerable security may be achieved with only the firewall and VPN functions without the UTM function. For such a small company or organization, UTM functions other than FW may be turned off from the FW / UTM security appliance 202.

(Delete)
(4) Utility Module The utility module 202a-3 is a module that manages the network connection function and other functions, and has, for example, the following functions (see FIG. 2).

-Network bridge and hub device-Cooling fan-AC outlet for appliance-Wi-fi security module (optional)
The functions listed here are examples and do not necessarily include all these functions. In addition, there may be a form other than the form described in the present embodiment. In addition, as an option, only the Wi-fi security module may be configured separately (separate housing) or may be provided in the same housing.

Also equipped with a hub for wired connection. In the example shown in FIG. 2, the upstream port of this hub faces the inside of the casing and is connected to the FW / UTM security appliance 202. Since there are generally few LAN ports out of the FW / UTM security appliance 202, the hub converts them to more ports. Although this increased downstream port is not shown in FIG. 2, it is provided toward the outside of the housing and is connected to other client PCs and other devices of the information system of the company / organization. Is also possible. As a result, the MFP 200 according to the present embodiment can serve as the center of the information system of the company or organization.

The cooling fan (see FIG. 2) is a fan for cooling the utility module 202a-3 and the FW / UTM security appliance 202.

The AC outlet for appliance is an outlet for supplying power to the FW / UTM security appliance 202, but it is also preferable to supply power to other devices.

In addition, means (Wi-fi security module) for detecting a wireless LAN access point existing in the vicinity is provided (optional) . By providing such means, it is possible to confirm the presence or absence of surrounding access points. As the name suggests, the Wi-fi security module is a means for detecting a Wi-fi access point, but it is a means for detecting various wireless LAN access points of various standards. Conventionally known. The MSS using such detection means will be described in detail later.

The function (means) of the so-called access point of the wireless LAN can be provided in the utility module 202a-3, but is not provided basically. This is because in recent years, small and inexpensive access points have been widely spread and utilized, and there are very many cases where they are already provided in user systems. However, there are cases where it is provided.

In addition, a wireless LAN access point function may be provided externally in this part via an interface such as USB.

In this embodiment, the utility module 202a-3 includes
-Network bridge and hub device-Cooling fan-AC outlet for appliance-Wi-fi security module means / examples provided, but in reality, only necessary means are provided according to user requirements Will be provided. Depending on the user, there may already be sufficient hub devices, and depending on the power consumption of the hardware, there may be no need for a cooling fan. Of course, it is also preferable to omit AC outlets if there are already enough information systems on the user side.

In addition, the Wi-fi security module is an option in principle, but in some cases, it can be used alone (including only the Wi-fi security module), and such a case is also within the scope of this patent. included.

Effects Others The MFP 200 according to the present embodiment can serve as the center of the information system of the company / organization by the above configuration.

In particular, the MFP 200 according to the present embodiment uses a tray-type casing 202a and stores the FW / UTM security appliance 202 in the tray-type casing 202a. Therefore, by storing this tray type casing 202a in the paper tray of the MFP 200, it is possible to ensure the security of the information system without taking up space.

Other aspects of MFP 200 (tray type, backpack type, subunit type)
In the above-described example, an example in which the tray-type casing 202a having the shape of a paper tray is used, or an example in which a shelf-like casing that is not for “paper” is used has been described.

If a paper tray-shaped housing is used, the FW / UTM security appliance 202 can be provided on the paper tray shelf of the MFP 200, and if the shelf-shaped housing is used, the shelf can be placed on the paper tray portion of the MFP. Can be provided adjacent to each other.

Therefore, it is not necessary to install a separate security alliance computer for information security, which saves office space for small and medium-sized companies. Since the utility module 202a-3 described above is provided, other computers of the company / organization can be connected to the hub device of the MFP 200 for operation. Similarly, since it has functions such as a wireless LAN router, other client computers can be connected wirelessly.

