JP2011114805A - Communication apparatus and method, and program - Google Patents

Abstract

The present invention relates to communication capable of preventing information leakage due to transfer and improving the accuracy of device search by transferring the search packet when the received search packet satisfies a predetermined transfer condition. Providing equipment.
When a search packet is received by a first NIC, a device having a plurality of network I / Fs connected to different networks from each other satisfies a predetermined transfer condition among the received search packets Is transferred from the second NIC 109. When the second NIC 109 receives a response packet for the transferred search packet, the received response packet is transferred from the first NIC 108 to the transmission source of the search packet.
[Selection] Figure 4b

Description

  The present invention relates to a communication apparatus, method, and program, and more particularly, to a communication apparatus, method, and program having a multihome function for searching for communication apparatuses that are connected to different networks and exist on a plurality of networks.

  Conventionally, a device such as an image forming apparatus connected to a network can be searched (searched) via a network from a client PC and used for printing or the like. Technologies for searching for devices on the network include WSD (Web Services on Device), SLP (Service Location Protocol), SNMP (Simple Network Management Protocol), and the like.

  However, the above-described device search technique has a problem that device search cannot be performed across different networks separated by routers. This is because broadcast packets and multicast packets used when searching for devices are not transferred beyond the router (multicast packets are technically possible, but there are many environments that cannot be exceeded in operation).

  In order to solve the above problem, a search server that centrally manages devices has been proposed, but there is no means for the device or client PC to automatically know the address of the search server. Even if a server system for search is constructed, it is not used much.

  By the way, a device having a multi-home function that includes a plurality of network interfaces (I / F) and can simultaneously communicate with them is put into practical use. Some devices having a multihome function transfer multicast packets between networks using the function (see, for example, Patent Document 1). This makes it possible to search for devices (services) in different networks.

JP 2004-320766 A

  However, since a device having a conventional multihome function transfers all multicast packets, there is a risk of information leakage by transferring unintended packets.

  In addition, there are a plurality of means (protocols) for searching for devices, and it is difficult to use a device (service) that a user wants to use by simply transferring a multicast packet.

  The present invention is a communication apparatus and method capable of preventing information leakage due to transfer and improving the accuracy of device search by transferring the search packet when the received search packet satisfies a predetermined transfer condition. It aims at providing a program.

  In order to achieve the above object, a communication device according to claim 1 is a search packet for searching for a device connected to the network in a communication device including a plurality of network interfaces each connected to different networks. When one of the plurality of network interfaces is received, first transfer means for transferring, from the other of the plurality of network interfaces, a search condition that satisfies a predetermined transfer condition among the received search packets, and the transferred search A second transfer unit configured to transfer the received response packet from one of the plurality of network interfaces to the transmission source of the search packet when a response packet to the packet is received by the other of the plurality of network interfaces. Features .

  According to the present invention, when a received search packet satisfies a predetermined transfer condition, by transferring the search packet, information leakage due to transfer can be prevented and device search accuracy can be improved.

1 is a block diagram illustrating a hardware configuration of an image forming apparatus that is an example of an embodiment of the present invention. It is a figure which shows an example of the network environment where the device of FIG. 1 exists. It is a block diagram which shows the software structure relevant to the search process in a device. It is a flowchart which shows an example of the search packet transfer process in a device (the 1). It is a flowchart which shows an example of the search packet transfer process in a device (the 2). It is a figure which shows an example of the search packet transfer permission table which is the transfer conditions of a search packet. It is a figure which shows an example of the search table for managing the search packet which the device transferred. It is a figure which shows an example of the search response table for managing the search response packet which the device received. It is a figure which shows an example of the setting screen for setting the transfer conditions of the search packet in a device. It is a figure which shows an example of the setting screen for setting the transfer conditions of the search response packet in a device. It is a figure which shows an example of the search packet which a device receives. It is a figure which shows an example of the search packet which a device transmits. It is a figure which shows an example of the search response packet which a device transmits.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a block diagram illustrating a hardware configuration of an image forming apparatus which is an example of an embodiment of the present invention.

