JP2023183941A - Network device management system and control method - Google Patents

Abstract

To provide a network device management system and a control method that, even when additionally installing a network device, complete activation of the network device without dispatching an operator who knows an activation key and without requiring customer's operation.SOLUTION: In a network device management system, a device management server 130 has: a device registration unit that registers information on a network device 110 in association with information on a base management device 120; transmission means that transmits, to the base management device 120, the information on the network device 110 registered in association with the base management device 120; an activation key issuing unit that issues an activation key of the network device 110; and a connection permission unit that permits connection to the network device 110 registered in the device registration unit.SELECTED DRAWING: Figure 3

Description

The present invention relates to a network device management system including a network device, a base management device, and a device management server, and a control method.

With the spread of cloud services and IoT, systems have appeared that collect data from network devices such as image forming devices equipped with communication control devices via the network and utilize the data to provide services to customers. . Here, IoT refers to the Internet of Things. Such systems can be used by service providers by registering network device information in a device management server that manages connections between network devices of multiple customer companies. When providing a network device service to a customer company, a person in charge of the service provider creates a new tenant and assigns it to the customer company. Then, in order to manage network devices for each customer company, the network devices are registered in the device management server in association with the tenant assigned to the customer company (hereinafter referred to as customer tenant). The network device establishes a connection by performing authentication using information that identifies the network device registered in the device management server, and activates the communication functions necessary for providing the service.

The technology disclosed in Patent Document 1 provides a system that prevents unauthorized access to a device management server and activates a network device by performing user authentication without dispatching a worker with specialized knowledge for installation. . Among them, the device management server completes user authentication of the registered network device by accessing a hyperlink issued in advance to the user of the network device. Unless the user knows the hyperlink, user authentication for network devices registered on the device management server cannot be performed, so unauthorized activation can be prevented.

The technology disclosed in Patent Document 2 is a system in which an activation key for activating a network device is not issued for each user of a network device, but an activation key issued to a sales company that performs installation can be used to perform installation work. I will provide a. By using the activation key issued to the sales company that performs the installation, the activation key is issued and distributed to each user of the network device by linking it with the sales company's tenant and activating it. Reduce effort.

JP2018-180978 Publication JP2021-125761 Publication

The technology disclosed in Patent Document 1 requires a hyperlink for activation to be issued in advance to users of network devices. Furthermore, it was necessary for the user to access the published hyperlink in the customer's network environment where the network device is installed.

The technology disclosed in Patent Document 2 does not require the trouble of issuing and distributing an activation key to each user of a network device. However, when a plurality of network devices are installed in a customer company, a worker is required to input an activation key for each of the network devices. Even when installing additional network devices, it is essential to dispatch a worker who knows the activation key.

Therefore, an object of the present invention is to be able to complete the activation of a network device without dispatching a worker who knows the activation key and without requiring any operation by the customer, even when additional network devices are installed. do.

In order to solve the above problems, the present invention provides a network device management system including a network device, a base management device, and a device management server, wherein the network device is connected to the network device from the base management device. and a connection establishment means for establishing a connection with the device management server using the received activation key, the base management device comprising: a first acquisition unit that acquires information on a network device registered in association with the base management device from the device management server; and a first acquisition unit that acquires information on the network device registered in association with the base management device; a device management unit that manages the network device as a managed network device; and a first unit that acquires an activation key from the device management server when there is an unactivated network device in the network device information acquired by the first acquisition unit. and an instructing means for instructing an unactivated network device to activate the activation key using the activation key acquired by the second acquisition means, and the device management server includes: a registration means for registering information on the base management device in association with information on the base management device; a transmission means for transmitting information on a network device registered in association with the base management device to the base management device; The device is characterized by comprising: issuing means for issuing an activation key for a network device; and connection permission means for permitting connection with a network device registered in the registration means.

According to the present invention, even when additionally installing a network device, activation of the network device can be completed without dispatching a worker who knows the activation key and without requiring any operation by the customer.

1 is a diagram showing the system configuration of the entire network device management system. 2 is a diagram showing the hardware configuration of a device management server 130. FIG. In particular, it is a software configuration diagram of a portion related to this system. (a) It is a flowchart of the activation process of the base management device 120. (b) is a flowchart of activation processing of the device management server 130;

DESCRIPTION OF THE PREFERRED EMBODIMENTS The best mode for carrying out the present invention will be described below with reference to the drawings.

(Example 1)
FIG. 1 is a diagram showing a system configuration according to an embodiment of the present invention. The network device management system of this embodiment includes a network device 110, a base management device 120, a device management server 130, a network 140, and the like.

