Communication device, computer program for communication device, and method

Abstract

To disclose a technique for improving convenience of a user in a situation in which filter processing relating to whether or not a communication between a communication device and an external device is permitted is executed.SOLUTION: A communication device may include: a memory that stores a comprehensive filter setting and a plurality of individual filter settings; a first change part that, when the comprehensive filter setting is changed from a first value to a second value by a user, changes each of one or more individual filter settings for which identification information has not yet been specified among the plurality of individual filter settings, from a fourth value to a third value without receiving a change operation from the user; and a second changing part configured to, when the comprehensive filter setting is changed from the second value to the first value by the user, change each of the one or more individual filter settings for which the identification information has not yet been designated among the plurality of individual filter settings, from the third value to the fourth value without receiving the change operation from the user.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] This specification discloses a technique for controlling communication from an external device to a communication device. [Background technology]

[0002] A print control device is disclosed in Patent Document 1. The print control device has a firewall function and permits or prohibits communication based on information such as an IP address, a port number, and a protocol. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2019-101567 Summary of the Invention [Problem to be solved by the invention]

[0004] This specification discloses a technique for improving user convenience in a situation where a filter process is executed to determine whether or not communication between a communication device and an external device is permitted. [Means for solving the problem]

[0005] This specification discloses a communication device, the communication device includes a memory that stores a blanket filter setting and a plurality of individual filter settings, the blanket filter setting indicating either a first value corresponding to allowing communication with all external devices or a second value corresponding to not allowing communication with all external devices, and each of the plurality of individual filter settings indicating either a third value corresponding to allowing communication with an external device identified by identification information designated by a user or a fourth value corresponding to not allowing communication with the external device, and the blanket filter setting being changed from the first value to the second value by the user. a first change unit that, when the comprehensive filter setting is changed by the user, changes each of one or more individual filter settings for which identification information has not yet been specified from the fourth value to the third value without accepting a change operation from the user; and a second change unit that, when the comprehensive filter setting is changed from the second value to the first value by the user, changes each of one or more individual filter settings for which identification information has not yet been specified from the third value to the fourth value without accepting a change operation from the user.

[0006] According to the above configuration, when a user changes an inclusive filter setting from a first value to a second value, the communication device changes each of one or more individual filter settings for which identification information has not yet been specified from a fourth value to a third value. This allows the user to specify identification information in association with the third value when the inclusive filter setting is the second value. Furthermore, when a user changes an inclusive filter setting from the second value to the first value, the communication device changes each of one or more individual filter settings for which identification information has not yet been specified from the third value to a fourth value, among the multiple individual filter settings. This allows the user to specify identification information in association with the fourth value when the inclusive filter setting is the first value. This improves user convenience.

[0007] A computer program for implementing the above-described communication device, a computer-readable storage medium storing the computer program, and a method executed by the above-described communication device are also novel and useful. [Brief explanation of the drawings]

[0008] [Figure 1] 1 shows the configuration of a communication system. [Figure 2] 1 shows a sequence diagram of a first embodiment. [Figure 3] The sequence diagram continues from Figure 2. [Figure 4] The sequence diagram continues from Figure 3. [Figure 5] The sequence diagram continues from Figure 4. [Figure 6] The sequence diagram continues from Figure 5. [Figure 7] 10 shows a sequence diagram of a second embodiment. [Figure 8] 10 shows a sequence diagram of the third embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0009] (First Example) (Configuration of communication system 2; Figure 1) 1, the communication system 2 includes a printer 10 and multiple terminals 100, 200, 300, and 400. The devices 10, 10 ...

[0010] (Printer 10 configuration) Printer 10 is a peripheral device (for example, a peripheral device of terminal 100) that can execute a printing function. Printer 10 includes an operation unit 12, a display unit 14, a print execution unit 16, a communication interface 18, and a control unit 30. Hereinafter, the interface will be referred to as "I / F."

[0011] The operation unit 12 has a plurality of keys. A user can input various instructions to the printer 10 by operating the operation unit 12. The display unit 14 is a display for displaying various information. The display unit 14 also functions as a so-called touch panel (i.e., an operation unit). The print execution unit 16 has a printing mechanism such as an inkjet type or a laser type. The communication I / F 18 is connected to the LAN 6. The communication I / F 18 may be a wireless I / F or a wired I / F.

[0012] The control unit 30 includes a CPU 32 and a memory 34. The memory 34 includes a main storage device and an auxiliary storage device, not shown. The CPU 32 executes various processes in accordance with a program 40 stored in the auxiliary storage device of the memory 34. Specifically, the CPU 32 executes the various processes by loading the program 40 from the auxiliary storage device to the main storage device and executing the program 40. The main storage device is, for example, a RAM and a cache memory. The auxiliary storage device may be, for example, a flash memory, an SSD (short for Solid State Drive), or a ROM, or a combination thereof.

[0013] The memory 34 also stores the printer 10's own IP address "192.168.1.1," the printer 10's own subnet mask "255.255.255.0," and filter setting information. The IP address and subnet mask are assigned by, for example, a DHCP server (not shown) installed on the LAN 6. In this case, the printer 10 can receive the IP address and subnet mask from the DHCP server by sending an IP address assignment request to the DHCP server.

[0014] The filter setting information includes default setting information and individual filter setting information 42. The default setting information is information indicating whether or not communication with all external devices is permitted, and indicates either "Allow," which means that communication is permitted, or "Deny," which means that communication is not permitted.

[0015] A plurality of filter rules can be stored in the individual filter setting information 42. Each filter rule associates number information (e.g., "1," "2," "3," "4," "5"), IP address information (e.g., "192.168.1.10," "192.168.2.0 to 192.168.2.50"), and status information (e.g., "Allow," "Deny").

