Information processing device, control method thereof, and program

Abstract

To establish communications with a web server using a different protocol version even when the protocol version is set, even in a case where only a single type of protocol version can be set as conventional.SOLUTION: An information processing apparatus is configured to perform encryption communications using an encryption communication protocol set as a use protocol from among a plurality of encryption communication protocols. The information processing apparatus sets a version of the encryption communication protocol to be used for the encryption communications in association with a specific communication destination; and executes, in a case that a communication partner is the specific communication destination and the set version of the encryption communication protocol includes a version of an encryption communication protocol set in the communication partner, the encryption communications with the communication partner using the version of the encryption communication protocol set in the communication partner.SELECTED DRAWING: Figure 12

Description

[Technical field]

[0001] The present invention relates to an information processing device, a control method thereof, and a program. [Background technology]

[0002] Multifunction peripherals (MFPs) are known as image forming devices that have not only a printing function but also a function to read documents and convert them into digital data, and store the read data and print data received from a host. Such MFPs also perform encrypted communication when transmitting and receiving highly confidential data. For example, encrypted communication is used when browsing using the MFP's web browser. Such encrypted communication uses, for example, TLS (Transport Layer Security), Encrypted communication protocols such as SSL (secure Sockets Layer), IPSec (Security Architecture for the Internet Protocol), and IEEE802.1X are used. When performing encrypted communication, the user can select a desired protocol version from multiple protocol versions of the encrypted communication protocol to be used and set it on the MFP. In addition, the MFP is equipped with multiple encryption algorithms for performing authentication processing executed in encrypted communication, and data encryption and decryption processing, etc., and the user can use them to perform communication.

[0003] Patent Document 1 describes an information processing device that performs encrypted communication using an encrypted communication protocol set as the protocol in use. When the information processing device is instructed to change the protocol in use from one encrypted communication protocol to another encrypted communication protocol, the information processing device determines whether or not encrypted communication can be performed using the encryption algorithm. If encrypted communication can be performed, the information processing device follows the instruction to change the protocol, thereby appropriately setting a desired encryption algorithm and protocol version. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2018-110288 A Summary of the Invention [Problem to be solved by the invention]

[0005] However, the technology of the above-mentioned Patent Document 1 allows only one protocol version to be set, so if a protocol version is set, communication with a Web server using a different protocol version may become impossible.

[0006] An object of the present invention is to solve at least one of the problems of the above-mentioned conventional techniques.

[0007] An object of the present invention is to provide a technique that enables encrypted communication with a plurality of communication destinations that use different versions of an encrypted communication protocol, without compromising the confidentiality of communication data. [Means for solving the problem]

[0008] In order to achieve the above object, an information processing device according to one aspect of the present invention has the following configuration. An information processing device that performs encrypted communication using an encrypted communication protocol that is set as a usage protocol among a plurality of encrypted communication protocols, a first setting means for setting a version of an encrypted communication protocol used in the encrypted communication in association with a specific communication destination; and an execution means for executing encrypted communication with the communication destination using the version of the encrypted communication protocol set at the communication destination when the communication destination is the specific communication destination and the version of the encrypted communication protocol set at the communication destination is included in the version of the encrypted communication protocol set by the first setting means. Effect of the Invention

[0009] According to the present invention, when performing encrypted communications with a plurality of communication partners, it is possible to perform encrypted communications with each communication partner using an optimal version of the encrypted communications protocol.

[0010] Other features and advantages of the present invention will become apparent from the following description taken in conjunction with the accompanying drawings, in which the same reference numerals are used to designate the same or similar components throughout the drawings. [Brief description of the drawings]

