Information processing system and information processing program

Abstract

To allow a request for name resolution of a host name to be made to an encrypted name resolution server even if a client application for encrypted name resolution is not implemented in an information processing system.SOLUTION: An information processing system includes a processor. When the processor receives a request for name resolution of a host name, the processor makes a request for name resolution of the host name to an encrypted name resolution client server that performs name resolution using encrypted communication with an encrypted name resolution server.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present invention relates to an information processing system and an information processing program. [Background technology]

[0002] Patent document 1 discloses a communications device capable of transmitting data to the outside via a plurality of different communications interfaces, the communications device having a first DNS client in which a DNS server accessible via a first communications interface is designated for name resolution, a second DNS client in which a DNS server accessible via a second communications interface is designated for name resolution, and a communications application for transmitting data to a destination designated by a host name, the communications application requesting name resolution of the host name from the first DNS client when transmitting data to the destination designated by the host name via the first communications interface, and requesting name resolution from the second DNS client when transmitting data via the second communications interface.

[0003] Patent document 2 also discloses a communication device having a setting means for setting whether or not to use encrypted communication for name resolution as an operational setting of the communication device, and a communication control means for controlling, when performing name resolution of a host name requested by an application, to request name resolution of the host name to a first DNS server via an encrypted communication path established with a first DNS server based at least on the setting means being set to use encrypted communication, and to request name resolution of the host name to a second DNS server in plain text based on the setting means being set to not use encrypted communication. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2020-167619 A [Patent Document 2] JP 2021-162778 A Summary of the Invention [Problem to be solved by the invention]

[0005] An object of the present disclosure is to enable a request for name resolution of a host name to be made to an encrypted name resolution server without the need to implement a client application for encrypted name resolution in an information processing system. [Means for solving the problem]

[0006] An information processing system according to a first aspect includes a processor, and when the processor receives a request for name resolution of a host name, the processor requests name resolution of the host name from an encrypted name resolution client server that performs name resolution using encrypted communication with an encrypted name resolution server.

[0007] An information processing system according to a second aspect is the information processing system according to claim 1, wherein the processor acquires a result of name resolution of the host name from the encrypted name resolution client server.

[0008] An information processing system according to a third aspect is an information processing system as described in claim 2, in which the processor requests the encrypted name resolution client server to perform name resolution of the host name without using DoH, and obtains the name resolution result of the host name from the encrypted name resolution client server.

[0009] An information processing system according to a fourth aspect is an information processing system as described in claim 1, wherein when the name resolution process of the host name using the encrypted communication is enabled, the processor requests the encrypted name resolution client server to perform name resolution of the host name, and when the name resolution process of the host name using the encrypted communication is disabled, the processor requests the name resolution server that performs name resolution without using encrypted communication to perform name resolution of the host name.

[0010] An information processing system according to a fifth aspect is an information processing system as described in claim 4, wherein, when the process of requesting name resolution to the encrypted name resolution client server is valid, the processor requests the encrypted name resolution client server to perform name resolution of the host name, and when the process of requesting name resolution to the encrypted name resolution client server is invalid, the processor requests the name resolution server to perform name resolution of the host name, or requests the encrypted name resolution server to perform name resolution of the host name using the encrypted communication.

[0011] An information processing system according to a sixth aspect is an information processing system as described in claim 1, wherein the processor requests the encrypted name resolution client server to perform name resolution of the host name if the version of a client application for encrypted name resolution implemented in the processor is older than the version of a client application for encrypted name resolution implemented in the encrypted name resolution client server.

[0012] An information processing system according to a seventh aspect is an information processing system according to any one of claims 1 to 6, wherein the processor performs an authentication request process to request authentication from the encrypted name resolution client server, and if the authentication request process is successful, requests the encrypted name resolution client server to perform name resolution of the host name.

[0013] An information processing program according to an eighth aspect causes a computer to execute a process in which, when a request for name resolution of a host name is received, the computer requests an encrypted name resolution client server that performs name resolution using encrypted communication with an encrypted name resolution server to resolve the host name.

[0014] An information processing system according to a ninth aspect includes a processor, and when the processor receives a request for name resolution of a host name from an information processing device, the processor requests an encrypted name resolution server to resolve the host name using encrypted communication, obtains a name resolution result for the host name from the encrypted name resolution server, and transmits the name resolution result for the host name to the information processing device.

[0015] An information processing system according to a tenth aspect is the information processing system described in claim 9, wherein the processor receives a request for name resolution of the host name for which DoH is not used from the information processing device, and requests name resolution of the host name to the encrypted name resolution server using DoH for the encrypted communication.

[0016] An information processing program according to an eleventh aspect causes a computer to execute a process in which, when a request for name resolution of a host name is received from an information processing device, the computer uses encrypted communication to request name resolution of the host name to an encrypted name resolution server, obtains a result of name resolution of the host name from the encrypted name resolution server, and transmits the result of name resolution of the host name to the information processing device. Effect of the Invention

[0017] According to the first aspect, it is possible to request the encrypted name resolution server to perform name resolution of a host name, even if a client application for encrypted name resolution is not installed in the information processing system.

[0018] According to the second aspect, it is possible to obtain the name resolution result of the host name from the encrypted name resolution server without implementing a client application for encrypted name resolution in the information processing system.

