JP2003101566A - Network equipment management method and system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To assure a certain level of security without impairing the convenience of Plug and Play and enable management of equipment connected to a network without requiring expertise or burdensome work. SOLUTION: The system comprises: a connected equipment recognizing means for automatically recognizing equipment connected to a LAN, an equipment property information storing means for storing equipment property information including identifiers to uniquely identify the equipment connected to the LAN and additional information about each of the equipment, a display means for displaying the equipment property information, and a management means for managing the equipment connected to the LAN based on the equipment property information stored in the equipment property information storing means. The method comprises the steps of: determining whether the equipment recognized by the connected equipment recognizing means is registered equipment or not by referring to the property information stored in the property information storing means, and, in the case of unregistered equipment, displaying notification to that effect on the screen of a display device.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a management method and apparatus for devices connected to a computer network, and particularly in a home LAN (Local Area Network) environment, the connection to the LAN is possible even without specialized knowledge. The present invention relates to a management method and apparatus for network devices that enable management of devices such as personal computers (PCs) and home appliances that are used by simple operations.

[0002]

2. Description of the Related Art The use of computer networks has changed in several ways from the fact that Internet protocol IPv6 has entered the practical stage. One is the diversification of devices connected to the network. Until now, the devices connected to the network have been mainly PCs, workstations, printers, and other network devices such as routers, switches, and hubs. However, in the future, in addition to general household appliances such as refrigerators, TVs, and air conditioners, sensors such as temperature / humidity meters and speedometers installed in automobiles will also be networked, and the operating status can be checked and the operation performed through the network I'm heading for control. Also, where the network is built,
It is gradually spreading from ordinary universities and companies to ordinary households and shops.

The other is an increase in the number of devices connected to the network. IP address exhaustion problem is IP
Since there is only a prospect for solving the problem by putting v6 into practical use, it is easily expected that a larger number of devices will be connected to the network than ever before. The amount of work required to manage the network will increase accordingly. Since setting IP addresses and the like for a large number of devices one by one is a very heavy work, automatic connection by the plug and play function is becoming mainstream.

The plug-and-play function includes a stateful system in which IP addresses to be allocated are pooled in advance and a stateless system in which pooling of addresses is not required. The stateful method is DHCP (Dynamic
A mechanism called Host Configuration Protocol) has been realized. The stateless method is a method standardized by IPv6, and for network segments,
A router notification including network prefix information (network address, etc.) is issued, and each network device automatically generates an IP address using the notified network prefix and its own interface identifier. By using such a plug and play function, many devices can be easily connected to the network without increasing the burden on the administrator. Especially if the use of IPv6 becomes mainstream,
Due to its simplicity, it is expected that more networks will be operated by stateless plug and play.

[0005]

However, the fact that the network can be automatically connected without any special setting means that it is possible to easily connect an unauthorized device which is not intended by the network administrator. To do. In particular, when plug and play is performed in a wireless LAN environment, physical connection with a connection cable or the like is not required, so that the network can be connected very easily.
Therefore, for example, an unauthorized device may be connected without knowing the LAN administrator or user, and the service provided on the LAN may be illegally used or information may be illegally taken out. .

Therefore, in order to allow only a specific device approved by the administrator to connect, some kind of identifier that uniquely identifies the device to which the connection is permitted is registered in advance, and a procedure for authenticating at the time of connection is carried out. It is possible. However, if registration is attempted for all devices, the benefits of plug and play cannot be received at all, and the amount of registration work will be enormous when the number of devices is large. That is, there is a dilemma between the convenience of plug and play and the security threat due to the connection of an unauthorized device. Also, network management work requires in-depth knowledge of computers and networks. Until now, in networks at universities and companies, personnel with appropriate technology were in charge of management work. However, when constructing a network in a general home, it is not always possible to secure personnel with the necessary technology. Some gateway products can be easily set by selecting a menu from a Web browser, but if you do not have enough knowledge about the mechanism of IP and its upper protocols TCP, UDP, or DNS, I can't decide which one to choose.

Further, in the past, for example, when setting packet filtering, each device was uniquely specified by an IP address, or devices on the same subnet were collectively specified. However, in an environment where a large number of devices are connected to the network, the work load becomes extremely high if they are individually set. If the devices can be classified into several groups and can be set for each group, the management work can be reduced.

