JP6965829B2 - Information processing systems, management devices and programs - Google Patents

Description

The present invention relates to an information processing system including a plurality of information processing devices, and a technique related thereto.

In an information processing device, there is a technique for executing a computer virus detection process using antivirus software in the device (see Patent Document 1).

Japanese Unexamined Patent Publication No. 2005-229611

By the way, in an information processing system including a plurality of information processing devices, different antivirus software may be installed on the plurality of information processing devices.

In addition, there may be a computer virus that cannot be detected by any one of the plurality of antivirus software installed in the plurality of information processing devices. For example, one antivirus software can detect the latest (new) computer virus, while another antivirus software cannot (at this time) detect the latest computer virus. There may be.

If there is a computer virus in the information processing system that cannot be detected by any antivirus software, protection from the computer virus in the information processing system is not always appropriate.

Therefore, an object of the present invention is to provide a technique capable of appropriately protecting from a computer virus in an information processing system including a plurality of information processing devices.

In order to solve the above problem, the invention of claim 1 is a management device that manages a plurality of information processing devices constituting an information processing system and also manages a plurality of antivirus software, and the plurality of antivirus software. It is not possible to detect a detectable device, which is an information processing device having antivirus software capable of detecting one of the computer viruses, and the one computer virus among the plurality of antivirus software. A specific means for identifying an undetectable device, which is an information processing device having possible antivirus software, from the plurality of information processing devices, and a communication control means for transmitting a proxy request transmission command to the undetectable device. The proxy request transmission command is a request that the virus detection process for detecting at least one computer virus should be executed by the detectable device instead of the undetectable device. Is a command to be transmitted to the detectable device.

The invention of claim 2 is the management device according to the invention of claim 1, wherein the communication control means transmits a pre-execution command and a conditional proxy request transmission command to the non-detectable device, and the pre-execution. The command is a command to execute the virus detection process in the non-detectable device prior to the transmission of the proxy request to the detectable device, and the conditional proxy request transmission command is the command in the non-detectable device. It is a command to send the proxy request for the process target file to the detectable device on condition that the computer virus is not detected from the process target file of the virus detection process.

The invention of claim 3 is the management device according to the invention of claim 1 or 2, wherein the proxy request transmission command detects the proxy request each time a file input / output process occurs in the undetectable device. It is a command to be transmitted to the enable device, and in the communication control means, after the proxy request transmission command is transmitted to the non-detectable device, the antivirus software in the non-detectable device is the computer. When it becomes possible to detect a virus, it is characterized in that a notification to the effect that the proxy request transmission command is withdrawn is transmitted to the undetectable device.

The invention of claim 4 is for virus detection processing by antivirus software which cannot detect the computer virus of the plurality of antivirus software in the management device according to the invention of claim 3. Further, a setting control means for changing the execution interval of the update confirmation of the virus definition file used from the first value preset for the antivirus software to the second value smaller than the first value. It is characterized by being prepared.

The invention of claim 5 is based on the detectable virus information which is the information defining the detectable virus in each antivirus software in the management device according to any one of claims 1 to 4. Further provided with a determination means for executing a presence / absence determination process, which is a process for determining whether or not there is a computer virus that cannot be detected by any of the antivirus software in the above. The specifying means is characterized in that the detectable device and the undetectable device are specified from the plurality of information processing devices based on the determination result by the determining means.

The invention of claim 6 is the management device according to the invention of claim 5, wherein the determination means determines the existence or nonexistence of a part of the computer viruses among the plurality of computer viruses defined in the detectable virus information. It is characterized in that it is determined as a computer virus to be searched for in the process, and the presence / absence determination process is executed for the computer virus to be searched.

The invention of claim 7 is the management device according to the invention of claim 6, wherein the part of the computer virus is a predetermined time before the present time among the plurality of computer viruses specified in the detectable virus information. It is characterized in that it is a computer virus that can be detected by any antivirus software within the period from the time point to the present time point.

The invention of claim 8 is the management device according to the invention of claim 6, wherein some of the computer viruses are designated by an administrator among the plurality of computer viruses specified in the detectable virus information. It is characterized by being a computer virus.

The invention of claim 9 applies to a computer built in a management device that manages a plurality of information processing devices constituting an information processing system and also manages a plurality of antivirus software a) the plurality of antivirus software. It is impossible to detect a detectable device, which is an information processing device having antivirus software capable of detecting one of the computer viruses, and the one computer virus among the plurality of antivirus software. A step of identifying an undetectable device, which is an information processing device having anti-virus software, from the plurality of information processing devices, and b) a step of transmitting a proxy request transmission command to the undetectable device. The proxy request transmission command is a program for execution, and the proxy request transmission command is a request that a virus detection process for detecting at least one computer virus should be executed by the detectable device instead of the undetectable device. It is characterized in that it is a command to transmit the proxy request to the detectable device.

According to the invention of claim 10, in the program according to the invention of claim 9, in step b), a prior execution command and a conditional proxy request transmission command are transmitted to the undetectable device, and the prior execution is performed. The command is a command to execute the virus detection process in the non-detectable device prior to the transmission of the proxy request to the detectable device, and the conditional proxy request transmission command is the command in the non-detectable device. It is a command to send the proxy request for the process target file to the detectable device on condition that the computer virus is not detected from the process target file of the virus detection process.

The invention of claim 11 is the program according to the invention of claim 9 or 10. The proxy request transmission command can detect the proxy request each time a file input / output process occurs in the non-detectable device. It is a command to be transmitted to the device, and the program c) after the step b), when the antivirus software in the undetectable device can detect the one computer virus. It is characterized in that the computer further executes a step of transmitting a notification to the non-detectable device to the non-detectable device to withdraw the proxy request transmission command.

The invention of claim 12 is the program according to the invention of claim 11, d) virus detection processing by antivirus software which cannot detect the one computer virus among the plurality of antivirus software. A step of changing the execution interval of the update confirmation of the virus definition file used in the above from the first value preset for the antivirus software to the second value smaller than the first value, the computer. It is characterized in that it is further executed.

The invention of claim 13 is a program according to any one of claims 9 to 12, wherein the program is e) information that defines a detectable virus in each antivirus software. Based on the step of executing the presence / absence determination process, which is a process of determining whether or not there is a computer virus that cannot be detected by any of the plurality of antivirus software. In step a), the detectable device and the undetectable device are identified from the plurality of information processing devices based on the determination result in step e). It is characterized by.

According to the invention of claim 14, in the program according to the invention of claim 13, in the step e), some computer viruses among the plurality of computer viruses defined in the detectable virus information are present or not. It is characterized in that it is determined as a computer virus to be searched in the determination process, and the existence / absence determination process is executed for the computer virus to be searched.

The invention of claim 15 is the program according to the invention of claim 14, wherein the part of the computer virus is a time point before a predetermined time at the present time among the plurality of computer viruses specified in the detectable virus information. It is a computer virus that can be detected by any antivirus software within the period from the above to the present time.

The invention of claim 16 is the program according to the invention of claim 14, wherein some of the computer viruses are computers designated by an administrator among the plurality of computer viruses specified in the detectable virus information. It is characterized by being a virus.

The invention of claim 17 is an information processing system, comprising a plurality of information processing devices, a management device for managing the plurality of information processing devices, and a management device for managing a plurality of antivirus software. The device is a detectable device that is an information processing device having antivirus software capable of detecting a computer virus of one of the plurality of antivirus software, and the one of the plurality of antivirus software. A specific means for identifying an undetectable device, which is an information processing device having antivirus software that cannot detect a computer virus, from the plurality of information processing devices, and a proxy for the undetectable device. The proxy request transmission command includes a communication control means for transmitting a request transmission command, and the proxy request transmission command performs a virus detection process for detecting at least one computer virus by the detectable device in place of the non-detectable device. It is characterized in that it is a command to send a proxy request, which is a request to be executed, to the detectable device.

The invention of claim 18 is the information processing system according to the invention of claim 17, wherein the non-detectable device transmits the proxy request to the detectable device based on the proxy request transmission command from the management device. In response to the proxy request from the undetectable device, the detectable device executes a virus detection process for detecting at least one computer virus by using antivirus software in the own device. It is characterized by.

