JP7040326B2 - Equipment management equipment, equipment management systems, and programs - Google Patents

Description

The present invention relates to a device management device, a device management system, and a program.

A device management system is known in which a plurality of devices such as an image forming device connected to a network are managed by one device management device.

In order to maintain a safe and secure office environment, it is possible to perform encrypted communication such as SSL (Secure Sockets Layer) encrypted communication in devices such as image forming devices as well as PCs (Personal Computers) and server devices. Is required.

However, devices with low encryption strength may be connected to the network. Therefore, a technique has been proposed in which the security level is raised by determining the encryption strength set in the device and changing the encryption strength to a stronger one when the encryption strength is low (Patent Document 1).

However, the device management system includes not only the device whose encryption strength can be changed as described in Patent Document 1, but also the old device whose encryption strength is low and whose encryption strength cannot be changed. Sometimes.

In the conventional device management system, each device is configured to enable encrypted communication only to a specific port of the device management device, so that the device management device can be used with all the devices included in the device management system. Communication must be done using the same encryption strength communication method.

For this reason, when the device management system includes old devices, the device management device has no choice but to communicate with all the devices according to the low security communication method used by the old devices. The security level of the entire system is reduced. That is, even if the device management system includes a device having a high encryption strength, the security level cannot be increased if even one device having a low encryption strength is included.

The disclosed technology is designed to solve this in view of the above circumstances, and aims to suppress a decrease in the security level of the entire device management system due to the inclusion of devices having low encryption strength.

The disclosed technology is a device management device that communicates with a plurality of devices and manages each device, and is held by a certificate holding unit that holds a plurality of certificates having different encryption strengths and the certificate holding unit. It is a device management device having a communication setting unit for setting the plurality of certificates to different ports, and a communication unit for performing encrypted communication with different encryption strengths for each port.

It is possible to suppress a decrease in the security level of the entire device management system due to the inclusion of devices with low encryption strength.

It is a figure which illustrates the whole structure of the device management system which concerns on one Embodiment of this invention. It is a figure which illustrates the hardware composition of the device management apparatus. It is a figure which illustrates the hardware configuration of a device. It is a block diagram which illustrates the functional structure of a device management device and a device. It is a figure which illustrates the device information held by the device information holding part. It is a figure which illustrates the communication setting held by the communication setting holding part. It is a flowchart explaining the operation of the device management system which concerns on embodiment. It is explanatory drawing explaining the operation of the equipment management system which concerns on embodiment. It is explanatory drawing explaining the operation of the conventional equipment management system.

Hereinafter, one embodiment of the device management system, the device management device, and the program according to the present invention will be described in detail with reference to the accompanying drawings. The present invention is not limited to the following embodiments.

[overall structure]
FIG. 1 is a diagram illustrating the overall configuration of the device management system 1 according to the embodiment of the present invention. As shown in FIG. 1, the device management system 1 includes a device management device 10, a plurality of devices 20, and a server device 30.

The device management device 10 is connected to a plurality of devices 20 via the network 50. It is connected to the server device 30 via the device management device 10 and the network 60. The network 50 is, for example, a network such as an in-house LAN (Local Area Network) used in a corporate office or the like. The network 60 is, for example, an external network such as the Internet.

The device management device 10 is installed, for example, in the office of a user who uses the device 20. The device management device 10 is also referred to as an intermediary device. The device management device 10 is equipped with management software (application program) for controlling and managing the device 20.

The device management device 10 communicates with each device 20 and collects operation information from each device 20. The device management device 10 transmits the operation information collected from each device 20 to the server device 30.

The device 20 is an image forming apparatus, for example, a multifunction device (MFP: Multi-Function Peripheral). The multifunction device is a device having at least two functions of a printing function, a copying function, a scanner function, and a facsimile function. The device 20 is not limited to the image forming device, but may be a network device, an electronic device, a PC, or the like. Further, as the plurality of devices 20, different types of devices may coexist.

When the device 20 is an image forming apparatus, the above-mentioned operation information includes a remaining amount value of consumables such as paper and toner, a count value of the number of printed sheets, error information, and the like.