[0019] According to the third aspect, it is possible to request name resolution of a host name from an encrypted name resolution server and obtain the name resolution result of the host name from the encrypted name resolution server without implementing a client application for DoH in an information processing system.

[0020] According to the fourth aspect, even if the host name resolution process using encrypted communication is disabled, the host name can be resolved.

[0021] According to the fifth aspect, even if the process of requesting name resolution to the encrypted name resolution client server is invalid, it is possible to request the name resolution server to perform name resolution of the host name.

[0022] According to the sixth aspect, it is possible to use a new version of a client application for encrypted name resolution implemented in an encrypted name resolution client server without upgrading the client application for encrypted name resolution implemented in one's own device.

[0023] According to the seventh aspect, it is possible to suppress unauthorized use of the encrypted name resolution client server, as compared with a case in which the encrypted name resolution client server is constantly in use.

[0024] According to the eighth aspect, it is possible to request the encrypted name resolution server to perform name resolution of a host name, even if a client application for encrypted name resolution is not implemented in the information processing system.

[0025] According to the ninth aspect, it is possible to request the encrypted name resolution server to perform name resolution of a host name on behalf of the information processing device by using encrypted communication.

[0026] According to the tenth aspect, it is possible to request the encrypted name resolution server to perform name resolution of a host name on behalf of an information processing device by using DoH.

[0027] According to the eleventh aspect, it is possible to request the encrypted name resolution server to perform name resolution of a host name on behalf of the information processing device by using encrypted communication. [Brief description of the drawings]

[0028] [Figure 1] 1 is a diagram showing a schematic configuration of an image forming system according to an embodiment of the present invention; [Diagram 2] FIG. 2 is a block diagram showing a hardware configuration of the image forming apparatus shown in FIG. [Diagram 3]A block diagram showing the hardware configuration of the external DoH client server shown in Figure 1. [Figure 4] A block diagram showing the hardware configurations of the internal file server, internal DNS server, external file server, external DNS server, and external DoH server shown in Figure 1. [Diagram 5] 2 is a flowchart showing a flow of a name resolution request process of the image forming apparatus shown in FIG. 1. [Figure 6] 2 is a flowchart showing the flow of authentication processing of the external DoH client server shown in FIG. 1. [Figure 7] 2 is a flowchart showing the flow of encrypted name resolution of the external DoH client server shown in FIG. 1. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0029] Hereinafter, an embodiment will be described with reference to the drawings. In each drawing, the same or equivalent components and parts are given the same reference numerals. In addition, the dimensional ratios of the drawings are exaggerated for the convenience of explanation and may differ from the actual ratios.

[0030] (Overview of image forming systems) 1 shows an image forming system 10 according to the present embodiment. The image forming system 10 includes an image forming device 20, an internal file server 22, an internal DNS server 24, an external file server 30, an external DNS server 32, an external DoH server 34, and an external DoH client server 40.

[0031] The image forming device 20, the internal file server 22, and the internal DNS server 24 are connected to, for example, an internal network 12. The internal network 12 is a network (local area network) operated and managed by a specific company, organization, etc. In addition, an external file server 30, an external DNS server 32, an external DoH server 34, and an external DoH client server 40 are connected to the internal network 12 via an external network 14 such as the Internet.

[0032] The image forming device 20 is an example of an information processing device and an information processing system. The internal DNS server 24 is an example of an internal name resolution server, and the external DNS server 32 is an example of an external name resolution server. The external DoH server 34 is an example of an external encrypted name resolution server, and the external DoH client server 40 is an example of an external encrypted name resolution client server and an information processing system. Here, the "system" in this embodiment is a concept that includes both a system composed of multiple devices and a system composed of a single device.

[0033] 1 shows, as an example, one each of the image forming device 20, the internal file server 22, the internal DNS server 24, the external file server 30, the external DNS server 32, the external DoH server 34, and the external DoH client server 40. However, there may be a plurality of each of the image forming device 20, the internal file server 22, the internal DNS server 24, the external file server 30, the external DNS server 32, the external DoH server 34, and the external DoH client server 40.

[0034] (Image forming device) As an example, the image forming device 20 is a printing device on the internal network 12 that has an image printing function of acquiring image data from the internal file server 22 or the external file server 30 and printing the acquired image data on a recording medium such as paper. The image forming device 20 may be a multifunction machine that has at least one of a plurality of functions, such as an image reading (scanning) function, an image copying (copying) function, and an image transmission (fax) function, in addition to the image printing function described above.

[0035] (Internal file server) The internal file server 22 is a file server on the internal network 12 that stores image data, etc. This internal file server 22 is capable of transmitting and receiving various data, such as image data, to and from the image forming apparatus 20 via the internal network 12.

[0036] (internal DNS server) The internal DNS server 24 is a DNS (Domain Name System) server on the internal network 12 that performs name resolution of host names. For example, in response to a request from the image forming apparatus 20, the internal DNS server 24 performs name resolution of host names on the internal network 12, and transmits address information (IP address) corresponding to the host name to the image forming apparatus 20 as the name resolution result of the host name.

[0037] In addition, in response to a request from the image forming device 20, the internal DNS server 24 may request name resolution of the host name to an external DNS server 32 described later, and transmit the name resolution result of the host name received from the external DNS server 32 to the image forming device 20.