The network device 110 is a processing device in a customer organization's network that is connected to the device management server 130 via a network 140 such as the Internet, and includes an image processing device such as a printer, a copier, or a scanner. Although only one network device 110 is shown in FIG. 1, multiple network devices or network devices of multiple customer organizations may exist in the network of the customer organization. The network device 110 connects to the device management server 130 using a server connection application running on the network device 110, and sends configuration information and operation information of the network device 110 to the device management server 130. When transmitting configuration information and operation information, the network device 110 authenticates with the device management server 130 and obtains access permission information such as an access token and session ID. The network device 110 attaches the acquired access permission information and transmits the setting information and operation information to the device management server 130.

The base management device 120 is a terminal within the network of the same customer organization to which the network device 110 is connected, and manages the connection of the network device 110 to the device management server 130 and the activation of the communication function. The base management device 120 may be such that one of the plurality of network devices 110 existing in the customer organization's network is equipped with the functions of the base management device 120 and also serves as the base management device 120. .

The device management server 130 is a server device that authenticates the network device 110 on the cloud, receives setting information and operation information, and manages the network device 110. When connecting the network device 110 to the device management server 130, the network device 110 and the base management apparatus 120 are registered in the device management server 130 in advance in order to identify and manage the owner of the network device 110. The device management server 130 associates the network device 110 with a customer company that owns the network device 110, and logically separates and manages information for each customer organization. When receiving setting information and operation information, the device management server 130 is authenticated based on the registered information, access permission information is issued, and the device waits for reception of the setting information and operation information.

FIG. 2 is a diagram showing the hardware configuration of a server computer that implements the device management server 130 according to the embodiment of the present invention. The server computer includes an output I/F unit 201 that connects to an output device such as a display, an input I/F unit 202 that connects to an input device such as a keyboard, a storage device 203, a memory 204, a CPU 205, and a communication I/F unit 206. Consisting of The storage device 203 stores an OS (Operating System), an authentication program that performs authentication and connection processing, and a management program that registers and manages the network device 110. Furthermore, the storage device 203 stores registration information of customer organizations and network devices 110, received setting information, operating information, and the like. The CPU 205 loads the authentication program and management program from the storage device 203 into the memory 204 and executes them. The communication I/F unit 206 is a network interface that is connected to the network 140 and controls communication with the network devices 110 that constitute the network device management system.

Note that the diagram showing the hardware configuration shown in FIG. 2 corresponds to a hardware block diagram of a general information processing device, and is also applied to the network device 110 and base management device 120 of this embodiment. . Therefore, the hardware configurations of the network device 110 and the base management device 120 are also similar.

FIG. 3 is a diagram illustrating functional blocks of parts particularly related to the present invention among the network device 110, base management apparatus 120, and device management server 130 that constitute the network device management system.

The network device 110 includes an activation instruction receiving section 311 and a connection establishment section 312. In order to logically separate and manage data for each customer organization, the device management server 130 creates a tenant, which is a virtual organization within the device management server 130, and assigns the created tenant to the customer organization. By registering the network device 110 in advance with a tenant assigned to a customer organization, data on the network device 110 can be managed separately on a tenant basis.

The activation instruction accepting unit 311 accepts input of an activation key. In the conventional technology, the activation key is assumed to be input using a hard key or touch panel operation on the input I/F unit 202 of the network device. However, in this embodiment, the access may be performed by API (Application Programming Interface) access via the communication I/F unit 206. The activation key is a character string that specifies a tenant to which a network device is connected within the device management server 130, and is used by the device management server 130 to permit connection. By requiring input of an activation key for connection to the device management server 130, connection from the network device 110 without input of an activation key can be prevented. Furthermore, it is possible to connect only to the tenant specified when the activation key was issued.

The connection establishing unit 312 establishes a connection with the device management server by transmitting the activation key input by the activation instruction receiving unit 311 to the device management server 130 and receiving the issuance of credential information from the device management server 130. . The network device 110 uses this credential information to connect to the device management server 130 and transmits data necessary for providing services, such as setting information and operation information of the network device 110, to the device management server 130.

The base management device 120 is set in advance to be able to connect and communicate with the device management server 130, and includes a managed device management section 321, an activation key acquisition section 322, and an activation instruction section 323. The managed device management unit 321 manages information on network devices 110 whose activation is managed by the base management device 120 and which is within the network of the same customer organization to which the base management device 120 is connected. Information about the network device 110 to be managed is obtained by periodically accessing the device management server 130. It also manages which network devices 110 have been activated among the acquired network device 110 information.

The activation key acquisition unit 322 accesses the device management server 130 and acquires the activation key necessary to activate the network device 110. The activation instruction unit 323 passes the activation key acquired by the activation key acquisition unit 322 to the network device 110 in the same customer organization's network that has not yet been activated, and instructs it to activate.

