JP2014170422A - Information processing device, control method therefor, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information processing device which can output an appropriate log according to a state of the device.SOLUTION: An information processing device is configured to: perform authentication processing with an external device according to predetermined procedures; save authentication information about authentication performed in the authentication processing as a log file in a specified storage destination, according to a log mode set among log modes including a first log mode outputting a log and a second log mode outputting a more detailed log than the first log mode; when there is no reply to an authentication processing start request from the external device in the authentication processing or when the authentication processing is successful, set the device in the first log mode; and when the authentication processing has failed, set the device in the second log mode.

Description

  The present invention relates to a device authentication function, and particularly to a technique for preventing a user from using the device in an easy-to-understand manner when necessary in setting a device equipped with an IEEE 802.1X function.

  Conventionally, as a method for detecting an error of a device, there is a method of dividing detailed error detection and simple error detection according to data handled by the device.

  Patent Document 1 discloses a method of changing a method of detecting an error in detail or simply according to the content of a printed matter in a printing apparatus. For example, if the printed matter is facsimile data, detailed error detection is performed in advance on the toner status so that the facsimile data is not erased from the memory even though printing has failed due to a problem. If there is a problem, the facsimile data is stored in the memory and notified to the user. In the case of printing from a PC (personal computer), printing can be performed again. Therefore, simple error detection is performed on the toner state and the like to shorten the time required for printing. In this way, detailed error detection and simple error detection are selectively used depending on the data to be printed.

JP 2009-065614 A

  However, in the prior art disclosed in Patent Document 1, when an error is detected, a predetermined error is notified regardless of whether a detailed error is detected or a simple error is detected. In the case of an authentication technique such as IEEE802.1X, there are cases where more detailed information is required or unnecessary depending on the state of port authentication or the state of authentication processing. In addition, depending on the authentication status, it is desirable to notify the user if there is a problem with security when connection to the network is possible even if authentication is not possible.

  The present invention has been made to solve the above-described problems, and an object thereof is to provide an information processing technique capable of performing appropriate log output according to the state of the apparatus.

In order to achieve the above object, an information processing apparatus according to the present invention comprises the following arrangement. That is,
An information processing apparatus for managing logs,
Authentication processing means for performing authentication processing with an external device according to a predetermined procedure;
Among the log modes including at least a first log mode for outputting a log and a second log mode for outputting a log more detailed than the first log mode, the authentication processing is performed according to the set log mode. Log file control means for saving the authentication information, which is information, as a log file in a specified storage location;
If there is no response to the authentication process start request in the authentication process from the external device, or if the authentication process is successful, set to the first log mode, and if the authentication process fails, Log mode control means for setting the log mode to No. 2.

  According to the present invention, appropriate log output can be performed according to the state of the apparatus.

It is a block diagram which shows the structure of a system. It is a flowchart which shows the detail of the setting of log mode. It is a flowchart which shows the detail of a video notification and an external notification. It is a figure which shows an example of the video notification by the image | video which carried out the superimposition process. It is a flowchart which shows the detail of the setting of a log storage destination.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a block diagram of a system including a network camera according to an embodiment of the present invention and a switch as an external device.

  The network camera 100 is an information processing device that also functions as an authentication device and a log management device. In the network camera 100, the imaging unit 101 includes a lens and a sensor, and outputs a video generated by imaging a subject as a video signal. The superimposing unit 102 receives control from the video control unit 103, and uses a predetermined information signal such as the installation location of the network camera 100 and the current time as an OSD (On Screen Display) function as required by the user setting. It is superimposed on the video signal acquired in 101.

  The transmitting unit 104 encodes the video signal that has passed through the superimposing unit 102, divides it into IP packets, and transmits the IP packet to the network. The authentication processing unit 105 is a supplicant that performs an authentication process according to a predetermined procedure (for example, IEEE 802.1X EAP (Extended Authentication Protocol). Identity and certificates necessary for EAP are set in advance by the user via an input device. The authentication processing unit 105 can refer to it.