Backpack Type On the other hand, it is also preferable to install the FW / UTM security appliance 202 on the back surface of the MFP 200. As described above, since the FW / UTM security appliance 202 according to the present embodiment has a size of 1 U, the depth of the MFP 200 does not increase so much even if it is provided on the back surface of the MFP 200.

FIG. 3 shows an example in which the FW / UTM security appliance 202 is stored in a backpack-type casing and provided on the back surface of the MFP 200 based on such a concept. In the case of the tray type, the front bezel 202a-2 is formed in substantially the same shape as the front surface of the paper tray and is attached to the MFP 200 just like the paper tray. The front bezel 202a-2, not the paper tray, has a shape as a front operation unit of a normal box-shaped electronic device, and has a shape that can be easily attached to the rear surface of the MFP 200. Such a backpack type casing is particularly called a backpack type casing 202b in FIG. 3, but it has a different shape and has a 1U chassis in terms of contents and functions. It is the same as 202a.

In the example shown in FIG. 3, the FW / UTM security appliance 202 is stored in the backpack-type casing 202 b and installed on the back surface of the MFP 200. By providing it on the back, it becomes easy to run the cable along the back of the device. Therefore, when using the backpack-type housing 202b, it is preferable to perform connection with other devices using a cable along the back surface.

・ Subunit type
　 The FW / UTM security appliance 202 is preferably installed adjacent to the MFP 200. As described above, the FW / UTM security appliance 202 according to the present embodiment has a size of 1U, is housed in a relatively small housing (referred to as a subunit-type housing), and is arranged next to the MFP 200. However, it is considered that a large occupied area is not required.

FIG. 4 shows an example in which the FW / UTM security appliance 202 is stored in the subunit type casing 202c and provided on the back surface of the MFP 200 based on such a concept. In this case, the front bezel 202a-2 is the same as the front portion of a normal box-shaped electronic device. Generally, various operation units are provided, but are omitted from FIG. Such a subunit type casing 202c is only different in shape, and is similar to the tray type casing 202a in terms of contents and functions such as having a 1U chassis.

Note that the subunit-type housing 202c corresponds to a preferred example of the sub-housing in the claims.

In the example shown in FIG. 4, the FW / UTM security appliance 202 is stored in the subunit type housing 202 c and is installed adjacent to the MFP 200. When using the subunit type housing 202c, it is preferable to connect between the other MFPs 200 with a predetermined cable.
In either case, the FW / UTM security appliance 202 may be a single Wi-fi security module.

Other OA devices In the above-described example, the MFP 200 (multifunction device) provided with the FW / UTM security appliance 202 has been described. However, the present invention is not limited to the multifunction device, and a so-called copying machine (copier) is also suitable. In addition to the copying machine, a printer, a FAX apparatus, a personal computer, a telephone-related apparatus such as a PBX or a key telephone, and NAS (Network Attached Storage) may be used. Any so-called OA device installed in or near the office can be used.

In particular, there may or may not be a “shelf” part into which a paper tray or the like can be inserted. If the paper tray can be stored, the paper tray-type housing 202a can be used. However, even when there is no paper tray, it is preferable to use a shelf-like housing and stack the paper tray on the bottom surface and the top surface.

For example, an OA device such as a copier or a FAX apparatus corresponds to an example of a particularly preferable device, but other OA devices can be used sufficiently.

The claimed OA device is a concept including various OA devices installed in or near the office in this way.

Security Service By introducing the MFP 200 in this way, unauthorized access or the like can be detected, and as a result, information security can be achieved.

That is,
・ I can achieve the security by the firewall.

・ If UTM is installed, multiple security can be achieved.

-Wi-fi security module allows you to know if there are access points around you. In particular, the Wi-fi security module of this embodiment records the presence / absence of surrounding access points as a log, so the administrator can check the presence / absence of unauthorized access points by viewing the contents. It is.
The Wi-fi security module detects surrounding access points, but the operation management center can determine unauthorized access points from the access points detected by the Wi-fi security module. .

