Information processing apparatus, image forming apparatus, information processing method, program, and information processing system

Abstract

To improve the efficiency of network address management by preventing an unnecessary network address from being added to a device.SOLUTION: An information processing apparatus applied to a predetermined system that restricts access from a network includes an access management unit that counts records of access to the predetermined system and records of use of a function of the predetermined system, and an address management unit that selects a network address registered in the predetermined system as a candidate to be deleted based on the records of access and the records of use counted within a certain period.SELECTED DRAWING: Figure 8

Description

[Technical Field]

[0001] The present invention relates to an information processing apparatus, an image forming apparatus, an information processing method, a program, and an information processing system. [Background technology]

[0002] In today's highly information-oriented society, there is an ever-increasing demand for stronger security. Systems that are expected to be used by many users, such as multifunction peripherals (MFPs), are equipped with a firewall function based on network addresses (Media Access Control (MAC) addresses or Internet Protocol (IP) addresses). To prevent unnecessary network addresses from being registered in devices such as MFPs, a system has been proposed that sends an Internet Control Message Protocol (ICMP) echo request to a device, measures the number of days the device has not been used based on whether or not there is a response to the echo request, and reclaims unnecessary fixed IP addresses (see, for example, Patent Document 1). An image forming device that enables filtering by network address has also been proposed (see, for example, Patent Document 2). Summary of the Invention [Problem to be solved by the invention]

[0003] While the technology disclosed in Patent Document 1 can recover unnecessary fixed IP addresses, it has the problem that it does not make a judgment based on the usage history of the device's functions. For example, even if a device responds to an ICMP echo request, if the device's functions are not being used, it may be desirable to delete the network address of that device as an unnecessary network address.

[0004] The technology disclosed in Patent Document 2 has a problem in that network addresses are registered without taking into consideration the resource limitations on the number of network addresses that can be registered to a device. Due to resource limitations, it may be desirable to delete unused and unnecessary network addresses.

[0005] One embodiment of the present invention has been made in consideration of the above problems, and one of its objectives is to improve the efficiency of network address management by not adding unnecessary network addresses to devices. [Means for solving the problem]

[0006] An information processing device according to one embodiment of the present invention is applied to a specified system that restricts access from a network, and is characterized by having an access management unit that counts the number of accesses to the specified system and the number of usages of the functions of the specified system, and an address management unit that selects network addresses registered in the specified system as candidates for deletion based on the access history and usage history counted within a certain period of time. [Effects of the Invention]

[0007] By not adding unnecessary network addresses to devices, this contributes to more efficient network address management. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is an example of a network configuration diagram to which the information processing technology according to this embodiment is applied. [Figure 2] FIG. 2 is a diagram showing an example of the hardware configuration of the image forming apparatus according to this embodiment. [Figure 3] FIG. 3 is a diagram showing an example of the hardware configuration of the terminal device according to this embodiment. [Figure 4] FIG. 4 is an example of a hardware configuration diagram of a router according to this embodiment. [Figure 5]FIG. 5 is an example of a functional configuration diagram of the information processing device according to this embodiment. [Figure 6] FIG. 6 is a diagram showing an example of the functional configuration of the image forming apparatus according to this embodiment. [Figure 7] FIG. 7 is an example of a functional configuration diagram of a terminal device according to this embodiment. [Figure 8] FIG. 8 is an example of a flowchart showing the basic operation of the information processing device according to this embodiment. [Figure 9] FIG. 9 shows an example of a setting screen for setting filtering by MAC address in the filter function of the image forming apparatus according to the first embodiment. [Figure 10A] FIG. 10A is an example of a setting screen for solving the network address management problem in FIG. [Figure 10B] FIG. 10B is an example of a list of information on all devices on the same network as the image forming apparatus according to the first embodiment. [Figure 10C] FIG. 10C is an example of a screen prompting deletion of unnecessary MAC addresses in the filter function of the image forming apparatus according to the first embodiment. [Figure 11] FIG. 11 is an example of a flowchart for the image forming apparatus according to the first embodiment to determine an unnecessary MAC address to be deleted. [Figure 12] FIG. 12 shows an example of a setting screen for setting filtering by IP address in the filter function of the image forming apparatus according to the second embodiment. [Figure 13A] FIG. 13A is an example of a setting screen for solving problems with network address management in FIG. [Figure 13B] FIG. 13B is an example of a list of information on all devices that access the image forming apparatus according to the second embodiment. [Figure 13C] FIG. 13C shows an example of a screen prompting deletion of unnecessary IP addresses in the filter function of the image forming apparatus according to the second embodiment. [Figure 14]FIG. 14 is an example of a flowchart for the image forming apparatus according to the second embodiment to determine an unnecessary IP address to be deleted. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In the following embodiments, an example will be described in which information processing technology for improving the efficiency of network address management is applied to an image forming apparatus. However, the present invention is not limited to this example. The information processing technology of the embodiments can also be applied to other systems and devices that have network addresses. For example, the information processing technology of the embodiments can also be applied to output devices such as projectors, IWBs (Interactive Whiteboards: electronic whiteboards with intercommunication functions), digital signage, HUD (Head Up Display) devices, industrial machinery, spherical imaging devices, video conferencing terminals, imaging devices, sound collection devices, medical equipment, network home appliances, automobiles (Connected Cars), notebook PCs (Personal Computers), mobile phones, smartphones, tablet terminals, game consoles, PDAs (Personal Digital Assistants), digital cameras, wearable PCs, desktop PCs, servers, scanners, printers, facsimiles, etc. Terminal devices such as notebook PCs and image forming apparatuses may be simply referred to as "devices" or "equipment."

[0010] FIG. 1 is an example of a network configuration diagram to which the information processing technology according to this embodiment is applied.

[0011] 1, a network A and a network B are constructed by a router 80a and a router 80b, respectively, and the routers 80a and 80b are connected by wire or wirelessly. Here, the segments of the networks A and B are defined as the LAN (Local Area Network) side, and the network of the routers 80a and 80b is defined as the WAN (Wide Area Network) side.

