Information processing device and program

Abstract

To accurately detect a change in network environment with a low load.SOLUTION: An information processing apparatus has: first detection means that detects a change in network environment based on network configuration information related to the configuration of a network to be connected; and second detection means that detects a change in the network environment based on packet information related to packets transmitted and received in the network. When the first detection means detects a change in the network environment, the information processing apparatus causes the second detection means to start acquisition of the packet information, thereby allowing accurate detection of a change in the network environment without the need to constantly perform the acquisition of the packet information.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an information processing device reference and programs. [Background technology]

[0002] As a security measure, it is necessary for the various security-related functions of information devices to be properly configured. If an information device is used in a single, fixed environment, by applying settings tailored to that single environment at the time of shipment, users can use the information device with appropriate security measures implemented without having to be aware of anything.

[0003] For example, when we look at the usage environments of multifunction devices, they are not limited to office environments, but are now diversified to include telecommuting and use in public spaces shared by an unspecified number of people. Appropriate security settings differ depending on the usage environment, so it is necessary to set appropriate settings for the usage environment. For example, if the usage environment changes, it is necessary to change the security settings. Information device administrators with specialized security knowledge recognize that settings need to be changed for each usage environment, and take measures such as changing the settings to suit changes in the usage environment before using the device.

[0004] Furthermore, a technique has been proposed for capturing packets transmitted and received on a network in order to investigate the network status. Patent Document 1 proposes a technique in which, when a server detects a network abnormality, it sends a capture start command to a packet capture PC to set a mirror port on a LAN switch, and when it detects that the abnormality has been resolved, it sends a capture stop command. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2012-104869 Summary of the Invention [Problem to be solved by the invention]

[0006] Due to the increase in the number of personally used information devices and the increase in working from home, there are an increasing number of cases where information devices are managed by users without specialized security knowledge. In recent years, personally managed information devices tend to have less adequate security measures than information devices within corporate networks that are managed by security administrators, and as a result, there is an increased possibility that information devices will be attacked by attackers.

[0007] Furthermore, when the network to which an information device connects changes and the device connects to a network with different characteristics than the previous one, it is necessary to change the security-related settings to suit the network to which the information device is connected. Users who are not security experts are likely not aware that they must change security-related settings to match changes in the network environment. Even if they are aware of this, it is difficult to identify and change security-related settings appropriately. As such, it is not easy for many users to recognize changes in the network environment to which they connect and change security-related settings accordingly.

[0008] An object of the present invention is to enable accurate detection of changes in a network environment with low load. [Means for solving the problem]

[0009] An information processing device according to the present invention comprises a first detection means for detecting a change in a network environment based on network configuration information relating to the configuration of a network to which the device is connected, and a second detection means for detecting a change in the network environment based on packet information relating to packets transmitted and received on the network; When the information processing device is started up or when the connection state to the network changes from disconnected to connected, The second detection means starts acquiring the packet information. [Effects of the Invention]

[0010] According to the present invention, it is possible to accurately detect changes in a network environment with a low load. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 2 is a diagram illustrating a connection configuration between an MFP and a management cloud system. [Figure 2] FIG. 2 illustrates an example of the configuration of a controller unit of an MFP. [Figure 3] FIG. 2 illustrates an example of the functional configuration of a controller unit of the MFP. [Figure 4] 10 is a flowchart illustrating a change detection process based on network configuration information. [Figure 5] 10 is a flowchart illustrating a change detection process based on packet information. [Figure 6] FIG. 10 is a diagram showing a screen configuration related to packet acquisition settings. [Figure 7] 10 is a flowchart illustrating an environment detection process of the MFP. [Figure 8] FIG. 10 is a diagram illustrating the processing of environment estimation. [Figure 9] FIG. 2 is a diagram showing the screen configuration of a menu screen. [Figure 10] FIG. 10 is a diagram showing a screen configuration related to security settings. DETAILED DESCRIPTION OF THE INVENTION

[0012] An embodiment of the present invention will be described below with reference to the drawings. In this embodiment, an example will be described in which various determinations and operations are performed on the information processing device side, which is an edge device, and only the status is notified to a cloud system. Whether control is performed by the cloud system or the edge device depends on the balance between the component costs related to the edge device's computational resources and the required response speed, and the appropriate form will differ depending on the solution to be applied.