Also, in the case of so-called stealth access points, it is often difficult to determine whether the access point is an unauthorized access point. However, in this embodiment, such a stealth access point is valid on the operation management center side. It can be determined whether or not it is a thing.
In addition, this Wi-fi security module provides externally recorded logs and information about surrounding access points detected at that time via the network in response to inquiries from the external operation management center 10 It also has a function to do. In addition, it also has a function of regularly providing log data and information on surrounding access points detected at that time to the outside via a network.

Such a function can be realized by a general computer and software. The operation of regularly sending predetermined information to the outside is performed by a general computer, and the operation of transmitting information every time there is an inquiry (irregularly) is also performed by a general computer. It can be realized by those skilled in the art.

Therefore, it is preferable to monitor the information system on the user side by accessing the MFP 200 from the external operation management center 10 as described below. That is, as described in the section of the prior art, it is preferable to use MSS (Management Security Service) at present when various threats such as targeted attacks exist. Therefore, in the next chapter, the use of MSS using the MFP 200 will be described.

Chapter 2 Provision of MSS 2-1a: Introduction of MFP 200 and Provision of MSS As described above, since the MFP 200 proposed in this embodiment has various communication functions, it is a small-scale company / organization. For example, an information system can be constructed around the MFP 200.

However, as mentioned above, there are many cases where IT managers are not present in small companies. As a result, the MFP 200 tends to be in a state where only so-called “security hardware” is inserted. That is, it is assumed that there is a case where there is an unauthorized intrusion from the outside, or even when an unauthorized access occurs, an appropriate process cannot be performed.

2-1b: Packaging in the Present Embodiment Therefore, in this embodiment, the MSS service is packaged and provided to the user. Such packaging eliminates the need for the “customization” described above, so that it is possible to reduce the cost of MSS services, and it is also possible for small and medium-sized businesses to introduce MSS. As a result, the so-called PDCA cycle shown in FIG. 6 and the like can be rotated, and the security of the information system can be maintained and managed very well.

The term “customization” as used herein means that the equipment used by each user may be special, and the MSS service to be provided can be monitored according to the company's requirements and the monitoring system according to the company's requirements. Mainly means when it has to be adopted.

2-2: Packaging In the conventional MSS, so-called “customization” is performed for each user. This is because a completely different information system is constructed for each user. However, the MFP 200 proposed above is a multifunction device for a small-scale company / organization, and can serve as a center for an information system of the company. Accordingly, when the MSS is provided together with the introduction of the MFP 200, the MFP 200 is mainly used as an information system. Therefore, it is preferable to provide software and services packaged based on the configuration of the MFP 200. The present inventor thought that there was.

A characteristic feature of the present embodiment is that the MSS is provided to the user not only with the MFP 200 but also with software and services pre-packaged with the MFP 200 instead of customization.

This packaging has the effect of providing MSS directly to the user at low cost. In addition, there are the following effects.

(1) With the introduction of the MFP 200, it is possible to introduce an MSS with software and services that meet the specifications, so there is an advantage that a stable system can be easily obtained from the beginning.

Until now, it was customary to customize MSS. The significance and contents of customization are as described in 2-1b above.

When such customization work is required, a certain delivery time and work period are required. Furthermore, since a system failure may occur, a certain amount of problems such as so-called debugging and identification of problems are required. In some cases, work was required and it took time for the system to operate stably. On the other hand, when packaged software is used, the work period and the like are significantly shortened, and a stable system is easily obtained.

(2) In addition, in a small-scale company or the like that intends to introduce the MFP 200, there is a case where a high degree of security insight is insufficient even if there is no IT manager. Even in such a case, there is an advantage that the security of the information system can be easily established by receiving the MSS provided with the UTM or the like together with the MFP 200 without the technical knowledge of security. In general, in an environment where a communication infrastructure such as the Internet is required and various smart devices can be connected to it, many people recognize that so-called mobile security and cloud security are necessary. In order to do this, advanced knowledge is often required.
Therefore, in this embodiment, since the MFP 200 is introduced and the settings of the appliance are packaged and the MSS is provided, even if there is no advanced knowledge on the user side, mobile security, cloud security, etc. are set in advance. It is possible to obtain a customized environment from the beginning.

