JP2020010159A - Apparatus management device, apparatus management system, and program - Google Patents

Abstract

To provide an apparatus management device, an apparatus management system, and a program that prevent the security level of the entire apparatus management system from deteriorating due to inclusion of an apparatus with low cipher strength.SOLUTION: In an apparatus management system 1, an apparatus management device communicates with a plurality of apparatuses and manages each of them. The apparatus management device includes: a certificate holding unit for holding a plurality of certificates with different cipher strength; a communication setting unit for setting the plurality of certificates held by the certificate holding unit to respective different ports; and a communication unit for performing cipher communication with cypher strength different for each port.SELECTED DRAWING: Figure 8

Description

  The present invention relates to a device management device, a device management system, and a program.

  2. Description of the Related Art A device management system that manages a plurality of devices such as image forming devices connected to a network by a single device management device is known.

  In order to maintain a safe and secure office environment, encrypted communication such as SSL (Secure Sockets Layer) encrypted communication is possible for devices such as image forming devices as well as PCs (Personal Computers) and server devices. Is required.

  However, devices with low encryption strength may be connected to the network. Accordingly, a technique has been proposed in which the security level is determined by determining the encryption strength set for the device and, when the encryption strength is low, changing the encryption strength to a stronger one to increase the security level (Patent Document 1).

  However, the device management system includes not only devices capable of changing the encryption strength as described in Patent Literature 1, but also old devices with low encryption strength and incapable of changing the encryption strength. Sometimes.

  In the conventional device management system, each device is configured to be able to perform encrypted communication only to a specific port of the device management device, so that the device management device includes all devices included in the device management system, Communication must be performed using a communication method with the same encryption strength.

  For this reason, when the device management system includes an old device, the device management device must communicate with all devices according to the low encryption strength communication method used by the old device. The security level of the entire system decreases. That is, even if a device with a high encryption strength is included in the device management system, the security level cannot be increased if at least one device with a low encryption strength is included.

  The disclosed technology has been made in view of the above circumstances and has been made to solve the problem, and has as its object to suppress a decrease in the security level of the entire device management system due to including devices having low encryption strength.

  The disclosed technology is a device management device that communicates with a plurality of devices and manages each device, and includes a certificate holding unit that holds a plurality of certificates having different encryption strengths, and a certificate holding unit that holds the certificates. A device management apparatus comprising: a communication setting unit configured to set the plurality of certificates to different ports, respectively; and a communication unit configured to perform encrypted communication having different encryption strength for each port.

  It is possible to suppress a decrease in security level of the entire device management system due to including devices with low encryption strength.

1 is a diagram illustrating an overall configuration of a device management system according to an embodiment of the present invention. FIG. 2 is a diagram illustrating a hardware configuration of the device management apparatus. FIG. 2 is a diagram illustrating a hardware configuration of a device. FIG. 2 is a block diagram illustrating a functional configuration of the device management device and the device. FIG. 4 is a diagram illustrating device information held by a device information holding unit. FIG. 4 is a diagram illustrating a communication setting held by a communication setting holding unit; 5 is a flowchart illustrating an operation of the device management system according to the embodiment. FIG. 3 is an explanatory diagram illustrating an operation of the device management system according to the embodiment. FIG. 11 is an explanatory diagram illustrating an operation of a conventional device management system.

  Hereinafter, an embodiment of a device management system, a device management device, and a program according to the present invention will be described in detail with reference to the accompanying drawings. The present invention is not limited by the following embodiments.

[overall structure]
FIG. 1 is a diagram illustrating an overall configuration of a device management system 1 according to an embodiment of the present invention. As illustrated in FIG. 1, the device management system 1 includes a device management device 10, a plurality of devices 20, and a server device 30.

  The device management apparatus 10 is connected to a plurality of devices 20 via a network 50. The device management device 10 is connected to the server device 30 via the network 60. The network 50 is, for example, a network such as an in-house LAN (Local Area Network) used in a corporate office or the like. The network 60 is, for example, an external network such as the Internet.

  The device management apparatus 10 is installed in, for example, an office of a user who uses the device 20. The device management device 10 is also called an intermediary device. Management software (application program) for controlling and managing the device 20 is mounted on the device management apparatus 10.