The invention of claim 19 is the information processing system according to the invention of claim 18, wherein the communication control means transmits a pre-execution command and a conditional proxy request transmission command to the non-detectable device, and the predecessor. The execution command is a command to execute the virus detection process in the non-detectable device prior to the transmission of the proxy request to the detectable device, and the conditional proxy request transmission command is the non-detectable device. It is a command to send the proxy request regarding the process target file to the detectable device on condition that the computer virus is not detected from the process target file of the virus detection process in the above, and the undetectable device is the management. Based on the advance execution command from the device, prior to the transmission of the proxy request to the detectable device, the virus detection process for the file to be processed is executed by using the antivirus software in the own device, and the above-mentioned Based on the conditional proxy request transmission command from the management device, the proxy request related to the processing target file can be detected on the condition that the computer virus is not detected from the processing target file by the virus detection process in the own device. It is characterized by transmitting to a device.

According to the inventions of claims 1 to 19, a detectable device which is a device having antivirus software capable of detecting one computer virus among a plurality of antivirus software, and the said one. An undetectable device, which is a device having antivirus software that cannot detect a computer virus, is identified from a plurality of information processing devices. Then, a proxy request transmission command is transmitted to the undetectable device. As a result, in response to the proxy request transmission command, a virus detection process for detecting at least one computer virus can be executed by the detectable device instead of the undetectable device. Therefore, in an information processing system provided with a plurality of information processing devices, it is possible to appropriately protect from computer viruses.

In particular, according to the inventions of claims 2, 10 and 19, the virus detection process is executed in the undetectable device prior to the proxy request from the undetectable device to the detectable device. Then, on condition that the computer virus is not detected from the processing target file of the virus detection processing by the undetectable device, the undetectable device transmits a proxy request regarding the processing target file to the detectable device. As a result, after ensuring the safety of the processing target file to a certain extent, the processing target file is exchanged between the undetectable device and the detectable device. Therefore, in an information processing system provided with a plurality of information processing devices, it is possible to more appropriately protect against computer viruses.

It is a figure which shows the information processing system. It is a figure which shows the functional block of the MFP. It is a figure which shows the functional block of the management server. It is a conceptual diagram which shows the outline of the operation of an information processing system. It is a figure which shows the antivirus software installed in each MFP. It is a figure which shows the antivirus software management table. It is a figure which shows the setting screen of the update confirmation interval of a pattern file. It is a flowchart which shows the operation of a management server. It is a flowchart which shows the operation of the MFP (virus detection processing for own device). It is a flowchart which shows the operation of the MFP (virus detection processing for other devices). It is a flowchart which shows the operation (virus detection processing for own apparatus) of the MFP which concerns on 2nd Embodiment. It is a figure which shows the antivirus software management table which concerns on the modification example of 2nd Embodiment. It is a flowchart which shows the operation of the management server which concerns on a modification. It is a figure which shows the antivirus software management table which concerns on a modification. It is a figure which shows the setting screen of the update confirmation interval of the pattern file which concerns on the modification.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

<1. First Embodiment>
<1-1. Configuration overview>
FIG. 1 is a diagram showing an information processing system 1 according to the present invention. The information processing system 1 includes a management device and a plurality of information processing devices. Here, as shown in FIG. 1, the information processing system 1 is composed of a management server 90 and a plurality of MFPs 10 (10a to 10d).

The elements 10a to 10d and 90 in the system 1 are connected to each other so as to be communicable with each other via the network 108. The network 108 is composed of a LAN (Local Area Network), the Internet, and the like. Further, the connection mode to the network 108 may be a wired connection or a wireless connection.

Software (also referred to as antivirus software or antivirus software) 300 capable of executing antivirus processing including computer virus detection processing (also referred to as virus detection processing) in each MFP10. Is installed. The virus detection process is also called a virus scan or a virus check. In the following, the "computer virus" is also simply referred to as a "virus".

Specifically, the antivirus software (also simply referred to as antivirus software) 300 is a virus based on a file (also referred to as a virus definition file or a pattern file) that records the actions (patterns) of various viruses. Execute the detection process in the antivirus process. In other words, the antivirus software 300 determines whether or not the virus is infected as defined in the pattern file by executing the virus detection process.

Further, when a virus is detected by the virus detection process, the antivirus software 300 also executes a process of detoxifying the detected virus (virus detoxification process) in the antivirus process. The virus detoxification process includes a removal process for removing (removing) the virus from a file infected with the virus (infected file), a deletion process for deleting the infected file itself, and / or a specific area for the infected file. Isolation processing is performed to isolate the virus.

In this information processing system 1, a plurality of antivirus software (a plurality of types of antivirus software) 300 (301, 302) exist, and each MFP 10 (10a to 10d) has the plurality of antivirus software 301, One of 302 is installed. FIG. 5 is a diagram showing antivirus software 300 installed in each MFP 10. Here, the antivirus software 301 is installed in the MFPs 10a, 10b, and 10d, and the antivirus software 302 is installed in the MFP 10c (see also FIG. 5).

<1-2. MFP configuration>
FIG. 2 is a diagram showing a functional block of an MFP (Multi-Functional Peripheral) 10 (10a to 10d). The MFP 10 is also referred to as an image forming apparatus or an image processing apparatus.

The MFP 10 is a device (also referred to as a multifunction device) having a reading function, a copying function, a facsimile function, a box storage function, and the like. Specifically, as shown in the functional block diagram of FIG. 2, the MFP 10 includes an image reading unit 2, a print output unit 3, a communication unit 4, a storage unit 5, an operation unit 6, a controller 9, and the like. Various functions are realized by operating each part of the above in a complex manner.

The image reading unit 2 is a processing unit that optically reads a document placed at a predetermined position of the MFP 10 and generates image data (also referred to as a document image) of the document.

The print output unit 3 is an output unit that prints and outputs an image on various media such as paper based on data related to a print target.

The communication unit 4 is a processing unit capable of performing facsimile communication via a public line or the like. Further, the communication unit 4 can also perform network communication via the network 108. In this network communication, for example, various protocols such as TCP / IP (Transmission Control Protocol / Internet Protocol) are used. By using the network communication, the MFP 10 can exchange various information with and from a desired destination (management server 90, other MFP 10 and the like). The communication unit 4 has a transmission unit 4a for transmitting various data and a reception unit 4b for receiving various data.

The storage unit 5 is composed of a storage device such as a hard disk drive (HDD).

The operation unit 6 includes an operation input unit 6a that receives an operation input to the MFP 10 and a display unit 6b that displays and outputs various information.

The MFP 10 is provided with a substantially plate-shaped operation panel portion 6c (see FIG. 1). Further, the operation panel unit 6c has a touch panel 25 (see FIG. 1) on the front side thereof. The touch panel 25 functions as a part of the operation input unit 6a and also as a part of the display unit 6b. The touch panel 25 is configured by embedding various sensors and the like in a liquid crystal display panel, and can display various information and receive various operation inputs from the operator.

The controller (control unit) 9 is a control device that is built in the MFP 10 and controls the MFP 10 in an integrated manner. The controller 9 is configured as a computer system including a CPU and various semiconductor memories (RAM and ROM). The controller 9 realizes various processing units by executing a predetermined software program (hereinafter, also simply referred to as a program) stored in a ROM (for example, EEPROM (registered trademark)) in the CPU. The program (specifically, a program module group) may be recorded on a portable recording medium such as a USB memory and installed on the MFP 10 via the recording medium. Alternatively, the program may be downloaded via the network 108 or the like and installed in the MFP 10.

Specifically, as shown in FIG. 2, the controller 9 executes various processes including the communication control unit 11, the input control unit 12, the display control unit 13, and the antivirus execution control unit 14 by executing the program or the like. Realize the part.

The communication control unit 11 is a processing unit that controls communication operations with other devices (management server 90, other MFP 10 and the like) in cooperation with the communication unit 4 and the like. The communication control unit 11 includes a transmission control unit that controls the transmission operation of various data and a reception control unit that controls the reception operation of various data.

The input control unit 12 is a control unit that controls an operation input operation for the operation input unit 6a (touch panel 25 or the like). For example, the input control unit 12 controls an operation of receiving an operation input for the operation screen displayed on the touch panel 25.

The display control unit 13 is a processing unit that controls the display operation on the display unit 6b (touch panel 25 or the like). The display control unit 13 causes the touch panel 25 to display an operation screen or the like for operating the MFP 10.