An object of the present invention is to secure a certain security level without impairing the convenience of plug and play, and to manage devices connected to a network without requiring advanced knowledge and heavy work. (EN) Provided is a network device management method and device capable of managing the network device.

[0009]

In order to achieve the above object, the present invention uniquely identifies a device connected to a LAN and a connected device recognition means for automatically recognizing a device connected to a LAN. A device property information storage unit that stores device property information including an identifier and additional information about each device, a display unit that displays the device property information, and a LAN based on the device property information stored in the device property information storage unit. A method of managing a network device in a network device management apparatus, comprising: managing means for managing a device connected to a device, wherein the property information indicates whether the device recognized by the connected device recognition means is already registered. The step of determining by referring to the property information stored in the storage means Characterized by comprising a step of displaying to that effect on the display device screen. Further, the method further comprises a step of receiving a registration instruction for the unregistered device and property information of the device and storing the property information in the device property information storage means. Further, the method further comprises: obtaining device property information for the unregistered device from a database in which an identifier unique to the device and property information of the device are associated with each other via the Internet, and storing the device property information storage means. It is characterized by Also, the schema definition of the device property information is acquired from the database having the schema definition information of the device property information through the Internet, the schema of the device property information is dynamically changed, and the corresponding instance of the device property information is changed to the new schema. It is characterized by further comprising the step of automatically modifying to match. Whether the source or destination device is a registered device for forwarding packets received from devices on the LAN to the Internet or forwarding packets received from the Internet to devices on the LAN. According to the setting instruction, the step of receiving the setting instruction as to whether or not to allow the forwarding is stored in the device property information storage means. Further, a registration instruction as to whether or not to permit communication between devices connected to the LAN is accepted according to a combination of a registered device and an unregistered device, and stored in the device property information storage means according to the instruction content. The method further comprises steps. Further, the method is characterized by including a step of setting the same device property information for the same type of device.

A network device management apparatus according to the present invention includes a connected device recognition means for automatically recognizing a device connected to a LAN, an identifier for uniquely identifying a device connected to a LAN, and an addition for each device. A device property information storage unit that stores device property information including information, a display unit that displays the device property information, and a device connected to the LAN based on the device property information stored in the device property information storage unit A network device management apparatus, which determines whether the device recognized by the connected device recognition unit is a registered device by referring to the property information stored in the property information storage unit. Means to do
If the device is an unregistered device, the device is provided with means for displaying that fact on the screen of the display device. Further, it is characterized by further comprising means for receiving a registration instruction for the unregistered device and property information of the device and storing the property information in the device property information storage means. The device property information for the unregistered device is further acquired from a database in which an identifier unique to the device and property information of the device are associated with each other via the Internet, and is stored in the device property information storage unit. It is characterized by Also, obtain the device property information schema definition from the database that holds the device property information schema definition information through the Internet,
It further comprises means for dynamically changing the schema of the device property information and automatically modifying the corresponding instance of the device property information so as to match the new schema. Whether the source or destination device is a registered device for forwarding packets received from devices on the LAN to the Internet or forwarding packets received from the Internet to devices on the LAN. According to the setting instruction, the device property information storage unit is further provided with a unit for receiving a setting instruction as to whether or not to permit the forward and storing the setting instruction according to the setting instruction. Also, L
A means for accepting a registration instruction as to whether or not to permit communication between devices connected to the AN according to a combination of a registered device or an unregistered device and storing the device property information storage means in accordance with the instruction content. It is characterized by further comprising. Further, it is characterized by comprising a unit for setting the same device property information for the same type of device.

[0011]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described in detail below with reference to the drawings. FIG. 1 is a diagram showing an example of a network environment utilizing the present invention. In FIG.
Reference numeral 101 denotes a router / network device management apparatus (hereinafter abbreviated as network management apparatus) to which the present invention is applied.
Reference numeral 102 is a schematic representation of a LAN, and actually
Realization with a cable such as 10BaseT and a hub, and wireless LA
Realization by N is available. Network management device 10
1 plays a role of a router which is connected to the LAN 102 and also connected to the external Internet. LAN1
A registered server device 103 having a server function such as a Web server, registered client devices 104 and unregistered client devices 105, which are clients that access the server device 103, are connected to the server 02.