[0013] 1 is a diagram illustrating a connection configuration among an MFP 100 according to this embodiment, a gateway 111, a management cloud system 121, a PC 113, and a DHCP server 114. The MFP (Multi-Function Peripheral) 100 and the management cloud system 121 are connected via a LAN (Local Area Network) 110, the gateway 111, and the Internet 120. The MFP 100, the PC 113, and the DHCP (Dynamic Host Configuration Protocol) server 114 are connected via the LAN 110.

[0014] The MFP 100 has an operation unit 102 that inputs and outputs data to and from the user, a printer unit 103 that outputs electronic data to paper media, and a scanner unit 104 that reads paper media and converts it into electronic data. The operation unit 102, printer unit 103, and scanner unit 104 are connected to a controller unit 101, and function as a multifunction peripheral under the control of the controller unit 101. The MFP 100 is an example of an information processing device.

[0015] The gateway 111 is a network router that relays communications from the MFP 100 to the Internet 120. The PC 113 is a personal computer. The DHCP server 114 is a server that assigns setting information related to network connection, such as an IP (Internet Protocol) address, to each device connected to the LAN 110. The management cloud system 121 remotely monitors the status of the MFP 100.

[0016] 2 is a block diagram showing an example of the configuration of the controller unit 101 of the MFP. A CPU (Central Processing Unit) 201 performs the main arithmetic processing within the controller unit 101. The CPU 201 is connected to a DRAM (Dynamic Random Access Memory) 202 via a bus. The DRAM 202 is used by the CPU 201 as a working memory for storing program data representing arithmetic instructions during the calculation process by the CPU 201 and data to be processed. The CPU 201 is connected to an I / O controller 203 via the bus. The I / O controller 203 performs input and output to and from various devices according to instructions from the CPU 201.

[0017] A SATA (Serial Advanced Technology Attachment) I / F 205 is connected to the I / O controller 203. A flash ROM (Read Only Memory) 211 is connected to the SATA I / F 205. The CPU 201 uses the flash ROM 211 to store programs and document files for realizing the functions of the MFP. A network I / F 204 is connected to the I / O controller 203. A wired LAN device 210 is connected to the network I / F 204. The CPU 201 controls the wired LAN device 210 via the network I / F 204 to realize communication on the LAN 110.

[0018] A panel I / F 206 is connected to the I / O controller 203. The CPU 201 performs input and output for the user to the operation unit 102 via the panel I / F 206. A printer I / F 207 is connected to the I / O controller 203. The CPU 201 performs output processing of paper media using the printer unit 103 via the printer I / F 207. A scanner I / F 208 is connected to the I / O controller 203. The CPU 201 performs reading processing of paper media documents using the scanner unit 104 via the scanner I / F 208.

[0019] For example, when a copy function is to be performed, the CPU 201 loads program data from the flash ROM 211 into the DRAM 202 via the SATA I / F 205. The CPU 201 detects a copy instruction from the user via the panel I / F 206 on the operation unit 102 in accordance with the program loaded into the DRAM 202. When the CPU 201 detects a copy instruction, it receives an original as image data from the scanner unit 104 via the scanner I / F 208 and stores it in the DRAM 202. The CPU 201 performs color conversion processing suitable for output on the image data stored in the DRAM 202. The CPU 201 transfers the image data stored in the DRAM 202 to the printer unit 103 via the printer I / F 207, and performs output processing onto paper media.

[0020] 3 is a block diagram showing an example of a functional configuration realized by software executed by the controller unit 101 of the MFP. All software executed by the controller unit 101 is executed after the CPU 201 reads programs stored in the flash ROM 211 into the DRAM 202.

[0021] The operation control unit 301 displays a screen image for the user on the operation unit 102, detects user operations, and executes processing associated with screen components such as buttons displayed on the screen. The data storage unit 302 writes and reads data to and from the flash ROM 211 in response to requests from other control units. For example, if the user wants to change some device setting, the operation control unit 301 detects the content entered by the user on the operation unit 102, and in response to a request from the operation control unit 301, the data storage unit 302 saves the content as a setting value in the flash ROM 211.

[0022] A job control unit 303 controls job execution in accordance with instructions from other control units. An image processing unit 304 processes image data into a format suitable for each application in accordance with instructions from the job control unit 303. A print processing unit 305 prints an image on a paper medium via a printer I / F 207 in accordance with instructions from the job control unit 303. A reading processing unit 306 reads an original document via a scanner I / F 208 in accordance with instructions from the job control unit 303.