  In FIG. 1, an image forming apparatus (hereinafter, referred to as “device”) 100 is a printer including two network interfaces (network I / F), and includes the components described below.

  The CPU 101 executes the device software program and controls the entire device. The ROM 102 is a read-only memory, and stores a device boot program, fixed parameters, and the like. A RAM 103 is a random access memory, and is used for temporary data storage when the CPU 101 controls a device.

  The HDD 104 is a hard disk drive and is used for storing various data such as print data. The printer I / F control unit 105 is a device that controls the printer unit 112. The NVRAM 106 is a non-volatile memory, and stores various setting values of the device 100. The panel control unit 107 controls the operation panel 111 to display various information and input instructions from the user.

  The first network I / F control unit 108 is, for example, a network interface card (NIC), is connected to the network 113, and controls data transmission / reception with the network 113. Hereinafter, the first network I / F control unit 108 is referred to as a first NIC 108. The second network I / F control unit 109 is, for example, a network interface card (NIC), and is a NIC that is connected to the network 114 and controls transmission / reception of data with the network 114. Hereinafter, the second network I / F control unit 109 is referred to as a second NIC 109.

  The bus 110 is connected to the CPU 101, ROM 102, RAM 103, HDD 104, printer I / F control unit 105, NVRAM 106, panel control unit 107, first NIC 108, and second NIC 109. The bus 110 is a system bus through which control signals from the CPU 101 and data signals between devices are transmitted and received.

  FIG. 2 is a diagram illustrating an example of a network environment in which the device 100 of FIG. 1 exists. A part of the internal configuration of the device 100 is omitted from the internal configuration shown in FIG.

  The device 100 is connected to the network 113 by the first NIC 108. The second NIC 109 is also connected to the network 114. The network 113 and the network 114 are connected via the router 204. A PC (personal computer) 201 and a device 202 are connected to a network 113. The device 207 is connected to the network 114.

  FIG. 3 is a block diagram illustrating a software configuration related to search processing in the device 100.

  In FIG. 3, the packet reception unit 301 performs processing for receiving packets from the networks 113 and 114 by the first NIC 108 or the second NIC 109.

  The device search packet determination unit 302 determines whether the packet received by the packet reception unit 301 is a predetermined device search packet (hereinafter simply referred to as “search packet”). The device search response packet determination unit 303 determines whether the packet received by the packet reception unit 301 is a predetermined device search response packet (hereinafter simply referred to as “search response packet”).

  The device search packet transfer management unit 304 determines whether to transfer the received search packet. For example, the device search packet transfer management unit 304 refers to the transfer-permitted IP address or search packet transfer permission table set on the setting screen, determines whether there is a source address of the received search packet, and searches for the search packet. It is determined whether or not to transfer.

  The device search response packet transfer management unit 305 determines whether to transfer the received search response packet. For example, the device search response packet transfer management unit 305 refers to the transfer-permitted IP address set on the setting screen 900 shown in FIG. Then, it is determined whether or not there is a source address of the received search response packet, and it is determined whether or not to transfer the search response packet.

  The device search / response packet transfer management unit 306 manages the transmission / reception status of search packets and search response packets, and controls transfer processing of search packets and search response packets. The search packet management unit 307 manages a search table 600 indicating the correspondence between the received search packet and the transferred search packet as shown in FIG. The search packet management unit 307 adds an entry indicating the relationship between the received search packet and the transferred search packet to the search table 600 each time the search packet is transferred. The search table 600 is used to determine which destination is to be transmitted with which protocol when a search response packet is received.

  The search protocol conversion unit 308 converts the received search packet or search response packet into a predetermined protocol, and generates a transfer search packet or search response packet. The search response packet management unit 309 manages the transferred search response packet. When searching with a plurality of protocols, a plurality of responses may be returned from the same device. In that case, in order to control to not return the search response redundantly to the original search packet transmission destination, the search response table 700 for managing the device that has made the search response is held as shown in FIG. If it is, the search response is not performed.

  The packet transmission unit 310 performs processing for transmitting a packet from the first NIC 108 or the second NIC 109 to the networks 113 and 114.

