JP2006181808A - Printer device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce a log record area by uploading a counter provided. <P>SOLUTION: The device compares a log to be left with existing logs. Only when a sender is the same and an access is the same kind at a preset time interval, the device does not add a new log record. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention provides an unauthorized access from a network in an external device such as a host computer connectable to a communication line and a network LAN and a print control system such as an image processing device that performs image processing based on data input from the external device. The present invention relates to a printer apparatus relating to a method of leaving an access record when there is a problem.

  In a local area network (LAN), computers, terminal devices, peripheral devices, and other devices distributed in a limited area (hereinafter, devices connectable to these networks are abbreviated as “network devices”). Are configured to communicate with each other.

  In recent years, adjacent LANs are connected to each other and geographically distant LANs are connected to each other via various communication lines, thereby enabling mutual communication between network devices in a wider area. It has become.

  Such an information processing apparatus having a printer function connected to a network is generally shared by a plurality of other host computers, which are host apparatuses connected to the network, and the network can be remotely accessed. May also be used.

  In such a network environment, it is possible to access the printer from any network client, which means that the client can also perform malicious and unauthorized access. Malicious access may cause the printer to go down, and damage to the printer settings may be rewritten illegally.

  Therefore, there is a network printer apparatus that performs a process of controlling to permit or restrict the access destination so as to protect itself from the unauthorized access described above. Such a security function is called an “IP block” or “MAC address block” depending on its control purpose.

The block control is used for protocols for various purposes. Examples include “printing” and “setting” protocols. Specifically, protocols such as “TCP / IP”, “UDP / IP”, “HTTP”, “IPP”, and “SNMP” are controlled.
JP 2004-248317 A

  As described above, access control is performed for the security function, but no record (log) is recorded for the restricted access.

  Even if it was done, there were many restrictions on the amount of information that could be left as a log, and it was not practical.

  This is because the network I / F device of the printer is usually an optional device, and there is little work memory in this optional network I / F device, and there is no secondary storage device, so the area for holding the log is limited. Because there is.

  In order to make the log practical, there is a problem of effectively using the restricted holding area.

  The present invention has been made in view of the above-described problems. In order to effectively use a restricted holding area, when the same type of access is made from the same client within a preset time, , Do that count and reduce log usage.

  If the log exceeds the buffer capacity even after the above-described reduction, the log information is sent out to the outside of the network I / F device by e-mail.

  Further, when the log exceeds the buffer capacity, the detailed information is deleted from the log in the network I / F device, a process for creating a minimally necessary simple log is performed, and the buffer is secured.

  It is another object of the present invention to provide a printer device capable of providing a function of visually displaying the contents of a log in a WEB server function on a network I / F device.

  In order to achieve the above object, a printer device of the present invention is a printer device capable of data communication with a plurality of data processing devices connected on a predetermined communication medium, and a printer main body and a network that can be attached to the printer main body. The printer device is configured by the I / F device, and when receiving the packet flowing on the communication medium and performing the response process, it is determined whether to respond to the process by the network setting value of the transmission source, that is, whether to limit. Means, a means for setting the restriction range as a parameter in the network I / F device in performing the restriction, a means for using the parameter for determination, and a log for further restricted access when restriction is performed. Is left in the memory area in the network I / F device If you want to leave a log, compare it with the existing log contents, and do not add a new log record only if the access is the same source and the same type at a set time interval. And means for reducing the log record area by providing a counter to increase the counter.

The printer device of the present invention is a printer device capable of data communication with a plurality of data processing devices connected on a predetermined communication medium. The printer device includes a printer main body and a network I / F device that can be attached to the printer main body. Is composed of
When receiving and responding to a packet flowing on the communication medium, a means for determining whether to respond to the processing according to the network setting value of the transmission source, that is, whether to perform the restriction, and the restriction range for performing the restriction Means for setting as a parameter in the network I / F device, means for using the parameter for determination, and when restriction is performed, the log is further stored in a memory area in the network I / F device for restricted access. If the setting to leave is made, means to leave the log, if to leave the log, means to overwrite if the restricted log area overflows, and to keep outside the network device before overwriting And means for determining whether or not to perform processing.

The printer device of the present invention is a printer device capable of data communication with a plurality of data processing devices connected on a predetermined communication medium. The printer device includes a printer main body and a network I / F device that can be attached to the printer main body. Is composed of
When receiving and responding to a packet flowing on the communication medium, a means for determining whether to respond to the processing according to the network setting value of the transmission source, that is, whether to perform the restriction, and the restriction range for performing the restriction Means for setting as a parameter in the network I / F device, means for using the parameter for determination, and when restriction is performed, logs for the restricted access are stored in a memory area in the network I / F device. If the setting to leave is made, means for leaving a log, if leaving a log, means for overwriting if the restricted log area overflows, and before overwriting in the network I / F device And a means for determining whether to perform the process of deleting the detailed information from the existing log and creating a minimally required simple log. .