The antivirus execution control unit 14 cooperates with the antivirus software (antivirus software in the own device) 300 installed in the own device to perform antivirus processing (virus detection processing and virus detoxification processing) in the own device. Etc.) is a processing unit that controls the operation of executing the execution.

Here, the above-mentioned various operations are executed mainly by executing the software program on the CPU of the controller 9, but the present invention is not limited to this, and the MFP 10 (specifically, the inside of the controller 9). Alternatively, the above-mentioned various operations may be executed by using dedicated hardware or the like provided in (externally). For example, all or part of the communication control unit 11, the input control unit 12, the display control unit 13, the antivirus execution control unit 14 (FIG. 2), and the like may be realized by using one or more dedicated hardware. ..

<1-3. Configuration of management server 90>
Next, the configuration of the management server 90 will be described.

The management server 90 is an external device (server computer (external server device)) different from the MFP. The management server 90 functions as a management device that manages a plurality of MFPs 10a to 10d in the information processing system 1 and also manages a plurality of antivirus softwares 301 and 302.

FIG. 3 is a functional block diagram showing a schematic configuration of the management server 90.

As shown in the functional block diagram of FIG. 3, the management server 90 includes a communication unit 94, a storage unit 95, a controller 99 (control unit), and the like, and by operating each of these units in a complex manner, various types of management servers 90 are provided. Realize the function.

The communication unit 94 can perform network communication via the network 108. In this network communication, for example, various protocols such as TCP / IP (Transmission Control Protocol / Internet Protocol) are used. By using the network communication, the management server 90 can exchange various data with and from a desired destination (MFP10, etc.). The communication unit 94 has a transmission unit 94a for transmitting various data and a reception unit 94b for receiving various data.

The storage unit 95 is composed of a storage device such as a hard disk drive (HDD) and a non-volatile semiconductor memory.

The antivirus software management table 400 (see FIG. 6) for managing the antivirus software 301 and 302 is stored in the storage unit 95. The antivirus software management table 400 defines the version information of the pattern files of the antivirus software 301 and 302. In addition, the antivirus software management table 400 also defines viruses (detectable viruses) (virus types) that can be detected by each antivirus software 300. Further, the antivirus software management table 400 also defines the date on which the antivirus software 301 and 302 became able to detect the detectable virus of the antivirus software 301 and 302. In other words, the antivirus software management table 400 defines the date (addition date) when the detectable virus of each antivirus software 301 or 302 is added to the pattern file of each antivirus software 301 or 302. As will be described later, these pieces of information are acquired from the server (also referred to as the provider server) of the provider (vendor) of each antivirus software 300 and registered in the antivirus software management table 400.

The controller 99 is a control device built in the management server 90 and collectively controls the management server 90. The controller 99 is configured as a computer system including a CPU and various semiconductor memories (RAM and ROM). The controller 99 realizes various processing units by executing a predetermined program stored in the storage unit 95 in the CPU. The program (specifically, a program module group) may be recorded on a portable recording medium such as a USB memory, read from the recording medium, and installed on the management server 90. Alternatively, the program may be downloaded via the network 108 or the like and installed on the management server 90.

Specifically, as shown in FIG. 3, the controller 99 realizes various processing units including a communication control unit 81, a determination unit 82, a specific unit 83, and a setting control unit 84 by executing the program or the like. ..

The determination unit 82 is a processing unit that executes various determination operations. For example, the determination unit 82 determines whether or not there is a virus (also referred to as an undetectable virus) that cannot be detected by any one of the plurality of antivirus software 300. To execute. This determination process is also referred to as an undetectable virus presence / absence determination process.

The identification unit 83 is a processing unit that executes a process of identifying a detectable device and an undetectable device related to one virus (undetectable virus) from a plurality of MFPs 10a to 10d. When the specific unit 83 cannot detect the one virus by any one of the plurality of antivirus software 300 as a result of the presence / absence determination process of the undetectable virus, the specific unit 83 (the one virus) ( A detectable device and an undetectable device are specified from a plurality of MFPs 10a to 10d with respect to (one undetectable virus).

The detectable device is a device having antivirus software capable of detecting one virus (undetectable virus) among a plurality of antivirus softwares 301 and 302. In other words, the detectable device is a device capable of detecting the one virus by using the antivirus software 300 installed in the own device. An undetectable device is a device having antivirus software that cannot (at present) detect the one virus among a plurality of antivirus softwares 301 and 302. In other words, the undetectable device is a device in which the antivirus software 300 installed in the own device cannot detect the one virus.

The communication control unit 81 is a processing unit that controls communication operations with other devices (MFP10, etc.) in cooperation with the communication unit 94. For example, the communication control unit 81 transmits a proxy request transmission command to the undetectable device specified by the specific unit 83. The proxy request transmission command indicates that the virus detection process that targets at least one virus should be executed by the detectable device on behalf of the undetectable device for the file to be processed by the virus detection process by the undetectable device. Is a command to send the request (also referred to as a proxy request) to the detectable device.

The setting control unit 84 is a processing unit that controls the setting operation for setting the execution interval of the update confirmation of the pattern files of the antivirus softwares 301 and 302.

Here, the above-mentioned various operations are executed mainly by executing the software program on the CPU of the controller 99, but the present invention is not limited to this, and the management server 90 (specifically, the controller 99). The above-mentioned various operations may be executed by using dedicated hardware or the like provided inside or outside the device. For example, all or part of the communication control unit 81, the determination unit 82, the specific unit 83, the setting control unit 84 (FIG. 3), and the like may be realized by using one or more dedicated hardware.

<1-4. Operation>
FIG. 4 is a conceptual diagram showing an outline of the operation in the information processing system 1.

In this embodiment, when the management server 90 cannot detect one virus (for example, V10) by any one of the plurality of antivirus software 301 and 302, the management server 90 can detect the virus V10. The device (for example, MFP10d) and the undetectable device (for example, MFP10c) are specified from the plurality of MFPs 10a to 10d. Then, the management server 90 should execute the virus detection process for the undetectable device 10c with at least the virus V10 as the detection target (infection presence / absence check target) on the detectable device 10d instead of the undetectable device 10c. A command (proxy request transmission command) to the effect that the request to that effect (proxy request) should be transmitted to the detectable device 10d is transmitted.

After that, the non-detectable device 10c transmits the proxy request for the virus detection process to the detectable device 10d together with the processing target file of the virus detection process based on the proxy request transmission command from the management server 90. Then, the detectable device 10d executes (substitutes) the virus detection process for the received file to be processed by using the antivirus software 301 in the own device 10d in response to the proxy request from the non-detectable device 10c.

The details of such an operation will be described below.

<Operation of management server 90>
First, the operation of the management server 90 will be described with reference to FIG. FIG. 8 is a flowchart showing the operation of the management server 90.

In step S11, the management server 90 executes update confirmation (confirmation process of presence / absence of update) of each pattern file of the plurality of antivirus softwares 301 and 302. Specifically, the management server 90 accesses (inquires) both the provider server of the antivirus software 301 and the provider server of the antivirus software 302, and obtains the pattern files of the antivirus software 301 and 302. Execute the update confirmation process.

The execution timing of the update confirmation process of the pattern file (execution interval of update confirmation) is set in advance as follows.

FIG. 7 is a diagram showing an update setting screen 600 (601). The update setting screen 600 (601) is a setting screen for setting various setting items related to the pattern file update operation. The management server 90 sets (determines) the update confirmation execution interval and the update confirmation execution time of the pattern files of the antivirus software 301 and 302 according to the setting operation by the administrator on the update setting screen 600 (601). )do. Here, as shown in FIG. 7, the execution interval of the update confirmation of the pattern files of the antivirus softwares 301 and 302 is set to the value "weekly" (that is, the value "1 week"). Further, here, the execution time of the update confirmation is set to the value "Friday 23:00". Here, the execution interval and execution time of the update confirmation of the pattern files of the antivirus software 301 and 302 are collectively set according to the setting contents on the update setting screen 601. However, the present invention is not limited to this, and the execution interval and execution time of the update confirmation of the pattern files of the antivirus software 301 and 302 may be set individually (for each antivirus software 300).

Then, the management server 90 executes update confirmation of the pattern files of the antivirus softwares 301 and 302 according to the setting contents on the update setting screen 600 (601) (here, at weekly intervals) (step S11). Here, it is assumed that the update confirmation process was executed at 23:00 on Friday, December 22, 2017.