[0023] The network control unit 307 performs network settings such as IP addresses on the TCP / IP control unit 308 at system startup or when a setting change is detected, in accordance with the setting values ​​stored in the data storage unit 302. The TCP / IP control unit 308 performs transmission and reception processing of network packets via the network I / F 204 in accordance with instructions from other control units.

[0024] The security setting control unit 309 controls the security settings of the MFP. The security setting control unit 309 manages the correspondence between usage environments such as an internal LAN, home, or public space and the corresponding security-related setting items, and can set the corresponding security-related settings all at once when the user specifies a usage environment. The security setting control unit 309 uses the data storage unit 302 to refer to and change setting values.

[0025] The management system communication unit 310 uses the network control unit 307 to exchange information between the management cloud system 121 and the MFP 100. For example, when a change is made to the settings stored in the data storage unit 302, the management system communication unit 310 notifies the management cloud system 121 of the change, allowing the management cloud system 121 to identify the settings under which the MFP 100 is operating. When a setting change instruction is issued in the management cloud system 121, the management system communication unit 310 receives the notification and performs processing to reflect the setting value in the data storage unit 302. By synchronizing the information of the MFP 100 in this way in both directions, the information of the MFP 100 can be confirmed and changed in real time in the management cloud system 121. The management system communication unit 310 also performs information transmission processing to the management cloud system 121 for the network configuration information stored in the data storage unit 302 by the network configuration detection unit 311.

[0026] The network configuration detection unit 311 collects network configuration information related to the configuration of the currently connected network and stores network configuration information related to the configuration of the previously connected network. The network configuration detection unit 311 also performs processing to detect changes in the network environment to which the MFP 100 is connected based on the acquired network configuration information. The network configuration detection unit 311 is an example of a first detection unit. The network configuration detection unit 311 collects network configuration information, for example, when the network control unit 307 starts network communication based on information stored in the data storage unit 302. The network configuration information includes information on other information processing devices connected to the same network. The network configuration information includes, for example, a Media Access Control (MAC) address that physically identifies the connected default gateway device. In this embodiment, the default gateway device corresponds to the gateway 111. Furthermore, the network configuration information also includes, for example, the MAC address and IP address of the DHCP server that allocates IP addresses, and the network address assigned to the device by the DHCP server. In this embodiment, this information is obtainable from the DHCP server 114. Furthermore, for example, the network configuration information also includes RA (Router Advertise) information of the connected IPv6 router. In the example of this embodiment, the IPv6 router corresponds to the gateway 111. The network configuration detection unit 311 uses the network control unit 307 to collect this information by performing communications in accordance with the respective corresponding protocols. When the network configuration detection unit 311 has completed collection of the network configuration information, it stores the network configuration information in the data storage unit 302 as the currently acquired network configuration information. The data storage unit 302 also stores the previously acquired network configuration information. When the currently acquired network configuration information is saved in the data storage unit 302, if the previously acquired network configuration information is stored in the data storage unit 302, it deletes the information, thereby optimizing the storage area.

[0027] The DHCP control unit 312 performs processing to determine the IP address, network address, and subnet mask of the MFP 100 by communicating with the DHCP server 114 in accordance with DHCP. The DHCP control unit 312 stores the determined IP address, network address, and subnet mask in the data storage unit 302. Once the determined IP address, network address, and subnet mask are stored in the data storage unit 302, the network control unit 307 performs network communication using these settings. The DHCP control unit 312 starts processing at the timing of network initialization, such as when the device is started up, and also starts processing at a timing based on the lease time of the IP address assigned by the DHCP server 114. Even when information such as the IP address is updated at a timing based on the lease time, the DHCP control unit 312 stores the information in the data storage unit 302, and the network control unit 307 then performs network communication using these settings.