(3) Similar to the above, a small company or the like that intends to introduce the MFP 200 may lack a high degree of security insight even if there is no IT administrator. For this reason, it may be difficult to understand security. In that respect, by receiving the MSS provided with the UTM in advance together with the MFP 200, information security can be established as a whole, so that it is possible to present and provide a solution that is easier for the user to understand.

As described above, since the MFP 200 is installed and the appliance settings are packaged to provide the MSS, the user can receive a high-quality MSS service at a low cost.

2-3: Contents of packaging In the present embodiment, the service is provided by packaging the settings of the appliance, which is introduced together with the MFP 200. This provided service is called a base package.

In addition, although the service here is a service provided by the operation management center 10, in addition to a service automatically executed by a computer, a service performed by a person in charge can be included. For example, it is preferable that a computer automatically sends a warning / report mail when a security failure has occurred (or is likely to occur). Similarly, it is preferable that the computer automatically determines a warning or the like when the CPU operation rate becomes XX% or more and notifies the user by e-mail or the like. In addition, the base package may include services by a person such as a person in charge who responds to a security inquiry or gives advice.

Also, the above services included in the base package are called “base services”.

This base package has the following features compared to the software and services used in customized MSS. The customization here includes the tuning described above. As described above, the tuning refers to the adjustment of the threshold value that is determined to be dangerous, and the like.

(A) Monitoring Target In the base package, the monitoring target is a specific security device, and specifically limited to UTM and Wi-fi access points.

On the other hand, in the customized MSS (which mainly means tuning, hereinafter referred to as tuning), the monitoring target can specify any device of the user, routers and firewalls of various companies, various servers, Various client devices can be monitored.

(B) Resource monitoring In the base package, a constant value is adopted as a threshold for resource monitoring for any device. That is, in any device, the CPU gives an alert when the operation rate is 90% or more. If any device does not respond to Ping three times in a row, an alert will be issued. These numerical values are only examples, and the scope of rights of the present invention is not limited to these numerical values.

Also, in the resource monitoring in the base package, only specific items are monitored. In the present embodiment, only the CPU operation rate, memory usage rate, Disk usage rate, number of sessions, and presence / absence of a response to Ping are monitored.

On the other hand, in the tuned MSS, an arbitrary threshold for resource monitoring can be set for each user and each device. For example, in resource monitoring in a certain device, an alert is issued when the CPU operation rate is 80% or more, while in other devices, an alert is issued when the CPU operation rate is 90% or more. Also, a certain device can be regarded as a timeout error when the response period is 3 seconds on the LAN, while another device can be regarded as a timeout error when the response period is 30 seconds. Further, when an alert is generated according to the number of times of not responding to Ping, the number of times can be set for each device.

In addition, the tuned MSS can perform resource monitoring of items specified by the user. For example, in addition to the CPU operation rate and the memory utilization rate, the status of hardware such as a power supply and a cooling fan can be entered as monitoring items. Also, software-related status such as whether or not a specific process is normally started can be entered in the monitoring item.

(C) Security alert setting A uniform rule is applied to the security alert in the base package. For example, security alerts are generated by applying only predefined rules such as firewall login failure, DMZ internal communication failure, internal communication from other than the main port to the Internet, etc. .
The alert may occur locally (for example, the above-described alliance within the MFP 200) or may be generated from the operation management center 10. This notifies the user.