[0038] (External file server) The external file server 30 is a file server on the external network 14 that stores image data, etc. This external file server 30 is capable of transmitting and receiving various data to and from the image forming apparatus 20 via the external network 14 and the internal network 12.

[0039] For ease of explanation, the internal file server 22 and the external file server 30 will be collectively referred to as a file server FS below.

[0040] (External DNS Server) The external DNS server 32 is a DNS server on the external network 14 that performs name resolution of host names. The external DNS server 32 is, for example, a public DNS server. For example, in response to a request from the image forming apparatus 20 or the internal DNS server 24, the external DNS server 32 performs name resolution of host names on the external network 14 and transmits the name resolution result of the host name to the image forming apparatus 20 or the internal DNS server 24.

[0041] (External DoH server) The external DoH server 34 is a DoH server on the external network 14 that performs name resolution of host names using DoH (DNS over HTTPS) as encrypted communication. This external DoH server 34 is, for example, a public DoH server.

[0042] For example, in response to a request from the image forming device 20 or the external DoH client server 40, the external DoH server 34 performs name resolution of a host name on the external network 14 and transmits the name resolution result of the host name to the image forming device 20 or the external DoH client server 40. At this time, the external DoH server 34 uses encrypted communication by DoH between the image forming device 20 or the external DoH client server 40, or between the external DoH server and the image forming device 20 or the external DoH client server 40, or between the external DoH server and another DoH server.

[0043] (External DoH client server) The external DoH client server 40 is a DoH client server on the external network 14 that provides a DoH client service for using the external DoH server 34. This external DoH client server 40 is, for example, a cloud server.

[0044] For example, in response to a request from the image forming device 20, the external DoH client server 40 requests the external DoH server 34 to resolve the host name using encrypted communication, and transmits the result of the name resolution of the host name received from the external DoH server 34 to the image forming device 20. At this time, the external DoH client server 40 uses encrypted communication by DoH with the external DoH client server 40.

[0045] The external DoH client server 40 also has an authentication function for authenticating an account of the DoH client service described above. Specifically, the external DoH client server 40 accepts, for example, account authentication information from the image forming device 20. If the account authentication information accepted from the image forming device 20 matches the authentication information of a preregistered account, the external DoH client server 40 considers the authentication to be successful and transmits a message to that effect, an access token, etc. to the image forming device 20.

[0046] On the other hand, if the authentication information of the received account does not match the authentication information of the pre-registered account, the external DoH client server 40 determines that the authentication has failed and notifies the image forming apparatus 20 to that effect.

[0047] (Hardware configuration of image forming device) Next, the hardware configuration of the image forming apparatus 20 will be described.

[0048] 2, the image forming apparatus 20 has a CPU (Central Processing Unit) 50, a ROM (Read Only Memory) 52, a RAM (Random Access Memory) 54, a storage 56, an input unit 58, a display unit 60, a communication interface (I / F) 62, an image reading unit 64, and an image forming unit 66. Each component is connected to each other via a bus 68 so as to be able to communicate with each other.

[0049] The CPU 50 is a central processing unit that executes various programs and controls each part. That is, the CPU 50 reads a program from the ROM 52 or the storage 56, and executes the program using the RAM 54 as a working area. The CPU 50 controls each of the above components and performs various arithmetic processing according to the program recorded in the ROM 52 or the storage 56. The CPU 50 is an example of a processor.

[0050] The ROM 52 stores various information processing programs and various data. The RAM 54 temporarily stores programs or data as a working area for the CPU 50. The RAM 54 also functions as a cache that stores the access token received from the external DoH client server 40 and the expiration date of the access token. The RAM 54 is an example of a storage unit.

[0051] The storage 56 is configured with a hard disk drive (HDD) or a solid state drive (SSD), and stores various programs including an operating system, and various data.

[0052] Storage 56 stores a Web (World Wide Web) browser application, a DNS client application, and a DoH client application, as well as configuration information for these Web browser application, DNS client application, and DoH client application.

[0053] The storage 56 stores, as setting information of the image forming device 20, information indicating whether or not the host name resolution process by DoH (DoH function) is enabled, and information indicating whether or not the request process for name resolution to the external DoH client server 40 is enabled (information indicating whether or not the external DoH client server 40 is available). The setting information of the image forming device 20 is appropriately set, for example, by an administrator or a user of the image forming device 20.

[0054] A name resolution program that performs name resolution of the host name of the file server FS when accessing the file server FS is stored in the ROM 52 or the storage 56. The name resolution program is an example of an information processing program.

[0055] The input unit 58 includes a pointing device such as a mouse and a keyboard, and is used to perform various input operations. The display unit 60 is, for example, a liquid crystal display, and displays various types of information. The display unit 60 may function as the input unit 58 by adopting a touch panel system.

[0056] The communication I / F 34 is an interface for communicating with other devices, and uses standards such as Ethernet (registered trademark), FDDI, and Wi-Fi (registered trademark).

[0057] The image reading unit 64 optically reads image data from an original document, etc. The image forming unit 66 prints the image data read by the image reading unit 64 or the image data acquired from the file server FS onto a recording medium such as paper.

[0058] (Hardware configuration of external DoH client server) Next, the hardware configuration of the external DoH client server 40 will be described.