The plurality of devices 20 communicate with the device management device 10 via the network 50 for each device 20.

The server device 30 communicates with the device management device 10 via the network 60. The server device 30 is a device that remotely manages each device 20 based on the operation information acquired via the device management device 10. The device management device 10 performs counter counting, consumables ordering, dispatch of customer engineers, and the like based on the operation information of each device 20.

For ensuring security, for example, SSL encrypted communication is used for communication between the device management device 10 and each device 20 and communication between the device management device 10 and the server device 30. The device management device 10, the device 20, and the server device 30 each have a public key certificate (electronic certificate), and each time they communicate with each other, they exchange certificates with each other to confirm that the other party is correct. Perform encrypted communication.

[Hardware configuration of device management device]
Next, the hardware configuration of the device management device 10 will be described. FIG. 2 is a diagram illustrating a hardware configuration of a device management device.

As shown in FIG. 2, the device management device 10 includes a CPU (Central Processing Unit) 101, a RAM (Random Access Memory) 102, a ROM (Read Only Memory) 103, an HDD (Hard Disk Drive) 104, and a device I / F 105. It has a network I / F 108, which are connected to each other via a bus 109. Further, a display unit 106 and an operation unit 107 are connected to the device I / F 105.

The CPU 101 comprehensively controls the operation of the entire device management device 10. The RAM 102 is used as a work area when the CPU 101 processes information. A program such as firmware is stored in the ROM 103. The HDD 104 stores an OS (Operating System), various control programs, application programs, and the like. The HDD 104 stores files, data, and the like necessary for realizing various functions of the device management device 10. Further, the HDD 104 stores various management information parameters and management programs used for managing the device 20 to be managed.

The device I / F 105 is an interface for connecting the display unit 106 and the operation unit 107 to the bus 109. The display unit 106 is a visual user interface for displaying various information, and is composed of, for example, an LCD (Liquid Crystal Display) or the like. The operation unit 107 is a user interface for a user to input various information to the device management device 10, such as a keyboard and a mouse. The network I / F 108 is an interface for connecting the device management device 10 to the networks 50 and 60.

The software control unit is configured by the CPU 101 performing an operation according to a program stored in the ROM 103 or a program loaded in the HDD 104 or the RAM 102. A functional block is configured by the combination of the software control unit and the hardware. Since the hardware configuration of the server device 30 is the same as that of the device management device 10, the description thereof will be omitted.

The program used by the device management device 10 may be a file in an installable format or an executable format, recorded on a computer-readable recording medium such as a recording medium, and distributed.

[Hardware configuration of equipment]
Next, the hardware configuration of the device 20 will be described. FIG. 3 is a diagram illustrating a hardware configuration of the device 20.

As shown in FIG. 3, the device 20 includes a CPU 201, a ROM 202, a RAM 203, an external storage device 204, an engine unit 205, an operation display unit 206, and a communication I / F 207. Each of these parts is communicably connected by the system bus 208.

The CPU 201 reads a program stored in the ROM 202 or the like into the RAM 203 and executes it, and controls the operation of the device 20 in an integrated manner. The ROM 202 stores the program used by the device 20. The RAM 203 is used as a work area for calculation of the CPU 201.

The external storage device 204 is a storage device such as an HDD or SSD (Solid State Drive) that stores various data such as image data and print data.

The engine unit 205 is a hardware device that realizes a scanner function, a printer function, and the like. Further, the engine unit 205 has a sensor for detecting the remaining amount of consumables such as paper and toner, a counter for counting the number of printed sheets, a sensor for detecting various errors, and the like. These sensors and counters are used to acquire the above-mentioned operation information.

The operation display unit 206 is, for example, a touch panel or the like, and is a device that receives input of an instruction to the device 20 and displays information such as the state of the device 20. The operation display unit 206 may be separated into an operation unit and a display unit.

The communication I / F 207 is an interface for connecting to the network 50 and communicating data.

