JP2017084124A - Communication device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent unauthorized access, information leakage and the like, and thereby improve network security in the case of one device being shared by a plurality of users or a plurality of groups.SOLUTION: Network communication is performed by using a plurality of network ports Pa and Pb, a network setting storage unit 12 for storing network settings set for each network port Pa, Pb, and corresponding network settings stored in the network setting storage unit 12 for every access from each network port Pa, Pb.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a communication device having a plurality of network ports.

  For example, an image forming apparatus (hereinafter abbreviated as MFP) such as a copying machine, a multifunction machine, and a facsimile machine usually has only one network port, and network settings are shared by all users. Yes. That is, all users share all the servers such as the IP address, subnet, gateway, mail server, DNS server, FTP server, and SMB server of the MFP.

  When a plurality of office users share and use such a network port I / F and an MFP with a single network setting on an office floor or the like where a plurality of offices enter, a user of a certain office A passes through the MFP. Since another office B network can be used, there have been network security problems such as unauthorized access and information leakage.

  This problem is caused by the fact that the communication path is limited to one path because there is only one network port.

  On the other hand, an image processing apparatus provided with a plurality of network ports has also been proposed (see, for example, Patent Document 1).

  In Patent Document 1, in an image processing apparatus that includes a plurality of communication ports and can communicate via each communication port, a storage unit that stores input image data, and an image data stored in the storage unit. Job information acquisition means for acquiring transfer job information; and communication line information acquisition means for acquiring a communication state of a communication line to which each of the plurality of communication ports is connected. The transfer job information and the communication state On the basis of this, there is described an image processing apparatus having selection means for selecting one communication port from among the plurality of communication ports.

JP 2008-126586 A

  The image processing apparatus predicts the end time of a job based on the type of job, the size of image data, etc., and automatically selects a communication port where all jobs end early. The communication port does not perform independent communication. Therefore, even the image processing apparatus described in Patent Document 1 does not solve the above problem, that is, the problem in network security such as unauthorized access and information leakage.

  The present invention was created to solve such problems, and its purpose is to prevent unauthorized access and information leakage when a single device is shared by a plurality of users or a plurality of groups. An object of the present invention is to provide a communication device that improves security.

  In order to solve the above problems, a communication device of the present invention includes a plurality of network ports, a network setting storage unit that stores network settings set for each network port, and the access from each network port, And a communication control unit that performs network communication using the corresponding network settings stored in the network setting storage unit.

  Here, the network setting is a setting for performing network communication using an IP address, a subnet, a gateway, a mail server, a DNS server, an FTP server, an SMB server, and the like of a device in which the communication apparatus of the present invention is mounted.

  In addition, the communication device of the present invention further includes a storage unit that stores the network port corresponding to each user terminal connected to each network port in association with each other, and the communication control unit is accessed from the user terminal When the network port matches the network port stored in the storage unit, the network communication by the user terminal may be permitted.

  In the communication device according to the present invention, in the above configuration, when the network port accessed from the user terminal does not match the network port stored in the storage unit, the communication control unit uses the user terminal. It may be configured to prohibit network communication.

  According to the above configuration, by associating (linking) a user terminal with a network port, for example, when an arbitrary user terminal accesses from another network port that is not associated, this can be rejected.

  In addition, the communication device of the present invention further includes a registration unit that registers a new user terminal connected to each network port, and the registration unit starts from a registered user terminal connected to an arbitrary network port. When a user terminal registration request is received, the connected network port may be set as a network port used by a newly registered user terminal and stored in the storage unit.

  That is, when there is a registration request for a new user terminal from a registered user terminal, the registration unit automatically determines the network port to which the registered user terminal is connected, and the newly registered user terminal uses it. As the network port, the network port automatically determined is set.

  In the communication apparatus according to the present invention, in the above configuration, a group is registered for each network port, and the registration unit is configured to register a new user terminal through a network port registered from a user terminal of a registered group. If there is a registration request, a new user terminal may be registered in the group.

  The communication device of the present invention further includes a display unit that displays a registration screen for registering a new user terminal connected to each network port, and is stored in the storage unit from the registration screen of the display unit. If the authentication information of the user terminal and the information of the user terminal to be newly registered are input, the user terminal newly registering the network port corresponding to the user terminal to which the authentication information is input It is good also as a structure set as a network port to be used and memorize | stored in the said memory | storage part.

  That is, when the authentication information of the user terminal stored in the storage unit and the information of the user terminal to be newly registered are input from the registration screen of the display unit, the network corresponding to the user terminal to which the authentication information is input A port is automatically set as a network port used by a newly registered user terminal.

  In the communication device according to the present invention, in the above configuration, a group is registered for each network port, and the authentication information of the group and information of a user terminal to be newly registered are registered from the registration screen of the display unit. When input, the user terminal to be newly registered may be registered in the group to which the authentication information is input.

