JP2007135083A - Equipment having data communication function - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide equipment with a data communication function capable of acquiring the situation of IPsec setting from the outside, and automating the IPsec setting. <P>SOLUTION: The equipment having a security communication function comprises a means for performing communication with a plurality of addresses; a means for putting at least one of the plurality of addresses outside the object of security communication, and setting at least one of the plurality of addresses to be the object of the security communication; and a means for notifying a request source of the setting situation of the security communication set to own equipment, when a request is received from the outside via a network by an address that is not set to be the target of the security communication. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a device having a data communication function such as IPsec (Internet Protocol security).

  There is a protocol called IPsec as a security technique that can be generally used in a TCP / IP (Transmission Control Protocol / Internet Protocol) environment. This is a secure communication protocol realized by Layer3.

  IPsec basically secures communication between two points, and supports two types of functions: an encryption function that prevents third parties from snooping communications, and an authentication function that avoids session hijacking by third parties. ing.

  In order to perform IPsec communication between two devices, both devices must be able to use IPsec. If only one device is set to require IPsec and the other device is set not to perform IPsec, both IP communications are disabled.

  Conventionally, since it is not possible for two parties to perform IP communication in such a situation, the IPsec setting information of a device that has already been set for IPsec is referred to manually, and the other device is set to communicate with the IPsec device. I was trying to set it manually.

On the other hand, Patent Document 1 discloses a technique for setting a security policy in a device using IPsec.
JP 2005-130096 A

  As described above, when only one device is set to require IPsec and the other device is set not to perform IPsec, the IPsec setting information of a device that has already been set for IPsec is displayed. There is a problem that the operation is complicated because it is necessary to manually set the other device so that communication with the IPsec device can be performed manually.

  The present invention has been proposed in view of the above-described conventional problems. The object of the present invention is to provide a data communication function capable of acquiring the IPsec setting status from the outside and automating the IPsec setting. It is to provide a device having the same.

  In order to solve the above problems, according to the present invention, as described in claim 1, a device having a security communication function, which communicates with a plurality of addresses, and the plurality of addresses Means for excluding at least one of the above-mentioned addresses from security communication, and at least one of the plurality of addresses as a target for security communication; A gist of a device having a data communication function including means for notifying a requester of a setting state of security communication set in the own device when a request is received via the device.

  According to a second aspect of the present invention, in the device having the data communication function according to the first aspect, the means for notifying the request source of the setting status of the security communication set in the own device is the request source. It is possible to generate a security function setting command that can be executed by the device and to notify the setting status as a setting status.

  In addition, as described in claim 3, in the device having the data communication function according to claim 1 or 2, at least one of the plurality of addresses is a multicast address, In the case where a request is received from the outside via the network by the above multicast address, a means for notifying the request source of information for accessing the device itself can be provided.

  According to a fourth aspect of the present invention, there is provided means for performing communication using a plurality of addresses, means for storing the setting status of security communication set in a predetermined device having a security communication function, and externally using the above address. And a means for notifying the requester of the setting status of the security communication set in the predetermined device when a request is received from the network via the network.

  According to a fifth aspect of the present invention, in the device having the data communication function according to the fourth aspect, the means for notifying the request source of the setting status of the security communication set in the predetermined device is a request It is possible to generate a security function setting command that can be executed by the original device and notify the setting status as a setting status.

  Further, as described in claim 6, in the device having the data communication function according to any one of claims 4 and 5, at least one of the plurality of addresses is a multicast address, In the case where a request is received from the outside via the network by the above multicast address, a means for notifying the request source of information for accessing the device itself can be provided.

  According to a seventh aspect of the present invention, there is provided a device having a security communication function, which requests a setting status of security communication set to a predetermined device from another device via a network, Means for setting the security communication of the own device according to the setting status of the security communication set for the predetermined device from another device.

  According to another aspect of the present invention, there is provided a control method in a device having a security communication function and having means for communicating by a plurality of addresses, wherein at least one of the plurality of addresses is a security method. When a request is received from the outside via the network by the process of excluding communication from at least one of the plurality of addresses and the address excluded from the above security communication And a method for controlling a device having a data communication function including a step of notifying a request source of a setting state of security communication set in the device itself.