[0012] Network A (LAN side) includes an image forming apparatus 10 equipped with a network address filtering function. The network address filtering function is implemented by an information processing device built into the image forming apparatus 10 or connected to the image forming apparatus 10. Network A includes a router 80a and multiple terminal apparatuses 20 (20a, 20b, and 20c) at the same L2 (Layer) level. Based on the filtering function of the image forming apparatus 10, the multiple terminal apparatuses 20 can send print requests, ICMP echo requests, and access the management screen of the image forming apparatus 10 via the router 80a. Among the multiple terminal apparatuses 20, some terminal apparatuses 20 frequently use functions of the image forming apparatus 10 (e.g., the printing function), while other terminal apparatuses 20 have never been powered on within a predetermined period.

[0013] At the same L2 level of network B (LAN side), there are router 80b and multiple terminal devices 20 (20d and 20e). Based on the filter function of image forming device 10 in network A (LAN side), the multiple terminal devices 20 can send print requests, ICMP echo requests, and access the management screen of image forming device 10 from router 80b through the WAN-side network via router 80a. Among the multiple terminal devices 20, some terminal devices 20 frequently use functions of image forming device 10 (for example, the print function), while other terminal devices 20 have not used the print function even once within a predetermined period.

[0014] From a security standpoint, it may be desirable to use the above-described filter function to prevent a terminal device 20 that has not used the image forming device 10 within a predetermined period from using the image forming device 10. In other words, it may be desirable to remove the terminal device 20 from the network address filter list registered in the image forming device 10. The determination of whether the image forming device 10 has been used within the predetermined period is made by an information processing device incorporated in or connected to the image forming device 10. The network address used in the above-described filter function may be, for example, at least one of an IP address and a MAC address.

[0015] For example, when configuring MAC address filtering in the filter function of the image forming apparatus 10, it is meaningful to specify the MAC addresses of the router 80a and multiple terminal devices 20 (20a, 20b, and 20c) that are at the same L2 level as network A. In more general terms, it is meaningful to configure MAC address filtering for devices that exist within the same network on the LAN side. On the other hand, specifying the MAC addresses of the router 80b and multiple terminal devices 20 (20d and 20e), which are not at the same L2 level as network A, is meaningless because MAC addresses function at the L2 level and source MAC address information is not retained between different L2 segments via the router 80, which functions at the L3 level. In more general terms, MAC address filtering across a WAN is meaningless. However, an administrator who is not familiar with networks may register unnecessary MAC addresses without knowing the reason for doing so. This can complicate network address management.

[0016] For example, when setting up filtering by IP address in the filter function of image forming device 10, it makes sense to specify the IP addresses of router 80a and multiple terminal devices 20 (20a, 20b, and 20c) on network A, and it also makes sense to specify the IP addresses of router 80b and multiple terminal devices 20 (20d and 20e) through which packets can reach image forming device 10.

[0017] Therefore, when setting up filtering of network addresses such as MAC addresses, it may be desirable from the viewpoint of network address management not to add unnecessary network addresses to the image forming apparatus 10.

[0018] <Hardware configuration> Next, an example of the hardware configuration of each device according to this embodiment will be described.

[0019] <Hardware configuration of image forming device> 2 is a diagram showing an example of the hardware configuration of the image forming apparatus 10 according to this embodiment. The image forming apparatus 10 includes a controller 110, a short-range communication circuit 120, an engine control unit 130, an operation panel 140, and a network I / F (Interface) 150.

[0020] Of these, the controller 110 has a CPU 101, which is the main part of the computer, a system memory (MEM-P) 102, a north bridge (NB) 103, a south bridge (SB) 104, an ASIC (Application Specific Integrated Circuit) 106, a local memory (MEM-C) 107, which is a storage unit, an HDD (Hard Disk Drive) controller 108, and an HD (Hard Disk) 109, which is also a storage unit, and is configured such that the NB 103 and the ASIC 106 are connected by an AGP (Accelerated Graphics Port) bus 121.

[0021] Of these, the CPU 101 is a control unit that performs overall control of the image forming apparatus 10.

[0022] The NB 103 is a bridge for connecting the CPU 101 with the MEM-P 102, the SB 104, and the AGP bus 121, and includes a memory controller that controls reading and writing to the MEM-P 102, a PCI (Peripheral Component Interconnect) master, and an AGP target.

[0023] MEM-P102 consists of ROM (Read Only Memory) 102a, which is memory for storing programs and data that realize each function of controller 110, and RAM (Random Access Memory) 102b, which is used for expanding programs and data and as drawing memory during memory printing.

[0024] The programs stored in RAM 102b may be configured to be provided by being recorded in an installable or executable file format on a computer-readable recording medium such as a CD (Compact Disc)-ROM, a CD-R (Recordable), or a DVD (Digital Versatile Disc).

[0025] The SB104 is a bridge for connecting the NB103 with PCI devices and peripheral devices.

[0026] The ASIC 106 is an integrated circuit (IC) for image processing applications that has hardware elements for image processing, and serves as a bridge connecting the AGP bus 121, PCI bus 122, HDD controller 108, and MEM-C 107. The ASIC 106 includes a PCI target and AGP master, an arbiter (ARB) that forms the core of the ASIC 106, a memory controller that controls the MEM-C 107, a plurality of direct memory access controllers (DMACs) that perform image data rotation using hardware logic, and a PCI unit that transfers data between the scanner unit 131, printer unit 132, and facsimile unit 133 via the PCI bus 122. A Universal Serial Bus (USB) interface or an Institute of Electrical and Electronics Engineers 1394 (IEEE1394) interface may be connected to the ASIC 106.

[0027] The MEM-C 107 is a local memory used as an image buffer for copying and a code buffer.

[0028] The HD 109 is a storage for storing image data, font data used during printing, and forms. The HD 109 controls the reading and writing of data from and to the HD 109 under the control of the CPU 101.

[0029] The AGP bus 121 is a bus interface for a graphics accelerator card proposed to speed up graphics processing, and by directly accessing the MEM-P 102 at high throughput, the graphics accelerator card can be made faster.

