Information processing device, control method for information processing device, and program

Abstract

Even when the target equipment may be used in a variety of environments, the equipment can be used in a manner that is more suitable depending on the circumstances at the time. [Solution] The usage environment estimation unit 312 estimates the usage environment of the target device based on the communication characteristics of the device. The operation control unit 301 notifies the user of the results of the device usage environment estimation. The usage environment estimation unit 312 checks the connection status of the network interface of the device. If the usage environment estimation unit 312 confirms that there is a network interface with an unconnected status, it will perform the estimation of the device usage environment if it receives an execution instruction from the user, and will stop estimating the device usage environment if it receives a cancellation instruction from the user.

Description

Technical Field

[0001] The present disclosure relates to an information processing apparatus, a control method for an information processing apparatus, and a program.

Background Art

[0002] As a security measure, it is desirable that various security-related functions of an information device are appropriately set. If the usage environment is a single fixed information device, by applying the set values tailored to the single usage environment at the time of shipment, it is possible to use an information device with appropriate security measures without the user particularly noticing.

[0003] On the other hand, in recent years, the usage environment of information devices has also diversified. For example, focusing on the usage environment of a multifunction device, conventionally, most of the usage was in an office environment with strong boundary defenses both physically and as a network interface. In contrast, in recent years, the ratio of new usage forms such as usage during telecommuting and usage in public spaces shared by an unspecified number of people has been increasing. In such environments, it is desirable that the device is used after being changed from the default values set at the time of shipment to settings adapted to the usage environment. For example, assuming that there is boundary defense in an office environment, it may be desirable to permit connection to a management console via a network, emphasizing convenience. On the other hand, in a public space, since there is no boundary defense and the possibility of being attacked is high, it may be desirable to prohibit this connection. Thus, appropriate security settings may vary depending on the usage environment, and it may be desirable to change the settings when the usage environment changes, and technologies assuming such situations have also been studied. Patent Document 1 discloses a technique for assisting in updating a security policy by associating and managing a preset security policy with the characteristics of the operating status of a network and detecting that the characteristics of the operating status of the network have changed.

[0004] Furthermore, some information devices, such as multifunction printers, have multiple interfaces, including wired LAN and wireless LAN, and can be enabled and used simultaneously. Such information devices may be shared in diverse usage environments. In such devices, for example, one interface may be connected to a general office environment, while another interface may be connected to an isolated network with restricted users and limited internet access. Thus, in information devices equipped with multiple interfaces, if a new interface connection is detected or the settings of an existing connection interface are changed, it may be desirable to change the settings of other interfaces as well. For example, if an information device used in a typical office environment is newly connected from an isolated network, the security settings of the typical office environment may not be suitable for the isolated network. In light of this situation, Patent Document 2 discloses a technology for detecting a new network communication interface and applying security settings to restrict the use of the service. [Prior art documents] [Patent Documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2019-22099 [Patent Document 2] Japanese Patent Publication No. 2016-66212 [Overview of the project] [Problems that the invention aims to solve]

[0006] On the other hand, with conventional technologies, the detection of a new interface would trigger security settings, which sometimes rendered services available through the previous connection interface unavailable, resulting in a less user-friendly experience.

[0007] In view of the above-mentioned problems, the present invention aims to enable the use of the target equipment in a more suitable manner depending on the circumstances at the time, even when the equipment may be used in a variety of environments. [Means for solving the problem]

[0008] The information processing device according to the present invention comprises: estimation means for estimating the usage environment of a target device based on the communication characteristics of the target device; notification means for notifying a user of the estimation result of the usage environment of the device by the estimation means; and confirmation means for checking the connection status of the network interface of the device. The estimation means is characterized in that, when the confirmation means confirms that there is a network interface that is not connected, it performs the estimation of the usage environment of the device when it receives an execution instruction from the user, and stops the estimation of the usage environment of the device when it receives a stop instruction from the user. [Effects of the Invention]

[0009] According to the present invention, even when the target equipment may be used in a variety of environments, it becomes possible to use the equipment in a more suitable manner depending on the circumstances at the time. [Brief explanation of the drawing]

[0010] [Figure 1] This diagram shows an example of the system configuration of an information processing system. [Figure 2] This diagram shows an example of the internal configuration of the controller section of an MFP. [Figure 3] This diagram shows an example of the software configuration of an MFP. [Figure 4] This diagram shows an example of a screen displayed on the MFP's control panel. [Figure 5] This diagram shows an example of a screen displayed on the MFP's control panel. [Figure 6] This is a flowchart illustrating an example of MFP processing. [Figure 7]This is a flowchart illustrating an example of MFP processing. [Figure 8] This is a flowchart illustrating an example of MFP processing. [Figure 9] This is a flowchart illustrating an example of MFP processing. [Modes for carrying out the invention]

[0011] Preferred embodiments of this disclosure will be described in detail below with reference to the attached drawings. In this specification and the drawings, components having substantially the same functional configuration are denoted by the same reference numerals, and redundant descriptions will be omitted.

[0012] Referring to Figure 1, an example of the system configuration of the information processing system according to this embodiment will be described. Specifically, the example shown in Figure 1 shows an example of the connection configuration between the MFP (Multifunction Peripheral), gateway, firewall, wireless LAN access point PC, mobile terminal, and the internet according to this embodiment.

[0013] The MFP100 has two wired LAN interfaces and a wireless LAN interface. The two wired LAN interfaces of the MFP100 are connected to LAN111 in network 110 and LAN121 in network 120, respectively. The wireless LAN interface of the MFP100 is connected to wireless LAN access point 123 in network 120. In this embodiment, network connection means that the device is in a link-up state where it can communicate with devices on each network. Conversely, network disconnection or network failure in this embodiment means that the device is in a link-down state where it can only communicate with devices on each network. Network 110 and Network 120 are each connected to LAN 130 and to the Internet 150 via Gateway 140.