  The authentication processing unit 105 attempts to start EAP authentication processing by transmitting an authentication processing start request to the switch 106. The authentication processing unit 105 can acquire and control the state (information (authentication information) related to authentication) of the authentication processing unit 105 by socket communication.

  The states that can be acquired include, as port states, network ports that have been authenticated (Authorized) / unauthenticated (Unauthorized) by IEEE 802.1X. In addition, the authentication processing unit 105 determines whether the EAP authentication process has been successful (SUCCESS) / failure (FAILURE) as a status of the progress of the EAP authentication process, the authentication process start request is not returned from the switch 106, and the authentication process proceeds. The state of no idle (IDLE) can be acquired.

  Further, as a controllable function, the authentication processing unit 105 can change the output content of the log by setting an arbitrary log mode from a plurality of types of log modes. As the log mode, in addition to the normal log mode (first log mode) that outputs the start and end of authentication, success and failure as a log, and the log of normal log mode, the log of the progress of authentication processing by EAP is detailed There is a detailed log mode (second log mode) to be output. And the authentication process part 105 performs control which switches a normal log mode and a detailed log mode.

  If the log mode is not specified, the normal log mode is set. Further, the authentication processing unit 105 can set the storage destination of the log file to an arbitrary location in the file system. If there is no setting, the authentication processing unit 105 logs to a location (RAM 109) mounted as a RAM file system in the file system. Save.

  In addition to the normal log mode and the detailed log mode, a log mode for outputting only a specific log may be set separately according to a specific purpose and application. Further, the normal log mode may be set when the detailed log mode has passed for a specific time. In the detailed log mode, when the authentication process by the authentication processing unit 105 fails a specific number of times, the normal log mode may be set.

  The log mode control unit 107 changes the log mode setting of the authentication processing unit 105 while monitoring the state of the authentication processing unit 105.

  While monitoring the status of the authentication processing unit 105, the log file control unit 108 stores the storage location of a log file including a log indicating authentication information in the authentication processing unit 105 as a RAM 109 as a volatile memory or a nonvolatile memory. Set to SD card 110. The SD card 110 can be arbitrarily inserted into a slot (not shown) of the network camera 100 as required by the user, is mounted at a location where it can be referred to from the file system, and can record video in addition to log recording. is there.

  The external notification control unit 111 performs processing for notifying the outside of the network camera 100 of information as necessary while monitoring the state of the authentication processing unit 105. The notification unit for external notification includes a light emitting unit 112, a voice output unit 113, an email processing unit 114, and an event processing unit 115. The external notification control unit 111 controls the operation of these notification units.

  The light emitting unit 112 is attached to the housing of the network camera 100 and is configured by an LED or the like, and performs operations such as lighting / extinguishing / flashing under the control of the external notification control unit 111. The audio output unit 113 is attached to the housing of the network camera 100 and outputs a predetermined sound (buzzer) under the control of the external notification control unit 111. The email processing unit 114 transmits a message to an email address set in advance by the user under the control of the external notification control unit 111. The event processing unit 115 transmits an event generated in the network camera 100 according to a preset protocol under the control of the external notification control unit 111.

  FIG. 2 is a flowchart showing operations of the authentication processing unit 105 and the log mode control unit 107. The log mode control unit 107 starts processing together with the authentication processing unit 105 when the network camera 100 is activated.

  The log mode control unit 107 acquires a port state and an EAP state from the authentication processing unit 105 as authentication information using socket communication (step S21). Next, the log mode control unit 107 refers to the state of the port (step S22). As a result of the reference, when the port state is Authorized (authenticated), the log mode control unit 107 sets the log mode of the authentication processing unit 105 to the normal log mode (step S24). The normal log mode outputs minimum logs such as authentication start and end, authentication success and failure, etc., so IEEE 802.1X settings are correct during normal operation, and minimum in the case of successful authentication Only limited logs are recorded.

  On the other hand, when the port status is Unauthorized (unauthenticated), the log mode control unit 107 refers to the EAP status (EAP authentication processing status) (step S23). When the EAP state is idle (IDLE), the log mode control unit 107 sets the log mode of the authentication processing unit 105 to the normal log mode (step S24). This is because EAP authentication processing has not progressed, and useful information cannot be obtained even if a detailed log is output.