Then, the process proceeds from step S11 to step S12.

In step S12, the management server 90 determines whether or not the pattern file of any of the plurality of antivirus software 301 and 302 has been updated. Here, it is determined that the pattern file of the antivirus software 301 (only) among the plurality of antivirus software 301 and 302 has been updated. Then, the process proceeds from step S12 to step S13.

Here, it is determined whether or not the pattern file is updated in any of the antivirus software 300 by confirming the update to the provider server of each antivirus software 300, but the present invention is not limited to this. For example, it may be determined whether or not the pattern file is updated in any of the antivirus software 300 based on the notification from each provider server (notification that the pattern file has been updated).

In step S13, the management server 90 refers to the devices (here, MFPs 10a, 10b, 10d (see FIG. 5)) having the antivirus software 301 whose pattern file has been updated among the plurality of MFPs 10a to 10d. Sends an update command to the effect that the pattern file of the antivirus software 301 in the own device should be updated.

Each MFP 10a, 10b, 10d executes the update process of the pattern file of the antivirus software 301 in the own device in response to the update command from the management server 90. Specifically, each MFP 10a, 10b, 10d accesses the provider server of the antivirus software 301, acquires the latest pattern file ("301_20171222"), and obtains the latest pattern file acquired from the provider server. Store in own device.

Then, the process proceeds from step S13 to step S14.

In step S14, the management server 90 updates the antivirus software management table 400 (FIG. 6).

FIG. 6 is a diagram showing the updated antivirus software management table 401. The management server 90 acquires the version information (here, "301_20171222") of the pattern file after the update of the antivirus software 301 from the provider server of the antivirus software 301, and registers it in the antivirus software management table 400 (401). do. In addition, the management server 90 acquires information indicating a virus (virus type) that can be newly detected in the updated pattern file from the provider server of the antivirus software 301, and is the antivirus software. Register (add) to the management table 401. Here, the virus V10 is newly registered in the antivirus software management table 401. Further, the management server 90 acquires the date when the antivirus software 301 can detect the virus V10 (here, December 22, 2017) from the provider server and sets it in the antivirus software management table 401. to register.

Then, the process proceeds from step S14 to step S15, and the management server 90 becomes one of the plurality of antivirus software 301 and 302 based on the antivirus software management table 401 (FIG. 6). The process of determining whether or not an undetectable virus exists (existence determination process of an undetectable virus) (see FIG. 4) is executed. In other words, it is determined whether or not there is a difference in detectability between the detectable virus of the antivirus software 301 and the detectable virus of the antivirus software 302.

Specifically, the management server 90 determines all the viruses specified in the antivirus software management table 401 (FIG. 6) as the virus to be searched (target of interest) in the presence / absence determination process of the undetectable virus. Then, the management server 90 executes the presence / absence determination process of the undetectable virus with respect to the search target virus (here, all the viruses specified in the antivirus software management table 401) of the presence / absence determination process of the undetectable virus. Here, as shown in FIG. 6, the antivirus software 301 can detect viruses V1 to V10, and the antivirus software 302 can detect viruses V1 to V9. That is, the antivirus software 302 cannot (at present) detect virus V10 (a virus that can be detected by the antivirus software 301) (it is not compatible with virus V10). Therefore, the management server 90 determines in step S15 that an undetectable virus (here, virus V10) exists in any of the plurality of antivirus software 301 and 302.

Then, the process proceeds from step S15 to step S16.

In step S16, the management server 90 has a device (detectable device) having antivirus software 301 capable of detecting the virus V10, and a virus that cannot (at present) detect the virus V10. The device (non-detectable device) having the countermeasure software 300 is specified from the plurality of MFPs 10a to 10d. Here, among the plurality of MFPs 10a to 10d, the MFPs 10a, 10b, and 10d having the antivirus software 301 capable of detecting the virus V10 are specified as the detectable device for the virus V10. Further, among the plurality of MFPs 10a to 10d, the MFP10c having the antivirus software 302 that cannot detect the virus V10 is specified as an undetectable device for the virus V10.

Then, the process proceeds from step S16 to step S17.

In step S17, the management server 90 should execute the virus detection process by the undetectable device 10c on the undetectable device (in this case, the MFP 10c) on the detectable device instead of the undetectable device 10c. A command (proxy request transmission command) to the effect that the request (proxy request) should be sent to the detectable device is transmitted (see FIG. 4). Here, every time a file input / output process occurs in the undetectable device, a proxy request transmission command to the effect that the proxy request should be transmitted to the detectable device is transmitted to the undetectable device.

Specifically, the management server 90 performs a virus detection process for detecting the detectable viruses V1 to V9 (see FIG. 6) of both the antivirus software 301 and 302 and the undetectable virus V10 of the antivirus software 302. A proxy request transmission command indicating that the proxy request to be executed by the detectable device should be transmitted to the detectable device is transmitted to the undetectable device 10c. When a plurality of detectable devices (here, MFPs 10a, 10b, 10d) exist, the management server 90 may use the plurality of detectable devices 10a, 10b, 10d, for example, based on a predetermined priority for each MFP 10. One of the detectable devices is determined as the request destination device (substitute device) for the virus detection process. Here, the MFP10d is determined as the request destination device (substitute device) for the virus detection process.

Here, the proxy request transmission command is always transmitted to the undetectable device (in this case, the MFP 10c) (step S17), but the present invention is not limited to this, and for example, the proxy request transmission command is already transmitted to the device. On the other hand, the proxy request transmission command may not be transmitted (retransmitted). Specifically, when the destination device (for example, MFP10c) of the proxy request transmission command is stored in the management server 90 and is determined to be "YES" again in the next undetectable virus presence / absence determination process (step S15). May prevent the retransmission of the proxy request transmission command from being executed for the device (MFP10c) that has already transmitted the proxy request transmission command.

<Operation of each MFP10>
Next, the operation of each MFP 10 will be described with reference to FIG. 9 and the like.

FIG. 9 is a diagram showing the operation of the MFP 10 (virus detection process for the own device). The process of FIG. 9 is executed by each MFP 10a to 10d. Here, the operation of the MFP 10c (the destination device of the proxy request transmission command) specified as the undetectable device will be mainly described.

First, in step S21 (S21A), the MFP10 (here, the MFP10c) determines whether or not the proxy request transmission command has been received from the management server 90. Here, the MFP 10c (non-detectable device) receives the proxy request transmission command from the management server 90, and proceeds with the process from step S21 (S21A) to step S22. The case where the process proceeds from step S21 to step S25 will be described later.

In step S22, the MFP 10 (10c) determines whether or not the file input / output process (input process or output process) is executed by the own device (10c) (whether or not the file input / output process occurs). do.

Specifically, the MFP 10c constantly (in real time) monitors whether or not to execute the file input / output process in the own device 10c by using the antivirus software 302 in the own device 10c. Then, when the MFP10c detects that the file input / output process is executed, the MFP 10c proceeds from step S22 to step S23.

In step S23, the MFP 10c (non-detectable device) executes a proxy request (execution request) for virus detection processing for the input / output file (process target file) based on the proxy request transmission command from the management server 90. It is transmitted to the detectable device (in this case, MFP10d) together with the target file (see FIG. 4). In other words, the undetectable device 10c causes another MFP 10 (detectable device 10d) to execute the virus detection process for the file to be processed not by the own device 10c (instead of the own device 10c). ..

Then, the process proceeds from step S23 to step S24, and the MFP 10c (non-detectable device) waits for the processing result (detection processing result) of the virus detection process in the request destination device (detectable device 10d) of the virus detection process. The operation after step S24 in the MFP 10c (non-detectable device) will be described later.

Next, the operation of the request destination device (in this case, the MFP 10d) of the proxy request from the non-detectable device 10c will be described with reference to FIG. FIG. 10 is a flowchart showing the operation of the MFP 10 (virus detection process for another device).

When the MFP10d (detectable device for virus V10) receives the proxy request for virus detection processing and the file to be processed from the MFP10c (undetectable device for virus V10) (step S31), the processing proceeds from step S31 to step S32. Proceed.

