JP2015153399A - Information processing device, information processing method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To apply an appropriate security policy according to a configuration of a network apparatus.SOLUTION: The information processing device includes: acquisition means for acquiring configuration information on a device capable of communicating through a network; determination means for determining whether security setting to the device needs to be changed on the basis of the configuration information acquired by the acquisition means; decision means for, when it is determined that security setting to the device needs to be changed by the determination means, deciding security setting capable of being applied to the device on the basis of the configuration information; and distribution means for distributing security setting information related to the security setting decided by the decision means to the device.

Description

  The present invention relates to an information processing apparatus, an information processing method, and a program.

  2. Description of the Related Art Conventionally, there is a technique for acquiring setting information of a network device and determining that it is necessary to take action when there is a difference between the setting of the network device management apparatus and the setting indicated by the acquired setting information of the network device.

JP 2004-363923 A

Patent Document 1 discloses a technique in which a network device management apparatus determines whether it is necessary to deal with a difference between a setting of a network device and its own setting.
An object of this invention is to apply an appropriate security policy according to the structure of a network apparatus.

  Therefore, the information processing apparatus according to the present invention requires an acquisition unit that acquires configuration information of a device that can communicate via a network, and a security setting change for the device based on the configuration information acquired by the acquisition unit. Determining means for determining whether or not the determining means determines that a security setting for the device needs to be changed, and determining means for determining a security setting applicable to the device based on the configuration information; Distribution means for delivering security setting information related to the security setting determined by the determination means to the device.

  According to the present invention, an appropriate security policy can be applied according to the configuration of a network device.

It is a figure which shows an example of a system configuration and a hardware configuration. It is a figure which shows an example of a software structure. It is a figure which shows an example of a management table (the 1). It is a figure which shows an example of a management table (the 2). It is a figure (example 1) which shows an example of a setting screen. It is FIG. (2) which shows an example of a setting screen. It is a flowchart (the 1) which shows an example of a process of a server. It is a flowchart (the 2) which shows an example of a process of a server. It is a flowchart (the 3) which shows an example of a process of a server. It is a figure which shows an example of the screen which displays a setting condition.

The best mode for carrying out the present invention will be described below with reference to the drawings.
<Embodiment 1>
FIG. 1 is a diagram illustrating an example of a system configuration and a hardware configuration of a network device management system including a network device management apparatus according to the present embodiment.
In the present embodiment, an application server apparatus (hereinafter referred to as an application server) 100 is described as an example of a network apparatus management apparatus, and an MFP (an image forming apparatus such as a multifunction peripheral) 150 is illustrated as an example of a network apparatus. MFP is an abbreviation for Multifunction Peripheral. The network device may be another device such as a printer or a FAX. The network device management system includes an application server 100, a client computer 120, and an MFP 150 that are communicably connected to each other via a network 170. The application server 100, the client computer 120, and the MFP 150 are examples of information processing apparatuses. The application server 100 and the client computer 120 have a general-purpose computer configuration. The hardware configuration of the client computer 120 is the same as the hardware configuration of the application server 100. In addition, the application server 100 and the client computer 120 are different devices, but may be configured as the same information processing device.
Hereinafter, the hardware configuration of the application server 100 will be described.
The CPU 101 executes the application program stored in the ROM 103 or the external memory 110, thereby realizing the software configuration of the application server 100 and the processing of the flowchart described below. The CPU 101 generally controls each device connected to the system bus 111. The CPU 101 opens various windows registered based on commands instructed by a mouse cursor or the like on the display 109, and executes various data processing.

The RAM 102 functions as a main memory, work area, and the like for the CPU 101. The ROM 103 is a read-only memory that functions as a storage area for basic I / O programs and the like. The ROM 103 or the external memory 110 stores an operating system program (hereinafter referred to as an OS program) that is a control program for the CPU 101. Further, the ROM 103 or the external memory 110 stores files and other various data used by the CPU 101 in processing based on the application program and the like.
The network I / F 104 connects to the network 170 and performs network communication. A keyboard I / F 105 controls input from the keyboard 108 and a pointing device. The display I / F 106 controls display on the display 109. The external memory I / F 107 controls access to the external memory 110 such as a hard disk (HD). The external memory 110 stores a boot program, various application programs, user files, edit files, and the like.
The application server 100 operates in a state where the CPU 101 is executing a basic I / O program and an OS program written in the ROM 103 or the external memory 110. The basic I / O program is written in the ROM 103, and the OS program is written in the ROM 103 or the external memory 110. When the power of the application server 100 is turned on, the OS program is written from the ROM 103 or the external memory 110 to the RAM 102 by the initial program load function in the basic I / O program, and the operation of the OS is started. The system bus 111 connects the above-described devices.