[0014] Network 110 has a firewall 112 installed, forming an isolated network with communication restricted between the Internet 160 and external networks. The communication of PC 113 with other devices is restricted to the devices connected within network 110. Network 120 is configured such that PC 122 and wireless LAN access point 123 are connected to LAN 121, and mobile terminal 124 is connected to wireless LAN access point 123. Network 120 can be connected to the Internet 150 and is capable of communicating with devices such as servers (not shown) connected to the Internet 150.

[0015] Referring to FIG. 2, an example of the internal configuration of the controller unit of MFP 100 will be described. The CPU (Central Processing Unit) 201 performs the main arithmetic processing within the controller unit of MFP 100. The CPU 201 is connected to the DRAM 202 via a bus. The DRAM 202 is used by the CPU 201 as a working memory to temporarily hold program data representing arithmetic instructions, data to be processed, etc. during the process of the CPU 201 performing arithmetic operations.

[0016] The CPU 201 is connected to the I / O controller 203 via a bus. The I / O controller 203 controls the input / output to various devices according to the instructions of the CPU 201. An SATA (Serial Advanced Technology Attachment) I / F 205 is connected to the I / O controller 203, and a FlashROM 211 is connected thereto at the end. The CPU 201 uses the FlashROM 211 as a storage area for permanently storing programs for realizing the functions of the MFP and document files.

[0017] The I / O controller 203 is connected to the network interface 204. Wired LAN devices 210 and 213 are connected to the network interface 204. The CPU 201 enables communication with other devices connected to LAN 111 by controlling the wired LAN device 210 via the network interface 204, and enables communication with other devices connected to LAN 121 by controlling the wired LAN device 213. A wireless LAN device 214 is connected to the wireless network interface 209. The CPU 201 controls the wireless LAN device 214 via the wireless network interface 209, thereby connecting to the wireless LAN access point 123 and enabling communication with other devices connected to LAN 121 and with the mobile terminal 124. Hereafter, the wired LAN devices 210 and 213, and the wireless LAN device 214 will also be referred to as LAN devices.

[0018] The I / O controller 203 is connected to the panel interface 206, and the CPU 201 controls the operation unit 102 via the panel interface 206 to enable the output of information to the user and the acceptance of input from the user. The printer interface 207 is connected to the I / O controller 203, and the CPU 201 controls the printer unit 103 via the printer interface 207 to enable paper output processing. As a specific example, when performing the copy function, the CPU 201 reads program data from the Flash ROM 211 to the DRAM 202 via the SATA I / F 205. The CPU 201 detects a copy instruction from the user to the operation unit 102 via the panel I / F 206, according to the program read into the DRAM 202. Upon detecting the copy instruction, the CPU 201 receives the original document as electronic data from the scanner unit 104 via the scanner I / F 208 and stores the electronic data in the DRAM 202. The CPU 201 then performs color conversion processing and other operations suitable for output on the image data stored in the DRAM 202. The CPU 201 then transfers the image data stored in the DRAM 202 to the printer unit 103 via the printer I / F 207 and performs output processing based on the image data to paper media.

[0019] Referring to Figure 3, an example of the software configuration of the MFP100 will be described. The software executed by the controller unit 101 is executed, for example, after the CPU 201 loads the program stored in the Flash ROM 211 into the DRAM 202. The operation control unit 301 performs processing related to displaying user-facing screen images to the operation unit 102, and also detects user operations and performs processing associated with screen components such as buttons displayed on the screen. The data storage unit 302 receives requests from other control units to store data in the Flash ROM 211 and to read data stored in the Flash ROM 211. For example, if a user gives an instruction to change some device settings, the operation control unit 301 detects the content entered by the user in the operation unit 102. In response to a request from the operation control unit 301, the data storage unit 302 saves the content entered by the user as a setting value in the Flash ROM 211.

[0020] The job control unit 303 performs control related to the execution of a job in accordance with instructions from other control units. The image processing unit 304 processes the target image data into a format suitable for each application, in accordance with instructions from the job control unit 303. The printing processing unit 305 prints an image onto paper media via the printer interface 207 in accordance with instructions from the job control unit 303, and outputs the result as a printed document. The reading control unit 306 reads the document placed on the reading table via the scanner I / F 208 according to instructions from the job control unit 303.

[0021] The network control unit 307 configures network settings such as IP addresses for the TCP / IP control unit 308 at triggers such as system startup or when a setting change is detected, according to the settings stored in the data storage unit 302. The network control unit 307 also enables or disables LAN devices based on the settings of the MFP100. The TCP / IP control unit 308, following instructions from other control units, performs the sending and receiving of network packets via the network interface 204 and the wireless network interface 209. The security settings control unit 309 manages the correspondence between usage environments such as company LAN, home, public spaces, and isolated networks, and security-related settings for those usage environments. Furthermore, when the security settings control unit 309 receives a usage environment specification from a user, it may set the corresponding security-related settings information all at once. The security settings control unit 309 uses the data storage unit 302 to refer to and change setting values. In addition, the security settings control unit 309 may set the corresponding security-related settings information all at once when the usage environment estimation described later is performed in response to a user instruction.

[0022] The communication log extraction unit 311 uses the network control unit 307 to extract communication logs transmitted and received by the MFP 100. As a specific example, the communication log extraction unit 311 may extract information such as the destination and source IP addresses, TCP / UDP type, port number, and IP header information from the information attached to the network packet. When this extraction process by the communication log extraction unit 311 is performed, for example, the content portion of the packet, called the payload, is excluded.