In step S32, the detectable device 10d responds to the proxy request from the undetectable device 10c and performs the virus detection process for the processing target file received from the undetectable device 10c with the antivirus software 301 in the own device 10d. (See FIG. 4). Specifically, the detectable device 10d executes a virus detection process for detecting the detectable viruses V1 to V10 of the antivirus software 301 in the own device 10d on the received file to be processed. In other words, the detection targets are the detectable viruses V1 to V9 of both the antivirus software 301 and 302 and the undetectable virus (detectable virus only of the antivirus software 301) V10 (see FIG. 6) of the antivirus software 302. The virus detection process to be performed is executed (on behalf of) by a device (MFP10d) having antivirus software 301.

Then, the process proceeds from step S32 to step S33, and the detectable device 10d determines whether or not a virus has been detected in the file to be processed.

When a virus is detected in the file to be processed by the virus detection process in the detectable device 10d, the process proceeds from step S33 to step S34, and the detectable device 10d disinfects the detected virus (from the file to be processed). Process to remove the virus) is executed. Then, the process proceeds from step S34 to step S35.

On the other hand, when the virus is not detected in the file to be processed by the virus detection process in the detectable device 10d, the process proceeds from step S33 to step S35 without going through step S34.

In step S35, the detectable device 10d transmits the processing result (detection processing result) of the virus detection processing in the own device 10d to the requesting device (here, the undetectable device 10c) of the virus detection processing.

Now, returning to the flowchart of FIG. 9, the operation (operation after step S24) of the MFP 10c (virus detection processing requesting device) will be described.

When the MFP10c (non-detectable device for virus V10) receives the detection processing result from the request destination device (MFP10d) for the virus detection processing (step S24), the processing proceeds from step S24 to step S27.

In step S27, the undetectable device 10c determines whether or not a virus has been detected in the file to be processed. Specifically, the non-detectable device 10c determines whether or not a virus has been detected in the file to be processed based on the detection processing result from the detectable device 10d.

For example, when the undetectable device 10c receives the detection processing result indicating that the virus has been detected from the processing target file from the detectable device 10d, the process proceeds from step S27 to step S28. Then, the undetectable device 10c executes a detoxification process (for example, a process of deleting the file to be processed) of the detected virus (step S28).

On the other hand, when the undetectable device 10c receives the detection processing result indicating that the virus was not detected from the processing target file from the detectable device 10d, the process proceeds from step S27 to step S29. Then, the undetectable device 10c executes the file input / output process (step S29).

The undetectable device 10c executes such an operation (such as an operation of transmitting a proxy request to the detectable device 10d) every time a file input / output process occurs in the own device 10c.

When the MFP 10 does not receive the proxy request transmission command from the management server 90 (when proceeding from step S21 (FIG. 9) to step S25), the following operations are executed. If it is determined in step S25 that the input / output process of the file (file to be processed) is executed without receiving the proxy request transmission command from the management server 90 in the MFP10 (MFP10a or the like), the process is performed in step S25. To step S26. Then, in step S26, the MFP 10 (10a, etc.) executes the virus detection process for the file to be processed by using the antivirus software 300 in the own device. After that, the process proceeds to step S27 and subsequent steps. The processes after step S25 are executed in the same manner as described above.

As described above, in the first embodiment, when the virus V10 cannot be detected by the antivirus software 302 among the plurality of antivirus software 301 and 302, the undetectable device 10c related to the virus V10 is used. , A command to send a proxy request for the detection process of the virus V10 to the detectable device 10d is transmitted (see FIG. 4). As a result, the antivirus software 301 capable of detecting the virus V10 is used instead of the device (MFP10c) having the antivirus software 302 that cannot detect the virus V10 in the detection process of the virus V10. It is executed by the device (MFP10d) having the device. Therefore, in the information processing system 1 provided with a plurality of MFPs 10, it is possible to appropriately protect from viruses.

<2. Second Embodiment>
The second embodiment is a modification of the first embodiment. Hereinafter, the differences from the first embodiment will be mainly described.

In the first embodiment, the virus detection process is not executed by the undetectable device (for example, MFP10c), and the file to be processed for the virus detection process is transmitted from the undetectable device (10c) to the detectable device (for example, MFP10d). Has been done.

Here, in consideration of the risk of virus spread and the like, when transmitting the processing target file from the undetectable device 10c to the detectable device 10d, the processing target file is transmitted in advance (at the device on the transmitting side of the processing target file). It is preferable that the possibility of infection with the virus is reduced.

In consideration of this point, in the second embodiment, the virus detection process is executed for the file to be processed by the undetectable device 10c, and then the file to be processed (and the proxy request for the virus detection process) is executed. It is transmitted from the undetectable device 10c to the detectable device 10d. Specifically, the processing target file is not infected with at least viruses V1 to V9 (detectable virus of antivirus software 302 in the undetectable device 10c (FIG. 6)) (that is, the processing target file). After ensuring a certain degree of safety), the processing target file is exchanged between the undetectable device 10c and the detectable device 10d.

First, the operation of the management server 90 will be described. Also in this second embodiment, the operation of FIG. 8 (steps S11 to S17) is executed by the management server 90.

However, in this second embodiment, the processing content of step S17 is different from that of the first embodiment. In this second embodiment as well, as in the first embodiment, the MFP10d is specified as the detectable device related to the virus V10, and the MFP10c is specified as the undetectable device related to the virus V10 (step S16). ..

Specifically, in step S17 according to the second embodiment, the management server 90 transmits not only the proxy request transmission command but also the advance execution command (described below) to the undetectable device 10c. The preceding execution command is a command that the virus detection process for the file to be processed should be executed by the non-detectable device 10c prior to the transmission of the proxy request to the detectable device 10d. Further, the proxy request transmission command according to the second embodiment is a conditional proxy request transmission command. Specifically, the conditional proxy request transmission command is a proxy request for the processing target file (undetectable virus V10 (undetectable virus V10), provided that the virus is not detected from the processing target file by the virus detection process in the undetectable device 10c. It is a command that the detection process of FIG. 6) should be executed by the detectable device 10d) to be transmitted to the detectable device 10d.

Next, the operation of each MFP 10 (particularly, the MFP 10c (a non-detectable device related to virus V10)) will be described. FIG. 11 is a flowchart showing the operation of the MFP 10 according to the second embodiment.

In this second embodiment, as shown in FIG. 11, the processes of steps S41 and S42 are executed between steps S22 and S23. The processing of steps S22 to S29 is the same as that of the first embodiment (FIG. 9).

Specifically, first, the MFP 10c (non-detectable device) receives the proxy request transmission command (conditional proxy request transmission command) and the preceding execution command (step S21 (S21B)) from the management server 90, and then the file When it is determined in step S22 that the input / output process is to be executed, the process proceeds to step S41.

In step S41, the undetectable device 10c performs virus detection processing on the processing target file prior to transmitting the proxy request (and the processing target file) to the detectable device 10d based on the advance execution command from the management server 90. Is executed using the antivirus software 302 in the own device 10c. Specifically, the undetectable device 10c executes a virus detection process for the file to be processed, which targets the detectable viruses V1 to V9 (FIG. 6) of the antivirus software 302.

Then, the process proceeds from step S41 to step S42, and the undetectable device 10c determines whether or not a virus has been detected in the file to be processed as a result of the virus detection process in the own device 10c.

When a virus is detected in the file to be processed by the virus detection process in the undetectable device 10c, the process proceeds from step S42 to step S28 (without going through step S23), and the undetectable device 10c is the process target file. To delete. In other words, when a virus is detected in the processing target file by the virus detection process in the non-detectable device 10c, the non-detectable device 10c does not transmit the processing target file and the proxy request for the virus detection process to the detectable device 10d. ..

On the other hand, if the virus is not detected in the file to be processed by the virus detection process in the undetectable device 10c, the process proceeds from step S42 to step S23, and the undetectable device 10c acts as a proxy for the detection process of the undetectable virus V10. The request and the file to be processed are transmitted to the detectable device 10d. In other words, the file to be processed is from the undetectable device 10c, provided that the file to be processed is not infected with at least viruses V1 to V9 (detectable virus of antivirus software 302 in the undetectable device 10c). It is transmitted to the detectable device 10d. The processing after step S24 is the same as that of the first embodiment.

