JP2009147421A - Communication control unit and method of controlling communication - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a communication control unit capable of appropriately preventing identification information from being registered erroneously when registering the identification information for refusing access from a terminal unit connected via a network. <P>SOLUTION: The communication control unit 30 has: a determination section 31 for determining whether an IP address for identifying a terminal unit 2 is included in IP address information to be registered, when the terminal unit 2 connected via a LAN 5 requests the registration of the IP address information for refusing the access; a communication section 33 for transmitting a message for calling the attention of the terminal unit 2, when it is determined that the IP address of the terminal unit 2 is included in the IP address information to be registered; and a registration section 32 for deferring the registration of the IP address information to a message transmitted from the communication section 33 until a response for approving the registration is received. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a communication control device and a communication control method, and more particularly, to a communication control device and a communication control method for rejecting access via a network based on registered identifier information.

  Address filtering is known as one of techniques for improving network security. In address filtering, the IP address of the network device that you want to deny (or allow) access is registered in advance, and if there is an access from a network device that is given the registered IP address, the access is denied. (Or allow) technology.

Regarding the registration of network device setting information, a network device setting management system capable of preventing the occurrence of a network communication failure due to an input error of setting information is disclosed in Patent Document 1 below. In this network device setting management system, the network device setting information input by the user is not immediately reflected in the network, but the input setting information is displayed on the display device and the user is allowed to confirm the contents. Then, by reflecting the result on the network, it is possible to prevent a user from entering an error in the setting information.
JP 2000-209239 A

  In the network device setting management system described above, it is possible to reduce the occurrence of communication failures due to user input errors. However, in this system, there is a possibility that the occurrence of a communication failure due to an error other than an input error cannot be prevented. For example, when registering a range of addresses to be denied access (hereinafter also referred to as “identifiers”), if the identifier of the own device is included in the range, there is no mistake in the user input itself. For this reason, there is a risk of missing an erroneous registration. In addition, if the identifier of the terminal device that requests registration is mistakenly registered, the terminal device cannot be accessed, so that the registration content cannot be corrected from the terminal device. .

  The present invention has been made to solve the above-described problems, and when registering identifier information that denies access from a terminal device connected via a network, erroneous registration of identifier information is appropriately performed. An object of the present invention is to provide a communication control apparatus and a communication control method that can be prevented.

  The communication control device according to the present invention is a communication control device that denies access via a network based on registered identifier information, and denies access from a terminal device connected via the network. When a request for registering identifier information is received, a determination unit that determines whether or not an identifier for specifying the terminal device is included in the identifier information to be registered, and the determination unit specifies the terminal device. When it is determined that the identifier is included in the identifier information to be registered, the information processing apparatus includes a registration unit that suspends registration of the identifier information until a predetermined process is completed.

  The communication control method according to the present invention is a communication control method for rejecting access via a network based on registered identifier information, and is accessed from a terminal device connected via the network. In the determination step for determining whether or not the identifier for identifying the terminal device is included in the identifier information to be registered when there is a registration request for identifier information that rejects the terminal device, A registration step of deferring registration of the identifier information until a predetermined process is completed when it is determined that the identifier to be identified is included in the identifier information to be registered.

  According to the communication control device or the communication control method according to the present invention, it is determined whether or not an identifier for specifying a terminal device is included in the identifier information to be registered. If the identifier specifying the terminal device is included in the identifier information to be registered, the registration is suspended until the predetermined process is completed. Therefore, for example, it is possible to perform correction or the like to delete the identifier that identifies the terminal device from the identifier information before the predetermined process is completed. As a result, it is possible to appropriately prevent erroneous registration of identifier information that denies access via the network.

  The communication control device according to the present invention further includes a transmission means for transmitting a message to call attention to the terminal device when it is determined that the identifier specifying the terminal device is included in the identifier information to be registered. It is preferable that the registration unit holds the registration of the identifier information until a response to the message transmitted from the transmission unit is received.

  Further, the communication control method according to the present invention includes a transmission step of transmitting a message to call attention to the terminal device when it is determined that the identifier specifying the terminal device is included in the identifier information to be registered. Preferably, in the registration step, registration of the identifier information is suspended until a response to the message transmitted from the transmission means is received.

  In this case, a message that calls attention to the terminal device is transmitted, and registration of identifier information is suspended until a response to the message is received. Since the access from the terminal device is not denied until the identifier information is registered, the operator of the terminal device that has confirmed the message during that time, for example, deletes the identifier that identifies the terminal device from the identifier information. And cancellation of the registration request.

  Preferably, the registration means suspends registration of identifier information until a session with a terminal device requesting registration of identifier information is completed.