[0030] The short-range communication circuit 120 includes a short-range communication circuit antenna 120a. The short-range communication circuit 120 is a communication circuit such as NFC (Near Field Communication) or Bluetooth (registered trademark).

[0031] The engine control unit 130 includes a scanner unit 131 , a printer unit 132 , and a facsimile unit 133 .

[0032] The operation panel 140 includes a panel display unit 140a such as a touch panel that displays current setting values ​​and selection screens, etc., and accepts input from the operator, and hard keys 140b that include a numeric keypad that accepts setting values ​​for image formation conditions such as density setting conditions, and a start key that accepts a copy start instruction.

[0033] The controller 110 controls the entire image forming apparatus 10, for example, controlling drawing, communication, input from the operation panel 140, and the like.

[0034] The scanner unit 131 or the printer unit 132 includes an image processing unit such as error diffusion and gamma conversion.

[0035] The image forming device 10 can be switched between the document box function, copy function, printer function, and facsimile function in sequence using the application switching key on the operation panel 140. When the document box function is selected, the image forming device 10 enters the document box mode, when the copy function is selected, the image forming device 10 enters the copy mode, when the printer function is selected, the image forming device 10 enters the printer mode, and when the facsimile mode is selected, the image forming device 10 enters the facsimile mode.

[0036] The network I / F 150 is an interface for performing data communication over a network, and has the functions of wired network connection and wireless network connection.

[0037] The short-range communication circuit 120 and the network I / F 150 are electrically connected to the ASIC 106 via a PCI bus 122 .

[0038] <Hardware configuration of terminal device> 3 is an example of a hardware configuration diagram of the terminal device 20 according to this embodiment. The terminal device 20 is constructed by a computer, and includes a CPU 201, a ROM 202, a RAM 203, a HD 204, an HDD controller 205, a display 206, an external device connection I / F 207, a network I / F 208, a bus line 209, a keyboard 210, a pointing device 211, an optical drive 213, and a media I / F 215.

[0039] The CPU 201 controls the overall operation of the terminal device 20 .

[0040] The ROM 202 stores programs used to drive the CPU 201, such as an IPL (Initial Program Loader).

[0041] The RAM 203 is used as a work area for the CPU 201 .

[0042] The HD 204 stores various data such as programs.

[0043] The HDD controller 205 controls reading and writing of various data from and to the HD 204 under the control of the CPU 201 .

[0044] The display 206 displays various types of information such as a cursor, a menu, a window, text, or an image.

[0045] The external device connection I / F 207 is an interface for connecting various external devices, such as a USB (Universal Serial Bus) memory or a printer.

[0046] The network I / F 208 is an interface for data communication using a communication network, and has the functions of wired network connection and wireless network connection.

[0047] The bus line 209 is an address bus, a data bus, etc. for electrically connecting the components such as the CPU 201 shown in FIG.

[0048] The keyboard 210 is a type of input means having a plurality of keys for inputting characters, numbers, various instructions, and the like.

[0049] The pointing device 211 is a type of input means for selecting and executing various instructions, selecting a processing target, moving a cursor, and the like.

[0050] The optical drive 213 controls reading and writing of various data from and to an optical medium 212, which is an example of a removable recording medium.

[0051] The optical media 212 may be a CD, DVD, Blu-Ray (registered trademark), or the like.

[0052] A media I / F 215 controls reading and writing (storing) of data from and to a recording medium 214 such as a flash memory.

[0053] <Router hardware configuration> 4 is an example of a hardware configuration diagram of a router 80 according to this embodiment. The router 80 is constructed by a computer and includes, for example, a CPU 801, a ROM 802, a RAM 803, a HDD 804, a network I / F 805, a display 806, and an input device 807. The hardware components of the router 80 are connected via a bus 808.

[0054] When the CPU 801 receives a request for belonging from an external device via the network I / F 805, it performs processing for the external device to connect to the router 80. Here, the external device may be, for example, the image forming device 10 or the terminal device 20. Hereinafter, the external device may be simply referred to as a device.

[0055] The ROM 802 stores, for example, applications, data, or parameters executed by the CPU 801.

[0056] The RAM 803 stores, for example, data used by the program, data generated by the program, parameters, and the like when the CPU 801 executes the program.

[0057] The HDD 804 stores various types of information, programs, and the like.

[0058] The network I / F 805 communicates with external devices via a network and has the functions of wired and wireless network connections.

[0059] The display 806 displays, for example, various types of information about external devices.

[0060] The input device 807 accepts user operations on external devices and notifies the CPU 801 of the contents of the control accepted from the user. The input device 807 is configured by, for example, a touch panel, a mouse, a keyboard, and the like.

[0061] <Functional configuration> Next, an example of the functional configuration of each device according to this embodiment will be described.

[0062] <Functional configuration of information processing device> FIG. 5 is an example of a functional configuration diagram of the information processing device 160 according to this embodiment.

[0063] The information processing device 160 is mainly composed of a controller and a memory, and may be incorporated into the image forming device 10, or may be connected to the image forming device 10 via a network or the like. The controller may also be referred to as a processor.

[0064] The information processing device 160 has an access management unit 1001, an address management unit 1002, and a storage unit 1003. Each of these units is a function or means realized by the controller of the information processing device 160 executing one or more programs stored in a memory or the like and controlling each piece of hardware of the information processing device 160.

[0065] The access management unit 1001 counts the number of accesses to a specific device and the number of uses of a function of a specific device for each network address. The number of accesses to a specific device may be referred to as an access history. The number of uses of a function of a specific device may be referred to as a usage history. Hereinafter, the access history and usage history of a specific device may be collectively referred to as device access information. The specific device may be the image forming device 10, an IWB, an omnidirectional imaging device, a video conference terminal, a projector, etc.

[0066] Based on device access information within a predetermined period, address management unit 1002 determines whether or not the network address of a specific device should be deleted from the network address filter list stored in storage unit 1003, and selects it as a candidate for deletion. In other words, address management unit 1002 determines whether or not the network address of a specific device should be deleted based not only on the access history to the specific device but also on the usage history of the specific device, and selects it as a candidate for deletion.