[0011] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the invention. [Figure 1] 1 is a diagram showing an outline of the configuration of a communication system including an MFP according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a block diagram illustrating the hardware configuration of the MFP according to the embodiment. [Diagram 3] FIG. 2 is a block diagram illustrating the configuration of a software module of the MFP according to the embodiment. [Figure 4] FIG. 4 is a view showing an example of a home screen displayed on an operation panel of the MFP according to the embodiment. [Diagram 5] FIG. 5 is a diagram showing an example of a web browser screen that is displayed when a web browser button is pressed on the screen of FIG. 4. [Figure 6] 4 is a view showing an example of an operation screen of an external controller displayed on an operation panel of the MFP according to the embodiment. [Figure 7] 11 is a view showing an example of a TLS setting screen displayed on the operations panel when an instruction to change TLS communication setting information is given in the MFP according to the embodiment. [Figure 8] 4 is a view showing an example of a version setting screen displayed on an operation panel of the MFP according to the embodiment. [Figure 9]6 is a view showing an example of a version setting screen for a specific server displayed on the operation panel of the MFP according to the embodiment. [Figure 10] 4 is a sequence diagram showing the procedure of encrypted communication processing performed by the MFP according to the embodiment with an external controller. [Figure 11] 4 is a sequence diagram showing the procedure of encrypted communication processing performed by the MFP according to the embodiment with an external controller. [Figure 12] 11 is a flowchart for explaining a procedure at the start of encrypted communication processing by an MP according to the embodiment. [Figure 13] 11 is a flowchart for explaining the procedure of a process for determining a TLS version by the MFP according to the embodiment. [Figure 14] FIG. 2 is a functional block diagram for explaining functions of the MFP according to the embodiment. [Figure 15] FIG. 11 is a block diagram illustrating another functional configuration of the MFP according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, the embodiments of the present invention will be described in detail with reference to the accompanying drawings. Note that the following embodiments do not limit the invention according to the claims. Although the embodiments describe a number of features, not all of these features are essential to the invention, and the features may be combined in any manner. Furthermore, in the accompanying drawings, the same or similar configurations are given the same reference numbers, and duplicated descriptions are omitted. Note that in the embodiments, an example in which the information processing device of the present invention is applied to a multi-function peripheral (MFP), but the present invention is not limited to an MFP and may be applied to an information processing device capable of encrypted communication, such as a PC (Personal Computer).

[0013] FIG. 1 is a diagram illustrating a schematic configuration of a communication system 100 including an MFP 101 according to an embodiment of the present invention.

[0014] This communication system 100 includes an MFP 101, a cloud server 102, a client PC 103, and an external controller 105. The client PC 103 and the external controller 105 are communicably connected to each other via a network 104. The cloud server 102, which exists on the Internet 106, is connected to the network 104 via a firewall 107. The MFP 101 is also connected to the network 104 via the external controller 105, and can communicate with devices on the network. Note that, as shown by the dashed line in FIG. 1, there is also a form in which the MFP 101 has a second network line and is directly connected to the network 104 without going through the external controller 105.

[0015] There are multiple applications that run on the cloud server 102. Services provided by these applications include a cloud print service that stores print jobs on the server 102 and enables printing from any MFP after authentication. There is also a file conversion service that converts data scanned by the MFP into file formats such as Word (registered trademark) and Excel (registered trademark). There is also an image log management service that stores the contents printed by the MFP as a log and enables tracking of output.

[0016] The external controller 105 also provides a number of services, including a print service that outputs print jobs received from the client PC 103 as printouts using the MFP 101, and a print job composition and imposition processing service. It also has a calibration function that adjusts colors to the desired colors for multiple types of paper.

[0017] The MFP 101 has a printing function, a scanning function, and a communication function. For example, the MFP 101 transmits image data and the like to a cloud server 102, and the cloud server 102 stores the image data, and performs printing based on print data received from a client PC 103. In the embodiment, the cloud server 102 functions as a TLS server, and the MFP 101 performs encrypted communication with the cloud server 102 using TLS. The MFP 101 can also function as a TLS server for the client PC 103. The MFP 101 can perform TLS communication with the client PC 103. However, the communication protocol is not limited to TLS. Furthermore, the external controller 105 functions as a TLS server, and can perform TLS communication with a web browser installed in the MFP 101.

[0018] The MFP 101 performs encrypted communication when transmitting and receiving highly confidential data. In encrypted communication, data encryption and decryption processing and authentication processing of the communication destination are performed. The MFP 101 performs encrypted communication using an encryption communication protocol such as TLS and IPsec. In the embodiment, as an example, a case will be described in which the MFP 101 uses TLS as the encryption communication protocol and performs encrypted communication using TLS (hereinafter, TLS communication). TLS has protocol versions TLS1.0, TLS1.1, TLS1.2, and TLS1.3. It is assumed that the MFP 101 according to the embodiment can use any of the above-mentioned protocol versions from TLS1.0 to TLS1.3.