  The printer device of the present invention is a printer device capable of data communication with a plurality of data processing devices connected on a predetermined communication medium. The printer device includes a printer main body and a network I / F device that can be attached to the printer main body. Is configured to receive packets flowing on the communication medium and perform the response process, means to determine whether to respond to the process according to the network setting value of the transmission source, that is, whether to limit, and A means for setting the restricted range as a parameter in the network I / F device, a means for using the parameter for determination, and a log for the restricted access when the restriction is performed in the network I / F device If the setting to leave in the memory area is made, means to leave the log, and the log is left If that is the WEB server function to operate on a network I / F unit, configured to statistical results of the analysis of the log and means for displaying graphically the.

  According to the present invention, when there is an access from a client whose access is restricted on the network, it is possible to effectively use the log holding memory space for holding the log.

  Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 is a block diagram showing a configuration of an image processing system including an image processing apparatus according to the first embodiment of the present invention.

  The image processing system according to the present embodiment includes a plurality of host computers 110/111 connected to a network, various servers 112/113, and interfaces (local I / F 121-1 or A controller (image processing device) 120 that performs predetermined image processing on image data transmitted through the network I / F 121-2) and a copy that is connected to the controller 120 and prints out, for example, a color / grayscale digital image The image forming apparatus 150 includes an engine 130 such as a machine.

  The controller 120 has an external interface 122 connected to the host computer 110 via an interface 121 (121-1, 121-2), and this external interface is connected to the CPU bus 123. The CPU bus includes a CPU 124 that controls the operation of the entire apparatus, a ROM 125 that stores a control program (including a flow to be described later), and a RAM 126 (126-1, 126-2) that is used as a work area. A FIFO controller 129 is connected to an HDD controller 127 that controls an internal hard disk (HDD) 128 in which font data, temporary storage data, print image data, and the like are stored. Here, the RAM includes a frame memory 126-1 for storing raster image data and a PDL buffer 126-2 for holding PDL image data. Instead of storing the raster image data in the frame memory 126-1, it is also possible to store it in the built-in HDD 128. The plurality of image data stored in the built-in HDD 128 can be printed out in the order corresponding to the editing mode designated by the operation unit 132 of the printer.

  According to the controller 120, PDL (Page Description Language) image data sent from the host computer 110 via the local interface 121-1 and the network interface 121-2 is temporarily transmitted via the CPU bus 123. It is held in the PDL buffer 126-2. The CPU 124 develops the PDL image data stored in the PDL buffer 126-2 into raster image data using the font data stored in the ROM 125 or the built-in HDD 128, and writes the raster image data in the frame memory 126-1.

  From the controller 120, raster image data is sent to the printer engine 130 via the CPU bus 123 and the FIFO 129 on the formation signal 141, and image formation is performed based on the signal. Further, the controller 120 and the printer engine 130 can perform various communications via the interface 142.

  The printer engine 130 includes an image forming unit 131, an operation unit 132, and a control unit 133. The image forming unit 131 has a function of outputting image data sent from the host computer 110 to a recording medium in color or gray scale at an image processing apparatus resolution of 400 dpi or the like, and the control unit 133 controls the printer 130. The print function is executed in accordance with the contents of communication with the operation unit 132 and the image processing apparatus 120. The operation unit 132 is used to instruct various settings of the printer and various operations.

  The controller 120 can communicate with devices on the network via the network interface 121-2, and not only exchanges print data but also communication for device control, communication of device status and management information. Etc. are performed.

  For example, communication of consumable information such as the remaining amount of toner, the remaining amount of paper for each cassette, and the remaining amount of staples, and the remaining amount of staples. Also, communication of printer status information (open door, paper jam, etc.) and communication of various optional devices (paper discharge processing device (sorter), Z-folder, paper deck) are installed. Communication for setting device setting values is also performed.

  The image forming apparatus 150 in the above description is an image forming apparatus that receives PDL data from a host computer and performs image rendering and print control inside the printing apparatus. The image forming apparatus may be of a type that is executed by the printer driver 202 or the language monitor 203 illustrated in FIG. The configuration on the host computer side in this case will be described below.

  Next, FIG. 2A is a software block diagram of the host computer in the print control system for carrying out the present invention. In the host computer 200, a print application 201 that performs printing is operating. When a print process is issued, a pre-installed printer driver 202 is activated to create print image data. The generated print image data is transferred to the language monitor 203. The language monitor 203 is based on various commands for controlling printing and a protocol in which the generated print image data is determined in advance. The data is transferred to the printer 210 via the cable 206. In the case of network connection instead of USB, the data is transferred to the printer 210 via a network port monitor and a network LAN.