Hereinafter, the hardware configuration of the MFP 150 will be described.
The network I / F 151 connects to the network 170 and performs network communication.
The CPU 152 implements the software configuration of the MFP 150 by executing a control program, application program, and the like stored in the ROM 154 or the external memory 162. The CPU 152 outputs an image signal as output information to the printer 158 via the printer I / F 157 connected to the system bus 163. Further, the CPU 152 can perform communication processing with other computers via the network I / F 151 and can notify the application server 100 of information in the MFP 150.
The RAM 153 functions as a main memory, work area, and the like of the CPU 152, and is configured such that the memory capacity can be expanded by an optional RAM connected to the expansion port. The RAM 153 is used as an output information expansion area, environment data storage area, NVRAM, and the like. A ROM 154 or an external memory 162 such as a hard disk (HD) stores a control program of the CPU 152, an application program, font data used when the CPU 152 generates the output information, and various information used on the MFP 150. . The ROM 154 or the external memory 162 temporarily stores an application program when an application is installed in the MFP 150.

The operation unit I / F 155 controls an interface with the operation unit 156 and outputs image data to be displayed to the operation unit 156. The operation unit I / F 155 also receives information input by the user via the operation unit 156. The operation unit 156 is an operation panel or the like on which switches for operation and LED indicators are arranged. The printer I / F 157 outputs an image signal as output information to the printer 158 (printer engine). The scanner I / F 159 receives an image signal as input information from the scanner 160 (scanner engine). An external memory I / F (memory controller) 161 controls access to an external memory 162 such as a hard disk (HD) or an IC card. As long as at least one external memory 162 is provided, a plurality of external memories 162 may be provided. In addition to the built-in font, an optional font card and an external memory storing a program for interpreting a printer control language of a different language system May be configured to be connected to each other. Furthermore, the external memory 162 may have NVRAM and store printer mode setting information from the operation unit 156. A system bus 163 connects the above-described devices.
The hardware configuration of the client computer 120 is the same as the hardware configuration of the application server 100 as described above. That is, the CPU of the client computer 120 executes a program stored in the ROM or the external memory of the client computer 120, thereby realizing the software configuration of the client computer 120. Description of other hardware configurations is omitted.

FIG. 2 is a diagram illustrating an example of a software configuration of each device included in the network device management system according to the present embodiment.
Hereinafter, the software configuration of the application server 100 will be described.
Each software program of the application server 100 is stored as a file in the external memory 110 or the like, and is loaded into the RAM 102 and executed by the CPU 101. The program of the network device management application 202 can be added to the CD-ROM of the external memory 110 or the HD of the external memory 110 via the network 170.
The network module 200 performs network communication with the client computer 120 and the MFP 150 using an arbitrary communication protocol.
The Web server service 201 provides a service that responds to an HTTP response when receiving an HTTP request from the Web browser 221 of the client computer 120. Here, the Web server service 201 may return the Web page data stored in the external memory 110 as an HTTP response. Further, the Web server service 201 may request the UI module 203 of the network device management application 202 to generate an HTTP response.
The network device management application 202 is an application that manages the MFP 150 connected to the application server 100 via the network 170. The network device management application 202 executes processing in response to a request for a Web page provided by the Web server service 201, for example. As described above, the network device management application 202 functions as a Web application that manages the MFP 150 together with the Web server service 201.

The UI module 203 generates an HTTP response in response to a request from the Web server service 201. Also, the UI module 203 receives user input information transmitted from the Web browser 221 of the client computer 120 and calls each function as necessary. Examples of functions that the UI module 203 calls include a search unit 204, a monitoring unit 205, a network device information management unit 206, an SP management unit 207, and an SP setting information check comparison unit 208. However, the UI module 203 may call functions other than these.
Search unit 204 searches MFP 150 connected to application server 100 via network 170 using an arbitrary communication protocol. Examples of communication protocols used by the search unit 204 for searching include SNMP (Simple Network Management Protocol) and SLP (Service Location Protocol). The search unit 204 may use other communication protocols such as WS-Discovery (Web Services Dynamic Discovery). When searching for the MFP 150, the search unit 204 acquires device information from the MFP 150 and records it in a table 301 of the database server service 209 described later. The device information here includes connection information and the like for the application server 100 to access the MFP 150.
The monitoring unit 205 monitors the MFP 150 at an arbitrary monitoring interval. The monitoring unit 205 acquires information necessary for monitoring related to the monitoring interval and the monitoring target from tables 302 to 307 of the database server service 209 described later. The monitoring unit 205 acquires information about the MFP 150 using an arbitrary communication protocol according to the acquired information necessary for monitoring, and monitors the MFP 150. Examples of communication protocols used by the monitoring unit 205 for monitoring include Web services, SNMP, and SLP. Note that the monitoring unit 205 may use another communication protocol or a unique protocol. Examples of information acquired by the monitoring unit 205 for monitoring the MFP 150 include status information such as errors, setting information, and the like. Further, the monitoring unit 205 may acquire information on a security policy (hereinafter referred to as SP), or may monitor that the SP setting has been changed.