[0016] The number information is information for identifying each filter rule. In this embodiment, the number information indicates one of five numbers from "1" to "5." In a modified example, the number of numbers may be four or less, or six or more. The IP address information is an IP address specified by the user. The IP address information may specify a single IP address or a range including multiple IP addresses. The status information is information regarding whether communication between the external device identified by the IP address information and the printer 10 is permitted. The status information indicates either "Allow," which means that communication is permitted, or "Deny," which means that communication is not permitted.

[0017] When the default setting information indicates "Deny" and there is a filter rule with status information indicating "Allow," the printer 10 generally denies communication with each external device, but allows communication with an external device identified by the IP address indicated by the filter rule as an exception. Also, when the default setting information indicates "Allow" and there is a filter rule with status information indicating "Deny," the printer 10 generally allows communication with each external device, but denies communication with an external device identified by the IP address indicated by the filter rule as an exception.

[0018] Each filter rule has a priority. In this embodiment, the smaller the number indicated by the number information, the higher the priority. Therefore, the filter rule corresponding to the number "1" has the highest priority, and the filter rule corresponding to the number "5" has the lowest priority. If there are multiple conflicting filter rules for a certain IP address, the printer 10 applies the filter rule with the highest priority among the multiple filter rules.

[0019] (Configuration of terminal 100) The terminal 100 is, for example, an administrator terminal used by an administrator of each device belonging to the network formed by the LAN 6. The terminal 100 is, for example, a desktop PC, a notebook PC, a tablet PC, a smartphone, a PDA, etc. The terminal 100 includes an operation unit 112, a display unit 114, a communication I / F 118, and a control unit 130.

[0020] The operation unit 112 has a plurality of keys. A user can input various instructions to the terminal 100 by operating the operation unit 112. The display unit 114 is a display for displaying various information. The display unit 114 may function as a so-called touch panel (i.e., an operation unit). The communication I / F 118 is connected to the LAN 6. The communication I / F 118 may be a wireless I / F or a wired I / F.

[0021] The control unit 130 includes a CPU 132 and a memory 134. The memory 134 includes a main storage device and an auxiliary storage device (not shown). The CPU 132 executes various processes in accordance with a program 140 stored in the auxiliary storage device of the memory 134. Specifically, the CPU 132 executes the various processes by loading the program 140 from the auxiliary storage device to the main storage device and executing the program 140. The main storage device may be, for example, a RAM and a cache memory. The auxiliary storage device may be, for example, a flash memory, an SSD, or a ROM, or a combination thereof. The memory 134 further stores the IP address "192.168.1.10" of the terminal 100 itself. Although not shown, the terminal 100 is assigned a subnet mask "255.255.255.0."

[0022] (Configuration of other devices 200, 300, 400) Each of the terminals 200, 300, and 400 is used by a general user who is not an administrator. Each of the terminals 200, 300, and 400 has the same configuration as the terminal 100, except that it stores its own IP address. The terminal 200 is assigned the IP address "192.168.1.12." The terminal 300 is assigned the IP address "192.168.1.13." The terminal 400 is assigned the IP address "192.168.1.14." The terminals 200, 300, and 400 are each assigned the same subnet mask "255.255.255.0."

[0023] (Specific processing: Figures 2 to 6) Specific processing will be described with reference to Figures 2 to 6. In the following, for ease of understanding, when describing processing executed by the CPU 32 of the printer 10 and the CPU 132 of the terminal 100 in accordance with the programs 40, 140, the description will be focused on the printer 10 and the terminal 100 rather than the respective CPUs 32, 132. Furthermore, all of the following communications executed by the printer 10 and the terminal 100 are executed via the communication I / Fs 18, 118. Therefore, in the following, when describing processing related to communication, the phrase "via the communication I / F 18 (or 118)" will be omitted.

[0024] In the initial state of FIG. 2, the default setting information of the printer 10 indicates "Deny." That is, the printer 10 generally denies communication with any external device. IP address information has not yet been stored in the individual filter setting information 42 of the printer 10. Because the default setting information indicates "Deny," all filter rules in the individual filter setting information 42 store "Allow," the opposite of "Deny," as status information.

[0025] At T10, the terminal 100 receives an access instruction from the user, which includes an input operation of an IP address for using the web server function of the printer 10. The input operation further includes input of a user ID and password set in the printer 10. In this case, at T12, the terminal 100 transmits an access request to the printer 10, which includes the IP address as a destination address, as well as the user ID and password.

[0026] When the printer 10 receives an access request from the terminal 100 at T12, it authenticates the user ID and password included in the access request. Specifically, the printer 10 determines whether the combination of the user ID and password has been stored. If the authentication is successful (i.e., if the combination of the user ID and password has been stored), the printer 10 functions as a web server and transmits screen data representing various web pages to the terminal 100. First, at T14, the printer 10 transmits home screen data representing a home screen to the terminal 100. Thus, in a situation where the authentication of the user ID and password is successful, the printer 10 can transmit screen data to the terminal 100 in response to the access request, even if the default setting information indicates "Deny" and the IP address has not yet been stored in the individual filter setting information 42.

[0027] When the terminal 100 receives home screen data from the printer 10 in T14, it displays a home screen (not shown) in T16. The home screen includes a plurality of buttons for executing various settings related to the printer 10. The plurality of buttons includes a button indicating filter settings. The filter settings are settings related to communication with the printer 10, and more specifically, settings related to which external devices communication is permitted or denied. When the terminal 100 accepts selection of the button from the user in T18, it transmits a filter setting request to the printer 10 in T20.

[0028] When the printer 10 receives a filter setting request from the terminal 100 in T20, the printer 10 transmits filter setting screen data representing a filter setting screen to the terminal 100 in T22.