  According to the present invention, by performing network settings for each network port, different network resources are used for each network port, so that the security problem is solved. For example, when the communication device of the present invention is shared by a plurality of groups, it is possible to prevent unauthorized access or information leakage from one group to another group by identifying the accessed network port. can do. In addition, user impersonation can be prevented.

It is a functional block diagram of the communication apparatus which concerns on embodiment of this invention. It is explanatory drawing which shows an example of the user / port correspondence table memorize | stored in the memory | storage part. It is a flowchart which shows the process sequence which performs network communication using the communication apparatus of this invention. It is explanatory drawing which shows the example of the address book of each user by list display. It is explanatory drawing which shows an example of the user / port correspondence table memorize | stored in the memory | storage part. It is a functional block diagram of the communication apparatus corresponding to Embodiment 4 which newly registers a user from a registration screen. It is explanatory drawing which shows an example of the user / port correspondence table memorize | stored in the memory | storage part.

  Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 is a functional block diagram of a communication apparatus according to an embodiment of the present invention.

  The communication apparatus 1 includes a plurality of network ports (two network ports in this example) Pa and Pb, and a network setting storage unit 12 that stores network settings A and B set for each network port Pa and Pb. And a control unit 11 for controlling the entire apparatus.

  The control unit 11 includes a communication control unit 11a that performs network communication using the corresponding network setting A or B stored in the network setting storage unit 12 for each access from the network ports Pa and Pb, and each network port. And a registration unit 11b for registering a new user terminal connected to Pa and Pb.

  Moreover, the communication apparatus 1 respond | corresponds for each user terminal A1, A2, ..., Am, B1, B2, ..., Bm of each group A, B connected to each network port Pa, Pb. A storage unit 13 is provided for storing a user / port correspondence table in which the network ports Pa and Pb are associated with each other.

  Group A is a local area network in which a plurality of user terminals A1, A2,... Am are connected to a LAN line or the like, and is connected to the network port Pa of the communication apparatus 1 by a network cable 21. Group B is a local area network in which a plurality of user terminals B 1, B 2,..., Bm are connected to a LAN line or the like, and is connected to the network port Pb of the communication apparatus 1 by a network cable 22.

  FIG. 2 shows an example of the user / port correspondence table stored in the storage unit 13.

  In this correspondence table, each user terminal A1, A2,..., Am in group A is associated (associated) with network port Pa, and each user terminal B1, B2,. It is associated (associated) with the network port Pb. In this example, the network ports Pa and Pb are associated with the groups A and B, respectively. However, the network ports Pa and Pb are not necessarily associated with each group, and may be associated with any network port for each individual. Good.

  Here, the network setting is a setting for performing network communication using an IP address, a subnet, a gateway, a mail server, a DNS server, an FTP server, an SMB server, or the like of a device in which the communication device 1 of the present embodiment is installed. In this embodiment, this setting is set for each of a plurality of network ports Pa and Pb.

  As a result, different network resources are used for each group A and B, and the security problem is solved. That is, network access can be performed using the network setting A set for the group A for access from the network port Pa, and set for the group B for access from the network port Pb. Network communication can be performed using the set network setting B.

  That is, for example, the login user of the user terminal A1 who has accessed via the network port Pa automatically uses the network setting A. By logging in also with other users of the group A to which this login user belongs. The network setting A is automatically used.

  On the other hand, for example, the login user of the user terminal B1 who has accessed via the network port Pb automatically uses the network setting B. By logging in also for other users of the group B to which this login user belongs. The network setting B is automatically used.

  In other words, by using the communication device 1 of the present embodiment, the users of each group can always use appropriate network settings without being aware of the proper use of the network settings that they use. .

<Description of Embodiment 1 of Network Communication>
Next, a first embodiment in which network communication is performed using the communication apparatus 1 having the above configuration will be described with reference to a flowchart shown in FIG.

  The control unit 11 constantly monitors the presence / absence of access from the network ports Pa and Pb (step S1). When there is an access through one of the network ports by login from an arbitrary user terminal (when it is determined Yes in step S1), first, it is confirmed from which network port the access is made ( Step S2).

  Next, when the control unit 11 confirms the accessed network port, the control unit 11 refers to the user / port correspondence table (FIG. 2) stored in the storage unit 13 and refers to the user terminal that has logged in to the network port. A match or mismatch between the associated network ports is confirmed (step S3).

  As a result, if the accessed network port matches the network port associated with the user terminal that has accessed the network port (if determined Yes in step S3), step S5 is performed. The process proceeds to S6, and network communication is performed using the corresponding network setting stored in the network setting storage unit 12.