The detectable device 10d executes the virus detection process for the file to be processed by using the antivirus software 301 in the own device 10d in response to the proxy request from the undetectable device 10c (step S32 (FIG. 10)). ). Here, the detectable device 10d executes a virus detection process for the file to be processed by detecting the detectable viruses V1 to V10 (FIG. 6) of the antivirus software 301. Not limited to this, among the detectable viruses V1 to V10 of the antivirus software 301, the virus detection process that targets the undetectable virus V10 (only) of the antivirus software 302 in the undetectable device 10c can be detected. It may be executed. In other words, the detectable viruses V1 to V9 of the antivirus software 302 in the undetectable device 10c (the virus to be detected by the undetectable device 10c) are the detection of the virus detection process by the detectable device 10d. It may be excluded from the target.

As described above, in the second embodiment, the virus detection process for the file to be processed is performed by the undetectable device 10c prior to the proxy request (and the file to be processed) for the virus detection process from the undetectable device 10c to the detectable device 10d. Is executed (step S41 (FIG. 11)). Then, on condition that the virus is not detected from the processing target file by the virus detection processing in the undetectable device 10c, a proxy request for the virus detection processing is transmitted from the undetectable device 10c to the detectable device 10d together with the processing target file. (Step S23). In other words, the file to be processed is detected as the undetectable device 10c on the condition that it is not infected with at least viruses V1 to V9 (the detectable virus of the antivirus software 302 in the undetectable device 10c (FIG. 6)). The processing target file is exchanged with the possible device 10d. As a result, after ensuring the safety of the processing target file to a certain extent (after reducing the possibility of virus infection of the processing target file as much as possible), the relevant device between the undetectable device 10c and the detectable device 10d is concerned. The file to be processed is sent and received. Therefore, in the information processing system 1 provided with a plurality of MFPs 10, it is possible to more appropriately protect against viruses.

In the second embodiment, the antivirus software 301 and the antivirus software 302 differ in whether or not a single virus (virus V10) can be detected (see FIG. 6). Not limited to. For example, when the detection availability of a plurality of viruses (for example, two viruses V10 and V11) differs between the antivirus software 301 and the antivirus software 302 (see FIG. 12), the following operations are performed.

First, the operation of the management server 90 (FIG. 8) will be described.

FIG. 12 is a diagram showing an antivirus software management table 400 (402) according to this modified example. As shown in FIG. 12, here, the antivirus software 301 can detect the virus V10, but cannot detect the virus V11. On the contrary, the antivirus software 302 cannot detect the virus V10, but can detect the virus V11.

In such a case, the management server 90 identifies the MFP10 having the antivirus software 301 (for example, the MFP10d (see FIG. 5)) as a detectable device for the virus V10, and the MFP10c having the antivirus software 302 (FIG. 5). (See) as an undetectable device for virus V10 (step S16 (FIG. 8)). Further, the management server 90 identifies the MFP 10 (10d) having the antivirus software 301 as a non-detectable device related to the virus V11, and identifies the MFP 10c having the antivirus software 302 as a detectable device related to the virus V11 ( Step S16).

Then, the management server 90 transmits a proxy request transmission command (conditional proxy request transmission command) and a preceding execution command to both the MFPs 10c and 10d (step S17).

Specifically, the management server 90 acts on behalf of the undetectable device 10c related to the virus V10 to execute the detection process of the undetectable virus V10 of the antivirus software 302 on the detectable device 10d related to the virus V10. A proxy request transmission command and a preceding execution command to the effect that the request should be transmitted to the detectable device 10d are transmitted (step S17). Further, the management server 90 requests the undetectable device 10d related to the virus V11 to execute the detection process of the undetectable virus V11 of the antivirus software 301 on behalf of the detectable device 10c related to the virus V11. A proxy request transmission command and a preceding execution command to the effect that the detection device 10c should be transmitted are transmitted (step S17).

Next, the operation of each MFP 10 (particularly the MFP 10c) (particularly the operation of step S41 (FIG. 11)) will be described.

Similar to the second embodiment, the MFP 10c executes a virus detection process for the file to be processed by using the antivirus software 302 in the own device 10c when inputting / outputting the file (step S41). Specifically, the MFP 10c executes a virus detection process for the file to be processed, which targets the detectable viruses V1 to V9 and V11 (FIG. 12) of the antivirus software 302. In other words, in the detectable device 10c related to the virus V11, the detection process of the virus V11 (and V1 to V9) is executed prior to the transmission of the processing target file to the undetectable device 10d related to the virus V11.

Then, when a virus is not detected from the processing target file by the virus detection processing by the MFP10c, the MFP10c (a device that cannot detect the virus V10) makes a proxy request for the virus detection processing together with the processing target file, and the MFP10d (detectable about the virus V10) can be detected. (Step S23).

The detectable device 10d relating to the virus V10 responds to the proxy request from the MFP 10c and uses the antivirus software 301 in the own device 10d to perform virus detection processing for the file to be processed (here, the antivirus software 301 can detect the virus). A virus detection process for detecting viruses V1 to V10) is executed (step S32 (FIG. 10)). In other words, the detection process of the undetectable virus V10 of the antivirus software 302 in the MFP10c is executed by the MFP10d (antivirus software 301 in the MFP10d) instead of the MFP10c.

In this way, for example, when the MFP 10c is an undetectable device for virus V10 and also a detectable device for another virus V11, the MFP 10c executes the detection process for the virus V11 (and V1 to V9). , The virus V10 detection process is executed by the detectable device 10d relating to the virus V10. That is, as a result, the virus detection process for detecting all the viruses specified in the antivirus software management table 402 (FIG. 12) is executed for the processing target file. Therefore, it is possible to comprehensively execute the virus detection process.

In addition, the same operation is performed in the file input / output process in the MFP10d also in the MFP10d (a device that is a device that cannot detect the virus V11 and is also a device that can detect another virus V10). Specifically, the virus V10 (and V1 to V9) is detected by the MFP 10d, and then the virus V11 is detected by the detectable device 10c related to the virus V11.

<3. Modification example>
Although the embodiments of the present invention have been described above, the present invention is not limited to the above contents.

<Modified example of withdrawal of proxy request transmission command>
For example, in each of the above embodiments, when the antivirus software 302 in the undetectable device (for example, the MFP 10c) regarding the virus V10 can detect the virus V10, the proxy transmitted to the MFP 10c is performed. The request transmission command may be withdrawn.

FIG. 13 is a flowchart showing the operation of the management server 90 according to this modified example. In this modified example, as shown in FIG. 13, the process of step S51 is executed when "NO" is determined in step S15. The processing other than step S51 (processing of steps S11 to S17) is the same as that of the first embodiment (FIG. 8).

Specifically, first, the management server 90 sends a proxy request transmission command (here, the undetectable virus V10) to the undetectable device (here, the MFP10c) regarding the undetectable virus V10 in the same manner as in the first embodiment. (Transmission command of proxy request to the detectable device 10d) is transmitted (step S17 (FIG. 13)).

After that, the management server 90 re-executes the update confirmation of the pattern files of the antivirus softwares 301 and 302 in response to the arrival of the preset execution timing (step S11 (FIG. 13)). Here, it is determined in step S12 that the pattern file of the antivirus software 302 has been updated, and after step S13, the antivirus software management table 400 is updated (step S14).

Here, the information indicating the virus newly detected in the updated pattern file of the antivirus software 302 is acquired from the provider server of the antivirus software 302 and newly added to the antivirus software management table 400. It is registered (additional) to. FIG. 14 is a diagram showing an updated antivirus software management table 403 (400) according to this modified example. Here, the virus V10 is newly registered as a detectable virus of the antivirus software 302, and the antivirus software management table 400 is changed from the antivirus software management table 401 (FIG. 6) to the antivirus software management table 403 (FIG. 14). Will be updated.

Then, the process proceeds from step S14 to step S15, and the presence / absence determination process of the undetectable virus is executed based on the antivirus software management table 403 (FIG. 14). In other words, it is determined whether or not the antivirus software 302 (antivirus software that could not detect the undetectable virus V10) can detect the virus V10. Here, by updating the antivirus software management table 403 (FIG. 14), virus V10 is newly added to the detectable virus of antivirus software 302, and the antivirus software 302 can detect virus V10. It is determined that the virus has become. Then, the process proceeds from step S15 to step S51. If a plurality of undetectable viruses are present, it cannot be detected whether to execute the proxy request transmission command transmission process (steps S16, S17) or the following withdrawal notification transmission process (step S51). It may be determined for each virus (individually), or it may be determined for a plurality of undetectable viruses as a whole.