[0029] When the terminal 100 receives the filter setting screen data from the printer 10 in T22, it displays the filter setting screen SC1 in T24. The filter setting screen SC1 includes an area for specifying a default policy for communication with the printer 10. This area includes an area A1 indicating "Deny" and an area A2 indicating "Allow." For example, if the user selects the area A1 indicating "Deny," i.e., if "Deny" is specified as the default policy for the printer 10, the printer 10 generally denies communication with any external device. However, the printer 10 can exceptionally permit communication with external devices specified in the filter rule. In other words, in this case, the filter rule functions as a whitelist indicating external devices with which the printer 10 can communicate. Furthermore, for example, if the user selects the area A2 indicating "Allow," i.e., if "Allow" is specified as the default policy for the printer 10, the printer 10 generally permits communication with any external device. However, the printer 10 can exceptionally deny communication with external devices specified in the filter rule. In other words, in this case, the filter rule functions as a blacklist indicating external devices with which communication is not possible.

[0030] Since the current default setting information of the printer 10 indicates "Deny," the area A1 indicating "Deny" is selected in the initial state of the filter setting screen SC1. The filter setting screen SC1 further includes an IP address designation area for designating an IP address, a status selection area for selecting a status, and an OK button B3. In the current individual filter setting information 42 of the printer 10, IP address information has not yet been stored, and "Allow" is stored as the status information for all filter rules. Therefore, in the initial state of the filter setting screen SC1, no IP addresses are written in any of the IP address designation areas, and "Allow" is written in all of the status selection areas.

[0031] In T26, the terminal 100 accepts from the user input of "192.168.1.10" into the IP address specification field corresponding to the number "1," input of "192.168.2.0-192.168.2.50" into the IP address specification field corresponding to the number "2," and selection of the enter button B3. In this case, as shown in Fig. 3, in T28, the terminal 100 transmits to the printer 10 the specified content including the combination of the number "1," the IP address "192.168.1.10," and the status information "Allow," and the combination of the number "2," the IP addresses "192.168.2.0-192.168.2.50," and the status information "Allow."

[0032] When the printer 10 receives the specified content from the terminal 100, at T30 it stores the two pieces of combination information included in the specified content in the individual filter setting information 42. As a result, the printer 10 will generally refuse communication with any external device, but will exceptionally permit communication with the terminal 100 identified by the IP address "192.168.1.10" associated with the number "1" and communication with each external device identified by the IP addresses "192.168.2.0 to 192.168.2.50" associated with the number "2."

[0033] 2 at predetermined times. At T50, the terminal 100 displays a filter setting screen SC2 represented by the filter setting screen data received from the printer 10. The filter setting screen SC2 is similar to the filter setting screen SC1 except for the following points: In the current individual filter setting information 42 of the printer 10, the IP address "192.168.1.10" is stored in association with the number "1," and the IP addresses "192.168.2.0 to 192.168.2.50" are stored in association with the number "2" (see T30). Therefore, the IP address designation area corresponding to the number "1" indicates "192.168.1.10," and the IP address designation area corresponding to the number "2" indicates "192.168.2.0 to 192.168.2.50."

[0034] When the terminal 100 receives the selection of the area A2 and the selection of the button B3 from the user in T52, it transmits the specified content including the default policy "Allow" to the printer 10 in T54.

[0035] As shown in FIG. 4, when the printer 10 receives the specified content from the terminal 100 in T54, in T56, the printer 10 changes the default setting information from “Deny” to “Allow” in accordance with “Allow” included in the specified content. The printer 10 also changes the status information of each of the filter rules included in the individual filter setting information 42 for which IP address information has not yet been specified, i.e., the filter rules identified by the numbers “3,” “4,” and “5,” from “Allow” to “Deny.” Note that the status information of each of the filter rules for which IP address information has already been specified, i.e., the filter rules identified by the numbers “1” and “2,” remains “Allow.” Then, in T58, the printer 10 transmits filter setting screen data representing the filter setting screen SC3 to the terminal 100.

[0036] When the terminal 100 receives the filter setting screen data from the printer 10 in T58, it displays the filter setting screen SC3 in T60. The filter setting screen SC3 is similar to the filter setting screen SC2 except for the following points: The current default setting information of the printer 10 indicates "Allow" (see T56). Therefore, on the filter setting screen SC3, the area A2 indicating "Allow" is selected. Furthermore, in the current individual filter setting information 42 of the printer 10, the status information associated with the numbers "3," "4," and "5" indicates "Deny" (see T56). Therefore, on the filter setting screen SC3, the status selection areas corresponding to the numbers "3," "4," and "5" indicate "Deny."

[0037] When the terminal 100 receives, in T62, the user's input of "192.168.1.0-192.168.1.20" into the IP address specification field corresponding to the number "3" and the selection of the decision button B3, it sends the specified content, including the combination of the number "3," the IP addresses "192.168.1.0-192.168.1.20," and "Deny," to the printer 10 in T64.

[0038] When the printer 10 receives the specified content from the terminal 100 in T64, in T66 the printer 10 stores one piece of combination information included in the specified content in the individual filter setting information 42. As a result, the printer 10 generally permits communication with any external device, but exceptionally denies communication with each external device identified by the IP addresses "192.168.1.0 to 192.168.1.20" corresponding to the number "3" (for example, terminals 200, 300, 400).

[0039] Here, the IP address of the terminal 100 (i.e., "192.168.1.10") is included in the range of IP addresses corresponding to the number "3." However, "Allow" is stored in association with "192.168.1.10" for the number "1," which has a higher priority than the number "3." Therefore, the printer 10 applies the filter rule identified by the number "1," which has a higher priority. In other words, the printer 10 allows communication with the terminal 100.

[0040] As described above, when the default policy is changed by the user from "Deny" to "Allow" (T52 in FIG. 3), the printer 10 changes the status information of each filter rule for which IP address information has not yet been specified, that is, each filter rule identified by the numbers "3," "4," and "5," from "Allow" to "Deny" without accepting a change operation from the user (T56 in FIG. 4). This allows the user to specify an external device with which communication is not permitted by specifying the IP address of the filter rule identified by the number "3" on the filter setting screen SC3 (T62 in FIG. 4).