A network device information management unit 206 manages administrator information and the like necessary for monitoring the MFP 150. A network device information management unit 206 connects to the MFP 150 using a table 301 of a database server service 209 (to be described later), and manages the location of the MFP 150, an administrator, and the like using the table 302.
The SP management unit 207 acquires SP setting information from the MFP 150. The SP management unit 207 also distributes SP setting information to the MFP 150. The SP management unit 207 can distribute common SP setting information when there are a plurality of MFPs to be managed, and can distribute SP setting information acquired from any MFP to other MFPs. Furthermore, the SP management unit 207 can also give a setting permission / prohibition condition to SP item editing and individual SP settings. Here, the SP setting information is security setting information indicating setting items related to the security of the MFP 150. Examples of the setting items include guest account prohibition setting, password cache prohibition setting, initial password change forced setting, and the like. It may be an item.
The SP setting information check comparison unit 208 checks and compares SP setting information distributed to the MFP 150 and SP setting information acquired from the MFP 150. Then, the SP setting information check comparison unit 208 records the check / comparison processing results in tables 303 to 305 of the database server service 209 described later.
The database server service 209 may be on a different device from the application server 100 as long as it can be accessed from the network device management application 202.

An example of a table configuration in the database server service 209 is shown in FIGS. 3A and 3B. Note that the table configurations in FIGS. 3A and 3B are merely examples, and may be different from this example.
First, each table in FIG. 3A will be described.
A table 301 illustrated in (a) of FIG. 3A is a network device management table, and is a table for managing device information related to the MFP 150 managed by the network device management application 202. The device information managed in the table 301 is, for example, a device identifier, a product name, an IP address, a serial number, an SP identifier, a last update date and time, etc. for linking with other tables. The device identifier is an identifier that uniquely identifies the MFP 150, and the SP identifier is an identifier that identifies the SP set in the MFP 150.
A table 302 illustrated in (b) of FIG. 3A is a network device administrator information table, and is a table for managing administrator information and the like of each MFP 150. Information managed in the table 302 includes, for example, a device identifier, a customer name, a customer ID, an administrator, an administrator e-mail address, and the last update date / time. The device identifier is an identifier that uniquely identifies which MFP 150 in the table 301 described above.
A table 303 illustrated in (c) of FIG. 3A is an installed application management table, and is a table for managing applications installed in the MFP 150. The information managed in the table 303 includes, for example, a device identifier, an operation application identifier, an operation application 1 that manages the presence / absence of an application that is operating on the device, an operation application 2,. In this example, each application is managed by assigning a number in advance, but may be managed by an application name. Further, each function is numbered, and it is defined that TRUE is implemented, and that FALSE is not implemented.
A table 304 shown in (d) of FIG. 3A is an application-corresponding function information table, and is a table for managing function information in each application linked to the operating application identifier in the table 303 in units of functions.

Next, each table in FIG. 3B will be described.
A table 305 shown in (a) of FIG. 3B is an SP original / individual setting information table, and is a table for managing each SP setting state set in each device (MFP). Information managed in the table 305 includes an SP identifier, an SP setting item, a setting value, a setting instruction value, a reason for difference, a last update date, and the like. The SP identifier of the table 305 is associated with the SP identifier of the table 301, and the table 305 represents the SP setting state with respect to the original SP setting value of the corresponding network device (MFP). Here, data in which Common is set as the SP identifier represents a common SP setting value for applying a common SP setting to a plurality of MFPs 150. When applying a common SP setting value to a plurality of MFPs 150, the Common information is referred to. The setting value represents a setting requested by the application server 100 to the MFP 150. On the other hand, the setting instruction value indicates whether or not the setting instruction value is set without change. The setting instruction value is set to FALSE when a setting value that is initially scheduled cannot be applied due to circumstances of an installed application, which will be described later, to indicate that the setting that was originally planned has not been applied. If the setting value is TRUE, it indicates that it is mounted, and if it is FALSE, it indicates that it is not mounted. Further, when FALSE is set as the setting instruction value, the SP setting information check comparison unit 208 can record the reason for the difference from the initially set value as the reason for difference.
A table 306 shown in (b) of FIG. 3B is an SP setting item detailed information table, and is a table showing the specific contents of the SP setting items set in the table 305. Information managed in the table 306 includes, for example, SP setting items, SP setting item names, and the like. The SP setting item name represents specific contents of the SP setting.
A table 307 shown in (c) of FIG. 3B is an SP setting difference reason explanation information table, which is composed of a difference reason managed in the table 305 and details of a difference reason corresponding to the difference reason, and is an expected setting. There are no defined reasons.