[0028] The packet acquisition control unit 313 acquires packet information related to packets transmitted and received over the currently connected network. The start and stop of packet information acquisition by the packet acquisition control unit 313 are controlled by the change detection control unit 314. The packet acquisition control unit 313 also performs processing to detect changes in the network environment to which the MFP 100 is connected based on the acquired packet information. The packet acquisition control unit 313 also performs processing to estimate the network environment to which the MFP 100 is connected (the usage environment of the MFP 100) based on the acquired packet information. The packet acquisition control unit 313 is an example of a second detection unit. The network from which the packet information is acquired may be a wired LAN, a wireless LAN, or both a wired LAN and a wireless LAN, as long as it is an active network. The packets from which the packet information is acquired may be only broadcast or multicast, or may include unicast packets. The longer the packet acquisition period, the higher the accuracy of change detection and environment estimation. However, the longer the period, the longer the period during which resources such as the CPU are under high load. Therefore, an appropriate packet acquisition period depends on the environment to which the MFP 100 is connected. In an environment with a high packet flow rate, sufficient accuracy can be achieved even with a short packet acquisition period, but in an environment with a low packet flow rate, the packet acquisition period must be long to achieve sufficient accuracy. When the acquisition period is set to a short period, for example, 60 seconds, change detection and environment estimation are possible. When the packet acquisition control unit 313 completes collection of packet information, it stores the packet information in the data storage unit 302 as currently acquired packet information. The data storage unit 302 also stores the previously acquired packet information. When the currently acquired packet information is stored in the data storage unit 302, if the packet information acquired two times previously is stored in the data storage unit 302, it can be deleted, thereby optimizing the storage area.

[0029] Change detection control unit 314 controls the process of detecting a change in the network environment to which MFP 100 is connected. For example, when network configuration detection unit 311 detects a change in the network environment, change detection control unit 314 controls packet acquisition control unit 313 to start acquiring packet information based on a setting value set by operation control unit 301. Note that if packet acquisition is set not to be performed, the detection of a change in the network environment is determined based only on a change in network configuration information.

[0030] Referring to Figure 4, a process in which MFP 100 detects a change in the network environment to which it is connected based on network configuration information will be described. Figure 4 is a flowchart illustrating the change detection process using network configuration information. The process of the flowchart in Figure 4 is performed by network configuration detection unit 311 of MFP 100, and is realized when CPU 201 loads a program stored in flash ROM 211 into DRAM 202 and then executes the program. The process of the flowchart in Figure 4 is performed when network control unit 307 of MFP 100 starts network communication.

[0031] In step S401, MFP 100 determines whether the MAC address of the default gateway has changed. MFP 100 compares the MAC address information of the default gateway included in the current network configuration information stored in data storage unit 302 with the previously acquired network configuration information, and determines whether the MAC address has changed. If the current MAC address information does not match the previously acquired MAC address information and it is determined that the MAC address of the default gateway has changed (YES in step S401), the process proceeds to step S405. If the current MAC address information matches the previously acquired MAC address information and it is determined that the MAC address of the default gateway has not changed (NO in step S401), the process proceeds to step S402.

[0032] In step S402, MFP 100 determines whether the MAC address of the DHCP server has changed. MFP 100 compares the MAC address information of the DHCP server contained in the current network configuration information stored in data storage unit 302 with the previously acquired network configuration information, and determines whether the MAC address has changed. If the current MAC address information does not match the previously acquired MAC address information and it is determined that the MAC address of the DHCP server has changed (YES in step S402), the process proceeds to step S405. If the current MAC address information matches the previously acquired MAC address information and it is determined that the MAC address of the DHCP server has not changed (NO in step S402), the process proceeds to step S403.

[0033] In step S403, MFP 100 determines whether the network address assigned by the DHCP server has changed. MFP 100 compares the network address information included in the current network configuration information stored in data storage unit 302 with the network configuration information previously acquired, and determines whether the network address has changed. If the current network address information does not match the network address information previously acquired and it is determined that the network address has changed (YES in step S403), the process proceeds to step S405. If the current network address information matches the network address information previously acquired and it is determined that the network address has not changed (NO in step S403), the process proceeds to step S404.

[0034] In step S404, MFP 100 determines whether the RA information of the IPv6 router has changed. MFP 100 compares the RA information of the router contained in the current network configuration information saved in data storage unit 302 with the previously acquired network configuration information, and determines whether the RA information has changed. If it is determined that the current RA information and the previously acquired RA information do not match and that the RA information of the router has changed (YES in step S404), the process proceeds to step S405. If it is determined that the current RA information and the previously acquired RA information match and that the RA information of the router has not changed (NO in step S404), the process of the flowchart in FIG. 4 ends.

[0035] In step S405, the MFP 100 records in the data storage unit 302 that there has been a change in the connection environment according to the network configuration information. In this way, by executing the process of the flowchart in FIG. 4, MFP 100 can generate a diagnosis result as to whether or not the network environment has changed, based on the network configuration information.