[0041] Consider a comparative example in which, at T56 in FIG. 4 , the printer 10 maintains the status information of each filter rule identified by the numbers "3," "4," and "5" at "Allow" rather than changing it to "Deny." In this case, on the filter setting screen SC3, the status selection fields corresponding to the numbers "3," "4," and "5" indicate "Allow" rather than "Deny." When creating a new filter rule in a situation where the default policy is changed to "Allow," i.e., a situation where communication with any external device is generally permitted, the user typically desires to create a filter rule that exceptionally denies communication with a specific device. In this comparative example, when entering an IP address in the IP address input field corresponding to the number "3," for example, the user must change the status selection field corresponding to the number "3" from "Allow" to "Deny."

[0042] In this embodiment, at T56 in FIG. 4, the printer 10 changes the status information of each filter rule for which IP address information has not yet been assigned from "Allow" to "Deny" without accepting a change operation from the user, among the multiple filter rules included in the individual filter setting information 42. Therefore, on the filter setting screen SC3, the status selection fields corresponding to the numbers "3," "4," and "5" indicate "Deny" rather than "Allow." Therefore, when the user enters an IP address in the IP address input field corresponding to the number "3," for example, the user does not need to change the status selection field corresponding to the number "3" from "Allow" to "Deny." This improves user convenience. This embodiment is particularly useful when there are a large number (e.g., several tens) of filter rules for which IP address information has not yet been assigned.

[0043] Furthermore, as shown in T56 of FIG. 4, when the printer 10 changes the default policy, it maintains the status information of each filter rule for which IP address information has already been specified, i.e., each filter rule identified by the numbers "1" and "2," as "Allow." Furthermore, as shown in T66 of FIG. 4, for the IP address "192.168.1.10" of the terminal 100, the number "1" indicates "Allow" and the number "3" indicates "Deny." In this way, when there are multiple conflicting filter rules for a certain IP address, the printer 10 applies the filter rule with the highest priority, i.e., the filter rule with the number "1." With this configuration, for example, by setting the priority of the filter rule for which "Allow" is associated with the IP address "192.168.1.10" of the terminal 100, which is the administrator terminal, to a high value, the printer 10 can properly communicate with the terminal 100, which is the administrator terminal, even if a new filter rule is added.

[0044] 5, the terminal 100 and the printer 10 execute the same processes as those from T10 to T22 in FIG. 2 at predetermined timings. At T70, the terminal 100 displays a filter setting screen SC4 represented by the filter setting screen data already received from the printer 10. The filter setting screen SC4 is similar to the filter setting screen SC3 except for the following points. In the current individual filter setting information 42 of the printer 10, the IP address information associated with the number "3" indicates "192.168.1.0 to 192.168.1.20" (see T66 in FIG. 4). Therefore, on the filter setting screen SC4, the IP address specification field corresponding to the number "3" indicates "192.168.1.0 to 192.168.1.20."

[0045] When the terminal 100 receives the selection of area A1 and button B3 from the user in T72, it transmits the specified content, including the default policy "Deny," to the printer 10 in T74.

[0046] When the printer 10 receives the specified content from the terminal 100 in T74, in T76 the printer 10 changes the default setting information from "Allow" to "Deny" in accordance with the "Deny" included in the specified content. As a result, the printer 10 generally denies communication with any external device, but exceptionally permits communication with the terminal 100 identified by the IP address "192.168.1.10" associated with the number "1" and communication with one or more external devices identified by the IP addresses "192.168.2.0 to 192.168.2.50" associated with the number "2." Furthermore, the printer 10 changes the status information of each filter rule for which IP address information has not yet been specified, i.e., each filter rule identified by the numbers "4" and "5," from "Deny" to "Allow." Then, as shown in FIG. 6, the printer 10 transmits filter setting screen data representing the filter setting screen SC5 to the terminal 100 in T78.

[0047] When the terminal 100 receives the filter setting screen data from the printer 10 in T78, it displays the filter setting screen SC5 in T80. The filter setting screen SC5 is similar to the filter setting screen SC4 except for the following points: The current default setting information of the printer 10 indicates "Deny" (see T76). Therefore, on the filter setting screen SC5, the area A1 indicating "Deny" is selected. Furthermore, in the current individual filter setting information 42 of the printer 10, the status information associated with the numbers "4" and "5" indicates "Allow" (see T76). Therefore, on the filter setting screen SC5, the status selection areas corresponding to the numbers "4" and "5" indicate "Allow."

[0048] According to the above configuration, when the user changes the default policy from "Allow" to "Deny" (T72 in FIG. 5), the printer 10 changes the status information of each of the filter rules included in the individual filter setting information 42 for which IP address information has not yet been specified, i.e., each of the filter rules identified by the numbers "4" and "5," from "Deny" to "Allow" (T76), without accepting a change operation from the user. Therefore, on the filter setting screen SC5, the status selection fields corresponding to the numbers "4" and "5" indicate "Allow" rather than "Deny." Therefore, when the user enters an IP address in the IP address input field corresponding to the number "4," for example, the user does not need to change the status selection field corresponding to the number "4" from "Deny" to "Allow." This improves user convenience.

[0049] (Correspondence) Printer 10 is an example of a "communication device." Terminals 100, 200, 300, and 400 are examples of "external devices." Default setting information and status information are examples of "comprehensive filter settings" and "individual filter settings," respectively. Allow and Deny are examples of "first value" and "second value," respectively. IP address information is an example of "identification information." Allow and Deny are examples of "third value" and "fourth value," respectively. Display unit 114 is an example of a "display unit." The IP address designation area and status selection area are examples of "first column" and "second column." Areas A1 and A2 for designating a default policy are examples of a "designation area."