  On the other hand, if the EAP state is failure (FAILURE), the log mode control unit 107 sets the detailed log mode (step S25). This is because, in the EAP authentication process, there is a problem in the settings of the identity and electronic certificate set by the user, the switch 106, and the Radius server (not shown). Setting to the detailed log mode makes it easier for the user to understand where the EAP authentication process has a problem.

  As described above, the first authentication process after the authentication process unit 105 starts the authentication process is executed in the normal log mode. On the other hand, the second authentication process after FAILURE in the EAP state (step S23) and setting to the detailed log mode (step S25) is executed in the detailed log mode.

  FIG. 3 is a flowchart showing operations performed by the video control unit 103 and the external notification control unit 111 in accordance with the result of acquiring the state of the authentication processing unit 105.

  As in the description of FIG. 2, the log mode control unit 107 acquires authentication information (step S21), and refers to the port state (step S22) and the EAP state (step S23). When the port state (step S22) is Unauthorized (unauthenticated) and the EAP state (step S23) is the IDLE state, the video control unit 103 refers to the video notification setting (step S31).

  This state is a state in which there is no response to the authentication processing start request transmitted to the switch 106 in the authentication processing by EAP in the authentication processing unit 105. In other words, although IEEE 802.1X is set in the network camera 100, the port setting is not correctly performed by the switch 106, and communication is possible although the port authentication is in the Unauthorized state. In this state, if another device is connected to the same port, another device that is not authenticated through the switch 106 can participate in the network, which causes a security problem. For this reason, the network camera 100 has been set for IEEE 802.1X, but it is desirable to notify that the setting including the switch 106 is inadequate. However, there is a possibility that another device connected to the switch 106 may erroneously determine that the setting has been made correctly when communication with the network camera 100 is successful, or until the authentication state of the switch 106 or the authentication processing unit 105. There is a risk of not confirming.

  Therefore, when the video notification setting is OSD, the video control unit 103 notifies that the port is unauthenticated using the OSD (step S32). That is, the video control unit 103 controls the superimposing unit 102 to superimpose information indicating that the authentication process has failed on the video signal. This notifies the user that there is a problem with the IEEE 802.1X setting using the video that is expected to be confirmed at the minimum by the network camera 100.

  If the video notification setting is transmission stop, the video control unit 103 stops video transmission by the transmission unit 104 (step S33). This prevents operation using the network camera 100 in a state where there is a problem with security.

  If the video notification setting is invalid, the video control unit 103 may not have a video notification, although there may be a security problem.

  Next, the external notification control unit 111 refers to the external notification setting (step S34). This is to perform processing for notifying that the IEEE 802.1X setting is not correctly performed by a method other than video.

  If the external notification setting is valid, the external notification control unit 111 controls the light emitting unit 112 to blink or controls the audio output unit 113 to sound a buzzer according to the user setting (step S35). Alternatively, the external notification control unit 111 can communicate although the port is unauthenticated, so the e-mail processing unit 114 is controlled to send an e-mail to a preset e-mail address of the user or the event processing unit 115 It is also possible to send an event under control.

  On the other hand, when the external notification setting is invalid, the external notification control unit 111 ends the process as it is.

  In FIG. 2, when the EAP state is IDLE, the authentication process has not progressed and a useful log cannot be obtained. Therefore, the log mode of the authentication processing unit 105 is set to the normal log mode instead of the detailed log mode. (Step S24). Even in this case, in addition to the log in the normal log mode, there may be a problem in the setting of the switch 106, and the port status is Unauthorized, and it may be left in the log that there is a problem in security. .

  FIG. 4 is a diagram illustrating an example of a method of notifying the Unauthorized state by OSD in step S32 of FIG. A video signal 41 indicates the video signal after being superimposed by the superimposing unit 102. Normally, OSD information 42 indicating the installation location and time of the network camera 100 is superimposed on the video signal 41. However, when the port is in an unauthenticated state but communication is possible or there is a problem with security, a message 43 for notifying the user of that fact is superimposed on the video signal 41.

