Image processing apparatus that operates according to security policies, control method therefor, and storage medium

• US 10,243,995 B2
• Filed: 12/22/2015
• Issued: 03/26/2019
• Est. Priority Date: 05/10/2011
• Status: Active Grant

• Current Assignee: Canon Ayutthaya Limited (Canon Inc.)
• Original Assignee: Canon Ayutthaya Limited (Canon Inc.)
• Inventors: Tsuchitoi, Naoki
• Primary Examiner(s): Arani, Taghi T
• Assistant Examiner(s): Champakesan, Badridot
• Application Number:
  US14/978,213
• Publication Number:
  US 20160112459A1
• Time in Patent Office: 1,190 Days
• Field of Search: 713168
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/608 Secure printing
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An image processing apparatus which is capable of restraining operation that does not comply with security policies even in a case where security policies are changed through setting of user modes. The security policies are set in advance in the image processing apparatus. The image processing apparatus has a UI operation unit that enables operation on the image processing apparatus. When settings of the image processing apparatus are changed via the UI operation unit, it is verified whether or not the changed settings match the security policies. Operation of the image processing apparatus is restrained until it is verified that the changed settings match the security policies.

Claims

1. An image processing apparatus, comprising:

a display configured to display a screen of a user interface; and

at least one processor and at least one memory coupled to the at least one processor and having stored thereon instructions, which when executed by the at least one processor, the at least one processor and the at least one memory cooperate to act as;

a managing unit configured to manage an operation setting of the image processing apparatus including a plurality of setting items;

a setting unit configured to set a security policy of the image processing apparatus including a plurality of setting items;

a storage unit configured to store correspondence information which defines a correspondence relationship between the plurality of setting items of the security policy and the plurality of the setting items of the operation setting;

an identifying unit configured to refer to the correspondence information stored in said storage unit and identify a setting item of the operation setting which corresponds to a setting item of the security policy set by said setting unit; and

a restraining unit configured to restrain execution of at least one function of the image processing apparatus, wherein

said storage unit stores that the security policy has not been checked in response to a change of a setting item of the plurality of setting items of the security policy received via the user interface and/or a change of a setting item of the plurality of the setting items of the operation setting, and

said restraining unit causes the user interface to display a message indicating that the security policy has not been checked and restrains execution of the at least one function of the image processing apparatus in a case where a user instructs execution of the at least one function of the image processing apparatus before the identifying unit identifies the setting item of the operation setting which corresponds to the setting item of the security policy set by said setting unit.

2. The image processing apparatus according to claim 1, wherein the at least one memory further stores instructions, which when executed by the at least one processor, the at least one processor and the at least one memory cooperate to act as a verifying unit configured to verify whether a setting content for the setting item of the operation setting identified by said identifying unit satisfies a constraint condition indicated by the setting item of the security policy.

3. The image processing apparatus according to claim 1, wherein one of the plurality of setting items included in the operation setting relates to whether to perform encryption when data is transmitted using Internet Printing Protocol.

4. The image processing apparatus according to claim 1, wherein one of the plurality of setting items included in the operation setting relates to whether to perform encryption when data is transmitted using Simple Mail Transfer Protocol.

5. The image processing apparatus according to claim 1, wherein one of the plurality of setting items included in the security policy relates to whether to perform encryption of a communication path.

6. A control method for an image processing apparatus including a display configured to display a screen of a user interface, the method comprising:

managing an operation setting of the image processing apparatus including a plurality of setting items;

setting a security policy of the image processing apparatus including a plurality of setting items;

storing correspondence information which defines a correspondence relationship between the plurality of setting items of the security policy and the plurality of the setting items of the operation setting;

referring to the stored correspondence information and identifying a setting item of the operation setting which corresponds to a setting item of the set security policy;

storing that the security policy has not been checked in response to a change of a setting item of the plurality of setting items of the security policy received via the user interface and/or a change of a setting item of the plurality of the setting items of the operation setting; and

displaying a message indicating that the security policy has not been checked and restraining execution of at least one function of the image processing apparatus in a case where a user instructs execution of the at least one function of the image processing apparatus before the setting item of the operation setting which corresponds to the setting item of the set security policy is identified.