[0036] Referring to Figure 5, a process in which MFP 100 acquires packet information and detects a change in the connected network environment based on the acquired packet information will be described. Figure 5 is a flowchart illustrating the change detection process using packet information. The process of the flowchart in Figure 5 is performed by packet acquisition control unit 313 of MFP 100, and is implemented by CPU 201 reading a program stored in flash ROM 211 into DRAM 202 and then executing the program. The process of the flowchart in Figure 5 is performed when packet acquisition control unit 313 of MFP 100 is instructed by change detection control unit 314 to acquire a packet.

[0037] In step S501, MFP 100 starts acquiring packets flowing through the network to which it is connected. After the time set in packet acquisition period 620 on the packet acquisition setting screen shown in Fig. 6 (described later) has elapsed, MFP 100 stops acquiring packets and saves them in step S502. In this way, MFP 100 acquires packets transmitted and received over the network during a predetermined period.

[0038] In steps S503 to S507, MFP 100 compares the packet information acquired last time with the packet information acquired this time. In step S503, MFP 100 determines whether there has been a change in the most prevalent source IP address among the source IP addresses included in the acquired packet information. MFP 100 compares the most prevalent source IP address in the previously acquired packet information with the most prevalent source IP address in the currently acquired packet information to determine whether there has been a change. If it is determined that there has been a change in the source IP address (YES in step S503), the process proceeds to step S507; if it is determined that there has not been a change (NO in step S503), the process proceeds to step S504.

[0039] In step S504, MFP 100 determines whether there has been a change in the most common destination IP address among the destination IP addresses included in the acquired packet information. MFP 100 compares the most common destination IP address in the previously acquired packet information with the most common destination IP address in the currently acquired packet information to determine whether there has been a change. If it is determined that there has been a change in the destination IP address (YES in step S504), the process proceeds to step S507, and if it is determined that there has not been a change (NO in step S504), the process proceeds to step S505.

[0040] In step S505, MFP 100 determines whether there has been a change in the most common source port number among the source port numbers included in the acquired packet information. MFP 100 compares the most common source port number in the previously acquired packet information with the most common source port number in the currently acquired packet information to determine whether there has been a change. If it is determined that there has been a change in the source port number (YES in step S505), the process proceeds to step S507, and if it is determined that there has not been a change (NO in step S505), the process proceeds to step S506.

[0041] In step S506, MFP 100 determines whether there has been a change in the most common destination port number among the destination port numbers included in the acquired packet information. MFP 100 compares the most common destination port number in the previously acquired packet information with the most common destination port number in the currently acquired packet information to determine whether there has been a change. If it is determined that there has been a change in the destination port number (YES in step S506), the process proceeds to step S507, and if it is determined that there has not been a change (NO in step S506), the process of the flowchart in FIG. 5 ends.

[0042] In step S507, the MFP 100 records in the data storage unit 302 that the connection environment has changed according to the packet information. In this way, by executing the process of the flowchart in FIG. 5, MFP 100 can acquire packet information and generate a diagnosis result indicating whether or not the network environment has changed based on the acquired packet information. The comparison between the previously acquired packet information and the currently acquired packet information is not limited to the above example, and any information contained in the packet information may be used. Furthermore, machine learning may be used to determine whether specific information contained in the packet has changed.

[0043] Fig. 6 is a diagram showing a packet acquisition setting screen 601 displayed on the operation unit 102. In Fig. 6, a setting item, packet acquisition 610, is a setting for whether or not packet acquisition (acquisition of packet information) is performed, and can be set by pressing an ON button 611 or an OFF button 612. When the ON button 611 of packet acquisition 610 is pressed, the setting is made to perform packet acquisition (ON), and when the OFF button 612 of packet acquisition 610 is pressed, the setting is made to not perform packet acquisition (OFF).

[0044] The setting item, packet acquisition period 620, is a setting for the time from when packet acquisition (acquisition of packet information) starts until packet acquisition (acquisition of packet information) stops, and is expressed in units of seconds, for example. Packet acquisition period 603 is a setting that is valid only when packet acquisition 610 is ON. In the example shown in FIG. 6, "3600" is displayed in packet acquisition period display section 621, and when packet acquisition is set to be performed, packets are acquired within 3600 seconds from the start of packet acquisition, and packet acquisition stops after 3600 seconds.