In step S51, the management server 90 notifies the destination device (device that transmitted the proxy request transmission command) (in this case, the MFP 10c) of the proxy request transmission command to withdraw the proxy request unnecessary command. (Hereinafter, also referred to as withdrawal notice) is sent. In other words, the management server 90 does not substitute the other device 10d for the virus detection process (at least the virus detection process for detecting the virus V10) for the file newly input / output by the MFP 10c, but the MFP 10c itself ( Originally, the device that should execute the virus detection process for the file) is made to execute it.

After receiving the withdrawal notification from the management server 90, the MFP 10c does not send a virus detection processing proxy request to the MFP 10d when a file input / output process occurs, and the antivirus software 302 in the own device 10c is used. Use to perform virus detection processing. Specifically, the MFP 10c executes a virus detection process for the file to be processed, which targets the (new) detectable viruses V1 to V10 of the antivirus software 302.

In this way, when the antivirus software 302 in the undetectable device 10c related to the virus V10 can detect the virus V10 (that is, when the MFP 10c changes from the undetectable device related to the virus V10 to the detectable device). ), The proxy request transmission command transmitted to the MFP 10c may be withdrawn. As a result, after the MFP 10c is changed from the undetectable device related to the virus V10 to the detectable device (after receiving the withdrawal notification), the virus detection process for the files input / output by the MFP 10 is performed by the other device (10d). It is completed in the MFP 10c without being executed. Therefore, it is possible to improve the efficiency of the virus detection process.

<Example of modification related to execution interval of pattern file update confirmation>
Further, in the above modification, when any virus (for example, virus V10) cannot be detected by any of the antivirus software 300, the antivirus software 300 (302) cannot detect the virus V10. The execution interval of the update confirmation of the pattern file in) may be shortened.

FIG. 15 is a diagram showing an update setting screen 600 (602) of a pattern file according to this modified example.

The management server 90 responds to the setting operation by the administrator on the update setting screen 602, and only the execution interval of the update confirmation in the normal time (when there is no undetectable virus) for the pattern files of the antivirus software 301 and 302. Also, set (determine) the execution interval of update confirmation when an undetectable virus exists. Here, the execution interval of the update interval in the normal time is set to the value "weekly" (that is, the value "1 week"), and the execution interval of the update confirmation when an undetectable virus is present is set to the value "1 hour". Set. It is assumed that the update confirmation execution interval when an undetectable virus is present is set to a value smaller than the setting value of the update interval at the normal time.

Then, when the management server 90 determines in step S15 (FIG. 13) that an undetectable virus (for example, virus V10) exists by any of the antivirus software 300, the management server 90 can detect the undetectable virus V10. The execution interval of the update confirmation of the pattern file in the impossible antivirus software 300 (302) is shortened. Specifically, the execution interval of the update confirmation of the pattern file in the antivirus software 302 (see FIG. 6) in which the virus V10 cannot be detected is set to the preset value "1" for the antivirus software 302. The value is changed to "1 hour", which is smaller than "week".

After the execution interval of the pattern file update confirmation in the antivirus software 302 is shortened, the management server 90 executes the update confirmation of the pattern file of the antivirus software 302 at the shortened time interval (1 hour interval). (Step S11 (FIG. 13)).

After that, when the pattern file of the antivirus software 302 is updated (see FIG. 14) and the antivirus software 302 can detect the virus V10, the process proceeds to step S51 (FIG. 13) through steps S12 to S15. Proceed with. Then, in step S15, the management server 90 transmits a withdrawal notification (notification to withdraw the proxy request transmission command) to the MFP 10c, which is an undetectable device related to the virus V10.

After receiving the withdrawal notification, the MFP 10c does not send a proxy request to another device (10d) when inputting / outputting a new file, as described above, and performs virus detection processing for the file in its own device 10c. (Using the antivirus software 302 in the own device 10c).

When it is determined that the antivirus software 302 can detect the virus V10, the management server 90 sets the value after shortening the execution interval of the pattern file update confirmation in the antivirus software 302. Return from "1 hour" to the value before shortening "1 week" (original value).

In this way, when an undetectable virus (for example, V10) is present in any of the antivirus software 300, the update confirmation of the pattern file in the antivirus software (302) that cannot detect the undetectable virus V10 is confirmed. The execution interval of is shortened.

According to this, when the latest pattern file (a pattern file in which the operation of the virus V10 is newly recorded) is started to be provided by the provider server of the antivirus software 302, the information processing system 1 The pattern file in the antivirus software 302 in is updated to the latest pattern file. As a result, the undetectable device related to the virus V10 (for example, MFP10c) becomes a detectable device related to the virus V10 earlier. As a result, the virus detection process in the MFP 10c is executed earlier (at an earlier stage) only in the MFP 10c without being executed in another device (MFP 10d). Therefore, it is possible to improve the efficiency of the virus detection process at an earlier stage.

<Modification example of the virus to be searched for in the process of determining the presence or absence of an undetectable virus>
Further, in each of the above embodiments, in the management server 90, all the viruses specified in the antivirus software management table 400 (FIG. 6 and the like) are subjected to the presence / absence determination process of the undetectable virus (step S15 (FIG. 8)). ), But is not limited to this. Specifically, some of the viruses specified in the antivirus software management table 400 may be determined as the virus to be searched.

Here, new viruses are emerging every day. However, there is a relatively high possibility that all antivirus software 300 can detect a virus for which a certain period of time has passed since its appearance due to pattern identification by the provider of each antivirus software 300 or the like. On the contrary, a virus for which a certain period or more has not passed since its appearance may not be detected by any of the antivirus software 300. That is, there is a possibility that there is a virus (undetectable virus) that cannot be detected by any antivirus software among relatively new types of viruses.

In consideration of this point, among a plurality of viruses specified in the antivirus software management table 400, from a predetermined time (for example, 6 months ago) at the present time (time of execution of the presence / absence determination process of undetectable virus). A virus that can be detected by any of the antivirus software 300 within a certain period up to the present time may be determined as a virus to be searched for in the presence / absence determination process (step S15) of the undetectable virus. In short, a relatively new type of virus (only) among the plurality of viruses specified in the antivirus software management table 401 (FIG. 6) may be determined as the virus to be searched.

Here, as shown in FIG. 6, a fixed period (in other words, the latest constant) from the time point (June 22, 2017) six months before the current time (here, December 22, 2017) to the present time (in other words, the latest fixed time). The viruses that can be detected by any of the antivirus software 300 within the period) are viruses V5 to V10. The management server 90 searches for the viruses V5 to V10 among the plurality of viruses V1 to V10 defined in the antivirus software management table 401 (FIG. 6) in the presence / absence determination process (step S15) of the undetectable virus. To determine as. Then, the management server 90 determines whether or not there is a virus that cannot be detected by any of the antivirus software 300 with respect to the virus to be searched (here, viruses V5 to V10) (step S15). ..

In this way, the existence / non-existence determination process for searching a part of the plurality of viruses (here, a relatively new type of virus) defined in the antivirus software management table 400 may be executed. .. In other words, the presence / absence determination process of the undetectable virus may be executed after the search target virus of the presence / absence determination process is narrowed down to some viruses (relatively new types of viruses). According to this, it is possible to improve the efficiency of the process of determining the presence or absence of an undetectable virus.

Here, among the plurality of viruses specified in the antivirus software management table 400 (401), the virus that can be detected by any of the antivirus software 300 within a predetermined period is detected. It is determined as a virus to be searched for in the process of determining the presence or absence of an unacceptable virus, but the virus is not limited to this.

For example, among a plurality of viruses specified in the antivirus software management table 400 (401 (FIG. 6)), the virus specified by the administrator is the presence / absence determination process of the undetectable virus (step S15 (FIG. 8)). It may be determined as a virus to be searched. Specifically, a list of viruses defined in the antivirus software management table 401 is displayed on the display screen (not shown) of the management server 90 (or the administrator's personal computer), and the list is displayed on the display screen. A virus designated by the administrator (for example, virus V10) may be determined as a search target virus in the presence / absence determination process of an undetectable virus.

<Others>
Further, in each of the above embodiments, the management server 90 manages a plurality of MFPs 10a to 10d (FIG. 1) and also manages a plurality of antivirus softwares 301 and 302, but the present invention is not limited to this. For example, an MFP 10 (MFP 10e (not shown)) different from the plurality of MFPs 10a to 10d may manage the plurality of MFPs 10a to 10d and may manage a plurality of antivirus softwares 301 and 302.