[0019] In the following, the protocol version of the encryption communication protocol that can be used by the communication software implemented in the MFP 101 is called the implemented protocol version. The MFP 101 also has multiple encryption algorithms that can be used for TLS communication. The multiple encryption algorithms include an encryption algorithm for encrypting and decrypting data (hereinafter, encryption algorithm), and an encryption algorithm for managing encryption keys used in data encryption and decryption processing and for issuing certificates to authenticate communication destinations (hereinafter, authentication algorithm). The MFP 101 has ChaCha20-Poly1305, AES-GCM, AES-CBC, and 3DES-CBC as encryption algorithms. Each of AES-GCM and AES-CBC is further classified into two types according to the length of the encryption key (key length) used in encryption and decryption processing. In the following, the encryption algorithm implemented in the MFP 101 is defined as the implemented encryption algorithm. The MFP 101 also has ECDSA, RSA, and DSA as authentication algorithms, which are defined as the implemented authentication algorithms in the following.

[0020] The authentication algorithm can be set independently of the protocol version. In this embodiment, the protocol version is mainly used. Since the authentication algorithm is not an essential element of the embodiment, the following description is omitted.

[0021] FIG. 2 is a block diagram illustrating the hardware configuration of the MFP 101 according to the embodiment.

[0022] The MFP 101 includes a control unit 200, a printer 210, a scanner 211, and an operation panel 212. The control unit 200 is connected to each of the printer 210, the scanner 211, and the operation panel 212. The control unit 200 includes a CPU 201, a ROM 202, a RAM 203, a HDD 204, a network I / F (interface) 205, a printer control unit 206, a scanner control unit 207, and a panel control unit 208. The CPU 201, the ROM 202, the RAM 203, the HDD 204, the network I / F 205, the printer control unit 206, the scanner control unit 207, and the panel control unit 208 are connected via a system bus 209. The control unit 200 controls the printer 210, the scanner 211, and the operation panel 212.

[0023] The CPU 201 loads a program stored in the ROM 202 or HDD 204 into the RAM 203, executes the loaded program, and realizes the functions of software modules in FIG. 3 described later to execute various processes. The ROM 202 stores a boot program and various setting data of the MFP 101. The RAM 203 is used as a program load area and a work area for the CPU 201, and is also used as a temporary storage area for various data. The HDD 204 stores various data such as programs and print data. For example, the RAM 203 and the HDD 204 store available version information (used protocols), available algorithm information, key pair information, and the like, which will be described later. The network I / F 205 performs data communication with an external device (not shown) connected to the network 104. The printer control unit 206 controls the execution of a print process by the printer 210, and the scanner control unit 207 controls the execution of a scan process by the scanner 211. The panel control unit 208 controls display on the operation panel 212 and accepts input information input through the operation panel 212. The printer 210 prints on a recording paper (sheet) based on print data acquired from the client PC 103 or the like, or image data acquired by the scanner 211 reading an original. The scanner 211 reads an original placed on a platen (not shown) and generates image data based on the results of the reading. The operation panel 212 displays a setting screen for performing various settings in the MFP 101, and the like.

[0024] FIG. 3 is a block diagram illustrating the configuration of software modules of the MFP 101 according to the embodiment.

[0025] The software modules include an application 302, an encryption communication module 303, an encryption processing module 304, and a network control module 305. The software modules further include a network driver 306, a UI control module 307, and a communication setting control module 308. The communication setting control module 308 includes a protocol version setting module 309, an encryption algorithm setting module 310, and a certificate management module 311.

[0026] The application 302 is a module for implementing a print function, a scan function, a communication function, and the like in the MFP 101. For example, when performing communication processing of highly confidential data, the application 302 instructs the encryption communication module 303 to execute TLS communication.