[0067] The storage unit 1003 stores the above-mentioned device access information and the above-mentioned network address filter list.

[0068] <Functional configuration of image forming apparatus> FIG. 6 is an example of a functional configuration diagram of an image forming apparatus 10 according to this embodiment. The image forming apparatus 10 includes an information processing device 160, a filter processing unit 1005, a job processing unit 1006, and a communication unit 1007. These units are functions or means realized by the CPU 101 of the image forming apparatus 10 executing one or more programs stored in the RAM 102b, etc., shown in FIG. 2, and controlling the hardware of the image forming apparatus 10. The information processing apparatus 160 (image forming apparatus 10) is realized by hardware resources including the CPU 101, ROM 102a, RAM 102b, and operation panel 140 shown in FIG. 2. The information processing apparatus 160 also includes an access management unit 1001, an address management unit 1002, a storage unit 1003 that stores an address filter database 1003a (hereinafter abbreviated as address filter DB 1003a) and a device access information database 1003b (hereinafter abbreviated as device access information DB 1003b), and a display control unit 1004. These units are functions or means realized by the CPU 101 of the information processing device 160 (image forming device 10) executing one or more programs stored in the RAM 102b or the like and controlling the hardware of the information processing device 160. In this example, the information processing device 160 is built into the image forming device 10, but it may be external to the image forming device 10 or connected to the image forming device 10 via a network or the like.

[0069] The access management unit 1001 counts the access history to the image forming apparatus 10 and the usage history of the image forming apparatus 10 for each network address. The usage history may include the number of times printing has been performed, the number of times the management screen has been accessed, the number of transmission control packets, the number of data packets, the number of network control packets, etc. The transmission control packets may be TCP (Transmission Control Protocol) packets. The data packets may be UDP (User Datagram Protocol) packets. The network control packets may be ICMP packets.

[0070] The address management unit 1002 determines whether or not to delete the network address of a specific device based on device access information of the image forming device 10 within a predetermined period, and selects it as a candidate for deletion. When the network address of a specific device is deleted by a user operation or the like, and there is a request to restore the deleted network address, the address management unit 1002 restores the deleted network address based on the deletion history stored in the storage unit 1003. This is effective when a network administrator mistakenly deletes a network address that should not be deleted.

[0071] The storage unit 1003 includes an address filter DB 1003a and a device access information DB 1003b. The address filter DB 1003a stores, for example, the network addresses of external devices accessing the image forming apparatus 10, access from those network addresses, and whether or not to permit certain packets. The device access information DB 1003b stores, for example, a network address filter list in which the access history of the image forming apparatus 10 for each network address and the usage history of the image forming apparatus 10 for each network address are registered. Hereinafter, the address filter DB 1003a and the device access information DB 1003b may be collectively referred to as device information. The contents of the address filter DB 1003a can be registered only by a network administrator from the operation panel 140 of the image forming apparatus 10 or from an external device that accesses the management screen of the image forming apparatus 10. Herein, the external device may access the management screen of the image forming apparatus 10 using a browser. An example of a network address filter list will be described later.

[0072] When the user sets the network address filter function, the display control unit 1004 displays the results of the setting. Also, after the address management unit 1002 selects a specific network address as a candidate for deletion, the display control unit 1004 displays the candidate for deletion. This makes it easier for the network administrator to manage the addition and deletion of network addresses.

[0073] The filtering processing unit 1005 determines whether to permit or deny a packet indicating a specific request from an external device received by the communication unit 1007 based on the contents of the address filter DB 1003a. If the determination is to deny the packet, the filtering processing unit 1005 discards the packet. Note that the packet may be, for example, a packet related to a print request.

[0074] The job processing unit 1006 performs processing according to a packet indicating a specific request from an external device received by the communication unit 1007. For example, if the packet is a print request, the job processing unit 1006 performs printing processing of the print data.

[0075] The communication unit 1007 uses wired or wireless communication technology to send and receive packets relating to print requests on the network, packets relating to access to the management screen of the image forming apparatus 10, and the like.

[0076] Note that a system in which image formation is performed by print processing when image forming apparatus 10 receives a print request packet from an external device may be referred to as an image forming system. The external device may be terminal device 20. The image forming system is an example of a predetermined system.

[0077] <Functional configuration of terminal device> FIG. 7 is an example of a functional configuration diagram of the terminal device 20 according to this embodiment.

[0078] The terminal device 20 has a job processing unit 1101, a storage unit 1102, a reception unit 1103, a communication unit 1104, and a screen display unit 1105. Each of these units is a function or means realized by the CPU 201 of the terminal device 20 executing one or more programs stored in the RAM 203 or the like and controlling the hardware of the terminal device 20.

[0079] The job processing unit 1101 executes a specific application stored in the storage unit 1102 and processes information input by the reception unit 1103. The specific application stored in the storage unit 1102 may be, for example, a browser. The information input by the reception unit 1103 may be, for example, a user ID and password for logging in to a management screen of the image forming apparatus 10 on the browser. Alternatively, the information input by the reception unit 1103 may be, for example, a print request for a page opened on the browser.

[0080] The communication unit 1104 uses wired or wireless communication technology to send and receive packets relating to print requests on the network, packets relating to access to the management screen of the image forming apparatus 10, and the like.

[0081] For example, the screen display unit 1105 displays information input by the reception unit 1008 and displays setting information for the filter function when setting the filter function of the image forming apparatus 10. Furthermore, the screen display unit 1105 also displays a preview of the page opened on the browser before sending a print request to the image forming apparatus 10, for example.

[0082] <Processing flow> Next, the flow of information processing related to improving the efficiency of network address management in a predetermined system according to this embodiment will be described.

[0083] <Basic operation of information processing device> FIG. 8 is an example of a flowchart showing the basic operation of the information processing device 160 according to this embodiment.

[0084] In step S1001, the information processing device 160 reads from the storage unit 1003 the device access information including the access record and usage record for each network address that have been counted up to this point.