  According to a ninth aspect of the present invention, there is provided a control method in a device including means for performing communication by a plurality of addresses, and storing a setting state of security communication set in a predetermined device having a security communication function. And a step of notifying the requester of the setting status of the security communication set in the predetermined device when a request is received from outside via the network by the above address. Can do.

  In the device having the data communication function of the present invention, the IPsec setting status can be acquired from the outside, and the IPsec setting can be automated.

  Preferred embodiments of the present invention will be described below with reference to the drawings.

<First Embodiment>
FIG. 1 is a diagram showing a configuration example according to a first embodiment of a device having a data communication function of the present invention.

  In FIG. 1, a device (A) 1 such as a printer and a device (B) 2 such as a PC (Personal Computer) are connected via a network 3.

  The device (A) 1 includes a communication processing unit 11 for performing data communication with other devices via the network 3 and a printing unit 15 for performing printing when it is a printer. The communication processing unit 11 holds the IPsec setting for each IP address of the input / output unit 12 and the input / output unit 12 that inputs / outputs data using two IP addresses, the management IP address and the data communication IP address. An IPsec setting holding unit 13 such as SAD (Security Association Database) / SPD (Security Policy Database) and the like, and an IPsec for transmitting the IPsec setting status held in the IPsec setting holding unit 13 in response to a request from an external management IP address And a setting status transmission unit 14. In the IPsec setting holding unit 13, the management IP address of the input / output unit 12 is set to be out of the IPsec target, and the data communication IP address is set to the IPsec target.

  In addition, the device (B) 2 includes a communication processing unit 21 for performing data communication with other devices via the network 3. The communication processing unit 21 includes an input / output unit 22 that inputs / outputs data using a normal IP address, an IPsec setting holding unit 23 such as SAD / SPD that holds an IPsec setting for the IP address of the input / output unit 22, An IPsec setting unit 24 that requests IPsec setting status from other devices when performing security communication by IPsec with an external device, and performs IPsec setting of the own device according to the IPsec setting status acquired from other devices; And a key information input unit 25 for inputting key information from the user when setting the IPsec of the own device. Note that the IPsec setting holding unit 23 is initially not set.

  Consider a case in which data is transmitted for printing or the like from a device (B) 2 such as a PC to a device (A) 1 such as a printer via a network 3. The network 3 to which both are connected is not secure, and it is desired to transmit data by security communication using IPsec.

  At this point, since the device (A) 1 requires IPsec communication, it is possible to know the IPsec setting status of the device (A) 1 from the device (B) 2 side by non-IPsec communication using a normal data communication IP address. I can't. Therefore, conventionally, it has been necessary to directly refer to the IPsec setting status set in the device (A) 1 and manually set the IPsec setting for the device (B) 2. In this regard, in the present invention, the IPsec setting status of the device (A) 1 can be known via the network.

  FIG. 2 is a diagram illustrating an example of IPsec setting processing according to the first embodiment.

  In FIG. 2, first, the IPsec setting unit 24 of the device (B) 2 is requested to notify the management IP address of the device (A) 1 via the input / output unit 22 of the IPsec setting status (step). S101). This request is received by the IPsec setting status transmission unit 14 via the input / output unit 12 of the device (A) 1. FIG. 3 is a diagram showing a state in which the device (B) 2 requests the device (A) 1 for the IPsec setting status.

  Next, returning to FIG. 2, the IPsec setting status transmission unit 14 of the device (A) 1 that has received the request acquires its own IPsec setting status from the IPsec setting holding unit 13, and the management IP address via the input / output unit 12. To the device (B) 2 (step S102). However, key information used in IPsec AH (Authentication Header) or ESP (Encapsulating Security Payload) or authentication information used in IKE (Internet Key Exchange) is not transmitted. FIG. 4 is a diagram showing an example of IPsec setting status information returned from the device (A) 1. Whether or not to use IKE, what is the IKE authentication method, what is Cypher, HMAC (Keyed-Hashing For Message Authentication), information about the security maintenance method is transmitted, but key information is not included.