[0045] The setting item, steady packet acquisition 630, is a setting as to whether or not packets (packet information) are acquired periodically, and can be set by pressing an ON button 631 or an OFF button 632. The steady packet acquisition 630 is a setting that is valid only when packet acquisition 610 is ON. When the ON button 631 of steady packet acquisition 630 is pressed, the setting is turned ON to perform regular packet acquisition, and when the OFF button 632 of steady packet acquisition 630 is pressed, the setting is turned OFF to not perform regular packet acquisition.

[0046] The setting item, acquisition interval 640, is the time setting from when packet acquisition stops until packet acquisition starts again, and is expressed in units of, for example, hours. The acquisition interval 640 is a setting that is valid only when packet acquisition 610 and packet steady acquisition 630 are both ON. In the example shown in Fig. 6, the acquisition interval display section 641 displays "24," and if packet acquisition is set to be performed periodically, the next packet acquisition will start 24 hours after packet acquisition stops.

[0047] If any of the setting items shown in FIG. 6 is not valid, the item display or button may be grayed out or hidden to make it impossible to set. Furthermore, the time to start packet acquisition may be set so that packet acquisition starts at the set time every day.

[0048] Referring to FIG. 7, the process in which MFP 100 detects a change in the network environment and estimates the network environment will be described. FIG. 7 is a flowchart illustrating the environment detection process executed by MFP 100. In this embodiment, an example will be described in which MFP 100 starts packet acquisition (acquisition of packet information) when a change is detected in the change detection process using network configuration information. The process of the flowchart in FIG. 7 is realized by CPU 201 loading a program stored in flash ROM 211 into DRAM 202 and then executing the program. The process of the flowchart in FIG. 7 starts when MFP 100 starts up.

[0049] In step S701, the MFP 100 determines whether the packet steady acquisition 630 in Fig. 6 is ON. If it is determined that the packet steady acquisition 630 is ON (YES in step S701), the process proceeds to step S702. If it is determined that the packet steady acquisition 630 is not ON, that is, is OFF (NO in step S701), the process proceeds to step S704.

[0050] In step S702, MFP 100 determines whether a change in the network environment has been detected by detecting changes based on packet information as shown in Fig. 5, and if it determines that a change has been detected, records that there has been a change in the network environment in data storage unit 302. The time from when packet acquisition (acquisition of packet information) starts to when it stops follows the setting value of packet acquisition period 620 in Fig. 6.

[0051] In step S703, the MFP 100 performs an environment estimation process to estimate the network environment using machine learning, as shown in FIG. 8. FIG. 8 is a diagram illustrating the environment estimation process. The environment estimation is performed using machine learning. The input parameters 801 are, for example, the source IP address and destination IP address in the IP header of the acquired packet, and the source port number and destination port number in the TCP header. Note that any parameter contained in the packet, such as TTL (Time to Live), window size, or flag, may be used. The digitized input parameters 802 are obtained by digitizing the input parameters 801. The digitized input parameters 802 are time-series data for the number of source IP addresses exceeding a threshold, the number of destination IP addresses exceeding a threshold, the number of source port numbers exceeding a threshold, and the number of destination port numbers exceeding a threshold. Note that any means for digitization may be used. The digitized input parameters 802 are used as the input for machine learning, and the output parameters 803 are output as the output for machine learning. The output parameter 803 indicates the network environment (usage environment) and is output as a continuous numerical value, for example, where an internal company LAN is 1, home is 2, and public space is 3. The type of usage environment may be any number of types, including direct internet connection and internet prohibited. The estimation result 804 is a value calculated from the occurrence rate of the output parameter 803, and in the example shown in FIG. 8, the probability that the usage environment is an internal company LAN is 60%, the probability that it is at home is 20%, and the probability that it is a public space is 20%. In this case, the internal company LAN with the highest probability among the estimated usage environments is taken as the usage environment estimation result in the environment estimation process.

[0052] In step S704, MFP 100 determines whether a change has been detected in the change detection process using network configuration information such as that shown in Fig. 4. If it is determined that a change has been detected (YES in step S704), the process proceeds to step S705, and if it is determined that a change has not been detected (NO in step S704), the process returns to step S701.

[0053] In step S705, MFP 100 determines whether packet acquisition 610 in Fig. 6 is ON. If it is determined that packet acquisition 610 is not ON, that is, OFF (NO in step S705), the process proceeds to step S706, and if it is determined that packet acquisition 610 is ON (YES in step S705), the process proceeds to step S707.