Further, in each of the above embodiments, the information processing system 1 is composed of the MFP 10 and the management server 90 (or only the MFP 10), but the present invention is not limited to this, and the personal computer is also a component of the information processing system 1. May be included in. Alternatively, the information processing system 1 may not be provided with the MFP 10, and the information processing system 1 may be composed of a personal computer and a management server 90 (or only a personal computer).

1 Information processing system 10,10a-10d MFP
90 Management server 300,301,302 Antivirus software 400 Antivirus software management table

Claims (19)

It is a management device that manages a plurality of information processing devices that make up an information processing system and also manages a plurality of antivirus software.
A detectable device that is an information processing device having antivirus software capable of detecting one computer virus among the plurality of antivirus software, and the one computer virus among the plurality of antivirus software. A specific means for identifying an undetectable device, which is an information processing device having antivirus software that cannot detect the virus, from the plurality of information processing devices, and
A communication control means for transmitting a proxy request transmission command to the undetectable device, and
With
The proxy request transmission command is a proxy request that is a request that a virus detection process for detecting at least one computer virus should be executed by the detectable device instead of the non-detectable device. A management device characterized in that it is a command to be transmitted to a virus. In the management device according to claim 1,
The communication control means transmits a preceding execution command and a conditional proxy request transmission command to the undetectable device, and transmits the preceding execution command and the conditional proxy request transmission command.
The advance execution command is a command to the effect that the virus detection process should be executed by the non-detectable device prior to the transmission of the proxy request to the detectable device.
The conditional proxy request transmission command indicates that the proxy request regarding the processing target file should be transmitted to the detectable device on condition that a computer virus is not detected from the processing target file of the virus detection processing in the undetectable device. A management device characterized by being a command of. In the management device according to claim 1 or 2.
The proxy request transmission command is a command to transmit the proxy request to the detectable device each time a file input / output process occurs in the non-detectable device.
When the communication control means can detect the one computer virus by the antivirus software in the undetectable device after transmitting the proxy request transmission command to the undetectable device. A management device comprising transmitting a notification to the non-detectable device to the effect that the proxy request transmission command is withdrawn. In the management device according to claim 3,
The antivirus software is used to set the update confirmation execution interval of the virus definition file used for virus detection processing by the antivirus software that cannot detect the one computer virus among the plurality of antivirus software. A setting control means for changing from a first value preset with respect to a second value smaller than the first value.
A management device characterized by further providing. In the management device according to any one of claims 1 to 4.
Based on the detectable virus information that defines the detectable virus in each antivirus software, a computer virus that cannot be detected by any one of the plurality of antivirus software is found. A determination means for executing an existence / absence determination process, which is a process for determining whether or not it exists.
With more
The specific means is a management device characterized in that the detectable device and the non-detectable device are specified from the plurality of information processing devices based on the determination result by the determination means. In the management device according to claim 5,
The determination means
A part of the computer viruses among the plurality of computer viruses specified in the detectable virus information is determined as the computer virus to be searched for in the presence / absence determination process.
A management device characterized by executing the presence / absence determination process for the computer virus to be searched. In the management device according to claim 6,
Among the plurality of computer viruses specified in the detectable virus information, some of the computer viruses may be used by any antivirus software within the period from the time before the current predetermined time to the present time. A management device characterized by being a computer virus that can be detected. In the management device according to claim 6,
A management device characterized in that some of the computer viruses are computer viruses specified by an administrator among the plurality of computer viruses specified in the detectable virus information. A computer built into a management device that manages multiple information processing devices that make up an information processing system and manages multiple antivirus software.
a) A detectable device that is an information processing device having antivirus software capable of detecting a computer virus of one of the plurality of antivirus software, and the one of the plurality of antivirus software. A step of identifying an undetectable device, which is an information processing device having antivirus software that cannot detect a computer virus, from the plurality of information processing devices, and
b) A step of transmitting a proxy request transmission command to the undetectable device, and
It is a program to execute
The proxy request transmission command is a proxy request that is a request that a virus detection process for detecting at least one computer virus should be executed by the detectable device instead of the non-detectable device. A program characterized in that it is a command to be sent to. In the program according to claim 9.
In step b), the preceding execution command and the conditional proxy request transmission command are transmitted to the undetectable device.
The advance execution command is a command to the effect that the virus detection process should be executed by the non-detectable device prior to the transmission of the proxy request to the detectable device.
The conditional proxy request transmission command indicates that the proxy request regarding the processing target file should be transmitted to the detectable device on condition that a computer virus is not detected from the processing target file of the virus detection processing in the undetectable device. A program characterized by being a command of. In the program according to claim 9 or 10.
The proxy request transmission command is a command to transmit the proxy request to the detectable device each time a file input / output process occurs in the non-detectable device.
The program
c) When the antivirus software in the undetectable device becomes able to detect the one computer virus after the step b), the undetectable device is opposed to the undetectable device. , The step of sending a notification to withdraw the proxy request transmission command,
A program characterized by causing the computer to further execute. In the program according to claim 11.
d) The antivirus countermeasure is set to the execution interval of the update confirmation of the virus definition file used for the virus detection process in the antivirus software that cannot detect the one computer virus among the plurality of antivirus software. A step of changing from a preset first value for software to a second value smaller than the first value.
A program characterized by causing the computer to further execute. In the program according to any one of claims 9 to 12.
The program
e) A computer that cannot be detected by any one of the plurality of antivirus software based on the detectable virus information that defines the detectable virus in each antivirus software. A step of executing a presence / absence judgment process, which is a process of determining whether or not a virus exists,
To the computer further
The program in step a) is characterized in that the detectable device and the undetectable device are identified from the plurality of information processing devices based on the determination result in step e). In the program according to claim 13.
In step e),
A part of the computer viruses among the plurality of computer viruses specified in the detectable virus information is determined as the computer virus to be searched for in the presence / absence determination process.
A program characterized in that the presence / absence determination process is executed for the computer virus to be searched. In the program of claim 14,
Among the plurality of computer viruses specified in the detectable virus information, some of the computer viruses may be used by any of the antivirus software within the period from the time before the current predetermined time to the present time. A program characterized by being a computer virus that can be detected. In the program of claim 14,
A program characterized in that some of the computer viruses are computer viruses specified by an administrator among the plurality of computer viruses specified in the detectable virus information. It is an information processing system
With multiple information processing devices
A management device that manages the plurality of information processing devices and also manages a plurality of antivirus software,
With
The management device is
A detectable device that is an information processing device having antivirus software capable of detecting one computer virus among the plurality of antivirus software, and the one computer virus among the plurality of antivirus software. A specific means for identifying an undetectable device, which is an information processing device having antivirus software that cannot detect the virus, from the plurality of information processing devices, and
A communication control means for transmitting a proxy request transmission command to the undetectable device, and
Have,
The proxy request transmission command is a proxy request that is a request that a virus detection process for detecting at least one computer virus should be executed by the detectable device instead of the non-detectable device. An information processing system characterized in that it is a command to be transmitted to a virus. In the information processing system according to claim 17,
The non-detectable device transmits the proxy request to the detectable device based on the proxy request transmission command from the management device.
In response to the proxy request from the undetectable device, the detectable device executes a virus detection process for detecting at least one computer virus by using antivirus software in the own device. An information processing system that features it. In the information processing system according to claim 18,
The communication control means transmits a preceding execution command and a conditional proxy request transmission command to the undetectable device, and transmits the preceding execution command and the conditional proxy request transmission command.
The advance execution command is a command to the effect that the virus detection process should be executed by the non-detectable device prior to the transmission of the proxy request to the detectable device.
The conditional proxy request transmission command indicates that the proxy request regarding the processing target file should be transmitted to the detectable device on condition that a computer virus is not detected from the processing target file of the virus detection processing in the undetectable device. Is a command of
The undetectable device is
Based on the advance execution command from the management device, the virus detection process for the file to be processed is executed by using the antivirus software in the own device prior to the transmission of the proxy request to the detectable device. ,
Based on the conditional proxy request transmission command from the management device, the proxy request for the process target file is detected on the condition that the computer virus is not detected from the process target file by the virus detection process in the own device. An information processing system characterized by transmitting to a possible device.

Images