  Next, returning to FIG. 2, the IPsec setting unit 24 of the device (B) 2 receives the IPsec setting status via the input / output unit 22 (step S103), and the IPsec setting unit 24 refers to the obtained IPsec setting status. Then, the IPsec setting necessary for the own device to communicate with the device (A) 1 is determined (step S104).

  Then, the IPsec setting unit 24 requests the user to input key information through the key information input unit 25 (step S105). The key information indicates a key number sequence when performing IPsec encryption or HMAC authentication. FIG. 5 is a diagram showing an example of an interface screen that prompts the user to input key information, and shows what authentication information is requested from the user, and has a part for inputting the authentication information. Yes.

  Next, returning to FIG. 2, the IPsec setting unit 24 of the device (B) 2 performs the calculated IPsec setting on its own IPsec setting holding unit 23 (step S106). FIG. 6 is a diagram illustrating a state in which the IPsec setting status is returned from the device (A) 1 and the IPsec setting is performed in the device (B) 2.

  With the above procedure, the device (A) 1 and the device (B) 2 are ready to communicate by IPsec.

  Then, returning to FIG. 2, the device (B) 2 performs IPsec communication using the normal data communication IP address of the device (A) 1 (steps S107 and S108). FIG. 7 is a diagram illustrating a state in which the device (A) 1 becomes usable from the device (B) 2.

  Note that the IPsec setting status transmission unit 14 of the device (A) 1 can generate a security function setting command that can be executed by the device (B) 2 that is the requesting device, and can notify this as a setting status. As a result, the device (B) 2 can perform the IPsec setting without a special execution mechanism.

<Second Embodiment>
FIG. 8 is a diagram showing a configuration example according to the second embodiment of a device having a data communication function of the present invention.

  In FIG. 8, a device (A) 1 having secret data 16 to be protected from unauthorized access and a device (B) 2 having a secret data transmission / reception unit 26 for transmitting / receiving secret data are connected via a network 3. Yes.

  The device (A) 1 includes a communication processing unit 11 for performing data communication with other devices via the network 3. The communication processing unit 11 includes an input / output unit 12 that inputs / outputs data using three IP addresses: a device discovery multicast IP address, a management IP address, and a data communication IP address, and each IP address of the input / output unit 12 IPsec setting holding unit 13 such as SAD / SPD that holds IPsec settings per device, device status holding unit 17 that holds the device status of the device itself (network-related information such as whether or not communication is possible), and device discovery at all times A device status transmission unit 18 that monitors the device multicast IP address and transmits the device status held in the device status holding unit 17 in response to a request from the device discovery multicast IP address from the outside, and management from the outside IPsec setting status held in the IPsec setting holding unit 13 in response to a request by a private IP address And a IPsec setting status transmission unit 14 to transmit. In the IPsec setting holding unit 13, the management IP address and the device discovery multicast IP address of the input / output unit 12 are set to be out of the IPsec target, and the data communication IP address is set to the IPsec target.

  In addition, the device (B) 2 includes a communication processing unit 21 for performing data communication with other devices via the network 3. The communication processing unit 21 includes an input / output unit 22 that inputs / outputs data using a normal IP address, an IPsec setting holding unit 23 such as SAD / SPD that holds an IPsec setting for the IP address of the input / output unit 22, When performing security communication with an external device by IPsec, a secret data holding device discovery unit 27 that performs multicast transmission to discover an external device that holds secret data, and IPsec setting for the discovered external device An IPsec setting unit 24 that requests the status and performs IPsec setting of the own device according to the IPsec setting status acquired from another device, and a key information input unit 25 that inputs key information from the user when setting the IPsec of the own device It has. Note that the IPsec setting holding unit 23 is initially not set.