[0059] 3, the external DoH client server 40 includes a CPU 70, a ROM 72, a RAM 74, a storage 76, and a communication I / F 78. Each component is connected to each other via a bus 80 so as to be able to communicate with each other.

[0060] The CPU 70 is a central processing unit, and executes various programs and controls each part. That is, the CPU 70 reads a program from the ROM 72 or the storage 76, and executes the program using the RAM 74 as a working area. The CPU 70 controls each of the above components and performs various arithmetic processing according to the program recorded in the ROM 72 or the storage 76. The CPU 70 is an example of a processor.

[0061] In addition, the ROM 72 or the storage 76 of the present embodiment stores a name resolution request program that requests the external DoH server 34 to resolve a host name using encrypted communication (DoH) based on a request from the image forming apparatus 20. The encrypted name resolution request program is an example of an information processing program.

[0062] The ROM 72 stores various information processing programs and various data. The RAM 74 temporarily stores programs or data as a working area for the CPU 70. The RAM 74 also functions as a DNS cache that stores the name resolution result received from the external DoH server 34. The RAM 74 is an example of a storage unit.

[0063] The storage 76 is configured with an HDD or SSD, and stores various programs including an operating system and various data. The storage 76 also stores a DoH client application and setting information for the DoH client application.

[0064] An authentication information database is stored in the storage 76. The authentication information database is a database in which authentication information of an account for using the external DoH client server 40 is registered. In this authentication information database, authentication information including, for example, an ID for identifying an account and a password, etc., is stored in association with each account.

[0065] An access token management database is stored in the storage 76. The access token management database is a database that manages access tokens issued to accounts that have been successfully authenticated. In this access token management database, the ID, access token, and expiration date of the access token of each successfully authenticated account are stored in association with each account.

[0066] An access restriction database is stored in the storage 76. The access restriction database is a database that manages access restrictions for host names. In this access restriction database, host names and the like to which access is restricted are stored in association with each account.

[0067] The communication I / F 78 is an interface for communicating with other devices, and uses standards such as Ethernet (registered trademark), FDDI, and Wi-Fi (registered trademark).

[0068] (Other server hardware configurations) Next, the hardware configurations of the internal file server 22, the internal DNS server 24, the external file server 30, the external DNS server 32, and the external DoH server 34 will be described.

[0069] The internal file server 22, the internal DNS server 24, the external file server 30, the external DNS server 32, and the external DoH server 34 are configured by general computers or server devices. Therefore, in the following, the hardware configuration of the internal file server 22 will be described, and the description of the hardware configuration of the external file server 30, the external DNS server 32, and the external DoH server 34 will be omitted as appropriate.

[0070] 4, the internal file server 22 includes a CPU 90, a ROM 92, a RAM 94, a storage 96, and a communication I / F 98. Each component is connected via a bus 100 so as to be able to communicate with each other.

[0071] The CPU 90 is a central processing unit, and executes various programs and controls each part. That is, the CPU 90 reads a program from the ROM 92 or the storage 96, and executes the program using the RAM 94 as a working area. The CPU 90 controls each of the above components and performs various arithmetic processing according to the program recorded in the ROM 92 or the storage 96. In this embodiment, a cloud program is stored in the ROM 92 or the storage 96. The CPU 90 is an example of a processor.

[0072] The ROM 92 stores various programs and various data. The RAM 94 temporarily stores programs or data as a working area. The RAM 94 is an example of a storage unit. The storage 96 is configured with an HDD or SSD, and stores various programs including an operating system and various data. A setting database is also stored.

[0073] A print image database is stored in the storage 96 of the internal file server 22 and the external file server 30. The print image database is a database that stores image data to be printed by the image forming device 20. In this print image database, for example, an account ID and image data, etc. are stored in association with each account.

[0074] The communication I / F 98 is an interface for communicating with other devices, and uses standards such as Ethernet (registered trademark), FDDI, and Wi-Fi (registered trademark).

[0075] (Name resolution request processing) Next, a process of requesting name resolution of a host name by the image forming apparatus 20 will be described.

[0076] For example, when a user operates a Web browser application implemented in the image forming apparatus 20 and selects a file server FS, a name resolution request process shown in Fig. 5 is executed in the image forming apparatus 20 in response to a request from the Web browser application. Note that the name resolution request process is an example of a name resolution request method.

[0077] First, in step S10, the CPU 50 determines whether or not the domain of the host name of the file server FS selected by the user (hereinafter referred to as the "destination host name") matches the domain set in the image forming apparatus 20. Then, if the CPU 50 determines that the destination host name matches the domain set in the image forming apparatus 20, the process proceeds to step S12.

[0078] In step S12, the CPU 50 requests the internal DNS server 24 to perform name resolution of the destination host name using a DNS client application implemented in the image forming apparatus 20, and proceeds to step S32, which will be described later. The DNS client application requests the internal DNS server 24 to perform name resolution of the destination host name in plain text, without using encrypted communication.

[0079] On the other hand, if the CPU 50 determines in step S10 that the destination host name does not match the domain set in the image forming apparatus 20, the process proceeds to step S14.