[0023] The usage environment estimation unit 312 estimates the usage environment from the communication logs extracted by the communication log extraction unit 311. This estimation of the usage environment is performed, for example, based on the patterns shown in Table 1. For example, the usage environment estimation unit 312 extracts the communication logs of wired LAN devices 210 and 213 and wireless LAN device 214, and estimates the usage environment based on these communication logs. If the estimation results for the usage environment for each LAN device differ, the usage environment estimation unit 312 may adopt the result with the higher recommendation priority. The method for setting the recommendation priority for each usage environment is not particularly limited; for example, the recommendation priority may be set so that the usage environment with the most functional restrictions due to recommended security settings has a higher priority.

[0024] [Table 1]

[0025] The usage environment shown as an internal LAN is equivalent to a typical office environment, for example, an environment where many people gather and use the internet to access some cloud services. The usage environment shown as an internal LAN has the largest number of connected information devices compared to other usage environments. In such an environment, a managed firewall is generally set up at the boundary with the external network, and access to the area where each information device is installed is restricted to employees and other related personnel. Due to these characteristics, the usage environment shown as an internal LAN uses a balanced approach between security measures implemented on the environment side and security measures implemented on each terminal. In this embodiment, the usage environment shown as network 120 in Figure 1 is assumed to be the usage environment shown as an internal LAN.

[0026] The usage environment shown as an isolated network assumes an environment where, for some reason, connection to the internet is blocked in the network topology, and the network is used in a separate environment, such as using an older protocol. The number of connected information devices in the usage environment shown as an isolated network is relatively small compared to other usage environments. In such an environment, strong security measures on the usage environment side make it possible to relax the level of security measures that must be taken on the terminal side. In this embodiment, the usage environment shown as network 110 in Figure 1 is assumed to be the usage environment shown as an isolated network.

[0027] The home environment described refers to a home network designed for teleworking, assuming a small-scale LAN used within the home is used directly for work from home. This home environment has the fewest connected information devices compared to other environments. In such an environment, it is necessary to implement a balanced security measure on the terminal side, given that security measures on the network side cannot be relied upon as much as in other environments.

[0028] The usage environment described as a public space assumes an open space where an unspecified number of people come and go and the network is shared. Examples of usage environments described as public spaces include airport lounges and co-working spaces that are open to guests. Compared to other usage environments, access restrictions are not as strict, and the number of connected information devices is relatively large. In such environments, it is advisable not to rely on the security measures implemented by the usage environment itself, and it is preferable to implement security measures on the terminal side, even if it means sacrificing some functionality.

[0029] The analysis of communication logs by the usage environment estimation unit 312 is specifically performed based on the information shown in Table 2 below.

[0030] [Table 2]

[0031] Traffic volume is the number of communication packets sent and received per unit of time. The data (packets) that a device can receive when connected to a network are either data sent via unicast communication destined for that device, or data sent via broadcast or multicast without a specified destination. Since the amount of broadcast and multicast traffic increases in proportion to the number of information devices in the environment to which the device is used, this information can be used to estimate the size of the network to which the device is connected. In order to more clearly determine the size of the network, data (packets) sent via unicast communication may be excluded from the measurement of traffic volume. Depending on the size of the traffic volume, it is possible to estimate which of the following environments is relatively more likely to be used: a large-scale company intranet, a medium-sized public space, or a small-scale home network.

[0032] The number of destination addresses represents the number of address variations that communication packets sent and received per unit of time were destined for. This number tends to increase when the device in question utilizes a variety of external services. Due to this characteristic, an extremely small number of destination addresses strongly suggests that the device is operating in an isolated network with restricted communication.

[0033] The number of source addresses represents the number of variations in the addresses used as the source for communication packets sent and received per unit of time. This number tends to increase when there are a large number of information devices within the network to which the target device is connected. While this number shows a similar trend to traffic volume, it represents a fundamentally different value. Therefore, observing the trend in combination with traffic volume can improve the accuracy of estimating the usage environment.

[0034] The number of protocol types is the number of protocol variations used by communication packets sent and received per unit of time. The more information devices connected to the target network (i.e., the network to which the target device is connected), the larger the number of protocol types tends to be. Conversely, in network environments with stricter functional restrictions, the number of protocol types tends to be relatively small. Due to characteristics like k, a relatively small number of protocol types suggests a high probability that the environment is an isolated network or a public space.

[0035] The variation in the Time to Live (TTL) attribute of an IP header represents the number of variations in TTL values ​​associated with communication packets sent and received per unit of time. This variation in the IP header's TTL attribute is deducted each time a packet passes through a router, so packets that have passed through more routers will have a smaller value. Due to this characteristic, an environment where the variation in the IP header's TTL attribute is uniformly large is likely to be a small network. On the other hand, an environment where the variation in the IP header's TTL attribute ranges from large to small values ​​is likely to be a large network.

[0036] In light of the above characteristics, the usage environment estimation unit 312 estimates the usage environment by setting thresholds according to characteristics such as network size and evaluating each of the parameters exemplified above. Furthermore, while communication logs may reveal trends (characteristics) depending on the usage environment, if it is difficult to logically determine a threshold for estimating the usage environment, it is possible to improve the accuracy of the usage environment estimation by combining multiple parameters to determine the threshold in a complex manner. For example, the processing related to the estimation of the usage environment by the usage environment estimation unit 312 can be implemented using a model trained based on machine learning, which uses a combination of the usage environment and communication logs obtained in the same environment as training data. Furthermore, whether a network is an internet-connected network like LAN120 or an isolated network like LAN110 can be determined by whether the source IP address falls within the range of private addresses.

[0037] When the usage environment estimation unit 312 performs analysis of the communication log, it saves the execution history for each LAN device, as exemplified in Table 3 below, to the Flash ROM 211 as the usage environment estimation history. For LAN devices for which the usage environment estimation unit 312 has performed estimation, the estimation result is saved as history, and for LAN devices for which estimation has not been performed, a history indicating that they are not connected is saved. Furthermore, if the state of a LAN device changes from connected to the network to not connected, the information saved as the usage environment estimation history is also changed to not connected. In addition, in the initial state where no usage environment estimation has been performed, a history indicating that no usage environment estimation has been performed is saved as the usage environment estimation history.