[0050] T76 in Fig. 5 and T56 in Fig. 4 are examples of processing executed by the "first change unit" and the "second change unit", respectively. T22 in Fig. 2, T78 in Fig. 6, and T58 in Fig. 4 are examples of processing executed by the "first display control unit", "second display control unit", and "third display control unit", respectively.

[0051] (Second embodiment: Figure 7) Next, a second embodiment will be described. In this embodiment, when the default policy is changed, the printer 10 inquires whether or not to change the status information of each filter rule for which an IP address has been specified. Figure 7 is a continuation of Figure 3.

[0052] When the printer 10 receives the specified content including the default policy "Allow" from the terminal 100 in T54 of FIG. 3, the printer 10 transmits inquiry screen data to the terminal 100 in T100 of FIG.

[0053] When the terminal 100 receives the inquiry screen data from the printer 10 in T100, it displays an inquiry screen SC6 in T102. The inquiry screen SC6 includes a message for asking the user whether or not to change the status information of each filter rule for which an IP address has been specified. The inquiry screen SC6 also includes a button B4 indicating that the change should be made and a button B5 indicating that the change should not be made.

[0054] In T104, the terminal 100 accepts the selection of the button B4 from the user on the inquiry screen SC6. In this case, the terminal 100 transmits the specified content including "change" to the printer 10 in T106.

[0055] When the printer 10 receives the specified content from the terminal 100 in T106, in T108, it changes the default setting information from "Deny" to "Allow" in accordance with "Allow" included in the specified content received in T54 of Figure 3. The printer 10 further changes the status information of each filter rule for which IP address information has already been specified, that is, each filter rule identified by the numbers "1" and "2," from "Allow" to "Deny" in accordance with "Change" included in the specified content received in T106. Note that when the printer 10 receives a user selection of button B5 on the inquiry screen SC6 indicating no change, it does not change the status information of each filter rule for which IP address information has already been specified from "Allow" to "Deny."

[0056] The printer 10 further changes the status information of each filter rule for which IP address information has not yet been specified, that is, each filter rule identified by the numbers "3," "4," and "5," from "Allow" to "Deny" among the multiple filter rules included in the individual filter setting information 42. Then, in T110, the printer 10 transmits filter setting screen data representing the filter setting screen SC7 to the terminal 100.

[0057] When the terminal 100 receives the filter setting screen data from the printer 10 in T110, it displays the filter setting screen SC7 in T112. The filter setting screen SC7 is similar to the filter setting screen SC3 in FIG. 4 except for the following points: In the current individual filter setting information 42 of the printer 10, the status information of each filter rule identified by the numbers "1" and "2" indicates "Deny." Therefore, the status selection areas corresponding to the numbers "1" and "2" indicate "Deny."

[0058] According to the above configuration, when the user changes the default policy from “Deny” to “Allow” (T52 in FIG. 3), the printer 10 displays the inquiry screen SC6 on the terminal 100. Then, when the printer 10 receives a selection of button B4 from the user, it changes the status information of each filter rule identified by the numbers “1” and “2” from “Allow” to “Deny” (T108). On the other hand, when the printer 10 receives a selection of button B5 from the user, it does not change the status information of each filter rule identified by the numbers “1” and “2” from “Allow” to “Deny.” This allows the printer 10 to switch, depending on the user's intention, whether or not to change the status information of each filter rule for which IP address information has already been specified. In this embodiment, the display unit 114 and the inquiry screen SC6 are examples of a “display unit” and a “second selection screen,” respectively. T100 in FIG. 7 is an example of a process executed by a “fifth display control unit.”

[0059] Here, a case where the default policy is changed by the user from "Allow" to "Deny" will be described with reference to FIGS. 5 and 7. As shown on the filter setting screen SC4 in FIG. 5, if the processes of T72 and T74 are executed when the default policy of the printer 10 is set to "Allow," the printer 10 executes a process similar to T100 in FIG. 7 instead of T76. If the terminal 100 subsequently executes processes similar to T102 to T106, the printer 10 changes the default setting information from "Allow" to "Deny" in T108, and also changes the status information of each filter rule for which IP address information has already been specified, among the multiple filter rules included in the individual filter setting information 42, in accordance with "change" included in the specified content received in T106. Specifically, the printer 10 changes the status information of each filter rule identified by the numbers "1" and "2" from "Allow" to "Deny," and changes the status information of the filter rule identified by the number "3" from "Deny" to "Allow." The printer 10 further changes the status information of each filter rule for which IP address information has not yet been specified, that is, each filter rule identified by the numbers "4" and "5," from "Deny" to "Allow" among the multiple filter rules included in the individual filter setting information 42. Then, in T110 of Fig. 7, the printer 10 transmits filter setting screen data representing a filter setting screen to the terminal 100.

[0060] When the terminal 100 receives the filter setting screen data from the printer 10 in T110, it displays a filter setting screen (not shown) in T112. This filter setting screen is the same as the filter setting screen SC5 in Fig. 6 except for the following points: The status selection areas corresponding to the numbers "1" and "2" indicate "Deny," and the status selection area corresponding to the number "3" indicates "Allow."

[0061] Even when the user changes the default policy from "Allow" to "Deny" through the above processes (T74 in FIG. 5), the printer 10 can switch, according to the user's intention, whether or not to change the status information of each filter rule for which IP address information has already been specified, by displaying the inquiry screen SC6 on the terminal 100. In this embodiment, the filter setting screen is an example of a "first selection screen." T100 in FIG. 7 cited here is an example of a process executed by a "fourth display control unit."

[0062] (Third Example: Figure 8) Next, a third embodiment will be described. In this embodiment, when the default policy is changed, the printer 10 changes the status information of each filter rule for which an IP address has been specified, and also changes the specified IP address. Figure 8 is a continuation of Figure 3.