  Next, search packet transfer processing in the device 100 when a search packet is received from the PC 201 will be described.

  4A and 4B are flowcharts illustrating an example of search packet transfer processing in the device 100. FIG.

  In step S <b> 401, the packet receiving unit 301 receives the search packet (1) from the PC 201 by the first NIC 108. An example of a received search packet is shown in FIG. A search ID is set in the search packet. Here, the search ID of the search packet (1) is referred to as an original search ID. The device search packet determination unit 302 determines whether the packet is a search packet.

  In step S <b> 402, the device search / response packet transfer management unit 306 transmits a search response packet for the search packet (1) from the first NIC 108 to the PC 201.

  In step S403, the device search packet determination unit 302 determines whether or not the second NIC 109 has received the same search packet as the search packet (1) until a predetermined time has elapsed after receiving the search packet (1). To do. If the same search packet is received as a result of this determination, it is determined that the search packet has been transferred via the router 204, and this process is terminated. On the other hand, if not received, the process proceeds to step S404.

  In step S404, the device search packet transfer management unit 304 refers to the search packet transfer permission table 500 shown in FIG. 5 and the IP address information set on the setting screen 800 shown in FIG. It is determined whether or not 1) is satisfied. Details of the search packet transfer permission table 500 and the setting screen 800 will be described later.

  If the transfer condition is satisfied as a result of the determination in step S404, the packet transmitting unit 310 transfers the search packet (1) from the second NIC 109 using the same protocol as the search packet (1). Step S404 is an example of a first transfer unit. An example of a search packet to be transmitted is shown in FIG. For example, when the protocol of the search packet (1) is SLP, the search packet (1) is transferred by SLP.

  Further, in step S404, the device search / response packet transfer management unit 306 converts the search protocol of the search packet into another search protocol supported by the device 100, and the packet transmission unit 310 converts the converted search packet into the second search protocol. It is transmitted from the NIC 109. For example, when the protocol of the search packet (1) is SLP, a search packet such as SNMP or CPCA corresponding to the search packet (1) is generated and transferred. Regardless of the protocol type, the same ID is added by the device search / response packet transfer management unit 306 as the transfer search ID to the transferred search packet. In this embodiment, as shown in FIG. 6, the transfer search ID is assigned with numbers 1 to 6, but the transfer search ID is not limited to this format, and if the transferred search packet can be identified. Any identification information may be used. Step S404 is an example of a first conversion unit.

  Next, in step S405, the search packet management unit 307 registers predetermined information related to the transferred search packet in the search table 600 shown in FIG. Details of the search table 600 will be described later.

  Next, the process of step S407 to step S414 is repeated for a predetermined time, and a search response packet reception process for the search packet transferred from the second NIC 109 is performed.

  In step S407, when the packet receiving unit 301 receives the search response packet (2) by the second NIC 109, the process proceeds to step S408. In step S408, the device search response packet determination unit 303 refers to the search table 600 shown in FIG. 6 and acquires the original search ID from the transfer search ID included in the search response packet (2). Further, the IP of the search response device that is the transmission source of the search response packet (2) is acquired.

  Next, in step S409, the search response packet management unit 309 determines whether or not the IP of the search response device acquired in step S408 is registered in the search response table 700 of the original search ID shown in FIG. judge. Details of the search response table 700 will be described later.

  As a result of the determination in step S409, if the IP of the search response device is registered in the search response table 700 of the original search ID, the search response packet has already been transferred, so the search response packet is received without doing anything. Return to the waiting state. On the other hand, if the IP of the search response device is not registered in the search response table 700 of the original search ID, the process proceeds to step S410.

  In step S410, the search packet management unit 307 registers the IP of the search response device acquired in step S408 in the search response table 700 of the original search ID. In step S411, the device search / response packet transfer management unit 306 refers to the search table 600 based on the transfer search ID, and determines whether or not the protocol of the search response packet (2) is the same as the original (original) search protocol. Determine whether. If they are the same, the process proceeds to step S413. On the other hand, if not, the process proceeds to step S412.