[0038] [Table 3]

[0039] In this embodiment, the security-related settings controlled by the security setting control unit 309 include settings common to LAN devices and settings independent of the main network and the sub-network. In the following description, the main network will also be referred to as the primary line, and the sub-network will also be referred to as the secondary line. In this embodiment, the primary line is assumed to be used primarily, such as for connecting to the company's core systems, and is therefore assigned a wired LAN device 210 and a wireless LAN device 214. The secondary line is assumed to be used expandably depending on the application, and is therefore assigned a wired LAN device 213.

[0040] Each of the usage environments shown in Table 1 has a different security-related setting policy. Therefore, the security setting control unit 309 compares the environment selected by the user with the setting table for each estimated environment shown below as Table 4, and sets the security-related settings based on the results. Note that for settings that are set to "optional" in the setting table shown in Table 4, settings such as on or off are not applied, and the current setting value is not changed.

[0041] [Table 4]

[0042] Encryption of communication paths can be applied as a countermeasure against threats such as leakage, tampering, and impersonation. For example, except for isolated network types where internet access is restricted, unspecified users may be able to access the MFP100 via the network. Therefore, it is desirable to enable settings related to communication path encryption in usage modes other than isolated network types. One example of a function that realizes communication path encryption is the communication encryption function using TLS (Transport Layer Security). TLS settings are enabled in environments other than isolated networks.

[0043] Disabling legacy protocols can be applied as a countermeasure against impersonation and data leakage. For example, except for isolated network types where internet access is restricted, unspecified users may be able to access the MFP100 via the network. Therefore, in usage scenarios other than isolated network types, it is desirable to enable the setting to disable legacy protocols in order to block insecure means of access. An example of a legacy protocol is the WINS (Windows Internet Name Services) protocol.

[0044] Authentication can be applied as a countermeasure against impersonation. For example, except for isolated network types that prioritize connectivity within an isolated network, it is desirable to enable features to authenticate accessing users and devices. Examples of authentication settings include disabling password caching and specifying a minimum password length.

[0045] Physical attack countermeasures can be applied as a measure against data leakage. For example, in home-use and public space-use environments where restricting physical access to the MFP100 is difficult, it is desirable to enable settings related to physical attack countermeasures to implement measures against physical attacks. An example of settings related to physical attack countermeasures is a hard disk complete erasure function that completely deletes unnecessary data from the hard disk.

[0046] Disabling file sharing functionality can be applied as a measure against data leaks when an unspecified number of users share and use a network. For example, it is desirable to disable settings related to file sharing functionality except in environments with private network environments. Therefore, it is recommended to disable file sharing functionality except in company LAN types, isolated network types, and home-based types. An example of settings related to file sharing functionality is SMB (Server Message Block) server settings.

[0047] Disabling external storage devices can be applied as a countermeasure against data leakage. One example of a setting related to external storage devices is whether or not to use USB (Universal Serial Base) storage devices as external storage devices. The threat of data leakage via USB can exist in any usage environment. Therefore, it is desirable to disable them in all usage environments.

[0048] Enabling a personal firewall can be applied as a countermeasure against data leaks and DoS (Denial of Service) attacks. For example, except for isolated network types where internet access is restricted and corporate LAN types protected by a firewall, unspecified users may be able to access the MFP100 via the network. Therefore, in usage patterns other than isolated network types and corporate LAN types, it is desirable to implement access control by enabling personal firewall settings. Examples of personal firewall functions include IP address filtering and port number filtering, which allow or deny access only to specific IP addresses or communication ports. Since IP address settings etc. are not common to the primary and secondary lines, independent settings are applied to each line individually.

[0049] Referring to Figure 4, the recommended security settings screen 701 will be described as an example of a screen displayed on the operation unit 102. The "Internal LAN Environment" button 702 is a button for setting a set of security settings appropriate for use within an internal LAN environment. The "Work from Home" button 703 is a button for setting a set of security settings appropriate for use at home. The "Public Space" button 704 is a button for setting a set of security settings appropriate for use in a public space environment. The "Isolated Network" button 705 is a button for setting a set of security settings appropriate for use on an isolated network environment. The display area 706 is an area where information indicating the usage environment set by buttons 702, 703, 704, or 705 is displayed as the selected usage environment. When the button corresponding to the target usage environment is pressed, this information is associated with date and time information indicating when the button was pressed and stored in the data storage unit 302. Display area 707 is the area where information indicating the usage environment, estimated through estimation processing based on the communication data trends of LAN devices, is displayed as the result of the usage environment estimation. If the network is not connected, that fact will be displayed in display area 707. Display area 708 is an area where information for providing various notifications to the user is displayed.

[0050] Figure 4(a) shows an example of the display when an isolated network is selected as the recommended security setting. In the example shown in Figure 4(a), LAN1 (wired LAN device 210) is the company LAN, LAN2 (wired LAN device 213) is the isolated network, and wireless LAN (wireless LAN device 214) is the company LAN, and this information is displayed in display area 707. Therefore, according to the recommended priority shown in Table 1, a message indicating that the recommended security setting is the company LAN is displayed in display area 708.

[0051] Figure 4(b) shows an example of the display when the wired LAN device 213 is not connected and the company LAN is selected as the recommended security setting. In the example shown in Figure 4(b), LAN1 is the company LAN, LAN2 is not connected, and the wireless LAN is the company LAN, and this information is displayed in display area 707. Therefore, according to the recommended priority shown in Table 1, a message indicating that the recommended security setting is the company LAN is displayed in display area 708. Also, in the example shown in Figure 4(b), since LAN2 is not connected, a message prompting the user to review the recommended security setting when LAN2 becomes connected is displayed in display area 708.