[0063] When the printer 10 receives specified content including the default policy "Allow" from the terminal 100 at T54 in Fig. 3, it changes the default setting information from "Deny" to "Allow" in accordance with "Allow" included in the specified content at T150 in Fig. 8. Furthermore, the printer 10 changes the status information of each filter rule for which IP address information has not yet been specified, that is, each filter rule identified by the numbers "3," "4," and "5," from "Allow" to "Deny." Up to this point, the process is the same as in the first embodiment.

[0064] The printer 10 further inverts the portion of the IP address indicated by the IP address information that is not masked by the subnet mask for each filter rule for which IP address information has already been specified, i.e., for each filter rule identified by the numbers "1" and "2." Specifically, the printer 10 first inverts the portion of the IP address "192.168.1.10" with the number "1" that is not masked by the subnet mask "255.255.255.0" (i.e., the 8-bit value corresponding to the last number in the address range, "10"). In other words, the printer 10 generates a range of IP addresses that does not include the 8-bit value corresponding to the last number in the address range, "10." In other words, the IP addresses after inversion are "192.168.1.0 to 192.168.1.9" and "192.168.1.11 to 192.168.1.255." Next, the printer 10 inverts the portion of the IP address number "2" (192.168.2.0 to 198.168.2.50) that is not masked by the subnet mask "255.255.255.0" (i.e., the 8-bit value corresponding to the last address range "0 to 50"). In other words, the printer 10 generates an IP address range that does not include the 8-bit value corresponding to the last address range "0 to 50". In other words, the IP addresses after inversion are "192.168.2.51 to 198.168.2.255".

[0065] The printer 10 further changes the status information of each filter rule identified by the numbers "1" and "2" from "Allow" to "Deny." Then, in T152, the printer 10 transmits filter setting screen data representing the filter setting screen SC8 to the terminal 100.

[0066] When the terminal 100 receives the filter setting screen data from the printer 10 in T152, it displays the filter setting screen SC8 in T154. The filter setting screen SC8 is similar to the filter setting screen SC3 in FIG. 4 except for the following points: The IP address designation field corresponding to the number "1" shows the inverted IP addresses "192.168.1.0 to 192.168.1.9 or 192.168.1.11 to 192.168.1.255", and the status selection field shows "Deny". The IP address designation field corresponding to the number "2" shows the inverted IP addresses "192.168.2.51 to 192.168.2.255", and the status selection field shows "Deny".

[0067] According to the above configuration, when the default policy is changed by the user from "Deny" to "Allow" (T52 in FIG. 3), the printer 10 inverts the portion of the IP address that is not masked by the subnet mask for each filter rule for which IP address information has already been specified, i.e., for each filter rule identified by the numbers "1" and "2," and changes the status information from "Allow" to "Deny." Therefore, the printer 10 can change the status information of each filter rule from "Allow" to "Deny" without changing the filtering content defined by each filter rule identified by the numbers "1" and "2" before and after the default policy change. In this embodiment, T150 in FIG. 8 is an example of processing executed by the "second inversion unit."

[0068] Here, a case where the default policy is changed from "Allow" to "Deny" will be described with reference to FIGS. 5 and 8. As shown on the filter setting screen SC4 in FIG. 5, when the processes of T72 and T74 are executed while the default policy of the printer 10 is set to "Allow," the printer 10 executes the same process as T150 in FIG. 8 instead of T76. That is, the printer 10 changes the default setting information from "Allow" to "Deny" in accordance with the "Deny" included in the specified content received in T74. Furthermore, the printer 10 changes the status information of each filter rule for which IP address information has not yet been specified, that is, the filter rules identified by the numbers "4" and "5," from "Deny" to "Allow."

[0069] The printer 10 further inverts the portion of the IP address that is not masked by the subnet mask for each filter rule for which IP address information has already been specified, i.e., for each filter rule identified by numbers "1," "2," and "3." Specifically, the printer 10 first inverts the portion of the IP address "192.168.1.10" that is not masked by the subnet mask for number "1." That is, the IP addresses after inversion are "192.168.1.0 to 192.168.1.9" and "192.168.1.11 to 192.168.1.255." Next, the printer 10 inverts the portion of the IP address "192.168.2.0 to 198.168.2.50" that is not masked by the subnet mask for number "2." That is, the IP addresses after the inversion are "192.168.2.51 to 192.168.2.255." Next, the printer 10 inverts the portion of the IP address number "3," "192.168.1.0 to 192.168.1.20," that is not masked by the subnet mask. That is, the IP addresses after the inversion are "192.168.1.21 to 192.168.1.255."

[0070] Printer 10 further changes the status information of the filter rules identified by numbers "1" and "2" from "Allow" to "Deny", and changes the status information of the filter rule identified by number "3" from "Deny" to "Allow".

[0071] With the above configuration, even if the user changes the default policy from "Allow" to "Deny" (T74 in FIG. 5), the printer 10 can invert the portion of the IP address that is not masked by the subnet mask for the filter rules for which IP address information has already been specified, i.e., for each filter rule identified by the numbers "1," "2," and "3," and can also change the status information. In this embodiment, T150 in FIG. 8 is an example of processing executed by the "first inversion unit."

[0072] Although specific examples of the present invention have been described above in detail, these are merely examples and do not limit the scope of the claims. The technology described in the claims includes various modifications and variations of the specific examples exemplified above. Modifications of the above-mentioned embodiments are listed below.

[0073] (Modification 1) The "identification information" may be a device name instead of IP address information. In other words, it may be information that can identify an external device in order to communicate with the external device.

[0074] (Variation 2) The status selection area may not be displayed on the filter setting screen SC1 of Fig. 2. That is, only the IP address specification area may be displayed on the filter setting screen SC1. In this variation, the "second column," "first display control unit," "second display control unit," and "third display control unit" may be omitted.

[0075] (Variant 3) The filter setting screen SC1, etc. may not include an area for specifying a default policy (i.e., areas A1, A2). The area for specifying a default policy may be included in a screen separate from the filter setting screen SC1, etc. Generally speaking, the "specification screen" may be realized by a single screen, as in the above embodiments, or may be realized by multiple screens.