In the present embodiment, there are two types of importance levels of devices connected to the LAN 102: a registered device in which an identifier for uniquely identifying the device is registered in advance and an unregistered device in which no identifier is registered. Is set. Here, the server device 103 and the client device 104 are registered devices, and the other client device 105
Is an unregistered device.

Under such a network configuration, in the present invention, the contents of services available on the network can be set separately for registered devices and unregistered devices. The service here is
Sending packets to the Internet, receiving packets from the Internet, sending packets to registered devices on the LAN, receiving packets from registered devices, sending packets to unregistered devices on the LAN , Receiving a packet from an unregistered device. In the present invention, the dilemma of convenience of plug-and-play and maintenance of security level and the fact that network management work requires advanced knowledge and heavy work are solved by the following methods. ing.

First, a level of importance is set between devices connected to a LAN, only devices with a high level of importance require registration and authentication, and devices that can be connected by plug and play are automatically set to a low level. Be adjusted accordingly.
Then, it is possible to set communication between devices having different importance levels or between devices having the same level. By doing this, registration work will be required for devices that have been set to a high level, but while ensuring that level of safety, and devices that have been set to a low level of importance, plug and play You can take advantage of convenience. Devices such as sensors that do not cause serious problems even when accessed by an unauthorized device for sending data, and whose number tends to increase, can use plug-and-play and server PCs. It is expected that the problem of the conventional technology can be improved by adopting an operation in which the registration system is applied to the ones that are likely to be damaged by such unauthorized access. The plug-and-play function is provided in the network device management apparatus 101 of FIG. 1, but is shown by the connected device recognition means 308 in FIG. In addition, since the administrator can only determine whether the recognized device has a high degree of importance, if the automatically recognized device is not registered, display that fact.
We have prepared a mechanism that allows the administrator to judge the degree of importance and perform or not carry out the registration procedure according to the judgment result.

The simplification of the network management work is solved by grouping the devices and grouping the settings for the devices in the same group. As for how to divide the groups, it will be easier to understand if abstract classification such as the types of devices such as “refrigerator” and “thermometer” can be performed. However, if this classification is done manually for all devices, the work cannot be simplified. Equipment M
It is desirable to have a mechanism that allows devices to be automatically classified from an identifier such as an AC address. Therefore, a database that can acquire information about the device from the MAC address value may be constructed so that it can be referenced through the Internet. It is just a distributed database similar to DNS that reversely looks up a host name from an IP address.

However, unlike the case of the host name, the device information is a data structure having a structure, and the schema of the device information may change each time a new type of device appears. Therefore, unlike the DNS, the device information database needs a function of propagating a schema change and modifying the structure of the existing instance accordingly. Therefore, by describing the structure of the device information in XML, the schema can be flexibly extended.

FIG. 2 is a diagram showing a typical setting example of which of the above services can be used depending on whether the device is a registered device or an unregistered device. In FIG. 2, the column indicated by reference numeral 201 is an example of default settings for registered devices. In this case, only packet transmission to unregistered devices is prohibited, and all other services are set to be available. The column indicated by reference numeral 202 is an example of default settings for unregistered devices, prohibiting packet transmission / reception to / from the Internet and receiving packets from registered devices on the LAN, and transmitting packets to registered devices. , Packet transmission / reception between unregistered devices is set to be available. This setting is performed for all the devices connected to the network 102. Before showing the procedure to prohibit unregistered devices from receiving packets from registered devices according to this setting,
First, the internal configuration of the network device management apparatus will be described with reference to the block diagram of FIG.

FIG. 3 is a block diagram showing the internal arrangement of the network device management apparatus 101 according to this embodiment.
In FIG. 3, reference numeral 301 denotes a network connection / communication means for connecting the apparatus to a LAN or the Internet, which is equivalent to a normal network device. Thirty
Reference numeral 2 is a part for notifying the router of the network segment connected to the routing of the IPv6 packet, and has the same function as a normal IPv6-compatible router. Reference numeral 303 denotes a part that plays a central role in the present embodiment, and is a device property information management unit that issues an instruction to another part or updates the device property information according to the content of the device property information. Reference numeral 304 denotes a device property information analysis unit that reads device property information, performs error checking, and interprets the contents. Reference numeral 305 denotes a device property information storage unit that provides a database for holding property information of registered devices and a search function. Reference numeral 306 is an access control application unit that determines how to process the received packet based on the content of the device property information and the content of the received packet. A device property information display unit 307 displays a list of devices connected to the LAN 102.