On the other hand, in the tuned MSS, in addition to the above standard rules, rules suitable for the user environment are set. For example, it is possible to output a security alert by monitoring specific communication (P2P or the like) designated by the user, monitoring communication from a specific transmission source, or the like. Also, for example, the average number of log outputs is always measured, and when a log is output more than N times within a specified time (that is, when a large amount of communication occurs), a security alert is detected. Is output. Also, for example, not only firewall logs but also specific character strings specified by the user on Syslog (error strings indicating interface down, HDD failure, etc. depending on the OS) are output and security alerts are output can do.

(D) Security incident response Security incidents in the base package are only critical level alerts.

And the response to the security incident will be dealt with according to the content of the alert, but it will be within the predetermined range. For example, the firewall setting is changed, but the server setting is changed only by giving an instruction to the user. In addition, incidents of critical level are handled within 4 hours as SLA (Service Level Agreement).

On the other hand, the tuned MSS targets not only the critical level but also the alert of the level requested by the user.

, Security incidents are dealt with according to the contents of the alert, and with customized processing according to the user's request. For example, the firewall setting is changed and the server setting is also changed. In addition, an incident at a critical level as an SLA is handled in a time coordinated with the user (for example, within 2 hours).

2-4 Merit of packaging If packaging is performed in this way, the amount of work is greatly reduced as compared with the case of customization and tuning for each user, and as a result, the cost can be reduced. Further, since the packaging is performed in advance, the work necessary for the MSS so far, such as customization, becomes unnecessary, and accordingly, the period until the operation can be shortened.

In the present embodiment, since it is assumed that the MFP 200 is introduced as the center of the user information system, the above-described packaging is possible as a result of fixing the hardware to some extent. .

Packaging means that functions are determined in advance in accordance with the functions and configurations of the MFP 200, and the MSS is standardized to simplify the work process and reduce costs. That is, since the service to be provided in advance is determined in accordance with the function and configuration of the MFP 200, the content, type, frequency, etc. notified from the operation management center 10 can be set (fixed) in advance, and smooth MSS can be performed. Can be easily realized. In particular, if the service content is determined in advance, it is possible to reduce the possibility of an error in the provision of the service, and it is expected that a higher quality MSS service can be provided, which has a great advantage for the user.

2-5 Possibility of tuning Even if the user initially wanted a packaged MSS, there may be cases where tuning is desired to set more detailed contents. In this case, of course, it is preferable to appropriately tune the software and services included in the base package as in the past.

2-6 Providing an MSS Service Using a Base Package As described above, in this embodiment, an MSS service packaged in accordance with the MFP 200 by causing the MFP 200 to function as the center of the user's information system. Proposed to provide. Overall diagram of a service providing the MSS is shown in FIG.

In this provision, in the first step, the security device is installed, that is, the MFP 200 is installed. Next, the operation monitoring of this device is performed from the operation management center 10 (FIG. 7), and when a failure occurs, notification of recovery from the failure is made. Further, in step 3, an attack (event) is monitored and analyzed, and a response process is performed.

After that, the so-called PDCA cycle can be rotated to ensure good security of the information system.

Note that such MSS (Management Security Service) corresponds to a preferred example of the security service in the claims.

Chapter 3 Additional Package 3-1: Addition to Base Package In the above, it was explained that MSS software and services are packaged and provided.

One of the merits of this packaging is “easy to understand” as mentioned above. In order to promote such intelligibility, the present inventors present the following additional packages (software and services) to the user in addition to the software and services of the base package.

・ Packaging for smart devices ・ Packaging for mobile devices ・ Packaging for cloud security In this way, by packaging for each target, it becomes possible to provide an MSS that is even easier to understand for users.

In the present embodiment, the MSS service using the base package is referred to as “first stage”, and the additional packages are referred to as second stage, third stage,.

Chapter 4 Wi-fi security package (optional)
In general, the Wi-fi security package described above is preferably provided as an option as an additional package. However, Wi-fi has been widely used in recent years, and it can be said that its utility value is high. For example, in addition to the base package, it is also preferable to introduce an optional Wi-fi security package from the beginning.
4-1 Importance of Wi-fi security
For example, in recent years, Wi-Fi connection has been widely used. Even in public places, free Wi-Fi access points may be provided. For example, restaurants and coffee shops may have Wi-Fi connection access points in the store, and there are many cases where Wi-Fi connection access points are installed in airport lounges. To use such a Wi-Fi connection, you need to know the SSID of the net and the password (if necessary).