Returning to the description of FIG. Hereinafter, the software configuration of the client computer 120 will be described.
Each software program of the client computer 120 is stored as a file in an external memory of the client computer 120 or the like. Then, the CPU of the client computer 120 loads the program into the client computer 120RAM and executes it.
The network module 220 performs network communication with the application server 100 and the MFP 150 using an arbitrary communication protocol.
The web browser 221 transmits an HTTP request message to the application server 100 via the network module 220, receives the HTTP response message from the application server 100, and displays it on the display. Access from the client computer 120 to the application server 100 is performed through the Web browser 221.

Next, the software configuration of the MFP 150 will be described.
Each software program of the MFP 150 is stored as a file in the external memory 162 or the like, and is loaded into the RAM 153 and executed by the CPU 152.
The network module 230 performs network communication with the application server 100 and the client computer 120 using an arbitrary communication protocol.
The SP management unit 231 manages the SP settings of the MFP 150. The SP management unit 231 receives the SP setting information distributed from the SP management unit 207 of the network device management application 202 via the network module 230 and reflects the setting contents on the own device. Further, the SP management unit 231 transmits the SP setting information of its own device in response to a request from the SP management unit 207 of the network device management application 202.
The state management unit 232 manages the state of the MFP 150. In response to a request from the monitoring unit 205 of the network device management application 202, the state management unit 232 transmits state information such as the presence or absence of an error or warning of the own device.
The configuration information management unit 233 manages applications that run on the MFP 150. The configuration information management unit 233 can manage not only applications installed from the beginning in the MFP 150 but also applications installed later. In response to a request from the network device management application 202 of the application server 100, the configuration information management unit 233 can transmit the latest information on the application running on the MFP 150.
The UI module 234 draws a UI displayed on the operation unit 156 of the MFP 150 and receives a user input value input by a user UI operation on the operation unit 156.

Next, a setting screen when the user performs SP setting for the MFP 150 will be described with reference to FIGS. 4 and 5. FIG. 4 is a diagram illustrating an example of a setting screen for selecting a target group to be associated with an SP. The application server 100 transmits setting screen information for displaying the above setting screen to the client computer 120. When the client computer 120 receives the setting screen information from the application server 100, the client computer 120 displays the setting screens of FIGS. 4 and 5 based on the setting screen information. Then, the client computer 120 receives an instruction from the user via the setting screen displayed on its own display, and transmits it to the application server 100. However, when the application server 100 and the client computer 120 are configured as the same information processing apparatus, the application server 100 displays the above setting screen on its own display.
On the SP setting screen 401, the user can individually set SP for each MFP 150, or can collectively set SP for a plurality of MFPs 150 with a common SP setting. In the example of FIG. 4, the devices (MFPs) searched by the search unit 204 described above are displayed in one line per unit. When the number of searched MFPs 150 exceeds the upper limit of the display line, the searched MFPs 150 are displayed divided into a plurality of screens. The user can change the page of each divided screen by pressing the return button 405 to the previous page or pressing the button 406 to advance to the next page.
The SP setting screen 401 is provided with an individual setting button 403 for individually setting the SP setting for each device, and the user can individually set the SP setting for each MFP 150. The SP setting screen 401 is also provided with a common setting button 402 for performing SP settings common to a plurality of MFPs 150, and the user can set SP settings common to the plurality of MFPs 150. In order to apply the common SP setting, the user checks the check box 404 to apply the common setting and presses the update button 407. As a result, the application server 100 can apply the SP setting common to the checked MFP 150. The update application range when the user presses the update button 407 may be updated across the divided screens, or only the MFP 150 on the displayed screen may be updated. When the SP setting screen 401 is terminated without changing the setting, the user presses the end button 408 without updating. As a result, the application server 100 ends the SP setting screen 401 without updating.