[0052] The user environment estimation execution button 709 is a button that causes the communication log extraction unit 311 to extract communication logs and the user environment estimation unit 312 to analyze the communication logs and perform user environment estimation. When the user environment estimation initiated by pressing the user environment estimation execution button 709 is completed, the information displayed in the display area 707 is updated based on the results of the user environment estimation. When the network control unit 307 determines that the LAN devices are not connected to the network during the environment estimation process, the screen shown in Figure 4(c) is displayed. Furthermore, if the network control unit 307 determines that some of the LAN devices are connected to the network and others are not, the screen shown in Figure 4(d) is displayed. Finally, if the network control unit 307 determines that all LAN devices are connected to the network, the screen shown in Figure 4(e) is displayed. Figure 4(c) is a screen prompting the user to connect to the network. Figure 4(d) is a screen asking the user whether to continue estimating the user environment. If the continue button 710 is pressed, the screen shown in Figure 4(e) is displayed, and if the cancel button 711 is pressed, the screen returns to the screen shown in Figure 4(a). Figure 4(e) is a screen showing the user environment estimation in progress. When the process is complete or the cancel button 712 is pressed, the screen returns to the screen shown in Figure 4(a).

[0053] Referring to Figure 5, an example of a screen displayed on the operation unit 102 will be described, specifically an example of a screen displayed when a network connection is detected while the estimated usage environment history contains a history of disconnected users. In the screen shown in Figure 5(a), if the Yes button 501 is pressed, the same process as when the User Environment Estimation Execution button 709 in Figure 4(a) is pressed is executed. On the other hand, in the screen shown in Figure 5(a), if the No button 502 is pressed, the destination of the screen is controlled according to whether the network-connected LAN device is a wired LAN device 210 or 213, or a wireless LAN device 214. When connected to wired LAN device 210 or 213, the screen shown in Figure 5(b) is displayed. If the LAN cable is disconnected from the target LAN device in this state, the screen transitions to the unillustrated screen that was displayed before the screen shown in Figure 5(a). On the other hand, if the back button 503 is pressed on the screen shown in Figure 5(b), the screen returns to the screen shown in Figure 5(a). When connected to the wireless LAN device 214, the screen shown in Figure 5(c) is displayed. If the Yes button 504 is pressed in this state, the network control unit 307 disables the wireless LAN and disconnects the network. Then, if the Back button 505 is pressed, the screen shown in Figure 5(a) is returned.

[0054] Referring to Figure 6, an example of the processing of the MFP100 according to this embodiment will be explained, focusing on the process by which the MFP100 receives instructions from the user and performs usage environment estimation. The series of processes shown in Figure 6 are processes that the usage environment estimation unit 312 performs in response to instructions from the network control unit 307 and the communication log extraction unit 311. In practice, the CPU 201 reads the program stored in the FlashROM 211 into the DRAM 202 and then executes the program, thereby realizing the series of processes shown in Figure 6.

[0055] In S1001, the MFP100 checks the network connection status. Note that the LAN devices checked in S1001 are those enabled by the network control unit 307. In other words, LAN devices that have been intentionally disabled by the user are excluded from the check in S1001. If the MFP100 determines in S1001 that all LAN devices to be checked are disconnected, it proceeds to S1002. Furthermore, if the MFP100 determines in S1001 that some of the LAN devices to be checked are connected to the network and others are not, it proceeds to S1003. Furthermore, if the MFP100 determines in S1001 that all LAN devices to be checked are connected to the network, it proceeds to S1005.

[0056] In S1002, the MFP100 displays the screen shown in Figure 4(c) and terminates the series of processes shown in Figure 6.

[0057] In step S1003, the MFP100 displays the screen shown in Figure 4(d). In S1004, the MFP100 receives user input via the screen displayed in S1003 and switches subsequent processing according to that user input. Specifically, if the MFP100 determines in S1004 that the continue button 710 was pressed, it proceeds to S1005. On the other hand, if the MFP100 determines in S1004 that the cancel button 711 has been pressed, it terminates the series of processes shown in Figure 6.

[0058] In S1005, the MFP100 performs usage environment estimation for network-connected LAN devices. Specifically, as described above, the communication log extraction unit 311 uses the network control unit 307 to extract communication logs transmitted and received by the MFP100. Then, the usage environment estimation unit 312 estimates which of the series of usage environments shown in Table 1 corresponds to the communication logs extracted by the communication log extraction unit 311. In S1006, the MFP100 saves the history of the user environment estimation performed in S1005. At this time, information indicating that a LAN device is not connected to the network is saved in the history of LAN devices that are connected to the network, and the results of the user environment estimation performed in S1005 are saved in the history of LAN devices that are connected to the network. Information indicating that a LAN device is not connected is also saved in the history of disabled LAN devices. After the user environment estimation, when a LAN device is enabled and connected to the network, that LAN device becomes the subject of processing in S2002, which will be described separately, thus preventing situations where the user continues to use the device without the user environment estimation being performed.

[0059] In S1007, the MFP100 selects recommended security settings based on the results of the usage environment estimation performed in S1005. If the usage environment estimation results for each LAN device differ in S1005, the MFP100 selects recommended security settings according to the recommended priority order shown in Table 1. On the other hand, if the usage environment estimation results for each LAN device in S1005 are all the same, the MFP100 selects the security settings corresponding to those usage environment estimation results.

[0060] In S1008, the MFP100 performs a batch configuration on security-related settings shown in Table 4, targeting items with a common setting type, based on the security setting selection results in S1007. Furthermore, for settings with independent setting types, the MFP100 performs a batch configuration corresponding to the estimated usage environment for each LAN device in S1005. In S1009, the MFP100 displays recommended security settings in the display area 708 based on the security setting selection result in S1007, and then terminates the series of processes shown in Figure 6. In the example shown in Figure 6, a configuration in which the settings are automatically configured in bulk is described, but it is also possible to configure the system to skip the S1008 process and notify the user of the estimation results.