  For example, when the accessed network port is the network port Pa and the user terminal that has accessed the network port Pa is A1, the user terminal A1 has the network port Pa from the user / port correspondence table of FIG. In this case, network communication is performed using the network setting A. That is, in this case, network communication is permitted.

  On the other hand, if the accessed network port does not match the network port associated with the user terminal that has accessed the network port (if determined No in step S3), the process proceeds to step S7. Proceed with processing and prohibit network communication.

  For example, when the accessed network port is the network port Pa and the user terminal that has accessed the network port Pa is B1, the user terminal B1 has the network port Pb from the user / port correspondence table of FIG. Are associated with each other and the network ports do not match. In this case, network communication is prohibited (rejected).

  As described above, in the first embodiment of network communication, when a user terminal is associated (associated) with a network port, for example, when an arbitrary user terminal accesses from another network port that is not associated. Can reject this, and can prevent impersonation of the user. In addition, users who use each user terminal are associated with the appropriate network port in advance, so the network settings used by the user terminal are always appropriate even if they are not aware of the proper use. Network settings can be used.

<Description of Embodiment 2 of Network Communication>
Next, a second embodiment in which network communication is performed using the communication apparatus 1 having the above configuration will be described.

  In the second embodiment, each user can register an address such as a mail address or a file server in the address book in order to transmit a file such as a scanned image. These addresses are also stored in association with network ports.

  FIG. 4 shows an example of the address book of each user in a list display.

  In this case, the same network port as the network port associated with the user (user terminal) who registered the address is set.

  As a result, when sending an email with an image scanned by the MFP, an appropriate mail server set for each network port is automatically selected. For example, when the user terminal A1 sends an e-mail attached with an image scanned by the MFP, an appropriate mail server set by the network setting A corresponding to the network port Pa is automatically selected. .

  Also, when an image scanned by the MFP is transmitted to the file server, an appropriate DNS server set for each network port is used to correctly determine the name of the file server. For example, when the user terminal B1 transmits an image scanned by the MFP to the file server, an appropriate DNS server set by the network setting B corresponding to the network port Pb is used, and the appropriate file server is automatically set. Will be selected.

  In the case of network communication in the above two examples, appropriate setting values for individual network ports are used for the IP address, subnet, and gateway of the MFP.

  Next, an embodiment in which a new user, that is, a new user terminal is registered in the user / port correspondence table will be described.

<Description of Embodiment 3 in which a user terminal is newly registered from an external device or the like>
In the third embodiment, when a registration request for a new user terminal is received from a registered user terminal connected to an arbitrary network port, the registration unit 11b of the control unit 11 newly sets the connected network port. Is automatically set as a network port used by the user terminal registered in, and additionally stored in the user / port correspondence table of the storage unit 13.

  That is, when there is a registration request for a new user terminal from a registered user terminal, the network port to which the registered user terminal is connected is automatically determined, and the network port used by the newly requested user terminal The network port that is automatically determined is set.

  For example, when there is a registration request for a new user terminal An belonging to the same group A from the registered user terminal A2 belonging to the group A, the registration unit 11b is connected to the network to which the registered user terminal A2 is connected. The port Pa is automatically determined, the automatically determined network port Pa is set as the network port used by the newly requested user terminal An, and additionally stored in the user / port correspondence table. As a result, as shown in FIG. 5, the user terminal An is automatically registered in the user / port correspondence table in association with the network port Pa as the user terminal of group A.

  That is, since it is not necessary to directly specify and set the network port to be used on the user side, it is possible to prevent setting errors of the network port to be used. For example, even if a user using a group B user terminal (for example, B1) tries to specify the network port Pa as a use port of a user terminal Bn belonging to the same group B, the registration unit 11b sets the connection port of the user terminal B1. Then, the used port of the new user terminal Bn is automatically registered in the network port Pb. That is, it is possible to refuse to set the use port of the user terminal Bn of group B to the network port Pa. Thereby, a user's impersonation etc. can be prevented.

  That is, even if the user terminal B1 is used to intentionally set the use port of the user terminal Bn to the network port Pa, the registration unit 11b rejects this, so that it is possible to prevent impersonation of the user.

<Description of Embodiment 4 for Registering New User Terminal from Registration Screen>
FIG. 6 is a functional block diagram of the communication device 1 corresponding to the fourth embodiment.

  In addition to the communication device 1 shown in FIG. 1, the communication device 1 further includes a display unit 14 that displays a registration screen for registering a new user terminal connected to each network port.

  The display unit 14 is a touch panel type display unit in which a touch panel sheet as an input unit is pasted on a liquid crystal panel. In addition, you may comprise about an input part also including the hard key etc. which were arrange | positioned around the touch panel sheet | seat.