  Various control commands are processed after being interpreted by the printer. If the host computer requires a reply, a reply process is performed. Examples include various status information in the printing apparatus. The returned status is received by the language monitor through the connection port, and further print processing is performed in accordance with the contents. At the same time, the status window 204 is notified of the status, and the status window 204 displays the printing status and printing device status on the host computer. To do.

  Further, the status window 204 shown in FIG. 2A is configured to receive a user operation request such as temporary stop or cancellation of printing, and the request is appropriately transmitted to the language monitor 203. The language monitor 203 transfers a command corresponding to the transmitted operation request to the printer 210 via the USB port monitor 205 and the USB cable 206 based on the predetermined protocol, and is transferred by the controller unit as described above. Processing according to the command is executed.

  Next, FIG. 2-2 is a block diagram showing the entire print control system for carrying out the present invention.

  On the network, there are an SMTP server 360 that performs an e-mail delivery service and an FTP server 361 that performs a file service.

  The host computer 1 is connected to a local I / F (USB), and can communicate with a network I / F device mounted on the printer device via this I / F.

  The host computer 2 is a client of the network printer device and performs various accesses to the network I / F device. This access is performed by a printing packet or various setting type packets.

  The host computer 3 operates a Web browser that executes a Remote UI utility capable of performing various settings of a printer (including a network I / F device).

  The network printer device 370 communicates with a network device on the network 350, performs packet control thereof, performs printing, provides a Remote UI service by a Web server function, and the like.

  As other functions, IP block and its setting are performed as packet control for security.

  It also holds a log for security.

  The network printer apparatus graphically displays the result of analyzing the security log in the Remote UI service by the Web server function.

  FIG. 3 is a flowchart illustrating the operation of the network I / F device on the printer side according to the embodiment. This will be described in detail with reference to this flowchart.

  The basic operation of the network I / F is to receive a packet from many clients of the network, analyze the received packet, perform processing according to the analysis result, and send it back. In addition, if necessary voluntarily among them, a packet is transmitted to a network device on the network. If necessary, the transmission packet is received. It is a repetition of that.

  The packet reception analysis process will be described. First, reception of a packet is detected in S301. Next, the received packet is analyzed (S302). Based on the analysis result, it is determined whether the packet is used for printing (S303-1), set using SNMP (S303-2), or searched for SLP (S303-3). Then, referring to the transmission source of these packets, it is determined whether the packet is to be blocked (access control) according to the setting on the network I / F device (S304). There are an IP address and a MAC address as information of the transmission source. If it is an object to be blocked, the processing is divided according to the packet type. If it is for printing (S305), a response “blocked” is returned to the packet response (S306). Other packet types are simply skipped and no response is made (S308). Then, security log holding processing is performed (S307), and the process returns to the top.

  If the packet is not to be blocked in S304, the packet is processed (S309), and the process returns to the top.

  FIG. 5 is an example of an error display on the host computer side that has received a response indicating that it is “blocked” at the network I / F (S306).

  FIG. 4 is a flowchart illustrating the log holding operation of the network I / F device according to the embodiment. This will be described in detail with reference to this flowchart.

  A log type (packet type) is determined (S401), and a character string to be used for each packet is prepared (S402). For example, a “PRINT” character string is used for a print packet, and an “SNMP” character string is used for an SNMP setting packet. The character string not based on the log includes a time information field, an IP address field, and a port number field. An example of this field is shown in FIG.

  When the character string to be used is determined, one line of the field character string is completed using the packet information, and a new record is created (S403). However, it is not yet stored in the log at the stage of creation.

  Next, the setting value (log setting interval) of the network I / F device is referred to (S404), the date record in the latest interval value in the log record is referred to (S405), and the same IP address and packet type are referred to. It is determined whether there is a log record having (S406). Examples of interval values may be 5 seconds, 55 seconds, 550 seconds, etc. This can be set freely by the administrator.

  If there is no matching record, a new record is added (S407). Further, it is determined whether or not the memory space allocated to the log area overflows (S408). If it overflows, it is determined whether or not it can be overwritten as it is (S409).

  If not overwritten, the entire log is transmitted from the network I / F device to the outside (S410). As an example, SEND can be considered as an e-mail to an e-mail server on the network, or a PUT can be considered as a file for an FTP server on the network. Furthermore, if the network I / F device is in an environment where the secondary storage device can be used, the secondary storage may be performed there. As the secondary storage device, a memory card, a USB memory, an HDD, or the like can be considered.

  When there is a matching record in S406, a counter character string is added to the corresponding record, and the record is overwritten to increase the count. FIG. 7 shows a case where this process is applied to the log of FIG. On the right is the counter value.