[0085] In step S1002, the information processing device 160 starts counting the device access information required to determine that an unnecessary network address is to be deleted.

[0086] In step S1003, the information processing device 160 acquires the current network address filter list, and in step S1004, compiles device access information within a predetermined period.

[0087] The subsequent steps S1005 to S1009 are processing for determining the network address of an external device to be deleted from the information processing device 160.

[0088] An index indicating a row of the network address filter list registered in information processing device 160 is set to n, and n is initialized to 1. Then, in step S1005, information processing device 160 determines whether the nth network address in the list is included in the network addresses that have been accessed within a predetermined period of time. If the nth network address is included in the network addresses that have been accessed within the predetermined period of time (step S1005: Yes), the process proceeds to step S1007, and if the nth network address is not included in the network addresses that have been accessed within the predetermined period of time (step S1005: No), the process proceeds to step S1006.

[0089] In step S1007, information processing device 160 determines whether an external device having an n-th network address is using a function of a specific device. If an external device having an n-th network address is using a function of a specific device (step S1007: Yes), the process proceeds to step S1008. If an external device having an n-th network address is not using a function of a specific device (step S1007: No), the process proceeds to step S1006.

[0090] In step S1006, the information processing device 160 determines that the nth network address is to be deleted. In addition, in step S1008, the information processing device 160 determines that the nth network address is not to be deleted. After both steps, n is incremented, and in step S1009, unless the number of lines in the network address filter list is exceeded (step S1009: No), the information processing device 160 returns to step S1005 and repeatedly determines whether the nth network address is to be deleted.

[0091] After the information processing device 160 has finished determining whether all network addresses in the network address filter list are to be deleted (step S1009: Yes), in step S1010, it stops counting the device access information and stores the counting results in the memory unit 1003 of the information processing device 160.

[0092] First Embodiment 9 shows an example of a setting screen for setting filtering by MAC address in the filter function of the image forming apparatus 10 according to the first embodiment. This setting screen or a user interface related to this setting screen may be applied to the browser of the terminal device 20, the operation panel 140 of the image forming apparatus 10, or the display control unit 1004 of the information processing apparatus 160.

[0093] On the setting screen 1300, the access control range is set to "enabled (MAC address)" to perform MAC address filtering. Furthermore, to enhance security, the default policy for MAC address filtering is set to "deny." Under these settings, the network administrator attempts to register the MAC addresses of external devices that can use the image forming apparatus 10.

[0094] When registering MAC address filtering, the MAC address to be filtered can be configured to specify whether it is an "exact match" MAC address or a "match in OUI (Organizationally Unique Identifier)" MAC address, where OUI refers to the first three bytes of the MAC address.

[0095] 9, the number of MAC addresses that can be registered in the MAC address filtering of the image forming apparatus 10 is set to 12, but this is not limited to this. However, in actual operation, there is a limit of up to 100, for example.

[0096] 1, consider a case where a user accesses the management screen of the image forming device 10 from a browser on the terminal device 20a on network A and sets up MAC address filtering for the terminal device 20d on network B. In this case, the network administrator should normally set up the system to allow the MAC address of the router 80a, but if the network administrator lacks knowledge, there is a possibility that the administrator may set up the system to allow the MAC address of the terminal device 20d on network B.

[0097] 1, consider a case where a user accesses the management screen of the image forming device 10 from a browser on a terminal device 20a in network A and sets up MAC address filtering for the image forming device 10. In this case, the network administrator may accidentally set up the MAC address of a terminal device 20c that exists in network A but has never been turned on within a predetermined period of time to be permitted.

[0098] Regarding the case where a network administrator sets up a setting to allow unnecessary MAC addresses, let us consider a case where there are 100 external devices with MAC addresses that the administrator wants to allow on network A. If the image forming apparatus 10 restricts the setting of MAC address filtering to a maximum of 100 devices, then setting up the setting to allow unnecessary MAC addresses as described above would pose a serious problem in terms of network address management.

[0099] Fig. 10A is an example of a setting screen for solving the problem of network address management in Fig. 9. Note that the setting screen in Fig. 10A may be applied to the browser of the terminal device 20, as in Fig. 9, or may be applied to the operation panel 140 of the image forming device 10.

[0100] The setting screen 1400 includes an icon 1401 for referencing information on all devices on the same network as the image forming device 10, and a table 1402 that displays the access history and usage history of the image forming device 10 for each MAC address registered in the image forming device 10, and device information for each MAC address registered in the image forming device 10. The table 1402 includes an icon for displaying a pop-up prompting the user to delete a MAC address registered in the image forming device 10.

[0101] On the setting screen 1400, for the reasons mentioned above, it may be better to delete MAC addresses that have extremely few access records to the image forming device 10 within a predetermined period, or MAC addresses that have many access records to the image forming device 10 but have extremely few or no use records of the image forming device 10. Therefore, to make it easier for the network administrator to delete such MAC addresses, icons 1402a and 1402b are displayed in the device information displayed for each MAC address to encourage the deletion of unnecessary MAC addresses.

[0102] 10B is an example of a list of information about all devices on the same network as the image forming apparatus 10 according to the first embodiment. FIG. 10B is displayed after tapping or clicking icon 1401 in FIG. 10A. FIG. 10B displays a list of the MAC address of the image forming apparatus 10, as well as the access history and usage history of MAC addresses that are permitted to access the image forming apparatus 10, and the access history of MAC addresses that are not permitted to access the image forming apparatus 10. This allows the network administrator to see which MAC addresses are permitted to access the image forming apparatus 10 and which are not, as well as the access history and usage history of each MAC address, enabling efficient management of network addresses.

[0103] Fig. 10C is an example of a screen that prompts the user to delete unnecessary MAC addresses in the filter function of the image forming apparatus 10 according to the first embodiment. Fig. 10C is displayed after tapping or clicking on icons 1402a and 1402b in Fig. 10A.