[Functional configuration]
Next, the functional configuration of the device management device 10 and the device 20 related to device management will be described. FIG. 4 is a block diagram illustrating the functional configurations of the device management device 10 and the device 20, and shows only characteristic parts related to the present embodiment.

In FIG. 4, the device 20a is a new type of device capable of switching the encryption strength, and is also hereinafter referred to as the device A. The device 20b is an old-type device whose encryption strength cannot be switched, and is hereinafter referred to as a device B. Hereinafter, when it is not necessary to distinguish between the devices 20a and 20b, it is simply referred to as the device 20.

[Functional configuration of device management device]
The functional configuration of the device management device 10 will be described. As shown in FIG. 4, the device management device 10 includes a communication unit 111, a certificate holding unit 112, a communication setting unit 113, a device search unit 114, a device information holding unit 115, and a device setting changing unit 116. Has. These are functional units realized by the CPU 101 executing a program. The certificate holding unit 112 corresponds to the first certificate holding unit described in the claims.

The communication unit 111 communicates with each device 20 via the network 50. Further, the communication unit 111 enables encrypted communication with each device 20 by, for example, SSL encrypted communication.

In SSL encrypted communication, a public key and a private key are used as the encryption key. Further, in SSL encrypted communication, a public key certificate (hereinafter, simply referred to as a certificate) is transmitted to the communication partner in response to a connection request from the communication partner. This certificate is electronic data that stores a public key together with information for identifying its owner and proves its identity. The signature algorithm and public key length (key length) are set in the certificate.

Certificates have different encryption strengths, for example, depending on the key length. For example, when the key length is 2048 bits, the cipher strength is higher than when the key length is 512 bits. Cryptographic strength represents the fragility and difficulty of decryption of the cipher. The higher the encryption strength, the more difficult it is for the encryption to be broken and the more difficult it is to decipher the data.

The certificate holding unit 112 holds a plurality of certificates for performing encrypted communication with each device 20. For example, the certificate holding unit 112 holds a certificate A having a key length of 2048 bits and a high encryption strength, and a certificate B having a key length of 512 bits and a low encryption strength. The certificate held by the certificate holder 112 is not limited to these two types of certificates A and B. The certificate holding unit 112 holds all kinds of certificates that are assumed to be held by each device 20.

The communication setting unit 113 sets communication for a plurality of ports of the device management device 10. Here, the port is an endpoint for the OS to perform data communication. Specifically, the communication setting unit 113 sets the communication for each device 20 based on the device information of each device 20 held in the device information holding unit 115.

The device search unit 114 searches for the device 20 connected to the network 50 in order to acquire the above device information. The device search unit 114 acquires device information (communication setting information) from each device 20 found by the search. The device information holding unit 115 holds the device information acquired by the device search unit 114.

FIG. 5 is a diagram illustrating device information held by the device information holding unit 115. As shown in FIG. 5, the device information includes the IP address (device address) of each device 20, the port number, the setting contents for the port, and the like. The device information shown in FIG. 5 indicates that, for example, the certificate A or the certificate B can be set in the 8080 port of the device A, and the certificate B is set in the 8081 port of the device B. ..

Returning to FIG. 4, the device setting changing unit 116 sets the communication settings of each device 20 based on the device information held by the device information holding unit 115 and the type of the certificate held in the certificate holding unit 112. change. Specifically, the device setting change unit 116 changes the setting so as to use the certificate having the highest encryption strength held by both the target device 20 and the device management device 10. For example, for the device A, the setting is changed so that the certificate A is set on the 8080 port. Since the certificate cannot be switched for the device B, the state in which the certificate B is set for the 8081 port is maintained.

Further, the communication setting unit 113 sets a plurality of certificates held in the certificate holding unit 112 to different ports. For example, the communication setting unit 113 sets the certificate B on the 443 port normally used in SSL encrypted communication, and sets the certificate A on the new 444 port.

The device setting changing unit 116 also sets the port number corresponding to the certificate type (encryption strength) set by the communication setting unit 113 in each device 20. That is, the communication path of each device 20 is set by the device setting changing unit 116 so as to connect to the port corresponding to the encryption strength among the plurality of ports of the device management device 10.