FIG. 5 is a diagram showing an example of the SP setting screen 501 displayed when the user presses the common setting button 402 or the individual setting button 403 on the SP setting screen 401 in FIG.
Depending on whether the button pressed by the user is the common setting button 402 or the individual setting button 403, (common) or (individual) is displayed in the title. Since both the common setting and the individual setting have the same setting method, an SP setting screen 501 displayed when the user presses the common setting button 402 will be described as an example.
The SP setting screen 501 displays, as SP setting items, for example, a minimum unit item 502 capable of SP setting such as prohibiting a guest account. The application server 100 displays the SP setting item based on the information acquired from the tables 305 and 306 described above. The SP setting screen 501 also has a setting check box 503 for each SP setting item on a one-to-one basis. When the user checks the setting check box 503, the corresponding SP setting item becomes valid, and when the user unchecks, the corresponding SP setting item becomes invalid. When there are many SP setting items, the SP setting items are displayed by being divided into a plurality of screens. The user can change the page of each divided screen by pressing a button 506 for returning to the previous page or a button 507 for proceeding to the next page.
When the update button 504 is pressed by the user, the application server 100 determines to apply the SP setting, and records the set SP setting information in the above-described table 305 by TRUE or FALSE. When ending the SP setting screen 501 without updating, the user presses an end 505 button without updating. As a result, the application server 100 ends the SP setting screen 501 without updating the table 305.

FIG. 6 is a flowchart illustrating an example of the SP setting process executed by the application server 100.
In step S601, the SP management unit 207 acquires connection information of a device (MFP) to be managed from the table 301 of the database server service 209, and acquires SP setting information from the MFP 150 using the acquired connection information (setting information). Acquisition process).
In step S <b> 602, the SP setting information check comparison unit 208 acquires device configuration information from the MFP 150. The device configuration information includes information related to applications installed in the MFP 150 and activated. Further, the information regarding the application includes information regarding whether or not the function of the application is affected by the SP setting. Here, the configuration information management unit 233 can pass the device configuration information of the MFP 150 to the application server 100 via the network module 230 in response to a request from the application server 100.
In step S603, the SP setting information check comparison unit 208 acquires information about the SP from the tables 303 to 305. Tables 303 to 305 record information about the applications installed in the MFP 150 as described above, the functions corresponding to each application, and whether or not the functions can support SP. In the table 304, the function of the application corresponding to the operating application identifier in the table 303 is recorded for each function unit. Further, the table 304 records information about the influence of the SP setting for each function. When it is recorded that there is no SP setting influence, it indicates that the function is not affected regardless of whether the corresponding SP setting item is valid or invalid. When it is recorded that the SP setting is not possible, this indicates that the function cannot be used when the SP setting is valid. In the present embodiment, the function can be used, but only the case where the function cannot be used is described as an example. However, the granularity of the information can be set in a plurality of stages.

In step S604 and subsequent steps, the application server 100 performs SP setting according to the device configuration of the MFP 150 using the information acquired in steps S602 and S603. First, in step S <b> 604, the monitoring unit 205 displays the SP setting information set in the MFP 150 from the table 305 in which the SP setting information set through the operation of the SP setting screen 401 described above with reference to FIG. 4 is recorded. get. An SP identifier is associated with the table 305 for each MFP 150 in the table 301. Furthermore, the SP setting items record the contents of the setting items that can be set by the SP in the table 306, and can be output to the screen as necessary. Next, the SP setting information check comparison unit 208 checks and compares whether the SP settings can be applied from the tables 303 and 304 without changing them. More specifically, the SP setting information check comparison unit 208 determines from the tables 303 and 304 whether the function of the application corresponding to the operating application identifier is “no SP setting influence” or “SP setting impossible”. Check and compare. That is, the SP setting information check comparison unit 208 needs to change the SP setting by determining whether or not the function of the application running on the MFP 150 can be used even when the SP setting is valid. It is determined whether or not. If it is determined that the SP setting needs to be changed as a result of the check / comparison, the SP setting information check comparison unit 208 proceeds to S605. If it is determined that the SP setting does not need to be changed, the SP setting information check comparison unit 208 proceeds to S606. When the SP setting is not set in the MFP 150, the SP setting information check comparison unit 208 determines whether or not the SP setting needs to be changed by the same process for the input SP setting.
In step S <b> 605, the SP setting information check comparison unit 208 records that an applicable SP setting is set in the setting value of the table 305. At this time, when the MFP 150 performs SP setting different from the setting instruction value that is the original SP setting value, the SP setting information check comparison unit 208 records the changed reason as a difference reason in the difference reason column of the table 305. The reason for difference is handled as a matter of difference defined in the table 307. As a more specific example, if the application installed in the MFP 150 does not support the SP setting item 01 “prohibit guest account”, if the SP setting for prohibiting the guest account is reflected in the MFP 150, The application becomes unavailable. Also, if another application does not support the SP setting item 02 “prohibit password caching”, if the SP setting for prohibiting password caching is reflected in the MFP 150, the application cannot be used. In such a case, not the setting instruction value but the SP setting excluding the SP setting that is not applicable from the setting instruction value is necessary.