[0104] As shown by icons 1402a and 1402b, a pop-up is displayed to prompt the user to delete from the MAC address filtering list of the image forming device 10 the MAC addresses of devices that have not been detected within a predetermined period of time on the same network as the image forming device 10 (i.e., devices that have not been accessed), and the MAC addresses of devices that have accessed the image forming device 10 within a predetermined period of time but have not been used. This makes it easier for the network administrator to find MAC addresses that are not required for the filtering function of the image forming device 10 and allows the administrator to delete the unnecessary MAC addresses, thereby enabling efficient management of network addresses.

[0105] FIG. 11 is an example of a flowchart for the image forming apparatus 10 according to the first embodiment to determine an unnecessary MAC address to be deleted.

[0106] In step S1501, the image forming apparatus 10 reads out the device access information including the access record and the usage record for each MAC address that have been counted up to this point.

[0107] In step S1502, the image forming apparatus 10 starts counting the device access information required to determine that an unnecessary MAC address is to be deleted.

[0108] In step S1503, the image forming apparatus 10 acquires a list of current MAC address filtering settings. As a result, the image forming apparatus 10 acquires information equivalent to a list of all device information on the same network as the image forming apparatus 10 (i.e., FIG. 10B) before counting device access information.

[0109] In step S1504, the image forming apparatus 10 compiles the device access information for a predetermined period of time, which can be freely set by the network administrator.

[0110] From here on, steps S1505 to S1509 will be described as processing for determining a MAC address to be deleted from the image forming apparatus 10.

[0111] Let n be a row index indicating the list of MAC addresses registered in the image forming apparatus 10, and n is initialized to 1. Then, in step S1505, the image forming apparatus 10 determines whether the nth MAC address in the list is included in the MAC addresses that have been accessed within a predetermined period of time. If the nth MAC address is included in the MAC addresses that have been accessed within the predetermined period of time (step S1505: Yes), the process proceeds to step S1507, and if the nth MAC address is not included in the MAC addresses that have been accessed within the predetermined period of time (step S1505: No), the process proceeds to step S1506.

[0112] In step S1507, the image forming apparatus 10 determines whether the device having the nth MAC address is using a function of the image forming apparatus 10 (for example, a print function or access to a management screen). If the device having the nth MAC address is using a function of the image forming apparatus 10 (step S1507: Yes), the process proceeds to step S1508. If the device having the nth MAC address is not using a function of the image forming apparatus 10 (step S1507: No), the process proceeds to step S1506. Note that, although step S1507 is limited to the function of the image forming apparatus 10, the present invention is not limited thereto. As described above, in the present invention, the image forming apparatus 10 is a type of information processing apparatus 160, and therefore step S1507 may be, for example, a function of an IWB, an omnidirectional imaging device, a video conference terminal, a projector, or the like.

[0113] Information about a device having an nth MAC address, and information about the access history and usage history of the device having the nth MAC address may be generated by the learning effect of machine learning. Information about the number of devices connectable to the network and the number of devices currently connected to the network may be generated by the learning effect of machine learning. The image forming apparatus 10 may have a function to predict future network operation status using machine learning and display (present) the predicted status separately from the network addresses of devices to be removed. Here, machine learning refers to a technology that enables a computer to acquire human-like learning capabilities. It refers to a technology in which a computer autonomously generates algorithms necessary for judgments such as data identification from previously acquired learning data and applies these algorithms to new data to make predictions. The learning method for machine learning may be supervised learning, unsupervised learning, semi-supervised learning, reinforcement learning, or deep learning, or a combination of these learning methods. Any learning method for machine learning is acceptable.

[0114] In step S1506, the image forming apparatus 10 determines that the nth MAC address is to be deleted. In addition, in step S1508, the image forming apparatus 10 determines that the nth MAC address is not to be deleted. After both steps, n is incremented, and in step S1509, the image forming apparatus 10 repeatedly determines whether or not to delete the nth MAC address unless the number of lines in the list of MAC addresses registered in the image forming apparatus 10 is exceeded (step S1509: No). The MAC address to be deleted is an example of a first network address.

[0115] After determining whether all MAC addresses in the MAC address list are to be deleted (step S1509: Yes), the image forming apparatus 10 ends counting the device access information in step S1510. The image forming apparatus 10 also stores the counting results in the image forming apparatus 10.

[0116] According to the above flowchart, the image forming apparatus 10 can determine unnecessary MAC addresses to be deleted, and can prompt the network administrator to delete the unnecessary MAC addresses, as shown in Figures 10A and 10C. This allows the network administrator to manage network addresses efficiently.

[0117] As described above, according to this embodiment, when filtering by MAC addresses is set in the filter function of the image forming apparatus 10, the network administrator can efficiently manage network addresses.

[0118] <Second embodiment> 12 shows an example of a setting screen for setting filtering by IP address in the filter function of the image forming apparatus 10 according to the second embodiment. This setting screen or a user interface related to this setting screen may be applied to the browser of the terminal device 20, the operation panel 140 of the image forming apparatus 10, or the display control unit 1004 of the information processing apparatus 160.

[0119] On the setting screen 1600, the access control range is set to "enabled (FW)" to perform IP address filtering. Under these settings, the network administrator can set the IP addresses, subnet masks, port numbers, and protocols that are permitted to access the image forming apparatus 10 in each setting. FW is an abbreviation for Firewall.

[0120] This is the same as the MAC address filtering in the first embodiment in that only access from network addresses registered in the filter function of the image forming apparatus 10 is permitted. However, what differs from the first embodiment is that the network addresses of multiple devices can be registered by specifying a subnet mask. For example, if the remote IP address in setting 1 is set to "10.60.10.254 / 32," it means a single IP address, "10.60.10.254." However, if the remote IP address in setting 2 is set to "10.60.20.1 / 24," it means a range of IP addresses from "10.60.20.1" to "10.60.20.255."

[0121] On the other hand, as in the first embodiment, for example, in the network configuration diagram of Figure 1, the network administrator may set up the network A to allow access from the IP address of terminal device 20c that exists in network A but has never been turned on within a specified period of time.