[Functional configuration of device A]
The functional configuration of the device 20a as the device A will be described. The device 20a has a communication unit 211a, a certificate holding unit 212a, a certificate selection unit 213a, and a communication setting holding unit 214a. The certificate holding unit 212a corresponds to the second certificate holding unit described in the claims.

The communication unit 211a communicates with the device management device 10 via the network 50. Similar to the communication unit 111 of the device management device 10, the communication unit 211a enables encrypted communication with the device management device 10 by, for example, SSL encrypted communication.

The certificate holding unit 212a holds a plurality of certificates in the same manner as the certificate holding unit 112 of the device management device 10. The certificate holding unit 212a holds, for example, the above-mentioned certificate A and certificate B.

The certificate selection unit 213a selects a certificate to be used for encrypted communication from a plurality of certificates held in the certificate holding unit 212a.

The communication setting holding unit 214a holds the communication setting for the device management device 10. This communication setting is changed based on the setting change instruction from the above-mentioned device setting change unit 116.

FIG. 6A is a diagram illustrating the communication settings held by the communication setting holding unit 214a. As shown in FIG. 6A, the communication settings include the IP address (device management device address) of the device management device 10, the port number, the setting contents for the port, and the like. As this communication setting, for example, one of the setting A and the setting B shown in FIG. 6A is selected. The setting A indicates that encrypted communication is performed with the communication method using the certificate A to the 444th port of the device management device 10. The setting B indicates that encrypted communication is performed with the communication method using the certificate B to the 443 port of the device management device 10.

The above-mentioned certificate selection unit 213a selects the certificate A and sets it to the 8080 port when the communication setting is the setting A, and selects the certificate B when the communication setting is the setting B. Set to port 8080.

[Functional configuration of device B]
The functional configuration of the device 20b as the device B will be described. The device 20b has a communication unit 211b, a certificate holding unit 212b, and a communication setting holding unit 214b.

The communication unit 211b has the same configuration as the device 20a. The certificate holding unit 212b holds only the certificate B having a low encryption strength. Therefore, the device 20b cannot select the certificate.

The communication setting holding unit 214b holds the communication setting for the device management device 10.

FIG. 6B is a diagram illustrating the communication settings held by the communication setting holding unit 214b. This communication setting indicates that encrypted communication is performed with the communication method using the certificate B to the 443 port of the device management device 10. Since the certificate is fixed in the device 20b, the communication setting is not changed by the device setting changing unit 116 of the device management device 10.

[Operation of device management system]
Next, the operation of the device management system 1 will be described. FIG. 8 is a flowchart illustrating the operation of the device management system 1. FIG. 9 is an explanatory diagram illustrating the operation of the device management system 1.

As shown in FIG. 8, in the device management system 1, first, as a preparatory operation before performing encrypted communication between the device management device 10 and the plurality of devices 20, the device search unit 114 first connects to the network 50. The device 20 is searched and device information is acquired (step S10). The device information exemplified in FIG. 5 acquired by the device search unit 114 is registered in the device information holding unit 115 (step S11).

Next, the device setting changing unit 116 changes the communication settings of each device 20 based on the device information registered in the device information holding unit 115 and the type of the certificate held in the certificate holding unit 112. (Step S12). For example, in the device 20b, the setting A shown in FIG. 6A is selected as the communication setting, and the certificate A is set in the 8080 port as shown in FIG.

Then, the communication setting unit 113 sets the communication of the device setting changing unit 116 (step S13). For example, as shown in FIG. 9, the 443 port and the 444 port are opened, the certificate B is set in the 443 port, and the certificate A is set in the 444 port.

After that, encrypted communication is performed between the device management device 10 and the plurality of devices 20 (step S13). For example, as shown in FIG. 9, encrypted communication using the certificate A having high encryption strength is performed between the device management device 10 and the device 20a. On the other hand, encrypted communication using the certificate B having a low encryption strength is performed between the device management device 10 and the device 20b.