  In step S412, the search protocol conversion unit 308 generates a search response packet (3) converted into the original search protocol. Step S412 is an example of a second conversion unit.

  In step S413, the packet transmission unit 310 transmits the search response packet (2) or (3) from the first NIC 108. When the search response packet (2) is transmitted, the original search protocol and the protocol of the search response packet (2) are the same. The search response packet (3) is transmitted when the original search protocol and the protocol of the search response packet (2) are different. In step S413, the device search / response packet transfer management unit 306 sets the source address of the search response packet (2) as the source IP address, and sets the MAC address of the device 100 as the source MAC address. . Step S413 is an example of a second transfer unit.

  In step S414, the device search / response packet transfer management unit 306 determines whether or not a predetermined time has elapsed after transferring the search packet. If the predetermined time has not elapsed, the process returns to step S407. When the predetermined time has elapsed, this process is terminated.

  In the above-described processing, the case where the search packet is received from the PC 201 on the network 113 by the first NIC 108 and transferred from the second NIC 109 to the network 114 has been described. However, the present invention is not limited to this. For example, the search packet can be received by the second NIC 109 from a PC or device on the network 114 and transferred from the first NIC 108 to the network 113.

  FIG. 5 is a diagram illustrating an example of a search packet transfer permission table, which is a search packet transfer condition.

  The search type 505 is divided into an SLP search 501, an SNMP search 502, a CPCA (Common Peripherals Controling Architecture) search 503, and a WSD search 504 for each type of search packet protocol. As a transfer condition, the search packet is transferred only when the search type packet is a packet for further searching for a device. The transfer conditions for each search type are defined in the search packet 506 transferred between the I / Fs.

  The transfer condition in the case of the SLP search 501 is that the destination (destination address) is a multicast address and the destination port is 427. In addition, the transfer condition is that the service type, which is a search attribute that can be set in the data area of the SLP packet, is “printer” and the scope is “xxx”. Thereby, for example, only a search packet received from a device manufactured by xxx can be transferred.

  The forwarding condition in the case of SNMP search 502 is that the destination (transmission destination address) is a broadcast address and the transmission destination port is 161. The transfer condition in the case of the CPCA search 503 is that the destination (transmission destination address) is a broadcast address and the transmission destination port is 47545. In addition, the fact that the CPCA header is b9b9 is also a transfer condition. Thereby, transfer of an illegal CPCA packet can be suppressed. The transfer condition for the WSD search 504 is that the destination (transmission destination address) is a multicast address and the transmission destination port is 80.

  When the search packet described above is received, the type of search packet transferred from another network I / F is defined in the search 507 performed by the device from another I / F. In the illustrated example, when each search type is received, the search is defined to be performed for all search types.

  FIG. 6 is a diagram illustrating an example of a search table 600 for managing search packets transferred by the device 100.

  The search table 600 manages the correspondence between the received original search protocol and the search source address and the transferred search packet. The search table 600 is used to know the original search protocol and destination address when a search response packet is received from the transfer destination network.

  The original search ID 601 indicates the search ID of the original search packet of the transferred search packet. An original search protocol 602 indicates a search protocol for an original search packet. The original search transmission source IP address 603 indicates the transmission source address of the original search packet.

  The transfer search ID 604 indicates the search ID of the transferred search packet. The search ID is generated by the device 100 so that the ID does not overlap in the search table 600 and has a unique value. The transfer search protocol 605 indicates the protocol of the transferred search packet.

  The device 100 adds an entry to the search table 600 each time a search packet is transferred. On the other hand, in step S414 of FIG. 4b described above, when a predetermined time set in advance for performing the search response packet reception process has elapsed (YES in step S414), the entry having the time-out original search ID is deleted. .

  FIG. 7 is a diagram illustrating an example of a search response table 700 for managing search response packets received by the device 100.

  The search response table 700 exists for each original search ID. The search response table 700 is a table for managing the transfer status of the search response packet so that the search response packet is not duplicated when the search response packet is transferred. This indicates that the search response packet from the device having the entry has been transferred.