  In the registration step, it is preferable that registration of identifier information is suspended until a session with a terminal device that requests registration of identifier information is completed.

  In this case, the registration of the identifier information is suspended until the session ends, so that access from the terminal device is not denied until the session ends. Therefore, the operator of the terminal device can perform, for example, correction for deleting the identifier that identifies the terminal device from the identifier information during the session.

  Preferably, the registration means suspends the registration of the identifier information until a predetermined time elapses after it is determined that the identifier specifying the terminal device is included in the identifier information to be registered.

  In the registration step, it is preferable that registration of identifier information is suspended until a predetermined time elapses after it is determined that the identifier specifying the terminal device is included in the identifier information to be registered.

  In this case, since registration of identifier information is suspended until a predetermined time elapses, access from the terminal device is not denied until the predetermined time elapses. Therefore, the operator of the terminal device can perform, for example, correction to delete the identifier that identifies the terminal device from the identifier information before the predetermined time elapses.

  According to the present invention, it is determined whether or not an identifier for specifying a terminal device that requests registration of identifier information for which access is denied is included in the identifier information to be registered, and the terminal device is specified. If it is determined that the identifier to be registered is included in the identifier information to be registered, the registration of the identifier information is suspended until the predetermined process is completed, so the terminal device connected via the network Therefore, when registering identifier information for which access is denied, it is possible to appropriately prevent erroneous registration of identifier information.

  DESCRIPTION OF EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings. In addition, in each figure, the same code | symbol is attached | subjected to the same element and the overlapping description is abbreviate | omitted. Here, a case where the communication control apparatus according to the embodiment is mounted on a network multifunction device will be described as an example.

  FIG. 1 is a diagram illustrating a configuration example of a communication system including a network multifunction device in which a communication control device is mounted. The communication system shown in FIG. 1 is connected to a terminal device 2 used by a network administrator, terminal devices 3 and 4 used by general users who do not have administrator authority, and terminal devices 2, 3, and 4 via a LAN 5. The network multifunction device 1 is mainly configured. A personal computer is preferably used as the terminal devices 2, 3, and 4. 1 shows an example of a communication system in which three terminal devices 2, 3, and 4 are connected to the network multifunction device 1, but the number of terminal devices connected to the network multifunction device 1 is three. It is not limited to.

  The network multifunction device 1 has network-compatible copy, printer, scanner, facsimile, and IFAX (Internet facsimile) functions. For example, the terminal devices 2, 3, 4, connected via the LAN 5, A printout or the like can be performed in response to a request from. The network multifunction device 1 has an address filtering function. That is, the network multifunction device 1 registers the IP address (identifier) of the terminal device to which access is denied, thereby denying access from the terminal device having the registered IP address and illegally printing from the outside. Out can be restricted. For example, when the IP address of the terminal device 3 is registered, access from the terminal device 3 to the network multifunction device 1 is denied.

  Further, the network multifunction device 1 has a Web server function, and the network administrator can set and register the IP address of the terminal device to which access is denied on the Web browser of the terminal device 2.

  FIG. 2 is a block diagram showing the configuration of the network multifunction device 1. As shown in FIG. 2, the network multifunction peripheral 1 includes a control unit 10, a reading unit 11, a recording unit 12, a display unit 13, an operation unit 14, a ROM 15, a RAM 16, an image storage unit 17, a codec 18, a modem 19, and an NCU 20. The IFAX control unit 21, the Web server 22, and the communication control device 30 are configured to be communicable with each other via a bus 40.

  The control unit 10 is realized by a CPU, for example, and integrally controls the hardware configuring the network multifunction peripheral 1 by executing a program stored in the ROM 15. The reading unit 11 reads an image with a CCD or the like and outputs it as image data. The recording unit 12 is an electrophotographic printer, and prints out image data output from the reading unit 11, image data received by a facsimile, and the like on a sheet.

  The display unit 13 is a display device using an LCD or the like, and displays the operating state of the Internet multifunction peripheral 1 and various setting contents. The operation unit 14 includes keys necessary for operating the network multifunction peripheral 1, such as a numeric keypad, an abbreviated key, a start key, and various function keys. The ROM 15 stores various programs necessary for the operation of the network multifunction device 1. The RAM 16 is realized by SRAM, DRAM, or the like, and temporarily stores data generated when the program is executed.

  The image storage unit 17 is configured by a DRAM or the like, and stores the image data output from the reading unit 11, the received image data, and the like. The codec 18 encodes and compresses the image data and decodes the image data that has been encoded and compressed. The modem 19 performs modulation / demodulation between a digital signal and an analog signal. The NCU 20 is connected to the modem 19 and controls the connection between the modem 19 and the PSTN (Public Switched Telephone Network) 8.