  Now, assume that there are two such devices, and the device (A) 1 has secret data 16 to be protected from unauthorized access, or receives the secret data 16 from the outside. The secret data 16 is transmitted / received from the secret data transmitting / receiving unit 26 of the device (B) 2. However, since the device (A) 1 and the device (B) 2 are connected by an insecure network 3, it is desired to make the communication between the device (A) 1 and the device (B) 2 IPsec. It is assumed that IPsec has already been set for the device (A) 1 and IPsec communication can be realized between the two if the IPsec setting of the device (B) 2 is prepared.

  Conventionally, in this situation, IPsec can be realized by manually knowing the IPsec setting and IP address of the device (A) 1 and performing setting for the device (B) 2 so that IPsec communication can be performed with the device. In the first embodiment described above, the device (A) 1 has a management IP address set for non-IPsec and communicates between the device (B) 2 and the device (A) 1 using the address. This indicates that IPsec setting information can be transmitted and received.

  However, in order to realize this, the device (B) 2 has to know the management IP address of the device (A) 1, and the value has to be manually entered in the device (B) 2. . Therefore, in the second embodiment, the operation is automated.

  FIG. 9 is a diagram illustrating an example of IPsec setting processing according to the second embodiment.

  9, first, the secret data holding device discovery unit 27 of the device (B) 2 exists for a known device discovery multicast IP address in order to discover a device having a function of transmitting the IPsec setting status to the outside. Is transmitted to request notification (step S201). This request is received by the device status transmission unit 18 via the input / output unit 12 of the device (A) 1. FIG. 10 is a diagram showing how the device (B) 2 finds a device having secret data.

  Next, returning to FIG. 9, the device status transmission unit 18 of the device (A) 1 that has received the request notifies the device (B) 2 of its own device status as its own presence via the input / output unit 12 (step S202). ). The source address at this time is a management IP address and is not made into IPsec, but since these pieces of information do not include information that should be kept secret, it is possible to communicate the insecure network 3 without using IPsec. it can. FIG. 11 is a diagram showing how the device (A) 1 returns its own device status to the device (B) 2.

  Next, returning to FIG. 9, the secret data holding device discovery unit 27 of the device (B) 2 receives the presence of the device (A) 1 via the input / output unit 22 (step S203), and the IPsec setting unit 24 notifies the fact. Tell. Accordingly, the IPsec setting unit 24 requests the management IP address of the device (A) 1 to notify the IPsec setting status via the input / output unit 22 (step S204). This request is received by the IPsec setting status transmission unit 14 via the input / output unit 12 of the device (A) 1.

  Next, the IPsec setting status transmission unit 14 of the device (A) 1 that has received the request acquires its own IPsec setting status from the IPsec setting holding unit 13, and the device (B) from the management IP address via the input / output unit 12. 2 is returned (step S205). However, key information used in IPsec AH or ESP or authentication information used in IKE is not transmitted.

  Next, the IPsec setting unit 24 of the device (B) 2 receives the IPsec setting status via the input / output unit 22 (step S206), the IPsec setting unit 24 refers to the obtained IPsec setting status, and the own device is the device. (A) The IPsec setting necessary to communicate with 1 is determined (step S207).

  Then, the IPsec setting unit 24 requests the user to input key information through the key information input unit 25 (step S208).

  Next, the IPsec setting unit 24 performs the calculated IPsec setting on its own IPsec setting holding unit 23 (step S209). FIG. 12 is a diagram illustrating a state where IPsec setting is performed in the device (B) 2.

  With the above procedure, the device (A) 1 and the device (B) 2 are ready to communicate by IPsec.

  Returning to FIG. 9, the device (B) 2 performs IPsec communication using the normal data communication IP address of the device (A) 1 (steps S210 and S211). FIG. 13 is a diagram illustrating a state in which the device (A) 1 and the device (B) 2 exchange secret data.

  Note that the IPsec setting status transmission unit 14 of the device (A) 1 can generate a security function setting command that can be executed by the device (B) 2 that is the requesting device, and can notify this as a setting status. As a result, the device (B) 2 can perform the IPsec setting without a special execution mechanism.

<Third Embodiment>
FIG. 14 is a diagram showing a configuration example according to the third embodiment of a device having a data communication function of the present invention.