  The device management apparatus 10 communicates with each device 20 and collects operation information from each device 20. The device management device 10 transmits the operation information collected from each device 20 to the server device 30.

  The device 20 is an image forming apparatus, for example, a multi-function peripheral (MFP). The multifunction peripheral is a device having at least two functions of a printing function, a copying function, a scanning function, and a facsimile function. The device 20 is not limited to an image forming apparatus, but may be a network device, an electronic device, a PC, or the like. Further, as the plurality of devices 20, devices of different types may coexist.

  When the device 20 is an image forming apparatus, the above-described operation information includes a remaining amount of consumables such as paper and toner, a count value of the number of printed sheets, and error information.

  The plurality of devices 20 communicate with the device management device 10 via the network 50 for each device 20.

  The server device 30 communicates with the device management device 10 via the network 60. The server device 30 is a device that remotely manages each device 20 based on operation information obtained via the device management device 10. The device management apparatus 10 performs counter counting, ordering of consumables, dispatch of a customer engineer, and the like based on the operation information of each device 20.

  In order to ensure security, for example, SSL encryption communication is used for communication between the device management apparatus 10 and each device 20 and for communication between the device management apparatus 10 and the server device 30. Each of the device management device 10, the device 20, and the server device 30 has a public key certificate (electronic certificate), exchanges certificates each time communication is performed, and confirms that the other party is correct. Performs encrypted communication.

[Hardware configuration of device management device]
Next, a hardware configuration of the device management apparatus 10 will be described. FIG. 2 is a diagram illustrating a hardware configuration of the device management apparatus.

  As shown in FIG. 2, the device management apparatus 10 includes a CPU (Central Processing Unit) 101, a RAM (Random Access Memory) 102, a ROM (Read Only Memory) 103, a HDD (Hard Disk Drive) 104, a device I / F 105, It has a network I / F 108, which is connected to each other via a bus 109. The display unit 106 and the operation unit 107 are connected to the device I / F 105.

  The CPU 101 controls the overall operation of the device management apparatus 10. The RAM 102 is used as a work area when the CPU 101 processes information. The ROM 103 stores programs such as firmware. The HDD 104 stores an OS (Operating System), various control programs, application programs, and the like. The HDD 104 stores files, data, and the like necessary to realize various functions of the device management apparatus 10. The HDD 104 stores various management information parameters and a management program used for managing the device 20 to be managed.

  The device I / F 105 is an interface for connecting the display unit 106 and the operation unit 107 to the bus 109. The display unit 106 is a visual user interface for displaying various types of information, and includes, for example, an LCD (Liquid Crystal Display). The operation unit 107 is a user interface, such as a keyboard and a mouse, for a user to input various information to the device management apparatus 10. The network I / F 108 is an interface for connecting the device management device 10 to the networks 50 and 60.

  The software control unit is configured by the CPU 101 performing an operation according to a program stored in the ROM 103 or a program loaded into the HDD 104 or the RAM 102. A functional block is configured by a combination of the software control unit and hardware. Note that the hardware configuration of the server device 30 is the same as that of the device management device 10, and a description thereof will be omitted.

  The program used by the device management apparatus 10 may be a file in an installable format or an executable format, recorded on a computer-readable recording medium such as a recording medium, and distributed.

[Device hardware configuration]
Next, a hardware configuration of the device 20 will be described. FIG. 3 is a diagram illustrating a hardware configuration of the device 20.

  As illustrated in FIG. 3, the device 20 includes a CPU 201, a ROM 202, a RAM 203, an external storage device 204, an engine unit 205, an operation display unit 206, and a communication I / F 207. These units are communicably connected by a system bus 208.

  The CPU 201 reads out a program stored in the ROM 202 or the like into the RAM 203 and executes the program to control the operation of the device 20 in an integrated manner. The ROM 202 stores a program used by the device 20. The RAM 203 is used as a work area for the CPU 201 to perform calculations.

  The external storage device 204 is a storage device such as an HDD or an SSD (Solid State Drive) that stores various data such as image data and print data.

  The engine unit 205 is a hardware device that implements a scanner function, a printer function, and the like. The engine unit 205 has a sensor for detecting the remaining amount of consumables such as paper and toner, a counter for counting the number of printed sheets, and a sensor for detecting various errors. These sensors and counters are used for acquiring the operation information described above.