In step S606, the SP setting information check comparison unit 208 applies a different SP setting to the MFP 150, and ends the SP setting process in FIG. More specifically, the SP management unit 207 distributes the applicable SP setting information determined in S605 to the MFP 150. Then, the SP management unit 231 of the MFP 150 receives the SP setting information from the SP management unit 207 via the network module 230 and reflects the setting contents on the own device. On the other hand, if the SP setting information check comparison unit 208 determines in S604 that the original SP setting can be applied without changing, the SP setting that is not different from the MFP 150 in S606, that is, the setting that is the original SP setting. The indicated value is applied and the SP setting process is terminated. At this time, the SP setting information check comparison unit 208 does not have to record the reason for the difference in the table 305. This is because an application using the table 305 may refer to the setting instruction value if the setting value is not recorded when referring to the setting value.
With the above processing, the application server 100 can determine and apply applicable SP settings according to the device configuration of the MFP 150.

Next, a process in which the application server 100 determines an SP setting applicable to the MFP 150 when the application is changed in the operation of the MFP 150 or the hardware configuration of the device is changed will be described with reference to FIG. explain. Here, the case where there is a change in the application means a case where a new application is added, an update such as an update of an application function is performed, or an application that is no longer used is uninstalled (deleted). Also, the case where there is a change in the hardware configuration of the device means a case where there is a change that requires a review of the SP settings, such as installation or removal of a new authentication module device.
In step S <b> 701, the SP management unit 207 acquires connection information of a device (MFP) to be managed from the table 301 of the database server service 209, and acquires SP setting information from the MFP 150 using the acquired connection information. Further, the SP setting information check comparison unit 208 acquires device configuration information from the MFP 150. Here, the configuration information management unit 233 can pass device configuration information of the MFP 150 to the application server 100 via the network module 230 in response to a request from the application server 100.
In step S <b> 702, the SP setting information check comparison unit 208 checks the difference between the acquired SP setting information and the SP setting information recorded in the application server 100. This is because the SP settings of the MFP 150 may have been changed by operations and instructions from other than the application server 100 since the last SP setting information acquisition. More specifically, the SP setting information check comparison unit 208 acquires information about the SP from the tables 303 to 305 and compares it with the SP setting information previously set in the MFP 150 instead of the original SP setting information. If YES in step S703, the process advances to step S703. If there is no difference, the process advances to step S704.

In S703, the SP setting information check comparison unit 208 determines that the device configuration has not been changed when the difference determined in S702 matches the difference in the previous comparison, and proceeds to S704. On the other hand, when a difference is detected in the SP setting, the SP setting information check comparison unit 208 checks whether it matches the previous SP setting information or whether new SP setting information has been added. If the SP setting information check comparison unit 208 matches the previous SP setting information, the process proceeds to S704.
In step S <b> 704, the SP setting information check comparison unit 208 discards the SP setting information acquired from the MFP 150 and retains the SP setting information set last time. The SP setting information check comparison unit 208 can be updated because there is no change in the contents of the SP setting information. The SP setting information acquired this time is discarded.
In step S705, the monitoring unit 205 checks the acquired device configuration information. Here, the monitoring unit 205 confirms whether or not an application is added, updated, or deleted. If there is no change in the application, the monitoring unit 205 proceeds to S710, and if there is a change, proceeds to S706.
In step S706, the SP setting information check comparison unit 208 determines whether the SP setting information needs to be changed. In determining, the SP setting information check comparison unit 208 first updates the table 303 with new information. Then, the SP setting information check comparison unit 208 determines whether or not the SP setting information needs to be changed due to the application difference from the table 304 by the method described above with reference to FIG. If the SP setting information check comparison unit 208 determines that the change is necessary, the process proceeds to S707. If the SP setting information check comparison unit 208 determines that the change is not necessary, the process proceeds to S710.