However, on the other hand, it is said that there is a certain danger in Wi-Fi connection in such public places, and communication at public Wi-Fi access points needs to be carefully considered. It is considered.

In recent years, an attack technique called a target-type attack has attracted attention. This attack is a kind of so-called cyber attack, but it is a more malicious attack aimed at a specific target. In particular, it is said that a targeted attack may be performed via the Wi-Fi connection as described above.

Therefore, it is considered that it is sufficiently valuable for users to introduce security (Wi-Fi package) related to Wi-Fi according to the present embodiment as an option.

4-2 Wi-Fi Package Chapter 4 describes a Wi-Fi package as an example of an optional package. For example, when an information system is constructed in a small restaurant or coffee shop, attempts to provide Wi-Fi services to store users have increased greatly in recent years. In that case, if the Wi-Fi package is introduced as an optional package at that restaurant / coffee shop, so-called sniffing can be found, and unauthorized access and connection can be found and removed. . Details will be described below.

(1) Hardware In terms of hardware, a function for detecting a Wi-Fi access point (a wireless LAN access point of various other standards) is implemented in the utility module 202a-3. A function of detecting surrounding Wi-Fi access points is also provided in a general personal computer or the like, and can be easily implemented by those skilled in the art. Hardware and software that detects surrounding Wi-Fi access points, including their strength, are also known, so if you apply this, you can operate information about the surrounding access points (intensity, frequency, etc.). It is easy for those skilled in the art to construct means for sending to the management center.

It is also preferable to construct a means for appropriately issuing an inquiry from the computer of the operation management center and returning information (intensity, frequency, etc.) about the surrounding access point. A device that makes an inquiry to a remote location via a network and returns information on the remote location in response to the inquiry is widely used in, for example, weather observation and the like. It is easy to build a device that returns In addition, since an apparatus that periodically inquires is also known, it is also preferable to provide such an apparatus (computer) in the operation management center 10. It is also preferable for the operator to make inquiries as appropriate (irregularly) to acquire information.

Furthermore, as described above, the utility module 202a-3 (FIG. 2) includes various functions. However, each function is modularized, and means necessary for the user is provided. It can be installed.

(2) Software and Service Since the MFP 200 has a function for detecting an access point of Wi-Fi as described above (Wi-fi security module: see FIG. 2), a user information system is provided by a remote service. It is possible to monitor the presence or absence of an available Wi-Fi access point around the MFP 200. What is characteristic in the present embodiment is that the remote service detects whether or not an unauthorized access point is provided around the Wi-Fi access point of the user.

As a specific aspect, the computer on the operation management center 10 side automatically transmits an inquiry to the MFP 200 periodically (or irregularly, as needed), and in response to this, the Wi-fi security module in the MFP 200 It is preferable to detect surrounding Wi-fi access points and transmit the detection results (referred to as information about Wi-fi access points) to the operation management center 10.

In this case, it is also preferable that the Wi-fi security module of the MFP 200 periodically and spontaneously transmits a detection result of surrounding Wi-fi access points (information on Wi-fi access points) to the operation management center 10. It is. In addition to periodic transmissions, whenever there is a change in information about Wi-fi access points detected in the surroundings, updated information about Wi-fi access points is sent to the operation management center 10 each time. It is also suitable to transmit.

Therefore, with such MSS monitoring service, it is possible to know whether an unauthorized access point is provided or not when a Wi-Fi service is provided at a restaurant or coffee shop that is a user. It is possible to report to

In such a base package consisting only of Wi-fi packages, when this unauthorized access point is found, the user is notified by e-mail and telephone. This notification preferably includes a range of unauthorized access points, how to find unauthorized access points, and the like. As a result, it is possible to prevent leakage of confidential information of customers who visit the restaurant, which contributes to improvement of customer satisfaction with the restaurant and coffee shop.