  If an electronic certificate is required for authentication processing by EAP in the authentication processing unit 105, authentication may fail and connection to the switch 106 may not be possible if the electronic certificate expires. Therefore, when the expiration date of the electronic certificate approaches (for example, when the expiration date is within a predetermined period), the superimposing unit 102 may superimpose a message indicating that on the video signal 41. Even when the expiration date has passed, a message indicating that (the expiration date has expired) may be superimposed on the video signal 41 if communication is possible.

  FIG. 5 considers the case where the user has inserted the SD card 110 into the network camera 100, and in addition to the log mode setting process of FIG. 2, the log file control unit 108 has added a process of determining a log file storage destination. It is a flowchart.

  First, the log mode control unit 107 acquires authentication information (step S21). The log mode control unit 107 determines the port state according to the acquired authentication information (step S22). If the port status is Authorized, the log file control unit 108 sets the log output destination in the RAM 109 (step S54). Then, the log mode control unit 107 sets the log mode of the authentication processing unit 105 to the normal log mode (step S24).

  On the other hand, when the port state is Unauthorized, the log mode control unit 107 refers to the EAP state (step S23). If the EAP state is IDLE, the process proceeds to step S54.

  On the other hand, if the EAP state is failure (FAILURE), the log file control unit 108 determines whether or not the SD card 110 has been mounted (step S51). If it is already mounted (YES in step S51), the log file control unit 108 sets the log output destination to the SD card 110 (step S53). On the other hand, if the SD card 110 has not been mounted (NO in step S51), the log file control unit 108 sets the log output destination in the RAM 109 (step S52). Thereafter, the log mode control unit 107 sets the detailed log mode (step S25).

  Since the network camera 100 generally has no output device such as a display and is connected via a network, the log cannot be confirmed even if the IEEE 802.1X authentication fails. Therefore, if the EAP state is FAILURE in step S23 and the SD card 110 is already mounted (YES in step S51), the log file control unit 108 saves the log in the SD card 110 that is a nonvolatile memory. By doing so, the user can check the cause of the EAP authentication failure by taking out the SD card 110 from the network camera 100 and referring to the log stored in the SD card 110.

  If the SD card 110 has not been mounted (NO in step S51) and the log output destination is the RAM 109 (step S52), the port of the switch 106 is changed to invalidate the IEEE 802.1X setting. Then, the log on the RAM 109 can be confirmed via the network. In this way, the cause of the failure of the EAP authentication can be confirmed in the detailed log regardless of the presence or absence of the SD card 110.

  When the port state (Step S22) is Authorized, the log output destination is set in the RAM 109 (Step S54), and the log is recorded in the normal log mode (Step S52). In other words, the log during normal operation using the network camera 100 after the IEEE802.1X setting is correctly performed is minimal, and the RAM 109, which is a volatile memory, generally has a lifetime that depends on the number of writes. The SD card 110, which is a volatile memory, is not used as a log output destination.

  Further, when the EAP state (step S23) is IDLE, communication is possible, and the log can be confirmed through the network without being written to the SD card 110. Therefore, the log output destination is the RAM 109 (step S23). S54).

  If you want to record the trouble of the network camera 100, the log mode is either normal log mode or detailed if the SD card 110 is already mounted, even if the log output destination is not divided according to the port status and EAP status. A log may be output to the SD card 110 regardless of the log mode.

  As described above, according to the present embodiment, it is possible to switch between outputting a log useful for the user in detail or outputting a simple log according to the port status, the authentication status, and the type of error.

  More specifically, when using IEEE802.1X, refer to the port status and EAP status, and change the log mode setting to output a minimum log during normal operation. If there is, output a detailed log. Thereby, it is possible to provide a network camera in which the cause of the problem is easily understood for the user. Even if IEEE 802.1X is set in the network camera by carelessness of the user, even if communication can be performed in an unauthenticated state, the OSD or video transmission is stopped to stop the authentication. By informing the user, security can be improved.