[0122] Fig. 13A is an example of a setting screen for solving problems with network address management in Fig. 12. Note that the setting screen in Fig. 13A may be applied to the browser of the terminal device 20, as in Fig. 12, or may be applied to the operation panel 140 of the image forming device 10.

[0123] The setting screen 1700 includes an icon 1701 for referencing information on all devices that access the image forming device 10, and a table 1702 that displays the access history, usage history, and number of packets of a specific protocol to the image forming device 10 for each IP address registered in the image forming device 10, as well as device information for each IP address registered in the image forming device 10. Table 1702 includes an icon for displaying a pop-up prompting the user to delete an IP address registered in the image forming device 10.

[0124] On the setting screen 1700, for the reasons mentioned above, it may be better to delete IP addresses that have extremely few access records to the image forming device 10 within a predetermined period, or IP addresses that have many access records to the image forming device 10 but have extremely few or no use records of the image forming device 10. Therefore, to make it easier for the network administrator to delete such IP addresses, an icon 1702a is displayed in the device information displayed for each IP address to prompt the deletion of unnecessary IP addresses.

[0125] FIG. 13B shows an example of a list of all device information accessing the image forming apparatus 10 according to the second embodiment. FIG. 13B is displayed after tapping or clicking icon 1702a in FIG. 13A. In FIG. 13B, a list is displayed, including the IP address of the image forming apparatus 10, as well as the access history, usage history, and number of packets of a specific protocol for IP addresses that can access the image forming apparatus 10, and the access history of IP addresses that cannot access the image forming apparatus 10. This allows the network administrator to know which IP addresses are permitted to access the image forming apparatus 10 and which are not, as well as the access history, usage history, and communication protocol for each IP address, enabling efficient management of network addresses. Furthermore, displaying the number of packets of a specific communication protocol makes it easier for the network administrator to determine which communication protocols should be permitted.

[0126] Fig. 13C is an example of a screen prompting deletion of unnecessary IP addresses in the filter function of the image forming apparatus 10 according to the second embodiment. Fig. 13C is displayed after tapping or clicking on icon 1702a in Fig. 13A.

[0127] As shown in icon 1702a, a pop-up is displayed to prompt the user to delete from the list of IP address filtering of the image forming apparatus 10 the IP addresses of devices whose access to the image forming apparatus 10 has not been detected within a predetermined period (i.e., devices with no access history), and the IP addresses of devices that have accessed the image forming apparatus 10 within a predetermined period but have no usage history. This makes it easier for the network administrator to find IP addresses that are not required for the filtering function of the image forming apparatus 10, and enables the administrator to delete the unnecessary IP addresses, thereby enabling efficient management of network addresses.

[0128] FIG. 14 is an example of a flowchart for the image forming apparatus 10 according to the second embodiment to determine an unnecessary IP address to be deleted.

[0129] In step S1801, the image forming apparatus 10 reads out the device access information including the access record and the usage record for each IP address that have been counted up to this point.

[0130] In step S1802, the image forming apparatus 10 starts counting the device access information required to determine whether an unnecessary IP address should be deleted. The device access information also includes the number of packets of a specific protocol.

[0131] In step S1803, the image forming apparatus 10 acquires a list of current IP address filtering settings. As a result, the image forming apparatus 10 acquires information equivalent to a list of all device information accessing the image forming apparatus 10 (i.e., FIG. 13B) before counting the device access information.

[0132] In step S1804, the image forming apparatus 10 tallyes up the device access information within a predetermined period of time, which can be freely set by the network administrator.

[0133] From here on, steps S1805 to S1809 will be described as processing for determining an IP address to be deleted from the image forming apparatus 10.

[0134] Let n be a row index indicating the list of IP addresses registered in the image forming apparatus 10, and n is initialized to 1. Then, in step S1805, the image forming apparatus 10 determines whether the nth IP address in the list is included in the IP addresses that have been accessed within a predetermined period of time. If the nth IP address is included in the IP addresses that have been accessed within the predetermined period of time (step S1805: Yes), the process proceeds to step S1807, and if the nth IP address is not included in the IP addresses that have been accessed within the predetermined period of time (step S1805: No), the process proceeds to step S1806.

[0135] In step S1807, the image forming apparatus 10 determines whether the device having the nth IP address is using a function of the image forming apparatus 10 (for example, a print function or access to a management screen). If the device having the nth IP address is using a function of the image forming apparatus 10 (step S1807: Yes), the process proceeds to step S1808. If the device having the nth IP address is not using a function of the image forming apparatus 10 (step S1807: No), the process proceeds to step S1806. Note that, although step S1807 is limited to the function of the image forming apparatus 10, the present invention is not limited thereto. As described above, in the present invention, the image forming apparatus 10 is a type of information processing apparatus 160, and therefore step S1807 may be, for example, a function of an IWB, an omnidirectional imaging device, a video conference terminal, a projector, or the like.

[0136] The device information having the nth IP address, and information relating to the access history and usage history of the device having the nth IP address may be generated by the learning effect of machine learning. Similarly to the first embodiment, the information relating to the number of devices connectable to the network and the number of devices currently connected to the network may be generated by the learning effect of machine learning. The image forming apparatus 10 may have a function to predict the future network operation status by machine learning and display (present) it separately from the network address of the device to be deleted.

[0137] In step S1806, the image forming apparatus 10 determines that the nth IP address is to be deleted. In addition, in step S1808, the image forming apparatus 10 determines that the nth IP address is not to be deleted. After both steps, n is incremented, and in step S1809, the image forming apparatus 10 repeatedly determines whether or not the nth IP address is to be deleted unless it exceeds the number of lines in the list of IP addresses registered in the image forming apparatus 10 (step S1809: No). The IP address to be deleted is an example of a first network address.

[0138] After determining whether all IP addresses in the IP address list are to be deleted (step S1809: Yes), the image forming apparatus 10 ends counting the device access information including the number of packets of the specific protocol in step S1810. The image forming apparatus 10 also stores the counting result in the image forming apparatus 10.

[0139] According to the above flowchart, the image forming apparatus 10 can determine unnecessary IP addresses to be deleted, and can prompt the network administrator to delete the unnecessary IP addresses, as shown in Figures 13A and 13C. This allows the network administrator to manage network addresses efficiently.