  The IFAX control unit 21 uses the Internet environment to transmit the read transmission document as TIFF / PDF format image data attached to a mail. The IFAX control unit 21 receives a mail from the POP server every set time and automatically prints out. The Web server 22 makes it possible to access predetermined data such as a home page and a setting registration page described in HTML from the terminal devices 2, 3, 4 and execute a predetermined HTTP task.

  The communication control device 30 provides an interface function for allowing the network multifunction peripheral 1 to communicate with the LAN 5 and an address filtering function. The LAN 5 is connected to the Internet 7 via the router 6. The communication control device 30 restricts access via the LAN 5 of terminal devices whose IP addresses are registered in a list of IP addresses that are denied access (hereinafter referred to as “filtering list”). On the other hand, a communication terminal in which an IP address is not registered is not restricted in access, and can use each function of the network MFP 1 via the LAN 5. In order to realize the above-described functions, the communication control device 30 includes a determination unit 31, a registration unit 32, and a communication unit 33.

  When the session with the terminal device 2 connected via the LAN 5 is established, and the IP address information registration request is denied from the terminal device 2, the determination unit 31 performs communication in the TCP / IP format. The IP address of the terminal device 2 is extracted from the data, and it is determined whether or not the IP address specifying the terminal device 2 is included in the IP address information to be registered. That is, the determination unit 31 functions as a determination unit described in the claims. Note that the determination result of the determination unit 31 is output to the registration unit 32.

  The registration unit 32 acquires the determination result output from the determination unit 31. If the IP address of the terminal device 2 is not included in the IP address information to be registered, the registration unit 32 registers the IP address information in the filtering list. To do. On the other hand, when the IP address information of the terminal device 2 is included in the IP address information to be registered, a message indicating that the IP address information of the terminal device 2 is included in the IP address information to be registered is communicated. The data is transmitted from the unit 33 to the terminal device 2. At that time, the registration unit 32 suspends the registration of the IP address information until there is a response from the terminal device 2 to approve the registration. That is, the registration unit 32 functions as a registration unit described in the claims.

  As described above, when the IP address of the terminal device 2 is included in the IP address information to be registered, the communication unit 33 prompts the network administrator who is the operator of the terminal device 2 to pay attention. Send. That is, the communication unit 33 functions as a transmission unit described in the claims. On the other hand, the network administrator who has confirmed the message can correct the deletion of the IP address of the terminal device 2 from the IP address information to be registered, and request registration again.

  Next, the operation of the communication control device 30 mounted on the network multifunction peripheral 1 and the IP address information registration method by the communication control device 30 will be described with reference to FIGS. First, the first IP address information registration process (first control mode) by the communication control device 30 will be described with reference to FIG. FIG. 3 is a flowchart showing a processing procedure of the first IP address information registration processing. Here, IP address information that establishes an HTTP session (hereinafter simply referred to as “session”) between the communication control device 30 and the terminal device 2 constituting the network multifunction peripheral 1 and denies access from the terminal device 2. It is assumed that there is a registration request.

  In step S100, when information indicating an operation for confirming registration of IP address information to be denied access is input from the terminal device 2, the determination unit 31 extracts the IP address of the terminal device 2 from the communication data. It is confirmed whether or not the IP address specifying the terminal device 2 is included in the IP address information to be registered (step S102).

  If it is determined in the subsequent step S104 that the IP address of the terminal device 2 is included in the IP address information to be registered, the process proceeds to step S106. On the other hand, when it is determined that the IP address of the terminal device 2 is not included in the IP address information to be registered, the process ends after the IP address information is registered in the filtering list in step S110.

  In step S <b> 106, a warning message that the IP address of the terminal device 2 is included in the IP address information to be registered is transmitted from the communication unit 33 to the terminal device 2. A display example of the registration confirmation screen is shown in FIG. In the display example of FIG. 4, the message “Your computer address is included, can I enable this setting?” Is displayed on the display of the terminal device 2. Also, buttons such as “Enable”, “Correction”, and “Cancel” are displayed on the display together with a warning message. The network administrator who has confirmed the message can perform correction to delete the IP address of the terminal device 2 from the IP address information to be registered by clicking “correct” with the mouse. Further, the network administrator can cancel the registration process once by clicking “Cancel” with the mouse, and can start registration from the beginning. Further, when registering IP address information including the IP address of the terminal device 2, a response to approve the registration is transmitted by clicking “Enable”.