[0027] The encryption communication module 303 controls the execution of encrypted communication based on an instruction to execute encrypted communication. For example, the encryption communication module 303 acquires each piece of information required to execute TLS communication from the encryption processing module 304 and the certificate management module 311 of the communication setting control module 308. The encryption communication module 303 also instructs the network control module 305 to execute data communication. The encryption processing module 304 generates and verifies each piece of data used in encrypted communication. For example, the encryption processing module 304 generates and verifies a signature for authentication in TLS communication and a hash value for detecting data tampering. The encryption processing module 304 also generates an encryption key for encrypting and decrypting data, and performs encryption and decryption processing of data.

[0028] A network control module 305 controls communication protocols such as TCP / IP, and instructs a network driver 306 to execute data communication. The network driver 306 controls the network I / F 205, and controls data communication with an external device (not shown) connected to the network 104.

[0029] The application 302 further controls the panel control unit 208 via the UI control module 307, and controls display on the operation panel 212 and reception of input information input by operating the operation panel 212. For example, the UI control module 307 receives a change instruction for setting information related to TLS communication (hereinafter, TLS communication setting information) by a user operating the operation panel 212. This TLS communication setting information includes permitted version information, permitted algorithm information, and key pair information. The permitted version information is information indicating a protocol version permitted for use among the protocol versions implemented in the MFP 101, and in the initial state of the MFP 101, one of the implemented protocol versions is preset as an initial value. The permitted algorithm information is information indicating an encryption algorithm permitted for use among the encryption algorithms implemented in the MFP 101, and in the initial state of the MFP 101, all the implemented encryption algorithms are preset as initial values. When the UI control module 307 receives a change instruction for the TLS communication setting information, it notifies the communication setting control module 308 via the application 302 of change instruction information including the change content and the like.

[0030] The communication setting control module 308 manages TLS communication setting information, and this TLS communication setting information is stored in the RAM 203 or the HDD 204. The communication setting control module 308 changes the TLS communication setting information based on change instruction information for the TLS communication setting information received from the UI control module 307. Specifically, the communication setting control module 308 changes the stored permitted version information to protocol version information corresponding to the change instruction information (hereinafter, change instruction version information) by the protocol version setting module 309. Furthermore, the communication setting control module 308 changes the stored permitted algorithm information to encryption algorithm information corresponding to the change instruction information (hereinafter, change instruction algorithm information) by the encryption algorithm setting module 310. Furthermore, the communication setting control module 308 changes the key pair information to setting information of the authentication algorithm corresponding to the change instruction information (hereinafter, change instruction authentication setting information) by the certificate management module 311.

[0031] FIG. 14 is a functional block diagram for explaining the outline of functions of the MFP 101 according to the embodiment.

[0032] To use a service provided by the cloud server 102 or the external controller 105, the user of the MFP 101 uses a web browser 1401 installed in the MFP 101. This web browser 1401 enables screen operations for using the service and browsing of the results of the service executed by the server. The web browser 1401 generates web applications 1402 and 1403 for each connection destination and switches the TLS communication protocol version for each server to be connected. This switching is performed by a version setting switching unit 1404, and for example, TLS1.2 is specified to connect to a web server 1408 of the cloud server 102. Also, TLS1.1 is specified to connect to a web server 1407 of the external controller 105. Note that the functional block diagram of the MFP is not limited to the configuration in FIG. 14 and other forms are also possible.

[0033] FIG. 15 is a block diagram illustrating another functional configuration of the MFP 101 according to the embodiment.

[0034] 15 differs from FIG. 14 in that the cloud server 102 communicates directly with the MFP 101, rather than being connected via the external controller 105. The MFP 101 has a web browser 1503 for communication with the cloud server 102, and a web browser 1501 for communication with the external controller 105. The web browsers 1501 and 1503 generate web applications 1502 and 1504, respectively. In addition, each web browser holds a TLS version setting value, and the web browser 1501 communicates with the web server 1407 using TLS 1.1, and the web browser 1503 can communicate with the web server 1408 using TLS 1.2.

[0035] Next, a display example of an operation screen displayed on operation panel 212 of MFP 101 will be described.

[0036] FIG. 4 is a diagram showing an example of a home screen displayed on the operation panel 212 of the MFP 101 according to the embodiment.