  The operation display unit 206 is, for example, a touch panel or the like, and is a device that receives input of an instruction to the device 20 and displays information such as a state of the device 20. Note that the operation display unit 206 may be separated into an operation unit and a display unit.

  The communication I / F 207 is an interface for connecting to the network 50 and communicating data.

[Function configuration]
Next, a functional configuration of the device management apparatus 10 and the device 20 regarding device management will be described. FIG. 4 is a block diagram illustrating the functional configuration of the device management apparatus 10 and the device 20, and shows only characteristic portions related to the present embodiment.

  In FIG. 4, a device 20a is a new type device capable of switching the encryption strength, and is also referred to as a device A below. The device 20b is an old device whose encryption strength cannot be switched, and is hereinafter referred to as device B. Hereinafter, when it is not necessary to distinguish the devices 20a and 20b, they are simply referred to as the device 20.

[Function configuration of device management device]
The functional configuration of the device management device 10 will be described. As shown in FIG. 4, the device management apparatus 10 includes a communication unit 111, a certificate holding unit 112, a communication setting unit 113, a device search unit 114, a device information holding unit 115, a device setting change unit 116, Having. These are functional units realized by the CPU 101 executing a program. Note that the certificate holding unit 112 corresponds to a first certificate holding unit described in the claims.

  The communication unit 111 communicates with each device 20 via the network 50. In addition, the communication unit 111 can perform encrypted communication with each device 20 by, for example, SSL encrypted communication.

  In SSL encrypted communication, a public key and a secret key are used as encryption keys. In SSL encrypted communication, a public key certificate (hereinafter simply referred to as a certificate) is transmitted to a communication partner in response to a connection request from the communication partner. This certificate is electronic data for storing the public key together with information for identifying the owner, and for certifying the identity. In the certificate, a signature algorithm and the length of the public key (key length) are set.

  The certificates have different encryption strengths depending on, for example, the key length. For example, when the key length is 2048 bits, the encryption strength is higher than when the key length is 512 bits. Cryptographic strength indicates how easily a cipher is destroyed and how difficult it is to break. The higher the encryption strength, the more difficult it is to break the encryption and the more difficult it is to decrypt the data.

  The certificate holding unit 112 holds a plurality of certificates for performing encrypted communication with each device 20. For example, the certificate holding unit 112 holds a certificate A having a key length of 2048 bits and high encryption strength, and a certificate B having a key length of 512 bits and low encryption strength. The certificates held by the certificate holding unit 112 are not limited to the two types of certificates A and B. The certificate holding unit 112 holds all types of certificates assumed to be held by each device 20.

  The communication setting unit 113 performs communication settings for a plurality of ports of the device management apparatus 10. Here, the port is an endpoint for the OS to perform data communication. Specifically, the communication setting unit 113 performs communication settings for each device 20 based on the device information of each device 20 held in the device information holding unit 115.

  The device search unit 114 searches for the devices 20 connected to the network 50 in order to obtain the device information. The device search unit 114 acquires device information (communication setting information) from each device 20 found by the search. The device information holding unit 115 holds the device information acquired by the device search unit 114.

  FIG. 5 is a diagram exemplifying the device information held by the device information holding unit 115. As shown in FIG. 5, the device information includes an IP address (device address) of each device 20, a port number, settings for the port, and the like. The device information illustrated in FIG. 5 indicates that, for example, the certificate A or the certificate B can be set to the port 8080 of the device A, and the certificate B is set to the port 8081 of the device B. .

  Returning to FIG. 4, the device setting change unit 116 changes the communication settings of each device 20 based on the device information held by the device information holding unit 115 and the type of the certificate held in the certificate holding unit 112. change. Specifically, the device setting change unit 116 changes the setting so that the certificate with the highest encryption strength held by both the target device 20 and the device management apparatus 10 is used. For example, the setting of the device A is changed so that the certificate A is set to the port 8080. Note that the certificate B cannot be switched for the device B, so that the state in which the certificate B is set to the port 8081 is maintained.