Based on the above configuration example, means for carrying out the following items will be described in order. (1) Display a list of registered devices and unregistered devices, including whether they are connected to a LAN. (2) Register the property information of an unregistered device as a valid device. (3) Inquire the device type from the identifier DB. (4) Download schema information and update device property information instance. (5) A routing control procedure with the Internet based on the presence or absence of registration. (6) Procedure of access control with other devices on the LAN based on the presence or absence of registration. (7) Access control procedure according to device type.

FIG. 4 is a description example of the device property information and its schema information. In this example, it is described in XML (Extensible Markup Language) to maintain extensibility. Reference numeral 401 denotes the network device management apparatus 10 of FIG.
XM that describes the contents of the device property information that 1 holds
It is an L instance. In this instance 401,
Information on two devices is described. Reference numeral 402 is a part describing property information of one device, and in this example, it is described that this device is a video deck. 403 is property information of another device,
This example shows that this device is a personal computer. 404 is a DTD (Document Type Definition) that defines the description method of these instances
Is.

In this example, the device property information is devi
It is listed as device in celist, indicating that the contents of device consist of interface, v4addr, role, maker, and option on the second line. Here, interface means an identifier that uniquely identifies a device, and in this example, M
AC address is described. v4addr means the IPv4 address value assigned to this device, role means the type of this device, maker means the maker who made this device, option means other information added by the user, and option is an attribute. You can bid. That is, like the property information 403, the loca intended for the storage location
It is possible to add attributes such as tion and owner that are intended for the owner.

FIG. 5 shows a network device management apparatus 101.
It is a figure which shows an example of the external appearance. This device 101 has a housing 5
01, a screen 502, and various operation buttons 505.
A list of devices is displayed on the screen 502. The contents of the screen are displayed by the device property information display unit 307 shown in FIG. In this screen example, the identifier,
The device type, registration status, and connection status (operating, stopped) are displayed. Reference numeral 503 represents the currently selected device. When an unregistered device is connected as indicated by reference numeral 504, it is highlighted by reverse display or the like.

FIG. 6 is a flow chart showing the procedure for displaying the screen as shown in FIG. First, the network device management apparatus multicasts (broadcasts) an ICMP echo request on the same segment, and receives an echo reply from a device in operation (step 601). Then, the MAC address is extracted from the content of the received packet, and a list of MAC addresses of the operating devices is created (step 602). Next, an inquiry is made as to whether or not there is registered device property information in the device property information DB 305 of FIG. 3 (step 603). If there is, one device property information item is taken out and the operating device list and M
The AC address is collated (step 604). If the same value as the MAC address indicated by the interface of the device property information exists in the operating device list (step 605), it is determined that the device is operating and the device information is displayed on the screen. (Step 606). Then, the displayed device is deleted from the operating device list (step 607).

If there is no matching MAC address in the operating device list in step 605, it is determined that the device is stopped and the device information is displayed on the screen (step 608). And step 605
The steps from to 608 are repeated until all the device property information is retrieved from the device property information DB 305. After displaying the information of all registered devices, it is checked whether or not there are any remaining items in the operating device list (step 609).
If they remain, it is determined that they are unregistered devices and displayed as unregistered devices on the screen (step 610). When registering an unregistered device as a legitimate device, the administrator selects a device to be registered and gives an instruction for registration while the device is connected to the LAN 102 and displayed on the screen as an unregistered device.

FIG. 7 shows a flowchart of the subsequent procedure. First, the network device management apparatus 101 displays a password entry screen, requests the administrator to enter the password, and collates the entered password (step 701). When the authentication is successful, the input screen of the property information of the target device is displayed (step 702). Items that prompt input on the input screen are schema information 404 in FIG.
Create according to the ELEMENT item shown in. At this time, the interface item displays in advance the value of the MAC address acquired at the time of connection.