[0061] As explained above, when the MFP100 receives a command from the user to perform network usage environment estimation, it will indicate if there are any unconnected networks and perform the usage environment estimation at the user's discretion. By applying this control, it is expected that the probability of situations occurring where the use of previously available functions is restricted as a result of a review of the usage environment after network connectivity is established is reduced.

[0062] Referring to Figure 7, an example of the processing of the MFP100 according to this embodiment will be explained, focusing on the process in which the MFP100 detects a network connection and presents the user with a request to re-execute the user environment estimation based on the execution history of the user environment estimation. The series of processes shown in Figure 6 are executed when the user environment estimation unit 312 gives instructions to the network control unit 307. In practice, the CPU 201 reads the program stored in the FlashROM 211 into the DRAM 202 and then executes the program, thereby realizing the series of processes shown in Figure 7.

[0063] In S2001, the MFP100 determines whether or not it has detected a network connection for the LAN device. The MFP100 will continue to monitor the network connection of the LAN device until a network connection of the LAN device is detected in S2001. Then, if the MFP100 determines in S2001 that a network connection of a LAN device has been detected, it proceeds to S2002.

[0064] In S2002, the MFP100 determines whether the history of estimated usage environments saved in the process of S1006 shown in Figure 6 includes a history of disconnections. If MFP100 determines in S2002 that the saved history of estimated user environments includes a history of disconnections, it proceeds to S2003. On the other hand, if MFP100 determines in S2002 that the saved history of estimated usage environments does not include any disconnected history, it terminates the series of processes shown in Figure 7. Furthermore, disabled LAN devices are excluded from the S2002 assessment, even if their usage environment estimation history shows them as not connected.

[0065] In S2003, the MFP100 displays the screen shown in Figure 5(a). In S2004, the MFP100 switches subsequent processes according to the operations received from the user via the screen displayed in S2003. Specifically, if the MFP100 determines in S2004 that the "Yes" button 501 on the screen shown in Figure 5(a) has been pressed, it proceeds to S2005. On the other hand, if the MFP100 determines in S2004 that the "No" button 502 on the screen shown in Figure 5(a) was pressed, it proceeds to S2006.

[0066] In S2005, the MFP100 performs the series of processes shown in Figure 6, and then terminates the series of processes shown in Figure 7.

[0067] In S2006, the MFP100 determines whether the newly connected LAN device is a wired LAN or a wireless LAN. If the MFP100 determines in S2006 that the newly connected LAN device is a wireless LAN, that is, if it determines that the wireless LAN device 214 is connected to the network, it proceeds to S2007. On the other hand, if the MFP100 determines in S2006 that the newly connected LAN device is a wired LAN, that is, if it determines that either wired LAN device 210 or 213 has been connected to the network, it proceeds to S2010.

[0068] In S2007, the MFP100 displays the screen shown in Figure 5(c). In S2008, the MFP100 switches subsequent processes according to the operations received from the user via the screen displayed in S2007. Specifically, if the MFP100 determines in S2008 that the "Yes" button 504 on the screen shown in Figure 5(c) has been pressed, it proceeds to S2009. On the other hand, if the MFP100 determines in S2008 that the back button 505 on the screen shown in Figure 5(c) has been pressed, it proceeds to S2003. In this case, the processing from S2003 onwards is executed again. In S2009, the MFP100 disables the wireless LAN and disconnects the network under the control of the network control unit 307, and then terminates the series of processes shown in Figure 7.

[0069] In S2010, the MFP100 displays the screen shown in Figure 5(b) for any LAN device (either wired LAN device 210 or 213) whose network connection was newly detected in S2001. The MFP100 then instructs the user to disconnect the LAN device from the network by unplugging its cable. In S2011, the MFP100 determines whether or not the back button 503 on the screen displayed in S2010 has been pressed. If MFP100 determines in S2011 that the back button 503 was pressed, it proceeds to S2003. In this case, the processing from S2003 onwards is executed again. On the other hand, if the MFP100 determines in S2011 that the back button 503 has not been pressed, it proceeds to S2012. In S2012, the MFP100 determines whether a LAN device (a LAN device whose network connection was newly detected in S2001) has become disconnected by unplugging its LAN cable. If the MFP100 determines in S2012 that the target LAN device is not disconnected (the LAN cable is not unplugged), it proceeds to S2011. In this case, the processes from S2011 onwards are executed again. Then, if the MFP100 determines in S2012 that the target LAN device is no longer connected (the LAN cable has been unplugged), it terminates the series of processes shown in Figure 7.

[0070] By applying the control described above, it becomes possible to avoid situations where, after a new network connection is detected by the MFP100, the usage environment estimation is not performed, or the MFP is used by a user while a new network connection is still established.

[0071] Referring to Figure 8, an example of the processing of the MFP100 will be explained, focusing on the process in which the MFP100 detects a network disconnection and updates the execution history of the user environment estimation. The series of processes shown in Figure 8 are executed by the user environment estimation unit 312 upon receiving notification from the network control unit 307. In practice, the CPU 201 reads the program stored in the FlashROM 211 into the DRAM 202 and then executes the program, thereby realizing the series of processes shown in Figure 8.

[0072] In S3001, the MFP100 determines whether or not it has detected a network connection for the LAN device. The MFP100 will continue to monitor the network connection of the LAN device until the network connection of the LAN device is detected in S3001. Then, if the MFP100 determines in S3001 that a network connection for a LAN device has been detected, it proceeds to S3002. In S3002, the MFP100 checks the usage environment estimation history of the disconnected LAN device and changes the history to "not connected" if the estimation result is saved. On the other hand, if the usage environment estimation history of the disconnected LAN device contains information indicating that it was not executed, the MFP100 does not change the history. Then, the MFP100 terminates the series of processes shown in Figure 8.