[0037] This home screen 401 is initially displayed when the MFP 101 is turned on. Buttons corresponding to multiple functions of the MFP 101 are displayed on the home screen 401. For example, a web browser button 403 is a button for browsing a web page provided by the cloud server 102. An external controller button 402 is a button for operating the external controller 105.

[0038] FIG. 5 is a diagram showing an example of a web browser screen that is displayed when the web browser button 403 on the screen of FIG. 4 is pressed.

[0039] This web browser screen 501 has a URL input field 502 for the web server to be displayed, and a content display field 503 displays the content received through the encrypted communication module 303 .

[0040] FIG. 6A is a diagram showing an example of an operation screen of the external controller 105 that is displayed when the external controller button 402 is pressed on the screen of FIG.

[0041] The host name and IP address of the external controller 105 are displayed at the top of the external controller operation screen 601. A menu area 602 is located on the left side of the screen, and a job list can be displayed and color calibration can be performed from the menu area 602. When an item in the menu area 602 is selected, the setting value of the external controller 105 is displayed in a content display area 603, and data can be input. The external controller operation screen 601 is realized in the MFP 101 by the same process as the web browser described in FIG. 14. The external controller 105 has an internal web server. The UI control module 307 can operate the external controller 105 by using the web application of the external controller 105 through the encryption communication module 303. Note that TLS communication is used for network communication between the external controller 105 and the MFP 101 to prevent leakage of communication information. If any error occurs in the TLS communication, a communication error dialog 604 is displayed as shown in FIG. 6B to alert the user.

[0042] Next, a display example of an operation screen relating to TLS communication settings and encryption algorithm settings will be described.

[0043] FIG. 7 is a diagram showing an example of a TLS setting screen 701 displayed on the operation panel 212 when an instruction to change the TLS communication setting information is given in the MFP 101 according to the embodiment.

[0044] This TLS setting screen 701 has an available version setting button 702 , a version setting button for a specific server 703 , check boxes 704 , an encryption algorithm setting button 705 , a key and certificate button 706 , and a close button 707 .

[0045] The usable version setting button 702 is a setting button selected when issuing an instruction to change the permitted version information for a specific server. The version setting button 703 for a specific server is a button selected when issuing an instruction to change the permitted version information for a specific server. The user can switch the protocol version for a specific server by checking a check box 704. The encryption algorithm setting button 705 is a button selected when issuing an instruction to change the permitted algorithm information. The encryption algorithm used for encrypting data can be set independently of the TLS protocol version. The key and certificate button 706 is a button selected when issuing an instruction to change the key pair information. The functions of the encryption algorithm setting button 705 and the key and certificate button 706 are not directly related to the operation of this embodiment, so will not be described below. The close button 707 is a button for ending the TLS setting.

[0046] FIG. 8A is a diagram showing an example of a version setting screen 801 that is displayed on the operation panel 212 of the MFP 101 when the available version setting button 702 is selected on the screen of FIG.

[0047] This version setting screen 801 is a screen for issuing an instruction to change the permitted version information. This version setting screen 801 includes an upper limit version 802, a lower limit version 803, and an OK button 804. The upper limit version 802 and the lower limit version 803 are displayed with the setting values ​​corresponding to the permitted version information stored in the RAM 203 or the HDD 204 set. The upper limit version 802 indicates the upper limit value of the permitted version information, and the lower limit version 803 indicates the lower limit value of the permitted version information.

[0048] In the embodiment, it is assumed that 1.0, 1.1, 1.2, and 1.3 can be selected as the TLS version. On this screen, the user can specify the upper and lower limits of the TLS version to be used. The set values ​​of the upper limit version 802 and the lower limit version 803 can be set by operating a pull-down menu. For example, the upper limit version 802 is set by the user operating the pull-down menu 805 in FIG. 8(B). The OK button 804 is a button that confirms the setting on this version setting screen 801 and issues an instruction to change the permitted version information. In FIG. 8(A), as an example of using a relatively new version, the upper limit version is set to TLS1.3 and the lower limit version is set to TLS1.2.