7. A non-transitory computer-readable storage medium storing a program for causing an image processing apparatus, which includes a display configured to display a screen of a user interface, to implement a control method, the control method comprising:

managing an operation setting of the image processing apparatus including a plurality of setting items;

setting a security policy of the image processing apparatus including a plurality of setting items;

storing correspondence information which defines a correspondence relationship between the plurality of setting items of the security policy and the plurality of the setting items of the operation setting;

referring to the stored correspondence information and identifying a setting item of the operation setting which corresponds to a setting item of the set security policy;

storing that the security policy has not been checked in response to a change of a setting item of the plurality of setting items of the security policy received via the user interface and/or a change of a setting item of the plurality of the setting items of the operation setting; and

displaying a message indicating that the security policy has not been checked and restraining execution of at least one function of the image processing apparatus in a case where a user instructs execution of the at least one function of the image processing apparatus before the setting item of the operation setting which corresponds to the setting item of the set security policy is identified.

8. An image processing apparatus, comprising:

a display configured to display a screen of a user interface;

a memory that stores instructions; and

a processor that executes the instructions to;

manage an operation setting including a plurality of setting items for controlling a secure communication process of the image processing apparatus, wherein setting values correspond to the plurality of setting items of the operation setting;

set a security policy of the image processing apparatus, wherein the security policy includes a plurality of setting items and the memory stores correspondence information which defines a correspondence between the plurality of setting items of the security policy and the setting values of the plurality of the setting items of the operation setting to be set in the image processing apparatus;

identify, in accordance with the correspondence information stored in the memory, a setting item of the operation setting for controlling the secure communication process which corresponds to a setting item of the set security policy;

store that the security policy has not been checked in response to a change of a setting item of the plurality of setting items of the security policy received via the user interface and/or a change of a setting item of the plurality of the setting items of the operation setting; and

display a message indicating that the security policy has not been checked and restrain execution of at least one function of the image processing apparatus in a case where a user instructs execution of the at least one function of the image processing apparatus before the setting item of the operation setting for controlling the secure communication process which corresponds to the setting item of the set security policy is identified.

9. The image processing apparatus according to claim 8, wherein the security policy is related to a policy which defines how strong a cipher should be for use in the secure communication process, and the operation setting is related to at least one of a password configuration, a secure transport layer, and a user authentication.

10. A control method for an image processing apparatus including a display configured to display a screen of a user interface, the method comprising:

managing an operation setting including a plurality of setting items for controlling a secure communication process of the image processing apparatus, wherein setting values correspond to the plurality of setting items of the operation setting;

setting a security policy of the image processing apparatus, the security policy including a plurality of setting items;

storing correspondence information defining a correspondence between the plurality of setting items of the security policy and the setting values of the plurality of the setting items of the operation setting to be set in the image processing apparatus;

identifying, in accordance with the stored correspondence information, a setting item of the operation setting for controlling the secure communication process which corresponds to a setting item of the set security policy;

storing that the security policy has not been checked in response to a change of a setting item of the plurality of setting items of the security policy received via the user interface and/or a change of a setting item of the plurality of the setting items of the operation setting; and

displaying a message indicating that the security policy has not been checked and restraining execution of at least one function of the image processing apparatus in a case where a user instructs execution of the at least one function of the image processing apparatus before the setting item of the operation setting for controlling the secure communication process which corresponds to the setting item of the set security policy is identified.

11. The control method according to claim 10, wherein the security policy is related to a policy which defines how strong a cipher should be for use in the secure communication process, and the operation setting is related to at least one of a password configuration, a secure transport layer, and a user authentication.

12. A non-transitory computer-readable storage medium storing a program for implementing a control method for an image processing apparatus including a display configured to display a screen of a user interface, the control method comprising:

managing an operation setting including a plurality of setting items for controlling a secure communication process of the image processing apparatus, wherein setting values correspond to the plurality of setting items of the operation setting;

setting a security policy of the image processing apparatus, the security policy including a plurality of setting items;

storing correspondence information defining a correspondence between the plurality of setting items of the security policy and the setting values of the plurality of the setting items of the operation setting to be set in the image processing apparatus;

identifying, in accordance with the stored correspondence information, a setting item of the operation setting for controlling the secure communication process which corresponds to a setting item of the set security policy;

storing that the security policy has not been checked in response to a change of a setting item of the plurality of setting items of the security policy received via the user interface and/or a change of a setting item of the plurality of the setting items of the operation setting; and

displaying a message indicating that the security policy has not been checked and restraining execution of at least one function of the image processing apparatus in a case where a user instructs execution of the at least one function of the image processing apparatus before the setting item of the operation setting for controlling the secure communication process which corresponds to the setting item of the set security policy is identified.

13. The non-transitory computer-readable storage medium according to claim 12, wherein the security policy is related to a policy which defines how strong a cipher should be for use in the secure communication process, and the operation setting is related to at least one of a password configuration, a secure transport layer, and a user authentication.