In step S <b> 707, the SP setting information check comparison unit 208 records new SP setting information in the table 305. Here, the SP setting information check comparison unit 208 records the changed reason in the difference reason column as the reason for difference when performing SP setting different from the setting instruction value that is the original SP setting value. The reason for difference is handled as a matter of difference defined in the table 307.
In step S <b> 708, the SP management unit 207 distributes the SP setting information to the MFP 150 on the assumption that the SP setting information managed by the application server 100 has changed. Then, the SP management unit 231 of the MFP 150 performs the setting by reflecting the SP setting based on the SP setting information transmitted from the SP management unit 207 on the own apparatus. The SP setting information check comparison unit 208 ends the processing of FIG.
In step S709, the SP setting information check comparison unit 208 determines whether to give priority to SP setting information managed by the application server 100 or to update other SP setting information as SP settings. The other SP setting information means that the SP setting information is directly changed by the SP setting function on the MFP 150 side. It is also possible to prepare a setting screen for determining the priority in the application server 100 in advance, and the user can change the priority via the setting screen. The SP setting information check comparison unit 208 proceeds to S705 if priority is given to the SP setting information managed by the application server 100, and proceeds to S710 if priority is not given.
In step S <b> 710, the SP setting information check comparison unit 208 records new SP setting information in the table 305 with the SP setting information acquired from the MFP 150. At this time, the SP setting information check comparison unit 208 records the reason for the difference so that it can be determined that the application server 100 has not set it, such as unknown or device convenience. The SP setting information check comparison unit 208 ends the processing of FIG.
With the above processing, even when a change occurs in the device configuration of the MFP 150, the application server 100 can determine and apply an applicable SP setting according to the change.

Next, a screen display method when the application server 100 performs SP settings that differ from the original SP setting request will be described with reference to FIGS. FIG. 8 is a flowchart illustrating an example of a display process in which the application server 100 switches and displays the display screen depending on the reason. The application server 100 transmits screen information for displaying the screen of FIG. 9 to the client computer 120. When the client computer 120 receives the screen information from the application server 100, the client computer 120 displays the screen of FIG. 9 based on the setting screen information. However, when the application server 100 and the client computer 120 are configured as the same information processing apparatus, the application server 100 displays the screen of FIG. 9 on its own display.
In step S <b> 801, the SP management unit 207 acquires SP setting information when a screen for displaying SP setting information is requested. More specifically, the SP management unit 207 acquires SP setting information of the MFP 150 to be displayed from the table 305 of the database server service 209. Here, the information acquired by the SP management unit 207 includes not only the setting value information but also the reason for the difference.
In step S802, the SP management unit 207 determines whether the SP setting difference reason is due to device configuration information or the difference reason. Here, the SP management unit 207 can confirm from the table 307 what kind of content the original SP setting was not applied as the reason for the difference. In S802, if the SP management unit 207 determines that the reason for the difference is due to device configuration information or the reason for the difference, the SP management unit 207 proceeds to S803 and displays an SP setting that does not match the original SP setting as a problem-free setting. On the other hand, if the SP management unit 207 determines in S802 that the original SP setting could not be performed for some reason that is not due to the device configuration, the SP management unit 207 proceeds to S804 and indicates that the SP setting is not properly performed. Display a warning display.

A display example of the screen displayed in S803 and S804 will be described with reference to FIG. A display example displayed by the processing of S804 is shown as an SP setting status screen 901 in FIG. A display example displayed by the processing of S803 is shown as an SP setting status screen 905 in FIG.
First, with reference to FIG. 9A, an example of a display screen that displays a warning that the SP setting is not expected by the processing of S804 will be described. The SP setting status screen 901 can display a list of each MFP 150 and has a column for displaying the status of the SP setting status of each MFP 150. In the example of FIG. 9A, the fact that Devices 2 and 5 are not in the original SP setting is displayed as a warning with a cross mark like 902 and 903, and a description different from the original setting is displayed in the detail column. ing. Similarly, if no SP setting has been made, a warning that no setting has been made is displayed as in 904. As a result, the administrator of the network device (MFP) can know the MFP 150 for which an appropriate SP setting has not been made.
Next, with reference to FIG. 9B, an example of a display screen that displays an SP setting that does not match the original SP setting as a problem-free setting by the processing of S803 will be described. The SP setting status screen 905 displays that the SP setting is appropriate, unlike the warning display in FIG. 9A, assuming that the original SP setting could not be performed due to the configuration of the device. In the example of FIG. 9B, Device 2 indicates that the encryption setting (weak) SP setting is set for the original SP setting that should not use the encryption strength (weak). . However, in the SP setting column, a circle (with SP setting) is displayed, indicating that there is no problem. In Device 3 in which the SP setting itself is not performed, a cross mark is displayed in the SP setting column and a message indicating that the SP setting is not set is displayed in the detail column.