[0049] It is preferable that all servers and clients that communicate with the TLS communication support new versions at the same time. However, the timing of support for new versions may differ depending on the circumstances of each manufacturer. In particular, for devices used for specific purposes such as the external controller 105, it may be difficult to support older products at the same time as general Web servers. In this case, a situation occurs in which the optimal TLS protocol version differs for each server. Therefore, in the embodiment, the TLS setting screen 701 in FIG. 7 is provided with a version setting for a specific server and a check box 704 for whether or not to use the setting.

[0050] FIG. 9A is a diagram showing an example of a version setting screen 901 for a specific server that is displayed on the operation panel 212 when the check box 704 is checked and the version setting for specific server button 703 is pressed.

[0051] This screen 901 is a screen for issuing an instruction to change the permitted version information of a specific server. This screen 901 differs from screen 801 in Fig. 8(A) in that a specific server host name 902 field and a version used field 903 field are added. In this embodiment, when the MFP 101 performs TLS communication with the external controller 105, the external controller 105 is designated as the specific server. Therefore, the IP address "10.255.255.1", which is a fixed value in the MFP 101, is entered in the specific server host name field 902.

[0052] The TLS protocol version to be used in communication with a specific server can also be specified using the version to be used field 903. In this embodiment, the TLS version of the specific server is known, so only one field is provided. If necessary, upper and lower limit versions may be set as shown in FIG. 8(A). When the MFP 101 performs TLS communication with the external controller 105, the TLS protocol version value set in this version setting screen 901 for specific server is used. In this embodiment, the external controller 105 does not yet support TLS 1.2 or later versions. Therefore, "TLS 1.1" is set in the version to be used field 903.

[0053] If the user wishes to change the version in use, the user may select the desired version from a pull-down menu 905 that displays a list of versions, as shown in Fig. 9(B) for example. After checking the input values, the user presses an OK button 904 to update the settings.

[0054] 15, when MFP 101 has multiple network interfaces, devices that can be set as a specific server may be limited to devices connected to one of the multiple network interfaces. Also, external controller 105 may have identification information (e.g., a vendor ID) indicating a device, and devices that can be set as a specific server may be limited to devices that have the corresponding identification information. In this way, limiting devices that can be set as a specific server is one way to prevent security holes from being created.

[0055] Fig. 10 is a sequence diagram showing the procedure of encrypted communication processing performed by MFP 101 according to the embodiment with external controller 105. In Fig. 10, the processing of MFP 101 is performed by each functional module of a software module (Fig. 3) realized by CPU 201 of MFP 101 loading a program stored in a storage unit such as HDD 204 or ROM 202 into RAM 203 and executing the program.

[0056] First, in S1001, the CPU 201 functions as the UI control module 307 and accepts an instruction from the user to press the external controller button 402 in Fig. 4. Next, in S1002, the CPU 201 functions as the communication setting control module 308 and acquires the upper and lower limit values ​​of the TLS version and encryption information set in the MFP 101, as described in Fig. 9(A). Next, in S1003, the application 302 notifies the external controller 105 of the acquired values ​​via the encryption communication module 303 and the network control module 305. As a result, in S1004, the external controller 105 acquires the TLS version and encryption information set in the external controller 105. Then, in S1005, the application 302 receives from the external controller 105 the TLS version number and encryption method that the external controller 105 wants to use.

[0057] Then, in S1006, the CPU 201 functions as the communication setting control module 308 and determines whether or not communication is possible using the TLS version number received from the external controller 105. The method of determining whether or not communication is possible will be described later with reference to FIG. 13. In the example of FIG. 10, the received TLS version 1.1 is within the range of the upper and lower limit versions of the MFP 101. Therefore, it is determined that subsequent communication is possible using the encryption method received in the format of TLS1.1. Then, in S1007, the application 302 requests the external controller 105 to transmit the content of the setting screen of the external controller 105 in the version of TLS1.1. Then, in S1008, the encryption communication module 303 receives the encrypted content from the external controller 105. Finally, in S1009, the application 302 uses the UI control module 307 to display the received content on the operation panel 212 using a web browser. FIG. 6A shows an example of the content thus displayed by the web browser.