  The search response device 702 indicates the IP address of the device that has returned the search response packet. An entry in the search response table 700 is added every time a search response packet is received. However, when a search response device is already registered in the search response table 700, registration is not performed. On the other hand, when a predetermined time set in advance for performing the search response packet reception process elapses in step S414 of FIG. 4b described above (YES in step S414), the search response table 700 of the matching original search ID 701 is deleted. Is done.

  Next, a method for setting the transfer conditions of the search packet and search response packet in the device 100 will be described.

  In the device 100, a setting screen as shown in FIGS. 8 and 9 is displayed on the operation panel 111, and the user can set transfer conditions for the search packet and the search response packet. A setting screen described below is displayed when the CPU 101 executes a predetermined process in response to a predetermined operation instruction to the operation panel 111.

  FIG. 8 is a diagram illustrating an example of a setting screen for setting search packet transfer conditions in the device 100.

  The search packet transfer permitted source address display field 801 displays a list of source addresses (IP addresses) that are currently permitted to transfer search packets. When the user inputs an IP address in the address addition field 802 and presses the add button 804, the transfer-permitted source address can be added. The added address is displayed in the search packet transfer permission source address display field 801.

  On the other hand, when the user presses the delete button 803 with the check box 805 in the search packet transfer permitted source address display field 801 checked, the checked address is deleted from the search packet transfer permitted source address display field 801. . As a result, the search packet is not transferred for the search packet received from the deleted source address. The setting screen 800 is an example of a first setting unit.

  FIG. 9 is a diagram illustrating an example of a setting screen for setting the search response packet transfer condition in the device 100.

  The search response packet transfer permitted source address display field 901 displays a list of source addresses (IP addresses) that are currently permitted to transfer search response packets. When the user inputs an IP address in the address addition field 902 and presses an add button 904, the transfer permitted source address can be added. The added address is displayed in the search response packet transfer permission source address display field 901.

  On the other hand, when the user presses the delete button 903 with the check box 905 in the search response packet transfer permitted source address display field 901 checked, the checked address is deleted from the search response packet transfer permitted source address display field 901. Is done. As a result, the search response packet is not transferred for the search response packet received from the deleted source address. The setting screen 900 is an example of a second setting unit.

  FIG. 10 is a diagram illustrating an example of a search packet (SLP) received by the device 100.

  In FIG. 10, the destination Ether address 1001 is set with the SLP multicast address. In the transmission source Ether address 1002, the address of the PC 201 that is the transmission source of the search packet is set. In the transmission source IP address 1003, the address of the PC 201 that is the transmission source of the search packet is set. In the destination IP address 1004, an SLP multicast address is set. A search ID is set in Xid1005. Since the illustrated packet is a search packet, the value set in Xid 1005 is the original search ID in the present embodiment.

  FIG. 11 is a diagram illustrating an example of a search packet (SLP) transmitted by the device 100.

  In the illustrated example, the search packet shown in FIG. 10 is received by the first NIC 108 from the network 113 and transferred from the second NIC 109 to the network 114.

  In FIG. 11, an SLP multicast address is set in the destination Ether address 1101. The address of the device 100 is set in the transmission source Ether address 1102. In the source IP address 1103, the address of the device 100 is set. The destination IP address 1104 is set with an SLP multicast address. A search ID is set in Xid 1105. Since the illustrated packet is a forwarded search packet, the value set in Xid 1105 is the forward search ID in this embodiment. This value is generated by the device 100 as a unique value.

  FIG. 12 is a diagram illustrating an example of a search response packet (SLP) transmitted by the device 100.

  The illustrated example is a search response packet that is returned from the device 207 in response to the search packet illustrated in FIG. 11 and received by the second NIC 109, and is transferred from the first NIC 108 to the transmission source PC 201 on the network 113. A search response packet is shown.

  In FIG. 12, the destination Ether address 1201 is set to the address of the PC 201 that is the source of the original search packet. The source Ether address 1202 is set with the address of the device 100. The source IP address 1203 is set with the address of the device 207. In the destination IP address 1204, the address of the PC 201 that is the transmission source of the original search packet is set. An original search ID is set in Xid 1205.