[0054] In step S706, MFP 100 determines whether a change has been detected based on the network configuration information, and if it determines that a change has been detected, records that there has been a change in the network environment in data storage unit 302, and returns to step S701. Note that change detection based on the network configuration information has been completed in the processing of step S704.

[0055] In step S707, the MFP 100 determines whether the packet steady acquisition 630 in Fig. 6 is ON. If it is determined that the packet steady acquisition 630 is ON (YES in step S707), the process proceeds to step S708. If it is determined that the packet steady acquisition 630 is not ON, that is, is OFF (NO in step S707), the process proceeds to step S709.

[0056] In step S708, since there is a possibility that MFP 100 has started acquiring packets before detecting a change in the change detection process based on the network configuration information, MFP 100 discards the packets being acquired and proceeds to step S709.

[0057] In step S709, MFP 100 determines whether a change in the network environment has been detected by detecting changes based on packet information as shown in Fig. 5, and if it determines that a change has been detected, records that there has been a change in the network environment in data storage unit 302, and returns to step S701. The time from when packet acquisition (acquisition of packet information) starts to when it stops follows the setting value of packet acquisition period 620 in Fig. 6. Also, the time from when packet acquisition (acquisition of packet information) stops to when packet acquisition starts again follows the setting value of acquisition interval 640 in Fig. 6.

[0058] In step S710, MFP 100 performs an environment estimation process to estimate the network environment using machine learning, as shown in Fig. 8. After the environment estimation process is completed and an estimation result of the usage environment is obtained, the process returns to step S701.

[0059] The information recorded in the data storage unit 302 indicating that there has been a change in the network environment is retained until the record is changed to indicate that there has been no change in the network environment when a change in settings is detected or when the detection cancellation button 1005 in Figure 10 described below is pressed. 7, it is possible to start packet acquisition at an appropriate timing and generate a diagnosis result as to whether or not the network environment has changed, without constantly acquiring packets (packet information). Also, it is possible to estimate the usage environment of MFP 100 based on the acquired packets (packet information).

[0060] Although packet acquisition (acquisition of packet information) is started when a change is detected in the change detection process based on network configuration information, packet acquisition may also be started when MFP 100 is started or when the network changes from a disconnected state to a connected state. Also, although an example has been shown in which environment estimation processing is performed after a change in the network environment is detected, it is also possible to perform only the change detection process in the network environment without performing the environment estimation processing.

[0061] FIG. 9 is a diagram showing a menu screen 901 displayed on the operation unit 102. In FIG. 9, a copy button 902, a scan button 903, and a setting button 904 are used to execute corresponding functions of the MFP 100. An information notification unit 905 is used to notify the user of information. For example, if a change in the network environment is detected, the information notification unit 905 can display a message to notify the user and prompt the user to change security settings, etc. To support user operations after the notification, the screen may be switched to a screen for the operation when the user touches the information notification unit 905. For example, if the user taps the information notification unit 905 while being notified that the network environment has changed, a recommended security setting screen 1001, as shown in FIG. 10, can be displayed to prevent the user from getting confused about the operation procedure.

[0062] FIG. 10 is a diagram showing a recommended security setting screen 1001 displayed on the operation unit 102. In FIG. 10, the usage environment corporate LAN button 1002 is a button for collectively setting a series of security settings that are appropriate when the usage environment of the MFP 100 is an corporate LAN. The usage environment at home button 1003 is a button for collectively setting a series of security settings that are appropriate when the usage environment of the MFP 100 is at home. The usage environment public space button 1004 is a button for collectively setting a series of security settings that are appropriate when the usage environment of the MFP 100 is a public space. For example, if the various batch setting buttons 1002, 1003, and 1004 are pressed after the network environment is detected and the settings are changed, the detection status of a change in the network environment is canceled. The detection cancel button 1005 is a button for canceling the detection status of a change in the network environment without changing the settings. This button is used in cases where it is desired to cancel the current detection status after confirming that no changes to the settings are necessary. The information notification unit 1006 is used to notify the user of information, similar to the information notification unit 905. When the environment estimation process is performed, the estimated usage environment may be displayed, or security settings may be automatically configured for each usage environment.