  Further, the communication setting unit 113 sets a plurality of certificates held in the certificate holding unit 112 to different ports. For example, the communication setting unit 113 sets the certificate B to the port 443 normally used in the SSL encrypted communication, and sets the certificate A to the new port 444.

  The device setting change unit 116 also sets a port number corresponding to the type of certificate (encryption strength) set by the communication setting unit 113 in each device 20. That is, the communication path of each device 20 is set by the device setting change unit 116 so as to connect to the port corresponding to the encryption strength among the plurality of ports of the device management apparatus 10.

[Functional configuration of device A]
The functional configuration of the device 20a as the device A will be described. The device 20a includes a communication unit 211a, a certificate holding unit 212a, a certificate selection unit 213a, and a communication setting holding unit 214a. Note that the certificate holding unit 212a corresponds to a second certificate holding unit described in the claims.

  The communication unit 211a communicates with the device management device 10 via the network 50. The communication unit 211a, like the communication unit 111 of the device management device 10, enables encrypted communication with the device management device 10 by, for example, SSL encrypted communication.

  The certificate holding unit 212a holds a plurality of certificates like the certificate holding unit 112 of the device management apparatus 10. The certificate holding unit 212a holds, for example, the above-described certificate A and certificate B.

  The certificate selection unit 213a selects a certificate to be used for encrypted communication from a plurality of certificates held in the certificate holding unit 212a.

  The communication setting holding unit 214a holds communication settings for the device management apparatus 10. This communication setting is changed based on the setting change instruction from the device setting change unit 116 described above.

  FIG. 6A is a diagram illustrating the communication settings held by the communication setting holding unit 214a. As shown in FIG. 6A, the communication settings include an IP address (device management device address) of the device management device 10, a port number, settings for the port, and the like. As this communication setting, for example, one of setting A and setting B shown in FIG. 6A is selected. The setting A indicates that encrypted communication is performed with the port 444 of the device management apparatus 10 using the communication method using the certificate A. The setting B indicates that encrypted communication is to be performed to the port 443 of the device management apparatus 10 by a communication method using the certificate B.

  The above-mentioned certificate selecting unit 213a selects the certificate A when the communication setting is the setting A and sets it to the port No. 8080, and selects the certificate B when the communication setting is the setting B. Set to port 8080.

[Functional Configuration of Device B]
The functional configuration of the device 20b as the device B will be described. The device 20b includes a communication unit 211b, a certificate holding unit 212b, and a communication setting holding unit 214b.

  The communication unit 211b has the same configuration as the device 20a. The certificate holding unit 212b holds only the certificate B having a low encryption strength. For this reason, the device 20b cannot select a certificate.

  The communication setting holding unit 214b holds communication settings for the device management apparatus 10.

  FIG. 6B is a diagram illustrating the communication settings held by the communication setting holding unit 214b. This communication setting indicates that encrypted communication is to be performed to the port 443 of the device management apparatus 10 using the communication method using the certificate B. In the device 20b, since the certificate is fixed, the communication setting is not changed by the device setting change unit 116 of the device management apparatus 10.

[Operation of device management system]
Next, the operation of the device management system 1 will be described. FIG. 8 is a flowchart illustrating the operation of the device management system 1. FIG. 9 is an explanatory diagram illustrating the operation of the device management system 1.

  As shown in FIG. 8, in the device management system 1, as a preparatory operation before performing encrypted communication between the device management apparatus 10 and the plurality of devices 20, the device search unit 114 first connects to the network 50. The device 20 is searched to obtain device information (step S10). The device information illustrated in FIG. 5 acquired by the device search unit 114 is registered in the device information holding unit 115 (Step S11).

  Next, the communication setting of each device 20 is changed by the device setting changing unit 116 based on the device information registered in the device information holding unit 115 and the type of the certificate held in the certificate holding unit 112. (Step S12). For example, in the device 20b, the setting A shown in FIG. 6A is selected as the communication setting, and the certificate A is set to the port 8080 as shown in FIG.

  Then, communication setting of the device setting changing unit 116 is performed by the communication setting unit 113 (step S13). For example, as shown in FIG. 9, ports 443 and 444 are opened, certificate B is set to port 443, and certificate A is set to port 444.