It should be noted that it is preferable from the viewpoint of speed to configure the mail to be automatically transmitted by the computer of the operation management center 10. An apparatus for sending an email when a certain condition is satisfied is known. Therefore, using such a mechanism, an email can be automatically sent from the operation management center 10.

(3) Airport Lounges In recent years, for example, in hotel lobbies and airport lounges, there is an increasing number of places where SSIDs and passwords are disclosed to the general public so that Wi-fi can be used freely. In the case of such a public Wi-fi service, it is preferable to have a mechanism for finding an unauthorized access point under predetermined conditions. In the case of a public Wi-fi service, the area to be covered is generally very wide, so it is preferable to take measures such as increasing the number of detection sensors. Various methods for discovering whether or not the access point is an unauthorized point are known. Some of these methods have high accuracy and others have low accuracy.

The inventor of the present application has developed a more accurate detection method, which is scheduled to be filed as a patent for a “detection method” different from the “business model patent relating to provision of MSS” of the present application.

4-3: Other additional packages It is also preferable to provide a “search service package” as a second stage option, for example. This “search service package” in the second stage is a service in which the person in charge of the operation management center 10 visits the user's information system to actually find and remove an unauthorized access point.

A complex commercial facility (called a shopping mall) with many stores in a row has been widely developed. In such shopping malls, services for transmitting information on sales items and information on events to smart devices are widely used. In many cases, such services are performed using Wi-Fi services.

Even if such a store is a user, the additional Wi-Fi package according to this embodiment is used, and according to the “search service package” that is the second stage option, an unauthorized access point is MSS services that can be discovered can be used. In general, such a coffee shop or the like is often small, and is often a user to which the MFP 200 described in the present embodiment is to be introduced.

Chapter 5 Variations of the Present Embodiment (1) In the above-described embodiment, the 1U rack type open chassis 202a-1 is used (FIG. 2). In this chassis, the FW / UTM security appliance 202 is stored, but it is also preferable to store other devices. When it is desired to replenish storage, it is preferable to store a hard disk or the like, and it is also preferable to insert an additional HUB device or the like. In the embodiment described above, the MFP 200 has been mainly described. However, it is also preferable to use NAS (Network Attached Storage) as another device.

In the embodiment described above, the 1U rack type open chassis 202a-1 is used (FIG. 2). However, it is also preferable to use a half half height chassis or a 2U rack type chassis.

As described above, in the present embodiment, since the tray-type casing provided with the chassis of the computer rack is used, there is flexibility in that a device that can be attached to the chassis can be attached to the MFP 200.

DESCRIPTION OF SYMBOLS 10 Operation management center 12 User side network 12a DMZ server group 12a1 Web server 12a2 Mail server 12a3 FTP server 12a4 DNS server 12b Firewall 14 Internal segment 14a, 14b, 14c, 14d Client terminal 20 Internet 200 MFP (MFP)
202 FW / UTM security appliance 202a Tray type case 202a-1 1U rack type open chassis 202a-2 Front bezel 202a-3 Utility module 202b Backpack type case 202c Subunit type case

Claims (20)