The device management server 130 includes a device information registration section 331, an activation key issuing section 332, and a connection permission section 333. The device information registration unit 331 is a functional block that registers information on the network devices 110 installed in the customer organization with tenants, and manages the network devices 110 by logically separating them in units of tenants. Based on a registration request from a user, information about a network device 110 that provides a service is registered with a tenant of a customer organization that provides the service. The device information registration unit 331 also registers and manages information about the base management device 120 installed in the customer organization. Table A shows an example of a device management information table that the device information registration unit 331 registers in the storage device 203 of the device management server 130.

The tenant ID is a tenant ID indicating a tenant that has registered the network device 110, and information on a plurality of network devices can be registered in one tenant ID. The management device ID is ID information that uniquely identifies the base management device 120 that manages activation of the network device 110. When the network device 110 is registered in association with the information on the base management apparatus 120, information on the network device 110 associated with the base management apparatus 120 can be returned in response to a request to obtain information on the network device 110 from the base management apparatus 120. The serial number is ID information that uniquely identifies the network device 110 within the tenant. In addition, network device information includes device name, registration date and time, IP address in the customer organization's network, and installation location information.

The activation key issuing unit 332 generates an activation key necessary to activate the network device 110. Table B shows an example of an activation key management table generated by the activation key issuing unit 332 and held in the storage device 203 of the device management server 130.

The tenant ID in Table B is ID information that uniquely identifies the tenant assigned to the customer organization. The activation key is a unique code within the device management server 130, and one or more activation keys are generated for each tenant ID. Alternatively, one may be generated for each network device registered in the device management information table. In this embodiment, the activation key is generated in response to a request from the base management device 120, and in most cases has an expiration date. Since the activation key is unique within the device management server 130, the tenant ID can be identified from the activation key.

The connection permission unit 333 receives a valid activation key, identifies a connection destination tenant from the activation key, and issues to the network device 110 credential information for transmitting data to the device management server 130 .

FIG. 4A is a flowchart showing activation management processing for the network device 110 that is periodically executed by the base management apparatus 120. The processing of the base management apparatus 120 when activating the network device 110 will be described below according to the flowchart of FIG. 4(a). Note that the program for activation management processing of the base management device 120 according to this flow is stored in the storage device 203 of the base management device 120, read out to the memory 204, and executed by the CPU 205.

In the activation management process, the management processing target device management unit 321 first accesses the device management server 130 and acquires information on the network device 110 registered in association with the base management apparatus 120 (step S401). It is checked whether there is any unactivated network device 110 in the information on the network device 110 acquired in step S401 (step S402). If there is a network device 110 that has not been activated yet, the process proceeds to step S403 and subsequent steps, and the activation key acquisition unit 322 and activation instruction unit 323 attempt to activate the network device 110. First, in step S403, the activation key acquisition unit 322 accesses the device management server 130 and acquires the activation key necessary to activate the network device 110 (step S403). The activation instruction unit 323 then accesses the IP address included in the information on the network device 110 acquired in step S401, and instructs the network device 110 in the network of the same customer organization to activate (step S404). Alternatively, a network device 110 with a matching serial number may be identified by searching within the customer organization's network, and activation may be instructed.

The activation instruction to the network device 110 is performed by passing the activation key obtained in step S403 to the network device 110. If the accessed network device 110 does not exist or does not match the serial number of the network device 110 obtained in step S401, the process ends without instructing activation (step S405). When a corresponding network device 110 exists and the network device 110 is instructed to activate, the connection establishment section 312 of the network device 110 transmits an activation key to the device management server 130 to activate it. When the activation of the network device 110 that has received the activation instruction is successful, the activation instruction unit 323 adds the network device 110 to the management target of the base management apparatus 120 and ends the process (step S407).

FIG. 4B is a flowchart showing the activation process of the connection permission section 333 in the device management server 130. Hereinafter, the process of the device management server 130 when receiving an activation key from the network device 110 and permitting activation of the network device 110 will be described according to the flowchart of FIG. 4(b). Note that the program for activation processing of the device management server 130 according to this flow is stored in the storage device 203 of the device management server 130, read out to the memory 204, and executed by the CPU 205.

The connection permission unit 333 verifies whether the activation key received from the network device 110 in step S411 is valid and valid, which was generated by the activation key issuing unit 332 (step S412). If it is confirmed that the activation key is legitimate and valid (step S413), the tenant to which the connection is made is identified from the activation key, and credential information for transmitting data to that tenant is issued to the network device 110. (Step S414). Upon receiving this credential information, the network device 110 determines that activation has been successful, notifies the base management device 120 of the result, and completes the process.