[0140] As described above, according to this embodiment, when setting up filtering by IP address in the filter function of the image forming apparatus 10, the network administrator can efficiently manage network addresses.

[0141] While the present invention has been described above based on various embodiments, the present invention is not limited to the requirements set forth in the above embodiments. These aspects may be modified without departing from the spirit of the present invention and may be appropriately determined depending on the application. The above-described embodiments may be combined with one another. For example, both a MAC address and an IP address may be specified as the network address when setting the filter function of the image forming device 10, and the MAC address and IP address to be deleted may be determined based on the access history and usage history of the image forming device 10.

[0142] Furthermore, each function of the above-described embodiments can be realized by one or more processing circuits. Here, the term "processing circuit" in this specification includes a processor programmed to perform each function by software, such as a processor implemented by an electronic circuit, as well as devices such as an ASIC (Application Specific Integrated Circuit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and conventional circuit modules designed to perform each of the above-described functions.

[0143] Furthermore, the devices described in the embodiments represent only one of multiple computing environments for implementing the embodiments disclosed herein. In some embodiments, an image forming apparatus includes multiple computing devices, such as a server cluster. The multiple computing devices are configured to communicate with each other via any type of communication link, including a network, shared memory, etc., and perform the processes disclosed herein. Similarly, a terminal device may include multiple computing devices configured to communicate with the image forming apparatus and with each other.

[0144] For example, aspects of the present invention are as follows. <1> In an information processing device applied to a predetermined system that restricts access from a network, an access management unit that counts the access records to the predetermined system and the usage records of the functions of the predetermined system; an address management unit that selects network addresses registered in the predetermined system as candidates for deletion based on the access record and the usage record counted within a certain period of time; Information processing device. <2> a display control unit that displays the candidates to be deleted; a storage unit configured to store, when a first network address is deleted from the candidates to be deleted by a user operation, the deleted first network address as a deletion history; the address management unit restores the first network address based on the deletion history when a restoration request for the first network address is received. <1> The information processing device described in <3> a filtering processing unit that filters access to the predetermined system based on the network address managed by the address management unit; a user interface for setting the filter; The filter can be set from at least one of a browser and an information processing device. <1> or <2> The information processing device described in <4> The network address is at least one of an IP address and a MAC address. <1> from <3> 10. The information processing device according to claim 9, wherein: <5> the usage history includes at least one of the number of accesses to the predetermined system, the number of transmission control packets received by the predetermined system, the number of data packets received by the predetermined system, and the number of network control packets received by the predetermined system; <1> from <4> 10. The information processing device according to claim 9, wherein: <6> <1> from <5> an information processing device according to any one of the preceding claims; an image forming system as the predetermined system, Image forming device. <7> An information processing method executed by an information processing device applied to a predetermined system that restricts access from a network, comprising: a step of counting the access record to the predetermined system and the usage record of the function of the predetermined system; and selecting a network address registered in the predetermined system as a candidate for deletion based on the access record and the usage record counted within a certain period of time. Information processing methods. <8> An information processing device applied to a predetermined system that restricts access from a network, A process of counting the access records to the predetermined system and the usage records of the functions of the predetermined system; and selecting a network address registered in the predetermined system as a candidate for deletion based on the access record and the usage record counted within a certain period of time. program. <9> <1> from <5> an information processing device according to any one of the preceding claims; an image forming system as the predetermined system; a terminal device connected to the image forming system via a network, the image forming system receives a packet for the image forming system from the terminal device via the network; the terminal device transmits the packet to the image forming system; Information processing system. [Explanation of symbols]

[0145] 10 Image forming device 20 Terminal equipment 80 Router 140 Operation Panel 160 Information processing equipment 1001 Access Control Department 1002 Address Management Department 1003 Storage section 1004 Display control unit [Prior art documents] [Patent documents]

[0146] [Patent Document 1] Patent Publication No. 2007-104500 [Patent Document 2] Patent Publication No. 2014-048723

Claims

1. In an information processing device applied to a predetermined system that restricts access from a network, an access management unit that counts the access records to the predetermined system and the usage records of the functions of the predetermined system; an address management unit that selects network addresses registered in the predetermined system as candidates for deletion based on the access record and the usage record counted within a certain period of time; Information processing device.

2. a display control unit that displays the candidates to be deleted; a storage unit configured to store, when a first network address is deleted from the candidates to be deleted by a user operation, the deleted first network address as a deletion history; the address management unit restores the first network address based on the deletion history when a restoration request for the first network address is received; The information processing device according to claim 1 .

3. a filtering processing unit that filters access to the predetermined system based on the network address managed by the address management unit; a user interface for setting the filter; The filter can be set from at least one of a browser and an information processing device. The information processing device according to claim 1 .

4. The network address is at least one of an IP address and a MAC address. The information processing device according to claim 1 .

5. the usage history includes at least one of the number of accesses to the predetermined system, the number of transmission control packets received by the predetermined system, the number of data packets received by the predetermined system, and the number of network control packets received by the predetermined system; The information processing device according to claim 1 .

6. The information processing device according to any one of claims 1 to 5; an image forming system as the predetermined system; and

7. An information processing method executed by an information processing device applied to a predetermined system that restricts access from a network, comprising: a step of counting the access record to the predetermined system and the usage record of the function of the predetermined system; and selecting a network address registered in the predetermined system as a candidate for deletion based on the access record and the usage record counted within a certain period of time. Information processing methods.

8. An information processing device applied to a predetermined system that restricts access from a network, A process of counting the access records to the predetermined system and the usage records of the functions of the predetermined system; and selecting a network address registered in the predetermined system as a candidate for deletion based on the access record and the usage record counted within a certain period of time. program.

9. The information processing device according to claim 1 ; an image forming system as the predetermined system; a terminal device connected to the image forming system via a network, the image forming system receives a packet for the image forming system from the terminal device via the network; the terminal device transmits the packet to the image forming system; Information processing system.

Images