  In the communication apparatus 1 having such a configuration, in the third embodiment, the registration unit 11 b of the control unit 11 newly registers with the authentication information of the user terminal stored in the storage unit 13 from the registration screen of the display unit 14. When the user terminal information is input, the network port corresponding to the user terminal for which the authentication information is input is automatically set as the network port used by the newly registered user terminal, and the storage unit It is configured to additionally store in 13 user / port correspondence tables.

  That is, when the authentication information of the user terminal stored in the storage unit 13 and the information of the user terminal to be newly registered are input from the registration screen of the display unit 14, corresponding to the user terminal to which the authentication information is input The network port is automatically set as the network port used by the newly registered user terminal.

  For example, a user of a registered user terminal A2 belonging to the group A inputs, for example, an ID and a password as his / her authentication information on the registration screen of the display unit 14, and the new user terminal Ar registered in the same group A is registered. When a registration request is made by inputting information (for example, the ID and password of the user terminal Ar), the registration unit 11b refers to the user / port correspondence table (FIG. 2) in the storage unit 13 and corresponds to the user terminal A2. The attached network port Pa is acquired, the acquired network port Pa is automatically set as a network port used by the newly registered user terminal Ar, and is additionally stored in the user / port correspondence table. As a result, as shown in FIG. 7, the user terminal Ar is automatically registered in the user / port correspondence table as a user terminal of group A in association with the network port Pa.

  That is, since it is not necessary to directly specify and set the network port to be used on the user side, it is possible to prevent a setting error of the network port to be used. Also, even if a user who uses a user terminal (for example, B1) of group B tries to specify a network port Pa as a used port of a user terminal Bn belonging to the same group B from the registration screen, the registration unit 11b does not use the user / port. By referring to the correspondence table, the connection port of the user terminal B1 is confirmed, and the used port of the new user terminal Bn is automatically registered in the network port Pb. That is, it is possible to refuse to set the use port of the user terminal Bn of group B to the network port Pa. Thereby, a user's impersonation etc. can be prevented.

  In the fourth embodiment, IDs and passwords are exemplified as user authentication information. However, user authentication can be performed using various other authentication means such as fingerprint authentication, face authentication, vein authentication, and the like. Is possible.

  The present invention can be implemented in various other forms without departing from the spirit or main features thereof. Therefore, the above-mentioned embodiment is only a mere illustration in all points, and should not be interpreted limitedly. The scope of the present invention is set forth in the claims, and is not restricted by the text of the specification. Further, all modifications and changes belonging to the equivalent scope of the claims are within the scope of the present invention.

  The present invention describes the case where the communication apparatus of the present invention is applied to an image forming apparatus such as a copying machine, a multifunction peripheral, and a facsimile machine. However, the present invention is not limited to the image forming apparatus, and includes a plurality of network ports. It greatly contributes to the entire technical field related to electrical / electronic equipment that needs to be assigned a user or group every time.

1 Image forming device (MFP)
DESCRIPTION OF SYMBOLS 11 Control part 11a Communication control part 11b Registration part 12 Network setting memory | storage part 13 Memory | storage part 14 Display part 21, 22 Network cable Pa, Pb Network port A1, A2, ..., Am, B1, B2, ..., Bm User terminal

Claims (7)

Multiple network ports,
A network setting storage unit for storing network settings set for each network port;
A communication apparatus comprising: a communication control unit that performs network communication using a corresponding network setting stored in the network setting storage unit for each access from each network port. The communication device according to claim 1,
A storage unit that associates and stores the network port corresponding to each user terminal connected to each network port;
The communication apparatus allows the network communication by the user terminal when the network port accessed from the user terminal matches the network port stored in the storage unit. The communication device according to claim 2,
The communication apparatus, wherein the communication control unit prohibits network communication by the user terminal when the network port accessed from the user terminal does not match the network port stored in the storage unit. The communication device according to claim 2 or 3, wherein
A registration unit for registering a new user terminal connected to each network port;
When there is a registration request for a new user terminal from a registered user terminal connected to an arbitrary network port, the registration unit uses the connected network port for the newly registered user terminal The communication apparatus is set as a network port to be stored and stored in the storage unit. The communication device according to claim 4,
A group is registered for each network port,
The registration unit registers a new user terminal in the group when there is a request for registration of a new user terminal through a registered network port from a registered group user terminal. apparatus. The communication device according to claim 2 or 3, wherein
A display unit for displaying a registration screen for registering a new user terminal connected to each network port;
When the authentication information of the user terminal stored in the storage unit and the information of the user terminal to be newly registered are input from the registration screen of the display unit, the user terminal to which the authentication information is input is input to the user terminal A communication device, wherein a corresponding network port is set as a network port used by a newly registered user terminal and stored in the storage unit. The communication device according to claim 6,
A group is registered for each network port,
When authentication information of the group and information of a user terminal to be newly registered are input from the registration screen of the display unit, the user terminal to be newly registered is registered in the group to which the authentication information is input A communication device characterized by:

Images