When the administrator inputs and confirms each item, the network device management apparatus 101 creates an XML instance of the device property information as in the example of FIG. 4 from the input information (step 703). Next, it is checked whether necessary items are input. If there is no error, the generated XML instance is added to the device property information DB 30.
5 (step 704). Finally, the content displayed as an unregistered device on the screen is updated (step 705).

By the way, in order to check the device type from the MAC address, a common database for searching the property information of the corresponding device from the MAC address value is required. In principle, this is a DNS (domain Name Syste
It is a distributed database system similar to m). This distributed DB holds two tables 801, 802 as shown in FIGS. 8 (a) and 8 (b). Table 801 is MAC
It is a table having an inquiry destination IP address value using the manufacturer identifier in the first half of the address as a key. Further, the table 802 is a table having a storage destination of the device property information with the product identifier as a key.

FIG. 9 shows a flow chart of a device type inquiry processing procedure in the distributed DB. Distributed DB is MA
When the inquiry is accepted using the C address as an argument, first, the table 802 of FIG. 8B is searched based on the latter half product identifier (step 901) and it is checked whether or not there is a record having the matching identifier (step 902). If there is a record having the same product identifier, the device type information included in the XML instance indicated in the storage destination is returned (step 903). If there is not, the table 80 of FIG. 8A is based on the manufacturer identifier in the first half of the MAC address.
1 is retrieved (step 904). When the record is found (step 905), the inquiry is transferred to the server indicated by the IP address described in the record, and the obtained result is returned to the first inquiry source (step 906). If no record is found, the fact that the device type is not defined is returned as a result of the inquiry (step 907). Thereby, the device property information can be obtained by the product identifier or the manufacturer identifier.

Next, the procedure for reflecting the schema of the device property information managed in the distributed DB in the device property information DB held by the network device management apparatus 101 will be described. The network device management apparatus 101 holds the version number of the current schema and the address list of the inquiry destination distributed DB in the device property information DB 305, and periodically makes a version confirmation inquiry to the distributed DB shown in the list. Issue. The argument of the version confirmation inquiry includes the version number of the schema held by the network device management apparatus 101. The distributed DB that has received the version confirmation query does nothing if the version number of the query argument is the same as the version number it holds, but if the version number it holds is a larger value,
Schema information, that is, DTD of device property information
And, if necessary, returns default values for additional elements.

If a new version of DTD is returned, the network device management apparatus 101 replaces the old DTD with the new DTD included in the inquiry result. At this time, depending on the change contents of the DTD, it may be necessary to update all XML instances of the device property information. For example, if an element defined in the old DTD has been deleted or repositioned in the new DTD, change the structure of the instance to match the new DTD. Alternatively, if a new element is added and it is specified that it must occur at least once, insert an element with the default value contained in the query result in all instances. To do. Even if an element is added, it does not have to appear, that is, if a question mark or "*" is specified in the DTD, the number of occurrences may be 0, so it is not necessary to modify the instance. Absent. These processes can be realized by performing text processing on the XML instance indicating the device property information. By taking such a procedure, the network device management apparatus 101 can always keep the device property information in the latest state.

Next, a procedure for restricting communication with other devices or connection with the Internet depending on whether the device connected to the LAN 102 is a registered device or an unregistered device will be described. First, the communication that can be performed on the LAN 102 is defined as some services according to the contents. Figure 1
0 is an example of the service definition. In FIG. 10, 1
An XML instance 001 describes a list of services. In this example, ForwardToInternet, ForwardFrom
Internet, SendToRegNode, ReceiveFromRegNode, SendT
Six types of services, oUnknownNode and ReceiveFromUnknownNode, are set. These represent the services shown in FIG. 2, respectively, "send packet through router to Internet", "receive packet sent from Internet side", and "send packet to registered device". , “Receive packet from registered device”, “Send packet to unregistered device”, “Receive packet from unregistered device”. Whether or not to permit these services to registered devices or unregistered devices is described in another setting file shown in FIG.

A DTD 1002 defines how to write this service list. For the service, service names are defined as attribute values and three types of dependency relationships among services are defined. AutoDepend means to inherit the permission information set for the referenced service as it is. Po
sitiveDepend indicates that the permission information of the referenced service is "O
If it is “K”, it means a dependency that even a service with this attribute automatically becomes OK. NegativeDepend
On the contrary, if the permission information of the referenced service is “NG”, it means that the service with this attribute automatically becomes NG. In this example, ForwardFromI
The service called nternet is a ReceiveFromRegisteredNode
Has a NegativeDepend attribute for that service. This means "if reception of packets from registered devices on the LAN is prohibited, reception of packets from the Internet is also prohibited".