[0076] (Variation 4) The printer 10 may be configured so as not to be able to store multiple conflicting filter rules. For example, when a certain filter rule exists and a conflicting filter rule is specified by the user, the printer 10 will present a warning to the user and will not store the other filter rule. Generally speaking, each of the multiple individual filter settings does not need to have a "priority."

[0077] (Variant 5) In T108 of FIG. 7, in addition to processing T108, the printer 10 may invert the portion of the IP address indicated by the IP address information that is not masked by the subnet mask for each filter rule for which IP address information has already been specified, i.e., each filter rule identified by the numbers "1" and "2."

[0078] (Variant 6) In the above embodiment, the processing of each step in Figures 2 to 8 is realized by software (e.g., program 40 of printer 10), but at least one of these processes may also be realized by hardware such as a logic circuit.

[0079] Furthermore, the technical elements described in this specification or drawings may exhibit technical utility either alone or in various combinations, and are not limited to the combinations described in the claims at the time of filing. Furthermore, the technologies illustrated in this specification or drawings may achieve multiple objectives simultaneously, and achieving one of those objectives alone is technically useful.

[0080] In the scope of the claims at the time of filing, even if each claim depends on only some of the claims, it is not limited to the fact that each claim can depend on only those some of the claims. To the extent that there is no technical contradiction, each claim can also depend on other claims that were not dependent at the time of filing. In other words, the technology of each claim can be combined in various ways as follows: (Item 1) A communication device, a memory for storing a global filter setting and a plurality of individual filter settings, the inclusive filter setting indicates either a first value corresponding to allowing communication with all external devices or a second value corresponding to not allowing communication with all external devices; the memory, wherein each of the plurality of individual filter settings indicates either a third value corresponding to allowing communication with an external device identified by identification information designated by a user, or a fourth value corresponding to not allowing communication with the external device; a first change unit that, when the user changes the comprehensive filter setting from the first value to the second value, changes each of one or more individual filter settings for which identification information has not yet been specified, among the plurality of individual filter settings, from the fourth value to the third value without accepting a change operation from the user; a second change unit that, when the comprehensive filter setting is changed from the second value to the first value by the user, changes each of one or more individual filter settings for which the identification information has not yet been specified, among the plurality of individual filter settings, from the third value to the fourth value without accepting a change operation from the user; A communication device comprising: (Item 2) The communication device further comprises: a first display control unit that causes a display unit to display a designation screen for designating the plurality of individual filter settings, the designation screen including a plurality of first fields for designating identification information, and a plurality of second fields corresponding to the plurality of first fields, the plurality of second fields for designating one of the third value and the fourth value; and a second display control unit that, when the user changes the inclusive filter setting from the first value to the second value, changes each of one or more second fields corresponding to one or more first fields for which the identification information has not yet been specified from the fourth value to the third value and displays the changed information on the display unit; a third display control unit that, when the user changes the inclusive filter setting from the second value to the first value, changes each of one or more second fields corresponding to one or more first fields in which the identification information has not yet been specified from the third value to the fourth value and displays the changed information on the display unit; Item 1. A communication device according to item 1, comprising: (Item 3) 3. The communication device according to item 2, wherein the designation screen further includes a designation area for designating the comprehensive filter setting. (Item 4) when the user changes the comprehensive filter setting from the first value to the second value, the first change unit does not change any of the one or more individual filter settings for which identification information is specified, among the plurality of individual filter settings; 4. The communication device according to any one of items 1 to 3, wherein the second change unit does not change one or more individual filter settings, among the plurality of individual filter settings, for which identification information is specified, when the comprehensive filter setting is changed by the user from the second value to the first value. (Item 5) The communication device further comprises: a fourth display control unit that, when the comprehensive filter setting is changed from the first value to the second value by the user, causes a first selection screen to be displayed on a display unit for selecting whether or not to change each of one or more individual filter settings, among the plurality of individual filter settings, for which identification information is specified, from the fourth value to the third value; a fifth display control unit that, when the comprehensive filter setting is changed from the second value to the first value by the user, causes a second selection screen to be displayed on the display unit for selecting whether or not to change each of one or more individual filter settings, among the plurality of individual filter settings, for which identification information is specified, from the third value to the fourth value; Item 1. A communication device according to item 1, comprising: (Item 6) the identification information is an IP address, the first change unit further changes, when the comprehensive filter setting is changed from the first value to the second value, each of one or more individual filter settings for which an IP address is specified, from the fourth value to the third value without accepting a change operation from the user; the second change unit further changes, when the comprehensive filter setting is changed from the second value to the first value, each of one or more individual filter settings for which an IP address is specified, from the third value to the fourth value without accepting a change operation from the user, among the plurality of individual filter settings; The communication device further comprises: a first inversion unit that, when the inclusive filter setting is changed from the first value to the second value, inverts a portion of the IP address that is not masked by a subnet mask for each of one or more individual filter settings in which an IP address is specified; a second inversion unit that, when the inclusive filter setting is changed from the second value to the first value, inverts a portion of the IP address that is not masked by a subnet mask for each of one or more individual filter settings in which an IP address is specified; 6. The communication device according to item 1 or 5, comprising: (Item 7) each of the plurality of individual filter settings has a priority; 7. The communication device according to any one of items 1 to 6, wherein when an individual filter setting having a higher priority conflicts with an individual filter setting having a lower priority, the individual filter setting having a higher priority is applied. [Explanation of symbols]

[0081] 2: Communication system, 6: LAN, 10: Printer, 12: Operation unit, 14: Display unit, 16: Print execution unit, 18: Communication I / F, 30: Control unit, 32: CPU, 34: Memory, 40: Program, 42: Individual filter setting, 100: Terminal, 112: Operation unit, 114: Display unit, 118: Communication I / F, 130: Control unit, 132: CPU, 134: Memory, 140: Program, 200: Terminal, 300: Terminal, 400: Terminal