[0073] Regarding the disconnection of LAN devices, while users may intentionally switch the network they are connected to, other scenarios such as momentary interruptions in the wired LAN connection or power outages of switching hubs or wireless LAN access points can also occur unintentionally. In light of this situation, it is also possible to control the system so that the user does not receive a command to re-execute the user environment estimation, shown as S2003 in Figure 7, due to the unintended disconnection of a LAN device. In this case, when the LAN device is disconnected, the MFP100 changes the estimation history to "not connected" and retains the previous estimation result. Then, when executing the S2003 process, the MFP100 automatically performs the user environment estimation, and if the estimation result matches the previous result, it may terminate the series of processes shown in Figure 7 without executing the S2003 process.

[0074] By applying the above-described controls, the MFP100 can instruct the user to perform environment estimation.

[0075] Referring to Figure 9, an example of the processing of the MFP100 will be explained, focusing on the process of the MFP100 starting up and updating the execution history of the user environment estimation. The series of processes shown in Figure 9 are executed by the user environment estimation unit 312 before the network control unit 307 initializes the LAN device and makes it possible to detect network connections. In practice, the CPU 201 reads the program stored in the FlashROM 211 into the DRAM 202 and then executes the program, thereby realizing the series of processes shown in Figure 9. Furthermore, the startup of the MFP100 can be triggered by, for example, turning the power on or off or restarting. The series of processes shown in Figure 9 are executed assuming that the user environment may change, for example, if the user changes the connection destination of the network cable or changes the network environment while the power is off or during a restart.

[0076] In S4001, the MFP100 checks the history of estimated usage environments for all LAN devices. Then, for LAN devices where the estimated usage environment results are stored in the history, the MFP100 changes the history to "Not Connected". However, for LAN devices where information indicating "before execution" is stored in the history, the MFP100 does not change the history. Finally, the MFP100 completes the series of processes shown in Figure 9.

[0077] It is expected that users often have to turn the MFP100 on and off or restart it out of necessity. In light of this situation, it is also possible to control the system so that the instruction to re-execute the user environment estimation, shown as S2003 in Figure 7, is not issued. In this case, the MFP100 changes the user environment estimation history to "not connected" and retains the previous estimation result. Then, when executing the S2003 process, the MFP100 automatically performs the user environment estimation, and if the estimation result matches the previous result, it may terminate the series of processes shown in Figure 7 without executing the S2003 process. By applying the above control mechanisms, the MFP100 can instruct the user to perform environment estimation triggered by power on / off or restart.

[0078] <Other Embodiments> The present invention can also be realized by supplying a program that implements one or more of the functions of the above-described embodiments to a system or device via a network or storage medium, and by having one or more processors in the computer of that system or device read and execute the program. It can also be realized by a circuit (e.g., an ASIC) that implements one or more functions. Furthermore, various modifications can be applied as long as they do not deviate from the basic technical concept of each embodiment of the present disclosure described above. For example, although each embodiment described above describes an example of applying the technology of the present disclosure to an image forming apparatus, it is possible to apply the technology of the present disclosure to information processing devices in general, not just image forming apparatuses.

[0079] Furthermore, the disclosure of this embodiment includes the following configurations, methods, and programs. (Configuration 1) An information processing device comprising: estimation means for estimating the usage environment of a target device based on the communication characteristics of the target device; notification means for notifying a user of the results of the estimation of the usage environment of the device by the estimation means; and confirmation means for checking the connection status of the network interface of the device, wherein the estimation means, when confirmed by the confirmation means to be in a state where there is a network interface that is not connected, performs the estimation of the usage environment of the device when it receives an execution instruction from the user, and stops the estimation of the usage environment of the device when it receives a stop instruction from the user. (Configuration 2) The information processing device according to Configuration 1, wherein the estimation means estimates which of a plurality of environments the device is used in, and applies the settings associated with the estimated environment to the device. (Configuration 3) The information processing device according to Configuration 1 or 2, wherein, when the confirmation means confirms that the connection status of a plurality of network interfaces is connected, the estimation means estimates which of a plurality of environments the usage environment of the device corresponds to for each of the plurality of network interfaces, and determines, based on a priority set in advance for the plurality of environments, which of the estimation results for each of the plurality of network interfaces to apply as the estimated result of the usage environment of the device. (Configuration 4) An information processing device according to any one of Configurations 1 to 3, wherein the storage means stores a history of the execution of the estimation of the usage environment of the device by the estimation means, and the storage means stores the estimation result of the usage environment of the device by the estimation means for network interfaces whose connection status has been determined to be connected by the confirmation means, and stores information indicating that a network interface is not connected for network interfaces whose connection status has been determined to be not connected. (Configuration 5) When a new network connection of a network interface is detected and information indicating that the network interface is not connected is stored in the history of the network interface, the estimation means has a receiving means that receives instructions from the user regarding the execution of estimation of the usage environment, and when the receiving means receives instructions from the user regarding the execution of estimation of the usage environment, the estimation means executes the estimation of the usage environment of the device. The information processing device according to configuration 4, wherein the notification means notifies the user of an instruction to disconnect the network of the network interface on which a new network connection has been detected, when the receiving means receives an instruction from the user to refuse to perform the estimation of the usage environment. (Configuration 6) The information processing device according to Configuration 5, wherein the notification means continues to notify the network disconnection instruction until a network disconnection is detected for the network interface on which a new network connection has been detected. (Configuration 7) The information processing device according to any one of Configurations 4 to 6, wherein the storage means changes the history of the network interface to information indicating that it is not connected when a network disconnection of a connected network interface is detected. (Configuration 8) The information processing device according to any one of Configurations 4 to 7, wherein the storage means, when the information processing device is started, changes the history of the network interface of the device to information indicating that it is not connected, before the network connection of the network interface of the device becomes detectable. (Configuration 9) The information processing apparatus according to any one of Configurations 1 to 8, characterized in that the network connection state is a link-up state in which the device can communicate with other devices, and the network disconnection state and the network out state are link-down states in which the device is restricted from communicating with other devices. (Configuration 10) An information processing device according to any one of Configurations 1 to 9, characterized in that at least one of traffic, destination IP address, source IP address, protocol, and IP header information is applied as a characteristic of the communication of the device. (Method 1) A control method for an information processing device, comprising: an estimation step of estimating the usage environment of a target device based on the communication characteristics of the target device; a notification step of notifying a user of the estimation result of the usage environment of the device in the estimation step; and a confirmation step of confirming the connection status of the network interface of the device, wherein the estimation step is characterized in that, under circumstances where it is confirmed in the confirmation step that there is a network interface with an unconnected status, the estimation of the usage environment of the device is performed if an execution instruction is received from the user, and the estimation of the usage environment of the device is stopped if an execution instruction is received from the user. (Program 1) A program for causing a computer to function as an information processing device, comprising: estimation means for estimating the usage environment of a target device based on the communication characteristics of the device; notification means for notifying a user of the results of the estimation of the usage environment of the device by the estimation means; and confirmation means for confirming the connection status of the network interface of the device, wherein the estimation means, when confirmed by the confirmation means to be in a state where there is a network interface that is not connected, executes the estimation of the usage environment of the device when it receives an execution instruction from the user, and stops the estimation of the usage environment of the device when it receives a stop instruction from the user. [Explanation of Symbols]