FIG. 11 shows the service defined in FIG.
It is an example of permission information that sets whether to permit the registered device and the unregistered device. In FIG. 11, 1
Reference numeral 101 is an example of permission information, and 1105 is a DTD that defines the notation. In 1101, FIG.
Define the permission information for the service defined in. 11
02 defines default permission information for registered devices. Reference numeral 1103 defines default permission information for unregistered devices. As in 1104, the permission information can be defined for individual devices.

FIG. 13 shows the contents of the permission information shown in FIG. 11 in the same table format as FIG. Unlike FIG. 2, here, permission information regarding individual devices shown in 1104 is added as a column 1303 in the table. By adding columns in the table in this way, special settings for each device can be added in addition to the default settings without changing the program. Specifically, the contents of the columns of the table are
This is achieved by adding the ode> element. Whether or not to permit packet exchange between a registered device, an unregistered device, and the Internet is determined when each device receives a packet.

FIG. 12 shows a procedure for controlling packet transmission / reception on the LAN by referring to the service definition and the permission information shown in FIGS. 10 and 11. First, the device that received the packet refers to the device property information DB 305 based on its own MAC address and acquires the defined device name (step 1201). Next, referring to the permission information file 1101 of FIG. 11 based on the acquired device name, it is checked whether or not individual permission information is defined. If it is defined, the node element is read, and if not, the name is read. Reads the content of the node element "RegNode-default" (step 1202).

Next, it is checked whether the source of the received packet is the same domain (step 1203), and if it is from within the same domain, the MA included in the packet is included.
The device property information DB 305 is searched from the C address (step 1204). Then, it is checked whether the packet transmission source is a registered device (step 1205), and if it is a registered device, refer to the service element for which ReceiveFromRegNode in the permission information read in step 1202 is the value of the name attribute. Yes (Step 12
06). If it is not registered, the value of the name attribute is also Receiv.
The service element that is eFromUnknowNode is referenced (step 1207). If the packet transmission source is not the same domain in step 1203, the value of the name attribute is
The service element that is ForwardFromInternet is referenced (step 1208). Then, the value of the referenced element is checked (step 1209), and if it is "OK", the received packet is processed (step 1210). "N
If it is "G", the packet is discarded.

By following the procedure described above, it becomes possible to control the exchange of packets between the devices classified according to the level of importance, and the illegally connected device becomes the device registered on the LAN 102. It is possible to prevent unauthorized access. When setting whether to allow packet exchange with the Internet or communication between devices on a LAN, specify the device type instead of the device identifier to identify multiple devices of the same type. Thus, the individual setting for each device can be omitted. With this configuration, the work of the administrator can be further reduced.

[0038]

As described above, according to the present invention, the convenience of plug-and-play is utilized, damage caused by an illegally connected device is suppressed, and high-level knowledge about network management work is not required. It is possible to realize access control and device management according to the importance level of the device.

[Brief description of drawings]

FIG. 1 is a diagram showing an example of a network environment of a network device management apparatus to which the present invention has been applied.

FIG. 2 is a diagram showing an example of setting services for registered devices and unregistered devices.

FIG. 3 is a block diagram showing an internal configuration of a network device management apparatus in FIG.

FIG. 4 is a diagram showing an example of property information of a device.

5 is a diagram showing an appearance and a screen display example of the network device management apparatus in FIG.

FIG. 6 is a flowchart of a process of displaying a list of devices connected to a LAN.

FIG. 7 is a flowchart of a process of registering an unregistered device as a valid device.

FIG. 8: Distributed DB that provides common device property information
It is a figure which shows the example of the table which it has.

FIG. 9 is a flowchart of a process of acquiring device type information from a MAC address in a distributed DB.

FIG. 10 is a definition example of services available on a LAN.

FIG. 11 is a definition example of access permission information for a service on a LAN.

FIG. 12 is a flowchart of a process of determining whether to permit access to a device on a LAN.

FIG. 13 is a diagram showing an example of setting services for individual devices in addition to registered devices and unregistered devices.