  In FIG. 14, a device (A) 1 for which IPsec setting has been performed, a device (B) 2 for which IPsec setting is to be performed, and a device (C) 4 as a server for providing the IPsec setting status are connected via a network 3. Connected.

  The device (A) 1 includes a communication processing unit 11 for performing data communication with other devices via the network 3. The communication processing unit 11 includes an input / output unit 12 that inputs / outputs data using a normal data communication IP address, and an IPsec setting holding unit such as SAD / SPD that holds IPsec settings for the IP address of the input / output unit 12 13. In the IPsec setting holding unit 13, the IP address for data communication of the input / output unit 12 is set as an IPsec target.

  In addition, the device (B) 2 includes a communication processing unit 21 for performing data communication with other devices via the network 3. The communication processing unit 21 includes an input / output unit 22 that inputs / outputs data using a normal IP address, an IPsec setting holding unit 23 such as SAD / SPD that holds an IPsec setting for the IP address of the input / output unit 22, When performing security communication with an external device using IPsec, an IPsec setting status providing device discovery unit 28 that performs multicast or anycast transmission to discover an IPsec setting status providing device, and the detected external IPsec setting status An IPsec setting unit 24 that requests the provided device for the IPsec setting status and sets the IPsec of the own device according to the IPsec setting status acquired from another device, and a key for inputting key information from the user when setting the IPsec of the own device And an information input unit 25. Note that the IPsec setting holding unit 23 is initially not set.

  The device (C) 4 includes a communication processing unit 41 for performing data communication with other devices via the network 3. The communication processing unit 41 includes an input / output unit 42 for inputting / outputting data using two IP addresses, ie, a device discovery multicast or anycast IP address and a normal data communication IP address, and a device discovery multicast / anycast. The device IP address transmission unit 43 that monitors the IP address and transmits its own IP address for data communication in response to a request by the device discovery multicast / anycast IP address from the outside, and the device (A) 1 An IPsec-compatible device IP address holding unit 44 that holds the IP address of the corresponding IPsec-compatible device, an IPsec-compatible device IPsec setting status holding unit 45 that holds the IPsec setting status of the device (A) 1, and for external data communication IPsec-compatible devices in response to requests by IP address And a P address holding unit 44 and the IPsec compatible device IPsec setting status transmission unit 46 for transmitting the IP address and IPsec setting status of IPsec compatible device held in the IPsec setting status holding unit 45.

  Now, the device (B) 2 wants to communicate with the device (A) 1 by IPsec, but the IPsec setting of the device (A) 1 is not known. The device (B) 2 wants to directly inquire about the current IPsec setting status to the device (A) 1, but since the communication requires IPsec in the first place, it cannot make an inquiry. Therefore, a third device (C) 4 is installed in addition to the devices (A) 1 and (B) 2 and the IPsec setting status is acquired from the device (C) 4.

  FIG. 15 is a diagram illustrating an example of IPsec setting processing according to the third embodiment.

  In FIG. 15, first, the IPsec setting status providing device discovery unit 28 of the device (B) 2 discovers a device (server) that manages the IPsec setting status, so that a known device discovery multicast / anycast IP address is used. Then, a packet is transmitted and requested to notify the presence (step S301). This request is received by the device IP address transmission unit 43 via the input / output unit 42 of the device (C) 4.

  Next, the device IP address transmission unit 43 of the device (C) 4 that has received the request notifies the device (B) 2 of its own normal data communication IP address as its own presence via the input / output unit 42 (step). S302). In this notification, the source address is the IP address assigned to the device (C) 4, and the destination address is the IP address of the device (B) 2. Then, this notification is received by the IPsec setting status providing device discovery unit 28 via the input / output unit 22 of the device (B) 2 (step S303). FIG. 16 is a diagram showing a state in which the device (B) 2 makes an inquiry about the IPsec setting status providing device.

  Next, returning to FIG. 15, the IPsec setting unit 24 of the device (B) 2 requests the data communication IP address of the device (C) 4 to notify the IPsec setting status via the input / output unit 22. (Step S304). This request is received by the IPsec setting status transmission unit 46 via the input / output unit 42 of the device (C) 4.