The network device 110 can then use this credential information to connect to the device management server 130 and send data necessary for providing services, such as configuration information and operation information, to the tenant in which the information of the network device 110 is registered. . If verification fails because the activation key has expired or has already been used and is no longer valid (step S413), an error is returned to the network device 110 without granting permission for connection ( Step S415). Note that the network device 110 that has returned an error notifies the base management device 120 of the activation failure, and completes the process.

In this embodiment to which the present invention described in detail above can be applied, the activation key for identifying the connection destination tenant and connecting the network device 110 is sent to the base based on the information registered in the device management server 130. Obtained by the monitoring device 120. Activation of the network device 110 can be completed by passing the activation key acquired by the base monitoring device 120 to the network device 110 and instructing activation. Therefore, even if the network device 110 is additionally installed, if the base monitoring device 120 is already installed, the activation of the network device 110 can be completed without dispatching a worker who knows the activation key. Furthermore, activation of the network device 110 can be completed without requiring any operation by the customer.

(Other examples)
The present invention also includes devices or systems configured by appropriately combining the embodiments described above, and methods therefor.

Here, the present invention is a device or system that is the main body that executes one or more software (programs) that implements the functions of the embodiments described above. The present invention also includes a method for implementing the above-described embodiments executed by the device or system. Further, the program is supplied to the system or device via a network or various storage media, and the program is read and executed by one or more computers (CPU, MPU, etc.) of the system or device. In other words, the present invention further includes the program itself or various computer-readable storage media storing the program. Further, the present invention can also be realized by a circuit (for example, an ASIC) that realizes the functions of the embodiments described above.

110 Network device 120 Base management device 130 Device management server 140 Network

Claims (10)

A network device management system including a network device, a base management device, and a device management server,
The network device includes:
receiving means for receiving an activation key for activating the network device from the base management device;
connection establishing means for establishing a connection with the device management server using the received activation key;
The base management device includes:
first acquisition means for acquiring information on network devices registered in association with the base management device from the device management server;
Device management means for managing the network device as a managed network device using the network device information acquired by the first acquisition means;
a second acquisition unit that acquires an activation key from the device management server when there is an unactivated network device in the network device information acquired by the first acquisition unit;
an instruction means for instructing an unactivated network device to activate using the activation key acquired by the second acquisition means;
The device management server includes:
registration means for registering information on the network device in association with information on the base management device;
transmitting means for transmitting information on network devices registered in association with the base management device to the base management device;
Issuing means for issuing an activation key for the network device;
A network device management system comprising: connection permission means for permitting connection with a network device registered in the registration means. The connection permission means of the device management server allows connection with the network device registered in the registration means when the activation key received from the network device and the activation key issued by the issuing means match. The network device management system according to claim 1, wherein the network device management system allows connection. When the activation key received from the network device and the activation key issued by the issuing means do not match, the connection permission means of the device management server allows connection permission with the network device registered in the registration means, if the activation key received from the network device and the activation key issued by the issuing means do not match. The network device management system according to claim 1, wherein connection is not permitted. The second acquisition means does not acquire the activation key from the device management server if there is no unactivated network device in the network device information acquired by the first acquisition means. 1. The network device management system according to 1. The network device management system according to claim 1, wherein the network device and the base management device are connected via a customer organization's network. A method for controlling a network device management system including a network device, a base management device, and a device management server, the method comprising:
a registration step in which the device management server registers information on the network device in association with information on the base management device;
a transmission step in which the device management server transmits information on network devices registered in association with the base management device to the base management device;
a first acquisition step in which the base management device acquires information on network devices registered in association with the base management device from the device management server;
a device management step in which the base management device manages the network device as a managed network device using the network device information acquired in the first acquisition step;
an issuing step in which the device management server issues an activation key for the network device;
a second acquisition step in which the base management device acquires an activation key from the device management server when there is an unactivated network device in the network device information acquired by the first acquisition means;
an instruction step in which the base management device instructs an unactivated network device to activate using the activation key acquired in the second acquisition step;
a receiving step in which the network device receives an activation key for activating the network device from the base management device;
a connection establishment step in which the network device establishes a connection with the device management server using the received activation key;
A control method comprising: a connection permission step in which the device management server permits connection with the network device registered in the registration step. In the connection permission step of the device management server, if the activation key received from the network device and the activation key issued by the issuing means match, the device management server connects the network device registered in the registration means. 7. The control method according to claim 6, wherein connection is permitted. In the connection permission step of the device management server, if the activation key received from the network device and the activation key issued in the issuing step do not match, the device management server connects the network device registered in the registration means. 7. The control method according to claim 6, wherein connection of is not permitted. In the second acquisition step, if there is no unactivated network device in the network device information acquired in the first acquisition step, the activation key is not acquired from the device management server. 6. The control method described in 6. 7. The control method according to claim 6, wherein the network device and the base management device are connected via a customer organization's network.

Images