[Explanation of symbols]

101 network equipment management device 102 LAN 103 Registered server device 104 Registered client device 105 Unregistered client device 301 Network connection / communication means 302 Routing control means 303 Device property information management means 304 Device property information analysis means 305 Device property information DB 306 Access control application means 307 Device property information display means 308 Connected device recognition means 401 XML instance of device property information 502 Device list display screen 1001 XML instance that describes the service list 1101 Access permission information

Claims (14)

[Claims] 1. A connected device recognition means for automatically recognizing a device connected to a LAN, an identifier for uniquely identifying the device connected to the LAN, and device property information including additional information about each device are stored. Network device management including device property information storage means, display means for displaying device property information, and management means for managing devices connected to a LAN based on the device property information stored in the device property information storage means A method of managing a network device in an apparatus, comprising the step of determining whether the device recognized by the connected device recognition means is a registered device by referring to the property information stored in the property information storage means. If it is an unregistered device, the step of displaying the fact on the display device screen is provided. Method of managing network devices, characterized in that. 2. The network device according to claim 1, further comprising a step of receiving a registration instruction for the unregistered device and property information of the device and storing the property information in the device property information storage means. Management method. 3. A step of obtaining device property information for the unregistered device from a database in which an identifier unique to the device and property information of the device are associated with each other via the Internet and storing the device property information in the device property information storage means. The network device management method according to claim 1, further comprising: 4. The device property information schema definition is defined as
Obtaining from the database having the schema definition information of the device property information through the Internet, dynamically changing the schema of the device property information, and automatically correcting the corresponding instance of the device property information to match the new schema. The network device management method according to any one of claims 1 to 3, further comprising: 5. A device which is a source or destination device for forwarding packets received from a device on a LAN to the Internet or forwarding packets received from the Internet to a device on the LAN. Depending on whether or not there is a setting instruction, whether to allow forwarding or not is accepted, and according to the setting instruction,
The method of managing a network device according to claim 1, further comprising a step of storing in the device property information storage means. 6. A registration instruction as to whether or not to permit communication between devices connected to a LAN is accepted in accordance with a combination of a registered device and an unregistered device, and the device property information storage means according to the instruction content. The method for managing a network device according to any one of claims 1 to 5, further comprising: 7. The network device management method according to claim 5, further comprising the step of setting the same device property information for devices of the same type. 8. A connected device recognition means for automatically recognizing a device connected to a LAN, an identifier for uniquely identifying the device connected to the LAN, and device property information including additional information about each device are stored. Network device management including device property information storage means, display means for displaying device property information, and management means for managing devices connected to a LAN based on the device property information stored in the device property information storage means A device for determining whether the device recognized by the connected device recognition means is a registered device by referring to the property information stored in the property information storage means, and an unregistered device. If there is, a management device for the network device, characterized by including means for displaying that fact on the screen of the display device. . 9. The network device according to claim 8, further comprising: a unit that receives a registration instruction for the unregistered device and property information of the device, and stores the property information in the device property information storage unit. Management device. 10. A means for acquiring device property information for the unregistered device from a database in which an identifier unique to the device and property information of the device are associated with each other via the Internet and storing the device property information in the device property information storage means. 9. Further comprising:
The management device for the network device according to 1. 11. A device property information schema definition is obtained from a database having device property information schema definition information through the Internet, the device property information schema is dynamically changed, and a corresponding device property information instance is created. The network device management apparatus according to any one of claims 8 to 10, further comprising means for automatically correcting the new schema to match the new schema. 12. A device which is a source or destination device for forwarding packets received from a device on a LAN to the Internet or forwarding packets received from the Internet to a device on the LAN. 12. The apparatus according to claim 8, further comprising means for accepting a setting instruction as to whether or not to allow the forward depending on whether there is any, and for storing the setting instruction in the device property information storage means in accordance with the setting instruction. The management device for the network device according to one item. 13. A registration instruction as to whether or not to permit communication between devices connected to a LAN is accepted in accordance with a combination of a registered device and an unregistered device, and the device property information storage means according to the instruction content. 13. The network device management apparatus according to claim 8, further comprising a storage unit. 14. The network device management apparatus according to claim 12, further comprising means for setting the same device property information for devices of the same type.