[0058] Fig. 11 is a sequence diagram showing the procedure of encrypted communication processing performed by MFP 101 according to the embodiment with external controller 105. In Fig. 11, the processing of MFP 101 is performed by each functional module of a software module realized by CPU 201 included in MFP 101 expanding a program stored in a storage unit such as HDD 204 or ROM 202 into RAM 203 and executing it.

[0059] The basic sequence here is the same as in Fig. 10. Here, a case will be described in which TLS communication fails when the version setting checkbox 704 for a specific server in Fig. 7 is not checked and the permitted version shown in Fig. 8(A) is commonly applied to all servers. That is, consider a case in which the upper limit version of the MFP 101 is set to TLS1.3 and the lower limit version is set to TLS1.2, and the same settings are applied to encrypted communication with the external controller 105. S1101 to S1105 in Fig. 11 are the same as S1001 to S1005 in Fig. 10, and therefore their description will be omitted.

[0060] In S1106, the CPU 201 functions as the communication setting control module 308 and determines whether communication is possible using the TLS version number received from the external controller 105. In the example of Fig. 11, the received TLS version 1.1 is not included in the range of the upper limit version 1.3 and the lower limit version 1.2 of the MFP 101. For this reason, in S1106, it is determined that agreement on the protocol version cannot be reached. Then, in S1107, the application 302 notifies the external controller 105 that the TLS communication will be interrupted using the encrypted communication module 303. Then, in S1108, the CPU 201 functions as the UI control module 307 and displays, for example, the communication error dialog 604 shown in Fig. 6(B) on the operation panel 212 to inform the user who was unable to perform encrypted communication with the external controller 105.

[0061] 12 is a flowchart for explaining a procedure at the start of encrypted communication processing by the MP 101 according to the embodiment. Note that the processing shown in this flowchart is realized by the CPU 201 of the MFP 101 expanding a program stored in a storage unit such as the HDD 204 or the ROM 202 into the RAM 203 and executing the program.

[0062] First, in S1201, the CPU 201 functions as the communication setting control module 308 and acquires host information of the server with which communication will be performed. Then, the CPU 201 functions as the UI control module 307 and determines which server to communicate with based on which button on the home screen 401 the user has pressed. Then, in S1202, the CPU 201 functions as the communication setting control module 308 and determines whether the check box 704 on the TLS setting screen 701 is checked. If the check box 704 is not checked, the same TLS version is used for all servers, so the process proceeds to S1205. On the other hand, if the check box 704 is checked, the process proceeds to S1203, where the CPU 201 functions as the communication setting control module 308 and determines whether the server to communicate with is a specific server. If the communication destination is a specific server, the process proceeds to S1204, where the CPU 201 acquires the TLS version to be used for the specific server shown in FIG. 9A, and proceeds to S1206. On the other hand, if it is determined in S1202 that the communication destination is not a specific server, the process proceeds to S1205, where the CPU 201 acquires the upper and lower limits of the TLS version shown in Fig. 8(A), and proceeds to S1206. Then, in S1206, the CPU 201 executes an encrypted communication handshake with the external controller 105 based on the version information acquired in S1204 or S1205, and ends this process. Note that the details of the encrypted communication handshake are the same as those already described in the sequence diagrams of Figs. 10 and 11.

[0063] By this process, if a version for a specific server is set and the communication destination is a specific server, it is possible to communicate with the specific server using the version set for that specific server.

[0064] 13 is a flowchart for explaining the procedure of a process for determining the TLS version by the MFP 101 according to the embodiment. Note that the process shown in this flowchart is realized by the CPU 201 included in the MFP 101 expanding a program stored in a storage unit such as the HDD 204 or the ROM 202 into the RAM 203 and executing the program.

[0065] First, in S1301, the CPU 201 functions as the communication setting control module 308 and acquires TLS upper and lower limit version setting information set in the MFP 101. Next, the process proceeds to S1302, where the CPU 201 functions as the communication setting control module 308 and acquires the TLS version number received from the communication destination server that the server desires to use. Then, the process proceeds to S1303, where the CPU 201 functions as the communication setting control module 308 and determines whether the TLS version number desired by the server is within the range of the upper and lower limit version values ​​of the MFP 101. If it is determined that the value is within the range, the process proceeds to S1304, where the CPU 201 functions as the communication setting control module 308 and decides to adopt the TLS version received from the server for encrypted communication, and ends this process. On the other hand, if it is determined in S1303 that the TLS version number desired by the server is outside the upper and lower limit ranges of the MFP 101, the process proceeds to S1305, where the CPU 201 interrupts communication with the communication destination server and ends this process.