[0080] 100 MFP 101 Controller Unit 301 Operation Control Unit 312 Usage environment estimation section

Claims

1. An estimation means that performs an estimation of the usage environment of the target device based on the communication characteristics of the device, A notification means for notifying the user of the estimated results of the usage environment of the device by the estimation means, A means for checking the connection status of the network interface of the aforementioned device, It has, The estimation means, under circumstances where the confirmation means has confirmed the existence of an unconnected network interface, will perform estimation of the device's usage environment if it receives an execution instruction from the user, and will stop estimating the device's usage environment if it receives a cancellation instruction from the user. An information processing device characterized by the following features.

2. The information processing apparatus according to claim 1, characterized in that the estimation means estimates which of a plurality of environments the usage environment of the device corresponds to, and applies the settings associated with the estimated environment to the device.

3. The estimation means is, If the verification means confirms that the connection status of multiple network interfaces is established, then it is estimated which of the multiple environments the device is operating in corresponds to for each of the multiple network interfaces. Based on the pre-configured priorities for the multiple environments, it is determined which of the estimation results for each of the multiple network interfaces will be applied as the estimated result of the device's usage environment. The information processing apparatus according to claim 1, characterized in that

4. The system has a storage means for storing a history of the execution of the estimation of the usage environment of the device by the estimation means, The storage means stores the estimated results of the device usage environment by the estimation means for network interfaces whose connection status is determined to be connected by the confirmation means, and stores information indicating that network interfaces whose connection status is determined to be disconnected are disconnected. The information processing apparatus according to claim 1, characterized in that

5. When a new network connection to a network interface is detected, and information indicating that the network interface was not connected is stored in the network interface's history, the system has a receiving means for receiving instructions from the user regarding the execution of estimation of the user environment. The estimation means, when the receiving means receives an instruction from the user regarding the execution of estimation of the usage environment, executes the estimation of the usage environment of the device. When the receiving means receives an instruction from the user to refuse the estimation of the usage environment, the notification means notifies the user of an instruction to disconnect the network of the network interface on which a new network connection has been detected. The information processing apparatus according to claim 4, characterized in that

6. The information processing apparatus according to claim 5, characterized in that the notification means continues to notify the network disconnection instruction until a network disconnection is detected for the network interface on which a new network connection was detected.

7. The information processing apparatus according to claim 4, characterized in that the storage means changes the history of the network interface to information indicating that it is not connected when a network disconnection of a connected network interface is detected.

8. The information processing apparatus according to claim 4, characterized in that, when the information processing apparatus is started, the storage means changes the history of the network interface to information indicating that it is not connected, before the network connection of the network interface of the device becomes detectable.

9. The network connection status refers to a link-up state in which the device can communicate with other devices. The state of being "not connected to the network" and the state of being "disconnected from the network" refer to a link-down state in which the device is restricted from communicating with other devices. The information processing apparatus according to claim 1, characterized in that

10. The information processing apparatus according to claim 1, characterized in that at least one of the following is applied as a characteristic of the communication of the aforementioned device: traffic, destination IP address, source IP address, protocol, and IP header information.

11. A method for controlling an information processing device, An estimation step that estimates the usage environment of the target device based on the communication characteristics of the device, A notification step in which the user is notified of the estimated results of the usage environment of the device in the estimation step, A verification step to check the connection status of the network interface of the aforementioned device, Includes, The estimation step, under the circumstances where it has been confirmed in the confirmation step that there are network interfaces with an unconnected status, will perform the estimation of the device's usage environment if instructed to do so by the user, and will stop the estimation of the device's usage environment if instructed to do so by the user. A control method for an information processing device, characterized by the features described herein.

12. Computers, An estimation means that performs an estimation of the usage environment of the target device based on the communication characteristics of the device, A notification means for notifying the user of the estimated results of the usage environment of the device by the estimation means, A means for checking the connection status of the network interface of the aforementioned device, It has, The estimation means, under circumstances where the confirmation means has confirmed the existence of an unconnected network interface, will perform estimation of the device's usage environment if it receives an execution instruction from the user, and will stop estimating the device's usage environment if it receives a cancellation instruction from the user. A program for causing an information processing device to function in a particular way.

Images