  Next, the IPsec setting status transmission unit 46 of the device (C) 4 that has received the request receives the IP address held in the IPsec compatible device IP address holding unit 44 and the IPsec setting held in the IPsec compatible device IPsec setting status holding unit 45. The situation is returned via the input / output unit 42 (step S305). However, key information used in IPsec AH or ESP or authentication information used in IKE is not transmitted. This information is received via the input / output unit 22 by the IPsec setting unit 24 of the device (B) 2 (step S306). FIG. 17 is a diagram illustrating a state in which the device (B) 2 acquires the IPsec setting status.

  Next, returning to FIG. 15, the IPsec setting unit 24 of the device (B) 2 refers to the obtained IPsec setting status, and determines the IPsec setting necessary for the device itself to communicate with the device (A) 1 (step). S307).

  Then, the IPsec setting unit 24 requests the user to input key information through the key information input unit 25 (step S308).

  Next, the IPsec setting unit 24 performs the calculated IPsec setting on its own IPsec setting holding unit 23 (step S309). FIG. 18 is a diagram illustrating a state where IPsec setting is performed in the device (B) 2.

  With the above procedure, the device (A) 1 and the device (B) 2 are ready to communicate by IPsec.

  Returning to FIG. 15, the device (B) 2 performs IPsec communication using the normal data communication IP address of the device (A) 1 (steps S310 and S311). FIG. 19 is a diagram illustrating a state in which IPsec communication between the device (A) 1 and the device (B) 2 is realized.

  Note that the IPsec setting status transmission unit 46 of the device (C) 4 can generate a security function setting command that can be executed by the device (B) 2 that is the requesting device, and can notify this as a setting status. As a result, the device (B) 2 can perform the IPsec setting without a special execution mechanism.

<Fourth Embodiment>
FIG. 20 is a diagram showing a configuration example according to the fourth embodiment of a device having a data communication function of the present invention.

  In the fourth embodiment, the device (A) 1 in the third embodiment shown in FIG. 14 is a printer, the device (B) 2 is a PC, and the device (C) 4 is a printer management server. In FIG. 20, the printer management server 4 includes a printer driver holding unit 47 that holds the printer driver of the printer 1 that is an IPsec-compatible device. The IPsec setting status transmission unit 46 has an IPsec setting status (in a format that can be executed by the PC 2). A printer driver is transmitted together with (generated as a file). Further, the IPsec setting unit 24 of the PC 2 is provided with a function of executing a file received from the printer management server 4 and a function of adding a printer driver. Other configurations are the same as those of the third embodiment shown in FIG.

  FIG. 21 is a diagram illustrating an example of IPsec setting processing according to the fourth embodiment.

  In FIG. 21, first, the IPsec setting status providing device discovery unit 28 of the PC 2 notifies existence to a known device discovery multicast / anycast IP address in order to discover the printer management server 4 that manages the IPsec setting status. A packet is transmitted and requested to do so (step S401). This request is received by the device IP address transmission unit 43 via the input / output unit 42 of the printer management server 4.

  Next, the device IP address transmission unit 43 of the printer management server 4 that has received the request notifies the PC 2 of its own normal data communication IP address as its presence via the input / output unit 42 (step S402). In this notification, the source address is the IP address assigned to the printer management server 4, and the destination address is the IP address of the PC 2. Then, this notification is received by the IPsec setting status providing device discovery unit 28 via the input / output unit 22 of the PC 2 (step S403). FIG. 22 is a diagram illustrating how the PC 2 makes an inquiry to the printer management server 4.

  Next, returning to FIG. 21, the IPsec setting unit 24 of the PC 2 requests the data management IP address of the printer management server 4 to notify the IPsec setting status via the input / output unit 22 (step S404). This request is received by the IPsec setting status transmission unit 46 via the input / output unit 42 of the printer management server 4.