[0080] In step S14, the CPU 50 determines whether or not the DoH function set in the image forming apparatus 20 is enabled. Specifically, the CPU 50 refers to the setting information of the image forming apparatus 20 and determines whether or not the name resolution process of the destination host name by DoH is enabled. If the CPU 50 determines that the DoH function set in the image forming apparatus 20 is disabled, the CPU 50 proceeds to step S12 and, as described above, requests the internal DNS server 24 to resolve the destination host name using the DNS client application implemented in the image forming apparatus 20.

[0081] On the other hand, if the CPU 50 determines in step S14 that the DoH function set in the image forming apparatus 20 is enabled, the process proceeds to step S16.

[0082] In step S16, the CPU 50 determines whether the external DoH client server 40 is available. Specifically, the CPU 50 refers to the setting information of the image forming device 20 and determines whether the request process for name resolution to the external DoH client server 40 is valid. If the CPU 50 determines that the external DoH client server 40 is unavailable, the process proceeds to step S18.

[0083] In step S18, the CPU 50 uses the DoH client application implemented in the image forming device 20 to request the external DoH server 34 to perform encrypted name resolution of the destination host name, and proceeds to step S32, which will be described later. The DoH client application uses DoH for encrypted communication to request the external DoH server 34 to perform name resolution of the destination host name.

[0084] In addition, if the DoH client application implemented in the image forming device 20 is unavailable, or if the DoH client application is not implemented in the image forming device 20, the CPU 50 sends a message to that effect to the Web browser application and terminates the processing.

[0085] On the other hand, if the CPU 50 determines in step S16 that the external DoH client server 40 is available, the process proceeds to step S20.

[0086] In step S20, the CPU 50 determines whether or not an access token indicating successful authentication of an account for using the external DoH client server 40 has been registered in the cache. If the CPU 50 determines that the access token has been registered in the cache, the process proceeds to step S30, which will be described later.

[0087] On the other hand, if the CPU 50 determines in step S20 that the access token is not registered in the cache, the process proceeds to step S22.

[0088] In step S22, the CPU 50 performs an authentication request process to request authentication from the external DoH client server 40. Specifically, the CPU 50 transmits to the external DoH client server 40 authentication information such as an account ID and password.

[0089] At this time, the CPU 50 may, for example, display an authentication information input screen on the display unit 60 of the image forming device 20, and transmit the account authentication information input by the user to the external DoH client server 40. In addition, the CPU 50 may, for example, transmit the account authentication information input by the user to the external DoH client server 40 when authenticating the account for the image forming device 20.

[0090] Note that an account may be created for each image forming device 20, rather than for each user who uses the image forming device 20. When an account is created for each image forming device 20, the CPU 50 may transmit authentication information, such as the account ID and password, entered by the user to the external DoH client server 40, for example, when the image forming device 20 is started.

[0091] Next, in step S24, the CPU 50 determines whether the authentication result received from the external DoH client server 40 is successful or not. Then, if the CPU 50 determines that the authentication result is failure, it proceeds to step S26.

[0092] In step S26, the CPU 50 performs authentication error processing. That is, the CPU 50 transmits a message to the Web browser application indicating that authentication of the external DoH client server 40 has failed, and ends the processing.

[0093] On the other hand, if the CPU 50 determines in step S24 that the authentication result received from the external DoH client server 40 is successful, the CPU 50 proceeds to step S28. If the authentication of the external DoH client server 40 is successful, as described below, the CPU 50 receives an access token and the expiration date of the access token from the external DoH client server 40.

[0094] In step S28, the CPU 50 registers the access token received from the external DoH client server 40 and the expiration date of the access token in a cache (access token cache).

[0095] Next, in step S30, the CPU 50 requests the external DoH client server 40 to resolve the destination host name. At this time, the CPU 50 requests the external DoH client server 40 to resolve the destination host name using, for example, HTTP or HTTPS without using DoH. The CPU 50 also transmits an access token to the external DoH client server 40 as authentication information.

[0096] The CPU 50 may request the external DoH client server 40 to perform name resolution of the destination host name using address information (IP address) of the external DoH client server 40 that is preset in the image forming device 20. The CPU 50 may also request the external DoH client server 40 to perform name resolution of the destination host name using the host name (URL) of the external DoH client server 40. In this case, the CPU 50 first uses a DNS client application or DoH client application implemented in the image forming device 20 to request the external DNS server 32 or the external DoH server 34 to perform name resolution of the destination host name for the external DoH client server 40.

[0097] Next, in step S32, the CPU 50 transmits the name resolution result of the destination host name received from the internal DNS server 24, the external DoH server 34, or the external DoH client server 40 to the Web browser application, and ends the process.

[0098] Thereafter, when the Web browser application receives address information (IP address) corresponding to the destination host name from the CPU 50 as the name resolution result, it accesses the file server FS using the address information. On the other hand, when the Web browser application receives from the CPU 50 as the name resolution result that the name resolution has failed, it displays that fact on the Web browser and ends the process.

[0099] If authentication is required when accessing the file server FS, the CPU 50 may use the access token issued when authenticating the external DoH client server 40. In this case, for example, when requesting authentication from the external DoH client server 40, the CPU 50 also requests authentication from the file server FS.

[0100] (Authentication process) Next, the authentication process by the external DoH client server 40 will be described.

[0101] When the external DoH client server 40 accepts an account authentication request from the image forming device 20, the authentication process shown in Fig. 6 is executed in the external DoH client server 40. Note that the authentication process is an example of an authentication method.