Claims

1. A communication device, a memory for storing a global filter setting and a plurality of individual filter settings, the inclusive filter setting indicates either a first value corresponding to allowing communication with all external devices or a second value corresponding to not allowing communication with all external devices; the memory, wherein each of the plurality of individual filter settings indicates either a third value corresponding to allowing communication with an external device identified by identification information designated by a user, or a fourth value corresponding to not allowing communication with the external device; a first change unit that, when the user changes the comprehensive filter setting from the first value to the second value, changes each of one or more individual filter settings, for which identification information has not yet been specified, from the fourth value to the third value, among the plurality of individual filter settings, without accepting a change operation from the user; a second change unit that, when the user changes the comprehensive filter setting from the second value to the first value, changes each of one or more individual filter settings for which the identification information has not yet been specified, among the plurality of individual filter settings, from the third value to the fourth value without accepting a change operation from the user; A communication device comprising:

2. The communication device further comprises: a first display control unit that causes a display unit to display a designation screen for designating the plurality of individual filter settings, the designation screen including a plurality of first fields for designating identification information, and a plurality of second fields corresponding to the plurality of first fields, the plurality of second fields for designating one of the third value and the fourth value; and a second display control unit that, when the user changes the comprehensive filter setting from the first value to the second value, changes each of one or more second fields corresponding to one or more first fields for which the identification information has not yet been specified from the fourth value to the third value and displays the changed information on the display unit; a third display control unit that, when the user changes the comprehensive filter setting from the second value to the first value, changes each of one or more second fields corresponding to one or more first fields for which the identification information has not yet been specified from the third value to the fourth value and displays the changed information on the display unit; The communication device of claim 1 , comprising:

3. The communication device according to claim 2 , wherein the designation screen further includes a designation area for designating the comprehensive filter setting.

4. the first change unit, when the user changes the comprehensive filter setting from the first value to the second value, does not change any of the one or more individual filter settings for which identification information is specified, among the plurality of individual filter settings; 2. The communication device according to claim 1, wherein when the user changes the comprehensive filter setting from the second value to the first value, the second change unit does not change any of the one or more individual filter settings for which identification information is specified, among the plurality of individual filter settings.

5. The communication device further comprises: a fourth display control unit that, when the comprehensive filter setting is changed from the first value to the second value by the user, causes a first selection screen to be displayed on a display unit for selecting whether or not to change each of one or more individual filter settings, among the plurality of individual filter settings, for which identification information is specified, from the fourth value to the third value; a fifth display control unit that, when the user changes the comprehensive filter setting from the second value to the first value, causes a second selection screen to be displayed on the display unit for selecting whether or not to change each of one or more individual filter settings, among the plurality of individual filter settings, for which identification information is specified, from the third value to the fourth value; The communication device of claim 1 , comprising:

6. the identification information is an IP address, the first change unit further changes, when the comprehensive filter setting is changed from the first value to the second value, each of one or more individual filter settings for which an IP address is specified, from the fourth value to the third value without accepting a change operation from the user; the second change unit further changes, when the comprehensive filter setting is changed from the second value to the first value, each of one or more individual filter settings for which an IP address is specified, from the third value to the fourth value without accepting a change operation from the user; The communication device further comprises: a first inversion unit that, when the inclusive filter setting is changed from the first value to the second value, inverts a portion of the IP address that is not masked by a subnet mask for each of one or more individual filter settings in which an IP address is specified; a second inversion unit that, when the comprehensive filter setting is changed from the second value to the first value, inverts a portion of the IP address that is not masked by a subnet mask for each of one or more individual filter settings in which an IP address is specified; The communication device of claim 1 , comprising:

7. each of the plurality of individual filter settings has a priority; The communication device of claim 1 , wherein when an individual filter setting with a higher priority conflicts with an individual filter setting with a lower priority, the individual filter setting with the higher priority is applied.

8. 1. A computer program for a communication device, comprising: The communication device includes a memory that stores a comprehensive filter setting and a plurality of individual filter settings, the inclusive filter setting indicates either a first value corresponding to allowing communication with all external devices or a second value corresponding to not allowing communication with all external devices; the memory, wherein each of the plurality of individual filter settings indicates either a third value corresponding to permitting communication with an external device identified by identification information designated by a user, or a fourth value corresponding to not permitting communication with the external device; The computer of the communication device comprises the following parts: a first change unit that, when the user changes the comprehensive filter setting from the first value to the second value, changes each of one or more individual filter settings, for which identification information has not yet been specified, from the fourth value to the third value, among the plurality of individual filter settings, without accepting a change operation from the user; a second change unit that, when the user changes the comprehensive filter setting from the second value to the first value, changes each of one or more individual filter settings for which the identification information has not yet been specified, among the plurality of individual filter settings, from the third value to the fourth value without accepting a change operation from the user; A computer program that functions as a

9. 1. A method performed by a communication device, comprising: The communication device includes a memory that stores a comprehensive filter setting and a plurality of individual filter settings, the inclusive filter setting indicates either a first value corresponding to allowing communication with all external devices or a second value corresponding to not allowing communication with all external devices; the memory, wherein each of the plurality of individual filter settings indicates either a third value corresponding to permitting communication with an external device identified by identification information designated by a user, or a fourth value corresponding to not permitting communication with the external device; The method comprises: a first change step of changing, when the user changes the comprehensive filter setting from the first value to the second value, one or more individual filter settings for which identification information has not yet been specified among the plurality of individual filter settings from the fourth value to the third value without accepting a change operation from the user; a second change step of changing, when the user changes the comprehensive filter setting from the second value to the first value, one or more individual filter settings for which the identification information has not yet been specified among the plurality of individual filter settings from the third value to the fourth value without accepting a change operation from the user; A method comprising:

Images