  Next, the IPsec setting status transmission unit 46 of the printer management server 4 that has received the request receives the IP address held in the IPsec compatible device IP address holding unit 44 and the IPsec setting status held in the IPsec compatible device IPsec setting status holding unit 45. From the above, a setting necessary for the PC 2 to communicate with the printer 1 is generated as a file that can be executed by the PC 2 and returned together with the corresponding printer driver held in the printer driver holding unit 47 via the input / output unit 42 ( Step S405). However, key information used in IPsec AH or ESP or authentication information used in IKE is not transmitted. These pieces of information are received by the IPsec setting unit 24 of the PC 2 via the input / output unit 22 (step S406). FIG. 23 is a diagram illustrating a state in which the PC 2 acquires the IPsec setting status.

  Next, returning to FIG. 21, the IPsec setting unit 24 of the PC 2 executes the executable file thus obtained, so that it can communicate with the printer 1 (step S407).

  Next, the IPsec setting unit 24 of the PC 2 sets its own printer using the printer driver and makes it usable as a printer (step S408). FIG. 24 is a diagram illustrating a state where the IPsec setting is performed in the PC 2.

  With the above procedure, the printer 1 and the PC 2 are ready to communicate by IPsec.

  Returning to FIG. 21, the PC 2 performs IPsec communication using the normal data communication IP address of the printer 1 (steps S409 and S410). FIG. 25 is a diagram illustrating a state in which IPsec communication between the printer 1 and the PC 2 is realized.

<Summary>
In this way, in the present invention, by having a function of notifying the outside of the IPsec setting status set in itself without using IPsec, even in a situation where IPsec is set, It is possible to notify via the network what kind of IPsec communication is necessary.

  In addition, since it has a function of notifying the IPsec setting status set in itself in a format that can be executed by an external device, the external device can perform IPsec setting without a special execution mechanism. .

  In addition, by making it possible to find the IP address that transmits the IPsec setting status from the outside, it is possible to automatically discover an IP address that can know the IPsec status.

  In addition, the IP address of the IPsec device and the setting status thereof are stored in another server, and the information is notified to the outside, whereby the IPsec-compatible devices in the network are collectively managed, and the other devices can be connected as necessary. The information can be notified. An external device can also obtain a list of IPsec devices in the network.

  The present invention has been described above by the preferred embodiments of the present invention. While the invention has been described with reference to specific embodiments, various modifications and changes may be made to the embodiments without departing from the broad spirit and scope of the invention as defined in the claims. Obviously you can. In other words, the present invention should not be construed as being limited by the details of the specific examples and the accompanying drawings.

It is a figure which shows the structural example concerning 1st Embodiment of the apparatus which has a data communication function of this invention. It is a figure which shows the example of a process of the IPsec setting in 1st Embodiment. It is a figure which shows a mode that the IPsec setting condition is requested | required with respect to apparatus A from the apparatus B. FIG. 6 is a diagram showing an example of IPsec setting status information returned from device A. FIG. It is a figure which shows the example of an interface screen which requests | requires the input of key information with respect to a user. FIG. 10 is a diagram showing a state in which IPsec setting status is returned from device A and IPsec setting is performed in device B. It is a figure which shows a mode that the apparatus A became usable from the apparatus B. FIG. It is a figure which shows the structural example concerning 2nd Embodiment of the apparatus which has a data communication function of this invention. It is a figure which shows the example of a process of the IPsec setting in 2nd Embodiment. It is a figure which shows a mode that the apparatus B discovers the apparatus which has secret data. It is a figure which shows a mode that the apparatus A responds with respect to the apparatus B of an own apparatus condition. 6 is a diagram illustrating a state where IPsec setting is performed in the device B. FIG. It is a figure which shows a mode that the apparatus A and the apparatus B exchange secret data. It is a figure which shows the structural example concerning 3rd Embodiment of the apparatus which has a data communication function of this invention. It is a figure which shows the example of a process of the IPsec setting in 3rd Embodiment. It is a figure which shows a mode that the apparatus B inquires an IPsec setting status provision apparatus. It is a figure which shows a mode that the apparatus B acquires an IPsec setting condition. 6 is a diagram illustrating a state where IPsec setting is performed in the device B. FIG. It is a figure which shows a mode that the IPsec communication of the apparatus A and the apparatus B was implement | achieved. It is a figure which shows the structural example concerning 4th Embodiment of the apparatus which has a data communication function of this invention. It is a figure which shows the example of a process of the IPsec setting in 4th Embodiment. It is a figure which shows a mode that PC inquires of a printer management server. It is a figure which shows a mode that PC acquires the IPsec setting condition. It is a figure which shows a mode that IPsec setting is performed in PC. It is a figure which shows a mode that the IPsec communication of a printer and PC was implement | achieved.