  Returning to FIG. 3, the description will be continued. In the subsequent step S108, it is determined whether or not there is a response to approve (validate) the registration. If there is a response to approve the registration, the process ends after the IP address information is registered in the filtering list in step S110. On the other hand, when there is no response to approve the registration, the registration of the IP address information is suspended until there is a response from the terminal device 2 to approve the registration. If the IP address information is corrected by the terminal device 2 during the hold, the process is executed again from step S100 described above. When the registration is canceled, the process is exited.

  According to this control mode, when the IP address of the terminal device 2 is included in the IP address information to be registered, a message for calling attention to the terminal device 2 is transmitted, and the message is registered for the message. The registration of the IP address information is suspended until a response for approving is received. Since the access from the terminal device 2 is not rejected while the registration is suspended, the network administrator who has confirmed the message during that time can modify the IP address of the terminal device 2 from the IP address information, Or cancel the registration. As a result, when registering IP address information that denies access from the terminal device 2 connected via the LAN 5, it is possible to appropriately prevent erroneous registration of the IP address information.

  When a warning message is always displayed when registering IP address information for which access is denied, the warning message is displayed even when the IP address information of the terminal device 2 is not included in the IP address information. May be annoying. In addition, the network administrator may get used to the warning message, and the warning function of the message may be deteriorated. According to this control mode, since the warning message is displayed only when the IP address of the terminal device 2 is included in the IP address information that denies access, there is no inconvenience to the network administrator. In addition, it is possible to suppress a decrease in warning function.

(Second control mode)
In the first control mode described above, a warning message is transmitted when the IP address information of the terminal device 2 is included in the IP address information to be registered, and registration is suspended until there is a response to approve the registration. Although the configuration is adopted, the registration of the IP address information is suspended while the same session between the terminal device 2 and the communication control device 30 is continued, and the IP address information is registered in the filtering list after the session is ended. it can. Here, the second IP address information registration processing (second control mode) by the communication control device 30 will be described with reference to FIG. FIG. 5 is a flowchart showing a processing procedure of the second IP address information registration processing.

  Since the processing content of steps S200 to S204 is the same as or similar to the processing content of steps S100 to S104 described above, description thereof is omitted here. Subsequently, when it is determined in step S204 that the IP address of the terminal device 2 is included in the IP address information to be registered, the process proceeds to step S206. On the other hand, if it is determined that the IP address of the terminal device 2 is not included in the IP address information to be registered, the process ends after the IP address information is registered in the filtering list in step S208.

  In step S206, a determination is made as to whether or not the session between the terminal device 2 and the communication control device 30 has ended. Here, when the session is ended, in step S208, the IP address information is registered in the filtering list, and then the process ends. On the other hand, when the session has not ended, registration of IP address information is suspended until the session ends. If the IP address information is corrected by the terminal device 2 before the session is terminated, the process is executed again from step S200 described above. When the registration is canceled, the process is exited.

  According to this control mode, the registration of the IP address information is suspended until the session is terminated, so that the access from the terminal device 2 is not denied until the session is terminated. For this reason, the network administrator can make corrections such as deleting the IP address of the terminal device 2 from the IP address information during the session. As a result, when registering IP address information that denies access from the terminal device 2 connected via the LAN 5, it is possible to appropriately prevent erroneous registration of the IP address information.

(Third control mode)
In the second control mode described above, when the IP address of the terminal device 2 is included in the IP address information to be registered, the registration is suspended until the session ends. The registration of the IP address information may be suspended, and the IP address information may be registered in the filtering list after a predetermined time has elapsed. Here, the third IP address information registration process (third control mode) by the communication control device 30 will be described with reference to FIG. FIG. 6 is a flowchart showing the procedure of the third IP address information registration process.

  Since the processing content of steps S300 to S304 is the same as or similar to the processing content of steps S200 to S204 described above, description thereof is omitted here. Subsequently, when it is determined in step S304 that the IP address of the terminal device 2 is included in the IP address information to be registered, the process proceeds to step S306. On the other hand, when it is determined that the IP address information of the terminal device 2 is not included in the IP address information to be registered, the processing ends after the IP address information is registered in the filtering list in step S310.

  In step S306, a timer for measuring the elapsed time since it is determined that the IP address information of the terminal device 2 is included in the IP address information to be registered is started. Subsequently, in step S308, a determination is made as to whether a predetermined time (for example, 10 minutes) has elapsed based on the value of the timer. If the predetermined time has elapsed, the process ends after the IP address information is registered in the filtering list in step S310. On the other hand, when the predetermined time has not yet elapsed, registration of the IP address information is suspended until the predetermined time has elapsed. If the IP address information is corrected by the terminal device 2 until the predetermined time elapses, the process is executed again from step S300 described above. When the registration is canceled, the process is exited.