1. In OA equipment equipped with a connection means with an external network,
   Appliance means including a security device such as UTM including a gateway;
   And the connection means is the gateway.
2. 2. The OA device according to claim 1, wherein the appliance means is optional.
   Means for detecting Wi-fi access points around this OA device;
   OA equipment characterized by comprising.
3. In the OA equipment according to claim 1 or 2,
   A shelf for storing paper trays;
   A paper tray-type housing stored in the shelf;
   The appliance means stored in the paper tray housing;
   OA equipment characterized by including.
4. In the OA equipment according to claim 1 or 2,
   A tray-type housing that is almost the same shape as the paper tray;
   The appliance means stored in the tray-type housing;
   OA equipment characterized by including.
5. In the OA equipment according to claim 1 or 2,
   A backpack housing that can be attached to the back of the OA device;
   The appliance means stored in the backpack housing;
   OA equipment characterized by including.
6. In the OA equipment apparatus according to any one of claims 1 and 2,
   The main body of the OA device;
   A sub-housing that is separate from the main body;
   The appliance means stored in the sub-enclosure;
   OA equipment characterized by including.
7. The OA device according to claim 3 or 4, wherein the tray-type casing is
   Computer rack type open chassis,
   OA equipment characterized by comprising.
8. The OA device according to claim 4, wherein the backpack-type housing is
   Computer rack type open chassis,
   OA equipment characterized by comprising.
9. The OA device according to claim 6, wherein the sub-housing is
   Computer rack type open chassis,
   OA equipment characterized by comprising.
10. The OA device according to any one of claims 1 to 9,
    The OA device is any one of a copier, a multifunction device, a FAX device, a printer, a personal computer, a telephone-related device, and NAS.
11. The OA device according to claim 10,
    The OA device characterized in that the telephone-related device is any one of a PBX and a key telephone.
12. A method for providing a security service to the information system by an operation management center monitoring the information system for the information system including the OA device according to claim 1,
    The operation management center makes an inquiry to the appliance means;
    The appliance means returning security information in response to the inquiry;
    Including
    The appliance means is installed with base software for security built in advance for the OA device, and the appliance means with the base software installed realizes a security device such as UTM including a gateway. A method for providing a security service characterized in that:
13. A method for providing a security service to the information system by an operation management center monitoring the information system for an information system including the OA device according to claim 2,
    The operation management center makes an inquiry to the appliance means;
    The appliance means returning information about the surrounding Wi-fi access point in response to the inquiry;
    Including
    The appliance means is installed with Wi-fi security software for security built in advance for the OA device, and the appliance means with the Wi-fi security software installed is connected to the Wi-fi access. A method for providing a security service characterized by realizing means for detecting a point.
14. A method for providing a security service to the information system by an operation management center monitoring the information system for the information system including the OA device according to claim 1,
    The appliance means transmitting security information, which is information relating to security, to the operations management center;
    The operation management center receiving the transmitted security information;
    A method for providing a security service comprising:
15. A method for providing a security service to the information system by an operation management center monitoring the information system for an information system including the OA device according to claim 2,
    The appliance means transmitting information about the surrounding Wi-fi access point to an operation management center;
    The operation management center receives the transmitted Wi-fi access point information;
    A method for providing a security service comprising:
16. The security service providing method according to any one of claims 12 to 15,
    The operation management center is a base service set in advance based on the configuration of the OA device and the contents of the software for security built in advance. A method for providing a security service, characterized by providing analysis and coping with a failure.
17. The method for providing a security service according to any one of claims 12 to 15,
    In addition to the base package composed of the base software and the base service, when a user who receives this security service requests an additional package, the additional software for security built in advance included in the additional package is Installing on appliance means;
    The appliance means transmitting information on security to be inspected by the additional software to an operation management center;
    The operation management center receiving the transmitted information on the security;
    A method for providing a security service comprising:
18. The method for providing a security service according to any one of claims 12 to 15,
    In addition to the base package consisting of the base software and the base service, when a user who receives the security service requests an additional package, adding an additional appliance included in the additional package to the appliance means;
    The appliance means transmitting information about security to be inspected by the additional appliance to an operation management center;
    The operation management center receiving the transmitted information on the security;
    A method for providing a security service comprising:
19. The method of providing a security service according to claim 17,
    The operation management center provides an additional service that is an additional service included in the additional package and is preset according to the software, and provides a security service.
20. The method for providing a security service according to claim 18,
    The method of providing a security service, wherein the operation management center provides an additional service included in the additional package and set in advance according to the additional appliance.

Images