[0102] First, in step S40, the CPU 70 determines whether or not the authentication information of the account received from the image forming device 20 matches the authentication information of the account held, i.e., the authentication information of the account registered in advance in the authentication information database. If the CPU 70 determines that the authentication information of the account received from the image forming device 20 matches the authentication information of the account held, the CPU 70 proceeds to step S42.

[0103] In step S42, the CPU 70 issues an access token to the account. Specifically, the CPU 70 issues an access token to the account using a predetermined access token issuing protocol. Then, the CPU 70 registers the issued access token and the expiration date of the access token in an access token management database in association with the account, and transmits the access token to the image forming apparatus 20, and ends the process. Note that the access token issuing protocol may be, for example, OAuth2.0, but is not limited thereto.

[0104] On the other hand, if the CPU 70 determines in step S40 that the authentication information of the account received from the image forming apparatus 20 does not match the authentication information of the account held by the user, the process proceeds to step S44. In step S44, the CPU 70 performs an authentication error process. That is, the CPU 70 transmits a message to the image forming apparatus 20 indicating that the authentication has failed, and ends the process.

[0105] (Cryptographic name resolution process) Next, the encrypted name resolution process of the host name by the external DoH client server 40 will be described.

[0106] When the external DoH client server 40 accepts a name resolution request from the image forming device 20, the encrypted name resolution process shown in Fig. 7 is executed in the external DoH client server 40. Note that the encrypted name resolution process is an example of an encrypted name resolution method.

[0107] First, in step S60, the CPU 70 determines whether the account that has received the name resolution request has been authenticated. Specifically, the CPU 70 determines whether the access token included in the name resolution request received from the image forming apparatus 20 has been registered in the access token management database and is within the validity period. If the access token included in the name resolution request received from the image forming apparatus 20 has not been registered in the access token management database or has expired, the CPU 70 proceeds to step S62.

[0108] In step S62, the CPU 70 performs an authentication error process, that is, the CPU 70 transmits a message to the image forming apparatus 20 indicating that the authentication has failed, and ends the process.

[0109] On the other hand, in step S60, if the access token included in the name resolution request received from the image forming apparatus 20 has been registered in the access token management database and is within the validity period, the CPU 70 proceeds to step S64.

[0110] In step S64, the CPU 70 determines whether or not the destination host name for which the request was accepted has access restrictions. That is, the CPU 70 determines whether or not the destination host name for which the request was accepted has already been registered in the access restriction database. If the CPU 70 determines that the destination host name for which the request was accepted has already been registered in the access restriction database, the CPU 70 proceeds to step S66.

[0111] In step S66, the CPU 70 performs an access restriction error process, that is, the CPU 70 transmits to the image forming apparatus 20 a message indicating that there is an access restriction on the destination host name, and ends the process.

[0112] On the other hand, if the CPU 70 determines in step S64 that the destination host name for which the request has been accepted is not registered in the access restriction database, the process proceeds to step S68.

[0113] In step S68, the CPU 70 judges whether the destination host name for which the request was accepted has been registered in the DNS cache. If the CPU 70 judges that the destination host name for which the request was accepted has been registered in the DNS cache, the CPU 70 proceeds to step S78, which will be described later. On the other hand, if the CPU 70 judges that the destination host name for which the request was accepted has not been registered in the DNS cache, the CPU 70 proceeds to step S70.

[0114] In step S70, the CPU 70 uses a DoH client application implemented in the own device (external DoH client server 40) to request the external DoH server 34 to perform encrypted name resolution of the destination host name. The DoH client application uses DoH for encrypted communication to request the external DoH server 34 to perform encrypted name resolution of the destination host name.

[0115] Next, in step S72, the CPU 70 determines whether the name resolution result of the destination host name received from the external DoH server 34 is successful or not. If the CPU 70 determines that the name resolution result of the destination host name received from the external DoH server 34 is unsuccessful, the CPU 70 proceeds to step S74.

[0116] In step S74, the CPU 70 performs a name resolution error process, that is, the CPU 70 transmits a message to the image forming apparatus 20 indicating that the name resolution has failed, and ends the process.

[0117] On the other hand, in step S72, if the CPU 70 determines that the name resolution result of the destination host name received from the external DoH server 34 is successful, the process proceeds to step S76.

[0118] In step S76, the CPU 70 registers the address information (IP address) that is the result of name resolution of the destination host name in the DNS cache.

[0119] Next, in step S78, the CPU 70 transmits address information, which is the result of name resolution of the destination host name, to the image forming apparatus 20, and ends the process.

[0120] (Modification) Next, a modification of the above embodiment will be described.

[0121] In the above embodiment, when there are multiple image forming devices 20, for example, the multiple image forming devices 20 may be divided into multiple groups by organization or tenant (store) unit, and a representative account (group account) for using the external DoH client server 40 may be created for each group. In this case, the external DoH client server 40 may manage access restrictions for destination host names for each representative account. Specifically, an access restriction database may be created for each representative account. In addition, the external DoH client server 40 may manage DNS cache information for each representative account. Specifically, the external DoH client server 40 may create a DNS cache for each representative account.