[0066] <Other embodiments> In the description of the embodiment, in Fig. 9(A), a host name (name) or an IP address is used as the identification information of a specific server, but the effect is the same even if each button displayed on the home screen in Fig. 4 is used as the identification information. Also, the identification information of a specific server may be set to more than one setting, and multiple settings may be registered.

[0067] (Other embodiments) The present invention can also be realized by a process in which a program for implementing one or more of the functions of the above-described embodiments is supplied to a system or device via a network or a storage medium, and one or more processors in a computer of the system or device read and execute the program. The present invention can also be realized by a circuit (e.g., ASIC) that implements one or more of the functions.

[0068] The present invention is not limited to the above-described embodiments, and various modifications and variations can be made without departing from the spirit and scope of the present invention. Therefore, the following claims are appended to apprise the public of the scope of the present invention. [Explanation of symbols]

[0069] 101...MFP, 105...external controller, 201...CPU, 202...ROM, 203...RAM, 212...operation panel, 302...application, 303...encrypted communication module, 304...encrypted communication module, 308...communication setting control module, 309...protocol version setting module

Claims

1. An information processing device that performs encrypted communication using an encrypted communication protocol that is set as a usage protocol among a plurality of encrypted communication protocols, a first setting means for setting a version of an encrypted communication protocol used in the encrypted communication in association with a specific communication destination; an execution means for executing encrypted communication with the communication destination using the version of the encrypted communication protocol set at the communication destination when the communication destination is the specific communication destination and the version of the encrypted communication protocol set at the communication destination is included in the version of the encrypted communication protocol set by the first setting means; 13. An information processing device comprising:

2. 2. The information processing apparatus according to claim 1, further comprising a storage unit for storing the version of the encrypted communication protocol set by said first setting unit in association with the identification information of said specific communication destination.

3. 3. The information processing apparatus according to claim 2, wherein the identification information is a name or an IP address of the communication destination.

4. 4. The information processing apparatus according to claim 1, wherein the first setting means sets a version selected from a displayed list of versions of an encryption communication protocol.

5. 5. An information processing device according to claim 1, further comprising a display means for displaying a communication error when the version of the encrypted communication protocol set at the communication partner is not included in the version of the encrypted communication protocol set by the first setting means.

6. 6. The information processing apparatus according to claim 1, wherein the first setting means is capable of setting a version of an encrypted communication protocol used in the encrypted communication for each of a plurality of specific communication destinations.

7. 7. The information processing apparatus according to claim 1, further comprising a second setting unit for setting an encrypted communication protocol used in the encrypted communication in the information processing apparatus.

8. 8. The information processing apparatus according to claim 7, wherein the second setting means sets the version of the encrypted communication protocol by an upper limit value and a lower limit value.

9. 9. The information processing apparatus according to claim 1, wherein the communication destination is a Web server.

10. 10. The information processing apparatus according to claim 1, wherein the encrypted communication protocol includes at least one of Transport Layer Security (TLS), secure Sockets Layer (SSL), Security Architecture for the Internet Protocol (IPSec), and IEEE802.1X.

11. A control method for controlling an information processing device that performs encrypted communication using an encrypted communication protocol that is set as a usage protocol among a plurality of encrypted communication protocols, comprising: a first setting step of setting a version of an encrypted communication protocol to be used in the encrypted communication in association with a specific communication destination; an execution step of executing encrypted communication with the communication destination using the version of the encrypted communication protocol set at the communication destination when the communication destination is the specific communication destination and the version of the encrypted communication protocol set at the communication destination is included in the version of the encrypted communication protocol set at the first setting step; A control method comprising the steps of:

12. A program for causing a computer to function as all of the respective means of the information processing device according to any one of claims 1 to 10.

Images