Explanation of symbols

1 Device A
11 Communication Processing Unit 12 Input / Output Unit 13 IPsec Setting Holding Unit 14 IPsec Setting Status Transmitting Unit 15 Printing Unit 16 Secret Data 17 Device Status Holding Unit 18 Device Status Transmitting Unit 2 Device B
DESCRIPTION OF SYMBOLS 21 Communication processing part 22 Input / output part 23 IPsec setting holding part 24 IPsec setting part 25 Key information input part 26 Secret data transmission / reception part 27 Secret data holding apparatus discovery part 28 IPsec setting status provision apparatus discovery part 3 Network 4 Equipment C
41 Communication Processing Unit 42 Input / Output Unit 43 Device IP Address Transmitting Unit 44 IPsec Compatible Device IP Address Holding Unit 45 IPsec Compatible Device IPsec Setting Status Holding Unit 46 IPsec Setting Status Transmitting Unit 47 Printer Driver Holding Unit

Claims (9)

A device with a security communication function,
Means for communicating with a plurality of addresses;
Means for excluding at least one of the plurality of addresses from security communication; and at least one of the plurality of addresses as a security communication target;
And a means for notifying the requester of the setting status of the security communication set in the own device when a request is received from outside via the network by an address that is not subject to the security communication. A device having a data communication function. In the apparatus which has a data communication function of Claim 1,
The means for notifying the request source of the setting status of the security communication set in the self-device generates a security function setting command that can be executed by the requesting device and notifies the setting status of the security function setting command. Equipment with data communication function. In the apparatus which has a data communication function as described in any one of Claim 1 or 2,
At least one of the plurality of addresses is a multicast address;
A device having a data communication function, comprising means for notifying a request source of information for accessing the device itself when a request is received from outside via the network by the multicast address. Means for communicating with a plurality of addresses;
Means for storing a setting state of security communication set in a predetermined device having a security communication function;
Data communication comprising: means for notifying a request source of a setting state of security communication set in the predetermined device when a request is received from outside via the network by the above address Functional device. In the apparatus which has a data communication function of Claim 4,
The means for notifying the request source of the setting status of the security communication set in the predetermined device generates a security function setting command that can be executed by the requesting device, and notifies this as the setting status. A device that has a data communication function. In the apparatus which has a data communication function as described in any one of Claim 4 or 5,
At least one of the plurality of addresses is a multicast address;
A device having a data communication function, comprising means for notifying a request source of information for accessing the device itself when a request is received from outside via the network by the multicast address. A device with a security communication function,
Means for requesting the setting status of the security communication set in the predetermined device to another device via the network;
A device having a data communication function, comprising: means for setting security communication of its own device in accordance with a setting state of security communication set for a predetermined device from the other device. A control method in a device having a security communication function and having means for performing communication by a plurality of addresses,
Excluding at least one of the plurality of addresses as a target for security communication, and at least one of the plurality of addresses as a target for security communication;
A step of notifying the requester of the setting status of the security communication set in the own device when a request is received from the outside via the network by an address that is not subject to the security communication. A method for controlling a device having a data communication function. A control method in a device provided with means for performing communication by a plurality of addresses,
Storing a setting state of security communication set in a predetermined device having a security communication function;
And a step of notifying a requester of the setting status of the security communication set in the predetermined device when a request is received from outside via the network by the above address. A method for controlling a device having a function.

Images