[0122] 5, the CPU 50 requests the internal DNS server 24 to resolve the destination host name. If the CPU 50 subsequently receives a message from the internal DNS server 24 indicating that the name resolution of the destination host name has failed as a name resolution result, the CPU 50 may request, for example, the external DoH server 34 or the external DoH client server 40 to resolve the destination host name.

[0123] In addition, the CPU 50 may compare the version of the DoH client application implemented in the image forming device 20 with the version of the DoH client application implemented in the external DoH client server 40, and if the version of the DoH client application implemented in the image forming device 20 is older than the version of the DoH client application implemented in the external DoH client server 40, request name resolution of the destination host name from the external DoH client server 40.

[0124] Also, in the above embodiment, the account authentication process is performed in the external DoH client server 40. However, the account authentication process is not limited to being performed in the external DoH client server 40, and may be performed in another server or the like.

[0125] In the above embodiment, DoH is used as the encrypted name resolution for performing name resolution of a host name using encrypted communication. However, the encrypted name resolution is not limited to DoH (HTTPS), and other encrypted communication may be used.

[0126] In the above embodiment, the information processing system is the image forming apparatus 20. However, the information processing system is not limited to the image forming apparatus 20, and may be, for example, an information processing terminal such as a personal computer or a smartphone.

[0127] In addition, in the above embodiment, the processor refers to a processor in a broad sense, and includes general-purpose processors (e.g., CPU: Central Processing Unit, etc.) and dedicated processors (e.g., GPU: Graphics Processing Unit, ASIC: Application Specific Integrated Circuit, FPGA: Field Programmable Gate Array, programmable logic device, etc.).

[0128] In addition, the operations of the processor in the above embodiment may be performed not only by one processor but also by multiple processors located at physically separate locations working together. The order of the operations of the processor is not limited to the order described in the above embodiment, and may be changed as appropriate.

[0129] In the above embodiment, the programs are installed in a ROM or storage, but the present invention is not limited to this. The programs according to the above embodiment may be provided in a form recorded on a computer-readable storage medium. For example, the programs according to the above embodiment may be provided in a form recorded on an optical disc such as a CD (Compact Disc)-ROM or a DVD (Digital Versatile Disc)-ROM, or in a form recorded on a semiconductor memory such as a USB (Universal Serial Bus) memory or a memory card. The programs according to the above embodiment may be obtained from an external device via a communication I / F.

[0130] In the above embodiment, the processing in the image forming device 20 and the external DoH client server 40 is realized by a software configuration using a computer by executing a program, but the present disclosure is not limited to this. For example, the processing in the image forming device 20 and the external DoH client server 40 may be realized by a hardware configuration or a combination of a hardware configuration and a software configuration.

[0131] In addition, the configurations of the image forming device 20 and the external DoH client server 40 described in the above embodiment are merely examples, and it goes without saying that unnecessary parts may be deleted or new parts may be added within the scope of the present disclosure.

[0132] Furthermore, the processing flow in the image forming device 20 and the external DoH client server 40 described in the above embodiment is also an example, and it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged within the scope of the gist of this disclosure.

[0133] The following supplementary notes are further disclosed regarding the above embodiment.

[0134] (((1))) A processor is provided. The processor, When a request for name resolution of a host name is received, the host name is requested to be resolved by an encryption name resolution client server that performs name resolution using encrypted communication with an encryption name resolution server. Information processing system. (((2))) The processor, obtaining a name resolution result for the host name from the encrypted name resolution client server; An information processing system according to (((1))). (((3))) The processor, requesting the encryption name resolution client server to perform name resolution of the host name without using DoH, and obtaining a result of the name resolution of the host name from the encryption name resolution client server; The information processing system according to (((2))). (((4))) The processor, If the host name resolution process using the encrypted communication is enabled, a request is made to the encrypted name resolution client server to resolve the host name; when the name resolution process of the host name by the encrypted communication is invalid, a name resolution server that performs name resolution without using the encrypted communication is requested to resolve the host name; 13. An information processing system according to any one of ((1))) to (((3))). (((5))) The processor, If the process of requesting name resolution to the encryption name resolution client server is valid, a request is made to the encryption name resolution client server to perform name resolution of the host name; When the process of requesting name resolution to the encrypted name resolution client server is invalid, the name resolution server is requested to perform name resolution of the host name, or the encrypted name resolution server is requested to perform name resolution of the host name using the encrypted communication. The information processing system according to (((4))). (((6))) The processor, When a version of a client application for encrypted name resolution implemented in the own device is older than a version of a client application for encrypted name resolution implemented in the encrypted name resolution client server, the encryption name resolution client server is requested to perform name resolution of the host name. 13. The information processing system according to claim 12, wherein the first and second information processing systems are connected to a first and second input terminal. (((7))) The processor, performing an authentication request process for requesting authentication from the encrypted name resolution client server; If the authentication request process is successful, a request is made to the encrypted name resolution client server to perform name resolution of the host name. 13. An information processing system according to any one of ((1))) to (((6))). (((8))) On the computer, When a request for name resolution of a host name is received, the host name is requested to be resolved by an encryption name resolution client server that performs name resolution using encrypted communication with an encryption name resolution server. An information processing program for executing processing. (((9))) A processor is provided. The processor, When a request for name resolution of a host name is received from an information processing device, the method requests an encrypted name resolution server to resolve the host name using encrypted communication; obtaining a name resolution result for the host name from the encrypted name resolution server; transmitting a name resolution result of the host name to the information processing device; Information processing system. (((10))) The processor, receiving a request for name resolution of the host name for which DoH is not used from the information processing device; Requesting the encrypted name resolution server to resolve the host name using DoH as the encrypted communication; The information processing system according to (((9))). (((11))) On the computer, When a request for name resolution of a host name is received from an information processing device, the method requests an encrypted name resolution server to resolve the host name using encrypted communication; obtaining a name resolution result for the host name from the encrypted name resolution server; transmitting a name resolution result of the host name to the information processing device; An information processing program for executing processing.