  Thereafter, encrypted communication is performed between the device management apparatus 10 and the plurality of devices 20 (Step S13). For example, as shown in FIG. 9, encrypted communication using a certificate A having high encryption strength is performed between the device management apparatus 10 and the device 20a. On the other hand, encrypted communication using the certificate B having low encryption strength is performed between the device management apparatus 10 and the device 20b.

[effect]
A conventional device management system will be described as a comparison with the device management system 1 according to the present embodiment. FIG. 9 is an explanatory diagram for explaining the operation of the conventional device management system. As shown in FIG. 9, in the conventional device management apparatus, a fixed port (443 port) is always used for encrypted communication. Therefore, when the device management system includes the device A that can select the certificate A and the certificate B and the device B having only the certificate B, the communication between the device management device and each device is All of the encrypted communication is performed using the certificate B having a low encryption strength, and there is a problem that the security level of the entire device management system is reduced.

  On the other hand, in the device management system 1 according to the present embodiment, in the device management apparatus 10, certificates with different encryption strengths are set to different ports, respectively. Encrypted communication can be performed. This suppresses a decrease in the security level of the entire device management system.

  Note that the device management system 1 according to the above embodiment is configured such that the device setting change unit 116 of the device management apparatus 10 selects the communication settings and the certificate of the device 20a. Alternatively, the configuration may be such that the user can make communication settings of the device 20a and select a certificate via a user interface such as the operation display unit 206 shown in FIG.

  As described above, the present invention has been described based on the embodiments. However, the present invention is not limited to the requirements described in the above embodiments. Regarding these points, the gist of the present invention can be changed without departing from the scope thereof, and can be appropriately determined according to the application form.

REFERENCE SIGNS LIST 1 device management system 10 device management device 20, 20 a, 20 b device 30 server device 50, 60 network 111 communication unit 112 certificate holding unit (first certificate holding unit)
113 Communication setting unit 114 Device search unit 115 Device information holding unit 116 Device setting change unit 211a, 211b Communication unit 212a Certificate holding unit (second certificate holding unit)
212b Certificate holding unit 213a Certificate selecting unit 214a, 214b Communication setting holding unit

JP-A-2005-08509

Claims (8)

A device management device that manages each device by communicating with a plurality of devices,
A certificate holding unit that holds a plurality of certificates having different encryption strengths,
A communication setting unit that sets the plurality of certificates held in the certificate holding unit to different ports,
A communication unit that performs encrypted communication with a different encryption strength for each port,
Device management device having A device search unit that searches for the plurality of devices and obtains device information from each of the devices,
A device information holding unit that holds the device information,
Based on the device information held in the device information holding unit, a device setting change unit that changes the communication settings of each device,
The device management apparatus according to claim 1, further comprising:   The device management device according to claim 2, wherein the device setting change unit changes the communication settings so as to connect each of the devices to one of the plurality of ports having a corresponding encryption strength.   The device management device according to claim 1, wherein the plurality of devices include an image forming device. A device management system having a plurality of devices and a device management device that communicates with the plurality of devices and manages each device,
The device management device,
A first certificate holding unit that holds a plurality of certificates having different encryption strengths,
A communication setting unit for setting the plurality of certificates held in the first certificate holding unit to different ports,
A communication unit that performs encrypted communication with a different encryption strength for each port,
Device management system having At least one device of the plurality of devices is
A second certificate holding unit for holding a plurality of certificates having different encryption strengths,
A communication setting holding unit that holds communication settings for the device management apparatus;
A certificate selecting unit that selects one certificate from the plurality of certificates held in the second certificate holding unit according to the communication setting;
The device management system according to claim 5, comprising: The device management device,
A device search unit that searches for the plurality of devices and obtains device information from each of the devices,
A device information holding unit that holds the device information,
Based on the device information held in the device information holding unit, a device setting change unit that changes the communication settings held in the communication setting holding unit,
The device management system according to claim 6, further comprising: A program executed by a device management device that communicates with a plurality of devices and manages each device,
In the device management device,
A certificate holding unit that holds a plurality of certificates having different encryption strengths,
A communication setting unit that sets the plurality of certificates held in the certificate holding unit to different ports,
A communication unit that performs encrypted communication with a different encryption strength for each port;
A program that realizes the functions of

Images