  As an example of the processing of S410, the log information is transmitted to the outside of the network I / F when overwriting occurs. However, when the log area is overwritten, some field information is deleted from the log contents. May be performed to enlarge the log free space. An example of deletion is time information. As a result, only the access type and the number of times remain.

  In the examples so far, the process for holding the log has been described. Here, an example will be described in which a log access result is graphically displayed on a network host using the WEB server function of the network I / F. Although FIG. 8 is a simple example, the total number of accesses and the type of access are displayed at a glance for each network client.

It is a figure explaining the system configuration | structure of the network apparatus containing the data processing apparatus which concerns on this invention. 1 is a block diagram for explaining a configuration of a printing system mainly showing an embodiment of a host computer in the present invention. FIG. 1 is a block diagram illustrating a functional configuration of a printing system according to an embodiment of the present invention. 3 is a flowchart illustrating a processing routine of the present invention in a printer. 6 is a flowchart illustrating a log holding processing routine of the present invention in a printer. It is a figure which shows the example of a display of the security log information of this invention in a printer. (Before improvement) It is a figure which shows the example of a display of the security log information of this invention in a printer. (After improvement) It is a display example of graphical log information statistical processing of the present invention on a printer. It is a figure which shows an example of embodiment of this invention.

Explanation of symbols

110 Host computer 1
111 Host computer n
112 Server SMTP
113 Server FTP
115 Network LAN
120 Printer Controller 121-1 Local Interface (USB)
121-2 Network interface 122 External interface 123 Internal bus 124 CPU
125 ROM
126 RAM memory 126-1 Frame memory 126-2 PDL buffer 127 HDD controller 128 Built-in hard disk (HDD)
129 FIFO
130 Printer Engine 131 Image Forming Unit 132 Operation Unit 133 Control Unit 141 Image Interface (Formation Signal)
142 Operation Unit Interface 150 Printer Device 1
151 Printer device n

Claims (4)

A printer device capable of data communication with a plurality of data processing devices connected on a predetermined communication medium,
The printer device is composed of a printer main body and a network I / F device that can be attached to the printer main body.
In receiving and responding to packets flowing on the communication medium,
A means of determining whether to respond to the process according to the network setting value of the transmission source, that is, whether to limit,
Means for setting the restriction range as a parameter in the network I / F device for restriction, means for using the parameter for determination,
In the case where the restriction is performed, if the setting is made to leave the log in the memory area in the network I / F device for further restricted access, means for leaving the log,
When leaving a log, compare it with the log content that already exists, and only when the access is of the same source and the same type at a set time interval, the counter is set without adding a new log record. Means to increase the counter and reduce the log record area;
A printer apparatus characterized by the above. A printer device capable of data communication with a plurality of data processing devices connected on a predetermined communication medium,
The printer device is composed of a printer main body and a network I / F device that can be attached to the printer main body.
In receiving and responding to packets flowing on the communication medium,
A means of determining whether to respond to the process according to the network setting value of the transmission source, that is, whether to limit,
Means for setting the restriction range as a parameter in the network I / F device for restriction, means for using the parameter for determination,
In the case where the restriction is performed, if the setting is made to leave the log in the memory area in the network I / F device for further restricted access, means for leaving the log,
When leaving a log, if the restricted log area overflows, a means of overwriting,
Means for determining whether to perform processing to be held outside the network device before overwriting;
A printer apparatus characterized by the above. A printer device capable of data communication with a plurality of data processing devices connected on a predetermined communication medium,
The printer device is composed of a printer main body and a network I / F device that can be attached to the printer main body.
In receiving and responding to packets flowing on the communication medium,
A means of determining whether to respond to the process according to the network setting value of the transmission source, that is, whether to limit,
Means for setting the restriction range as a parameter in the network I / F device for restriction, means for using the parameter for determination,
In the case where the restriction is performed, if the setting is made to leave the log in the memory area in the network I / F device for further restricted access, means for leaving the log,
When leaving a log, if the restricted log area overflows, a means of overwriting,
Means for deleting detailed information from the log in the network I / F device before overwriting, and determining whether to perform a process of creating a minimally required simple log;
A printer apparatus characterized by the above. A printer device capable of data communication with a plurality of data processing devices connected on a predetermined communication medium,
The printer device is composed of a printer main body and a network I / F device that can be attached to the printer main body.
In receiving and responding to packets flowing on the communication medium,
A means of determining whether to respond to the process according to the network setting value of the transmission source, that is, whether to limit,
Means for setting the restriction range as a parameter in the network I / F device for restriction, means for using the parameter for determination,
In the case where the restriction is performed, if the setting is made to leave the log in the memory area in the network I / F device for further restricted access, means for leaving the log,
In the case where a log is left, means for graphically displaying a statistical result obtained by analyzing the log in the WEB server function operating on the network I / F device;
A printer apparatus characterized by the above.