[0135] According to (((1))), it is possible to request a cryptographic name resolution server to resolve a host name, even if a client application for cryptographic name resolution is not implemented in an information processing system. According to (((2))), it is possible to obtain the result of name resolution of a host name from a cryptographic name resolution server without implementing a client application for cryptographic name resolution in an information processing system. According to (((3))), even if a client application for DoH is not implemented in an information processing system, it is possible to request a host name resolution from an encrypted name resolution server and to obtain the host name resolution result from the encrypted name resolution server. According to (((4))), even if host name resolution processing using encrypted communication is disabled, host name resolution can be performed. According to (((5))), even if the process of requesting name resolution to an encrypted name resolution client server is invalid, it is possible to request the name resolution server to resolve a host name. According to (((6))), a new version of a client application for encrypted name resolution implemented in an encrypted name resolution client server can be used without upgrading the version of the client application for encrypted name resolution implemented in the device itself. According to (((7))), it is possible to suppress unauthorized use of the encrypted name resolution client server, compared to a case where the encrypted name resolution client server is always available. According to (((8))), it is possible to request a cryptographic name resolution server to resolve a host name, even if a client application for cryptographic name resolution is not implemented in an information processing system. According to (((9))), it is possible to request the encrypted name resolution server to perform name resolution of a host name on behalf of an information processing device by using encrypted communication. According to (((10))), it is possible to use DoH to request name resolution of a host name to an encrypted name resolution server on behalf of an information processing device. According to (((11))), it is possible to request an encrypted name resolution server to perform name resolution of a host name on behalf of an information processing device using encrypted communication. [Explanation of symbols]

[0136] 20 Image forming apparatus (information processing system, information processing apparatus) 34 DoH Server (Encrypted Name Resolution Server, Information Processing System) 40 DoH client server (encrypted name resolution client server, information processing system) 50 CPU (processor) 90 CPU (processor)

Claims

1. A processor is provided. The processor, When a request for name resolution of a host name is received, the host name is requested to be resolved by an encryption name resolution client server that performs name resolution using encrypted communication with an encryption name resolution server. Information processing system.

2. The processor, obtaining a name resolution result for the host name from the encrypted name resolution client server; The information processing system according to claim 1 .

3. The processor, requesting the encrypted name resolution client server to perform name resolution of the host name without using DoH, and obtaining a result of the name resolution of the host name from the encrypted name resolution client server; The information processing system according to claim 2 .

4. The processor, If the host name resolution process using the encrypted communication is enabled, a request is made to the encrypted name resolution client server to resolve the host name; when the name resolution process of the host name by the encrypted communication is invalid, a name resolution server that performs name resolution without using the encrypted communication is requested to resolve the host name; The information processing system according to claim 1 .

5. The processor, If the process of requesting name resolution to the encryption name resolution client server is valid, a request is made to the encryption name resolution client server to perform name resolution of the host name; When the process of requesting name resolution to the encrypted name resolution client server is invalid, the name resolution server is requested to perform name resolution of the host name, or the encrypted name resolution server is requested to perform name resolution of the host name using the encrypted communication.

5. The information processing system according to claim 4.

6. The processor, When a version of a client application for encrypted name resolution implemented in the own device is older than a version of a client application for encrypted name resolution implemented in the encrypted name resolution client server, the encryption name resolution client server is requested to perform name resolution of the host name. The information processing system according to claim 1 .

7. The processor, performing an authentication request process for requesting authentication from the encrypted name resolution client server; If the authentication request process is successful, a request is made to the encrypted name resolution client server to perform name resolution of the host name.

7. An information processing system according to claim 1.

8. On the computer, When a request for name resolution of a host name is received, the host name is requested to be resolved by an encryption name resolution client server that performs name resolution using encrypted communication with an encryption name resolution server. An information processing program for executing processing.

9. A processor is provided. The processor, When a request for name resolution of a host name is received from an information processing device, the method requests an encrypted name resolution server to resolve the host name using encrypted communication; obtaining a name resolution result for the host name from the encrypted name resolution server; transmitting a name resolution result of the host name to the information processing device; Information processing system.

10. The processor, receiving a request for name resolution of the host name for which DoH is not used from the information processing device; requesting the encrypted name resolution server to perform name resolution of the host name using DoH as the encrypted communication; The information processing system according to claim 9.

11. On the computer, When a request for name resolution of a host name is received from an information processing device, the method requests an encrypted name resolution server to resolve the host name using encrypted communication; obtaining a name resolution result for the host name from the encrypted name resolution server; transmitting a name resolution result of the host name to the information processing device; An information processing program for executing processing.

Images