  According to the above embodiment, when the device 100 receives a search packet from one network I / F, the device 100 transfers only the search packet satisfying a predetermined transfer condition from the other network I / F. When transferring, the search packet is converted into a protocol supported by the device 100. When a search response packet for the transferred search packet is received by the other network I / F, only a predetermined search response packet is transferred from the one network I / F to the transmission source of the search packet based on the search response table 700. To do. When transferring, the search response packet is converted according to the protocol of the search packet. By limiting the packets to be transferred to specific packets in this way, there is no risk of information leakage, and device search can be performed reliably by automatically performing device search using multiple device search methods. It becomes.

  In the above embodiment, the embodiment in which the present invention is applied to the image forming apparatus has been described. However, the present invention is not limited to this, and may be a communication apparatus, an information processing apparatus having a communication function, a terminal, or the like. Not too long.

  Further, although the device 100 is connected to the wired networks of the networks 113 and 114, the present invention can be realized even if the device 100 has a wireless communication function and can be connected to a plurality of networks by different wireless communication methods. is there.

  In the above embodiment, the case where the SLP search is used has been described. However, the present invention is not limited to this, and SNMP, CPCA, WSD may be used, and other search methods may be used. Needless to say, this is applicable.

  The embodiment of the present invention can also be realized by executing software (program) acquired via a network or various storage media on a personal computer (CPU, processor).

1 Image forming device (device)
108 First network I / F control unit (first NIC)
109 Second network I / F control unit (second NIC)
113, 114 Network 301 Packet reception unit 302 Device search packet determination unit 303 Device search response packet determination unit 306 Device search / response packet transfer management unit 307 Search packet management unit 307
308 Search protocol converter

Claims (8)

In a communication device including a plurality of network interfaces each connected to different networks,
When a search packet for searching for a device connected to the network is received by one of the plurality of network interfaces, one of the received search packets that satisfies a predetermined transfer condition is received from the other of the plurality of network interfaces. A first transfer means for transferring;
A second transfer unit configured to transfer the received response packet from one of the plurality of network interfaces to a transmission source of the search packet when a response packet to the transferred search packet is received by the other of the plurality of network interfaces; A communication device comprising: First conversion means for converting the search protocol of the received search packet into another search protocol;
2. The communication apparatus according to claim 1, wherein the first transfer unit transfers a plurality of search packets converted into another search protocol by the first conversion unit. A determination means for determining whether a response packet is received from the same device when receiving a plurality of response packets with respect to the plurality of forwarded search packets;
3. The second transfer unit according to claim 2, wherein when the determination unit determines that the response packet is received from the same device, the second transfer unit sets the received response packet as transferred and does not transfer the response packet. Communication device. When the protocol of the received response packet is different from the search protocol of the received search packet, it further comprises second conversion means for converting the protocol of the response packet into the search protocol,
4. The communication apparatus according to claim 1, wherein the second transfer unit transfers the response packet converted by the second conversion unit. 5. First setting means for setting a transmission source address permitting transfer of the received search packet as the predetermined transfer condition;
The first transfer means does not transfer the search packet when the transmission source address of the received search packet is not a transmission source address that permits transfer set by the first setting means. The communication device according to any one of claims 1 to 4, wherein A second setting means for setting a source address permitting transfer of the received response packet as the predetermined transfer condition;
The second transfer means does not transfer the response packet when the transmission source address of the received response packet is not the transmission source address that permits the transfer set by the second setting means. The communication device according to claim 1, wherein: In a communication method of a communication device including a plurality of network interfaces each connected to different networks,
When a search packet for searching for a device connected to the network is received by one of the plurality of network interfaces, one of the received search packets that satisfies a predetermined transfer condition is received from the other of the plurality of network interfaces. A first transfer step of transferring;
A second transfer step of transferring the received response packet from one of the plurality of network interfaces to a transmission source of the search packet when a response packet to the transferred search packet is received by the other of the plurality of network interfaces; A communication method comprising:   A computer-readable program for causing a computer to execute the communication method according to claim 7.

Images