[effect]
A conventional device management system will be described as a comparison with the device management system 1 according to the present embodiment. FIG. 9 is an explanatory diagram illustrating the operation of a conventional device management system. As shown in FIG. 9, in the conventional device management device, a fixed port (port 443) is always used for encrypted communication. Therefore, when the device management system includes the device A in which the certificate A and the certificate B can be selected and the device B having only the certificate B, between the device management device and each device. All encrypted communication is performed using the certificate B having a low encryption strength, and there is a problem that the security level of the entire device management system is lowered.

On the other hand, in the device management system 1 according to the present embodiment, in the device management device 10, certificates having different encryption strengths are set in different ports, so that the communication path corresponding to the encryption strength is used for each device 20. Encrypted communication can be performed. As a result, the deterioration of the security level of the entire device management system is suppressed.

In the device management system 1 according to the above embodiment, the device setting changing unit 116 of the device management device 10 is configured to perform the communication setting of the device 20a and the selection of the certificate. Instead of this, the user may be configured to be able to make communication settings for the device 20a and select a certificate via a user interface such as the operation display unit 206 shown in FIG.

Although the present invention has been described above based on each embodiment, the present invention is not limited to the requirements shown in the above embodiments. With respect to these points, the gist of the present invention can be changed to the extent that the gist of the present invention is not impaired, and can be appropriately determined according to the application form thereof.

1 Equipment management system 10 Equipment management equipment 20, 20a, 20b Equipment 30 Server equipment 50, 60 Network 111 Communication unit 112 Certificate holder (1st certificate holder)
113 Communication setting unit 114 Device search unit 115 Device information holding unit 116 Device setting changing unit 211a, 211b Communication unit 212a Certificate holding unit (second certificate holding unit)
212b Certificate holding unit 213a Certificate selection unit 214a, 214b Communication setting holding unit

Japanese Patent Application Laid-Open No. 2015-084509

Claims (8)

A device management device that communicates with multiple devices and manages each device.
A certificate holder that holds multiple certificates with different encryption strengths,
A communication setting unit that sets the plurality of certificates held in the certificate holding unit to different ports, and a communication setting unit.
A communication unit that performs encrypted communication with different encryption strength for each port,
Equipment management device with. A device search unit that searches for the plurality of devices and acquires device information from each device, and
The device information holding unit that holds the device information and
A device setting changing unit that changes the communication settings of each device based on the device information held in the device information holding unit, and a device setting changing unit.
The device management device according to claim 1, further comprising. The device management device according to claim 2, wherein the device setting changing unit changes the communication setting so that each device is connected to a plurality of the ports corresponding to the encryption strength. The device management device according to any one of claims 1 to 3, wherein the plurality of devices include an image forming device. A device management system having a plurality of devices and a device management device that manages each device by communicating with the plurality of devices.
The device management device is
The first certificate holder, which holds multiple certificates with different encryption strengths,
A communication setting unit that sets the plurality of certificates held in the first certificate holding unit to different ports, and a communication setting unit.
A communication unit that performs encrypted communication with different encryption strength for each port,
Equipment management system with. At least one of the plurality of devices is
A second certificate holder that holds multiple certificates with different encryption strengths,
A communication setting holding unit that holds communication settings for the device management device,
A certificate selection unit that selects one certificate from the plurality of certificates held in the second certificate holding unit according to the communication settings, and a certificate selection unit.
The device management system according to claim 5. The device management device is
A device search unit that searches for the plurality of devices and acquires device information from each device, and
The device information holding unit that holds the device information and
A device setting changing unit that changes the communication setting held in the communication setting holding unit based on the device information held in the device information holding unit.
The device management system according to claim 6, further comprising. A program executed by a device management device that communicates with multiple devices and manages each device.
In the device management device
A certificate holder that holds multiple certificates with different encryption strengths,
A communication setting unit that sets the plurality of certificates held in the certificate holding unit to different ports, and a communication setting unit.
A communication unit that performs encrypted communication with different encryption strength for each port,
A program that realizes the functions of.

Images