  According to this control mode, since registration of IP address information is suspended until a predetermined time elapses, access from the terminal device 2 is not denied until the predetermined time elapses. Therefore, the network administrator can make corrections such as deleting the IP address of the terminal device 2 from the IP address information until a predetermined time elapses. As a result, when registering IP address information that denies access from the terminal device 2 connected via the LAN 5, it is possible to appropriately prevent erroneous registration of the IP address information.

  Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments, and various modifications can be made. For example, in the above embodiment, the present invention is installed in a network multifunction peripheral, but the configuration and function sharing of the network multifunction peripheral are not limited to the above embodiment. Further, the application target of the present invention is not limited to a network multifunction peripheral, and can be incorporated into a network device such as a router.

  In the above embodiment, an IP address is used as an identifier for specifying the terminal device 2, but a MAC address or the like may be used instead of the IP address.

  In addition, the first control mode and the second control mode described above may be combined to transmit a message and hold registration until the session ends. Further, the first control mode and the third control mode may be combined to transmit a message, and the registration may be suspended until a predetermined time elapses. Note that the phrase “pending registration” includes not being used as determination information for address filtering even if it is registered.

It is a figure which shows the structural example of the communication system containing the network multifunction device by which the communication control apparatus which concerns on embodiment is mounted. 1 is a block diagram illustrating a configuration of a network multifunction peripheral equipped with a communication control apparatus according to an embodiment. It is a flowchart which shows the process sequence of the 1st IP address information registration process by the communication control apparatus which concerns on embodiment. It is a figure which shows the example of a display of the registration confirmation screen of a terminal device. It is a flowchart which shows the process sequence of the 2nd IP address information registration process by the communication control apparatus which concerns on embodiment. It is a flowchart which shows the process sequence of the 3rd IP address information registration process by the communication control apparatus which concerns on embodiment.

Explanation of symbols

1 Network multifunction device 2, 3, 4 Terminal device 5 LAN
6 Router 7 Internet 8 PSTN
DESCRIPTION OF SYMBOLS 10 Control part 11 Reading part 12 Recording part 13 Display part 14 Operation part 15 ROM
16 RAM
17 Image storage unit 18 Codec 19 Modem 20 NCU
21 IFAX control unit 22 Web server 30 communication control device 31 determination unit 32 registration unit 33 communication unit

Claims (8)

A communication control device that denies access via a network based on registered identifier information,
Whether or not an identifier for identifying the terminal device is included in the identifier information to be registered when there is a registration request for identifier information for refusing access from a terminal device connected via the network Determining means for determining
If it is determined by the determination means that the identifier for identifying the terminal device is included in the identifier information to be registered, registration of the identifier information is suspended until a predetermined process is completed. A communication control device. Transmitting means for transmitting a message to call attention to the terminal device when the determining means determines that the identifier specifying the terminal device is included in the identifier information to be registered; In addition,
The communication control apparatus according to claim 1, wherein the registration unit suspends registration of the identifier information until a response to the message transmitted from the transmission unit is received.   The communication control apparatus according to claim 1, wherein the registration unit suspends registration of the identifier information until a session with the terminal device that requests registration of the identifier information is completed.   The registration unit holds the registration of the identifier information until a predetermined time has elapsed after the determination unit determines that the identifier specifying the terminal device is included in the identifier information to be registered. The communication control device according to claim 1, wherein: A communication control method for denying access via a network based on registered identifier information,
Whether or not an identifier for identifying the terminal device is included in the identifier information to be registered when there is a registration request for identifier information for refusing access from a terminal device connected via the network A determination step for determining
In the determination step, when it is determined that the identifier for identifying the terminal device is included in the identifier information to be registered, registration of the identifier information is suspended until a predetermined process is completed. And a registration step. In the determination step, when it is determined that the identifier for specifying the terminal device is included in the identifier information to be registered, a transmission step for transmitting a message for calling attention to the terminal device. In addition,
6. The communication control method according to claim 5, wherein in the registration step, registration of the identifier information is suspended until a response to the message transmitted from the transmission unit is received.   6. The communication control method according to claim 5, wherein in the registration step, registration of the identifier information is suspended until a session with the terminal device that requests registration of the identifier information is completed.   In the registration step, registration of the identifier information is suspended until a predetermined time elapses after it is determined in the determination step that the identifier specifying the terminal device is included in the identifier information to be registered. The communication control method according to claim 5, wherein:

Images