[0063] According to this embodiment, MFP 100 does not need to constantly acquire packets (packet information), but acquires packets at appropriate times and detects changes in the network environment based on the acquired packet information. This enables accurate detection of changes in the network environment with low load. For example, by not acquiring packets until a change is detected in the change detection process using network configuration information and starting to acquire packets when a change is detected, the load on resources such as the CPU can be reduced compared to when packets are constantly acquired. Furthermore, by detecting changes in the network environment using the change detection process using packet information, changes in the network environment can be accurately detected.

[0064] Furthermore, by notifying the user when a change in the network environment is detected, the user can be made aware of the change in the connected network environment and can be prompted to change the security settings in response to the change in the network environment. In this way, the MFP 100, an information processing device that is an edge device, can make the user aware that the security settings need to be changed in response to a change in the network environment and further support appropriate security settings. Therefore, even if the user does not have specialized security knowledge, the user can recognize that the settings need to be changed in response to a change in the usage environment and can change the settings without any confusion.

[0065] Although the above-described embodiment has been described taking an MFP as an example, the present invention is not limited to application to an MFP, but can be applied to information processing devices in general.

[0066] (Another embodiment of the present invention) The present invention can also be realized by supplying a program that realizes one or more functions of the above-described embodiments to a system or device via a network or a storage medium, and having one or more processors in the computer of the system or device read and execute the program.The present invention can also be realized by a circuit (e.g., ASIC) that realizes one or more functions.

[0067] It should be noted that the above-described embodiments are merely examples of specific embodiments of the present invention, and the technical scope of the present invention should not be construed as being limited by these embodiments. In other words, the present invention can be embodied in various forms without departing from its technical concept or main features. [Explanation of symbols]

[0068] 100: MFP 121: Management cloud system 301: Operation control unit 302: Data storage unit 303: Job control unit 307: Network control unit 308: TCP / IP control unit 309: Security setting control unit 310: Management system communication unit 311: Network configuration detection unit 312: DHCP control unit 313: Packet acquisition control unit 314: Change detection control unit

Claims

1. a first detection means for detecting a change in a network environment based on network configuration information relating to the configuration of a network to which the device is connected; a second detection means for detecting a change in the network environment based on packet information relating to packets transmitted and received on the network; The information processing apparatus, wherein the second detecting means starts acquiring the packet information when the information processing apparatus is started up or when the connection state to the network changes from disconnected to connected.

2. A first detection means for detecting a change in the network environment based on network configuration information relating to the configuration of the network to be connected; a second detection means for detecting a change in the network environment based on packet information relating to packets transmitted and received on the network; when the first detecting means detects a change in the network environment, the second detecting means starts acquiring the packet information; The information processing device is characterized in that the second detection means determines whether the network environment has changed based on at least one of the source IP address, destination IP address, source port number, and destination port number in the packet information acquired over a predetermined period.

3. 3. The information processing apparatus according to claim 1, wherein the second detection means, when detecting a change in the network environment based on the packet information, estimates the network environment based on the packet information.

4. The information processing device according to any one of claims 1 to 3, characterized in that the network configuration information includes at least one of a network address assigned to the information processing device, a MAC address and an IP address of another information processing device connected to the network, and RA (Router Advertisement) information of a router.

5. 5. The information processing apparatus according to claim 1, wherein it is possible to set whether or not to acquire packet information relating to packets transmitted and received over the network.

6. 6. The information processing apparatus according to claim 5, wherein it is possible to set whether or not the packet information is to be acquired periodically.

7. 7. The information processing apparatus according to claim 6, wherein the packet information is set to be acquired periodically, and when the first detection means detects a change in the network environment, the packet information being acquired is discarded.

8. 8. The information processing apparatus according to claim 5, wherein if the setting is such that the packet information is not acquired, the change in the network environment is detected only by the first detection means.

9. a first detection step of detecting a change in a network environment based on network configuration information relating to the configuration of a network to which the device is connected; a second detection step of detecting a change in the network environment based on packet information relating to packets transmitted and received on the network; A program for causing a computer to execute a process of starting acquisition of the packet information in the second detection step when the information processing device is started or when the connection state to the network changes from disconnected to connected.

10. A first detection step of detecting a change in the network environment based on network configuration information relating to the configuration of the network to be connected; a second detection step of detecting a change in the network environment based on packet information relating to packets transmitted and received on the network; when a change in the network environment is detected in the first detection step, a process of starting acquisition of the packet information in the second detection step is executed; In the second detection step, a program determines whether the network environment has changed based on at least one of the source IP address, destination IP address, source port number, and destination port number in the packet information acquired during a specified period.

Images