Note that the application server 100 can make the type of display detailed in the manner of holding the information of the reason for difference in the determination of the display switching. For example, the application server 100 does not display a warning for a difference reason less than an arbitrary number, but can display a warning if the number is an arbitrary number or more. Further, the application server 100 can add a condition other than this table, and can display a warning when the original SP setting cannot be applied to only one specific machine among a plurality of MFPs 150.
Through the above processing, the application server 100 can switch and display the screen showing the setting status of the SP setting according to the status, thereby improving the convenience for the user.
As described above, according to the present embodiment, the application server 100 can appropriately and appropriately apply the SP setting according to the device configuration of the network device (MFP).

<Other embodiments>
The present invention can also be realized by executing the following processing. That is, software (program) that realizes the functions of the above-described embodiments is supplied to a system or apparatus via a network or various storage media, and a computer (or CPU, MPU, etc.) of the system or apparatus reads the program. It is a process to be executed.

  As mentioned above, according to each embodiment mentioned above, an appropriate security policy can be applied according to the composition of a network device.

  The preferred embodiment of the present invention has been described in detail above, but the present embodiment is not limited to the specific embodiment, and various modifications can be made within the scope of the gist of the present invention described in the claims.・ Change is possible.

Claims (10)

Obtaining means for obtaining configuration information of devices capable of communicating via a network;
Determination means for determining whether or not a security setting change for the device is required based on the configuration information acquired by the acquisition means;
A determination unit for determining a security setting applicable to the device based on the configuration information when the determination unit determines that a change in security setting for the device is required;
Distribution means for distributing security setting information related to the security setting determined by the determination means to the device;
An information processing apparatus.   The information processing apparatus according to claim 1, wherein when the configuration of the device changes, the determination unit determines whether it is necessary to change a security setting for the device based on the configuration information. The determination means determines whether or not it is necessary to change the security setting for the device based on whether or not the security setting affects the function of the device indicated by the configuration information;
The information processing apparatus according to claim 1, wherein the determining unit determines a security setting that does not affect the function of the device indicated by the configuration information as a security setting applicable to the device. Further comprising setting information acquisition means for acquiring security setting information of the device from the device;
The determination unit determines whether or not it is necessary to change the security setting indicated by the security setting information acquired by the setting information acquisition unit based on the configuration information;
4. The distribution unit according to any one of claims 1 to 3, wherein the distribution unit distributes, to the device, security setting information related to a security setting applicable to the device determined by the determination unit among the acquired security setting information. The information processing apparatus described. And further comprising a receiving means for receiving input of security setting information of the device,
The determination unit determines whether or not it is necessary to change the security setting indicated by the security setting information received by the reception unit based on the configuration information;
4. The distribution unit according to any one of claims 1 to 3, wherein the distribution unit distributes, to the device, security setting information related to a security setting applicable to the device determined by the determination unit among the received security setting information. The information processing apparatus described.   When there is a difference between the security setting information of the device and the security setting information distributed by the distribution unit, the apparatus further includes a providing unit that provides screen information related to a setting state of the security setting according to the reason for the difference. Item 6. The information processing apparatus according to Item 4 or 5.   The information processing apparatus according to claim 6, wherein the providing unit switches and provides the screen information depending on whether the reason for the difference is based on a change in the configuration of the device.   The information processing apparatus according to claim 1, wherein the device is an image forming apparatus. An information processing method executed by an information processing apparatus,
An acquisition step of acquiring configuration information of devices communicable via a network;
A determination step of determining whether or not it is necessary to change a security setting for the device based on the configuration information acquired by the acquisition step;
A determination step for determining a security setting applicable to the device when it is determined that the security setting for the device needs to be changed by the determination step;
A distribution step of distributing security setting information related to the security setting determined in the determination step to the device;
An information processing method including: On the computer,
An acquisition step of acquiring configuration information of devices communicable via a network;
A determination step of determining whether or not it is necessary to change a security setting for the device based on the configuration information acquired by the acquisition step;
A determination step for determining a security setting applicable to the device when it is determined that the security setting for the device needs to be changed by the determination step;
A distribution step of distributing security setting information related to the security setting determined in the determination step to the device;
A program for running

Images