  The present invention can also be realized by executing the following processing. That is, software (program) that realizes the functions of the above-described embodiments is supplied to a system or apparatus via a network or various storage media, and a computer (or CPU, MPU, or the like) of the system or apparatus reads the program. It is a process to be executed.

Claims (13)

An information processing apparatus for managing logs,
Authentication processing means for performing authentication processing with an external device according to a predetermined procedure;
Among the log modes including at least a first log mode for outputting a log and a second log mode for outputting a log more detailed than the first log mode, the authentication processing is performed according to the set log mode. Log file control means for saving the authentication information, which is information, as a log file in a specified storage location;
If there is no response to the authentication process start request in the authentication process from the external device, or if the authentication process is successful, set to the first log mode, and if the authentication process fails, An information processing apparatus comprising: log mode control means for setting the log mode to two. A nonvolatile memory is provided as the storage destination,
The information processing apparatus according to claim 1, wherein the log file control unit stores the log file in the nonvolatile memory when the second log mode is set as a log mode. The information processing apparatus according to claim 1, wherein the log mode control unit sets the first log mode when the second log mode elapses for a specific time. The log mode control means sets the first log mode when the authentication process by the authentication processing means has failed a specific number of times in the state of the second log mode. The information processing apparatus described. The information processing apparatus according to claim 1, further comprising a notification control unit that controls an operation of a notification unit that notifies information to the outside according to a state of the authentication processing unit. The notification unit is a light emitting unit,
The information processing apparatus according to claim 5, wherein the notification control unit turns on, turns off, or blinks the light-emitting unit when there is no response to the authentication process start request in the authentication process from the external apparatus. . The notification unit is an audio output unit,
The information processing apparatus according to claim 5, wherein the notification control unit outputs a sound from the sound output unit when there is no response of an authentication process start request in the authentication process from the external apparatus. The notification unit is a mail processing unit,
6. The information processing according to claim 5, wherein, when there is no response to the authentication processing start request in the authentication processing from the external device, the notification control means transmits a mail indicating that fact from the mail processing unit. apparatus. The notification unit is an event processing unit,
6. The information processing according to claim 5, wherein the notification control means transmits an event indicating the fact from the event processing section when there is no reply of the authentication processing start request in the authentication processing from the external device. apparatus. Imaging means for imaging a subject and generating a video signal;
Superimposing means for superimposing a predetermined information signal on the video signal;
Transmitting means for transmitting the video signal on which the predetermined information signal is superimposed by the superimposing means via a network;
When there is no response to the authentication process start request in the authentication process from the external device, the video signal is transmitted with information indicating that the operation of the transmission means is stopped or the authentication process has failed according to the video notification setting. The information processing apparatus according to claim 1, further comprising: a video control unit that controls the superimposing unit to superimpose. In the case where an electronic certificate is required for the authentication process, when the expiration date of the electronic certificate is within a predetermined period or when the expiration date has passed, the superimposing means sends an information signal indicating the fact The information processing apparatus according to claim 10, wherein the information processing apparatus is superimposed on a video signal. A method of controlling an information processing apparatus that manages logs,
An authentication processing step for performing authentication processing with an external device according to a predetermined procedure;
Among the log modes including at least a first log mode for outputting a log and a second log mode for outputting a log more detailed than the first log mode, the authentication processing is performed according to the set log mode. Log file control process to save the authentication information that is information as a log file in the specified save destination;
If there is no response to the authentication process start request in the authentication process from the external device, or if the authentication process is successful, set to the first log mode, and if the authentication process fails, And a log mode control step for setting the log mode to the log mode. A program for causing a computer to control the information processing apparatus that manages logs,
The computer,
Authentication processing means for performing authentication processing with an external device according to a predetermined procedure;
Among the log modes including at least a first log mode for outputting a log and a second log mode for outputting a log more detailed than the first log mode, the authentication processing is performed according to the set log mode. Log file control means for saving the authentication information, which is information, as a log file in a specified storage location;
If there is no response to the authentication process start request in the authentication process from the external device, or if the authentication process is successful, set to the first log mode, and if the authentication process fails, A program which functions as a log mode control means for setting the log mode of No. 2.

Images