Relay device, program for relay device, and information processing system

A relay device includes: a hardware processor that refers to association information associating an address of a device and a port number in a first network with a port number of a second network to relay communication between the device in the first network and a device in the second network, wherein the hardware processor dynamically changes the association information on the basis of a state of the device in the first network.

Japanese Patent Application No. 2016-212015 filed on Oct. 28, 2016, including description, claims, drawings, and abstract the entire disclosure is incorporated herein by reference in its entirety.

BACKGROUND

Technological Field

The present disclosure relates to relay devices, programs for relay devices, and information processing systems, and in particular, to a relay device, a program for the relay device, and an information processing system.

Description of the Related Art

In the related art, various proposals have been made on a relay device that relays data transmission. For example, JP 2007-219711 A discloses a program for remote device control that: acquires connection information of a peripheral device locally connected to another computer via a network; displays the connection information to a user to facilitate selection; performs switching of control right of a peripheral device driver corresponding to the peripheral device selected by the user; and performs data conversion processing between a data structure for the peripheral device and a data structure for the network.

JP 11-345106 A discloses a management server that converts a monitoring signal of Simple Network Management Protocol (SNMP) output from a network printer into an HTML signal conforming to HTTP, and outputs this HTML signal to a terminal equipped with a World Wide Web (WWW) browser as push type information.

JP 2001-160825 A discloses packet relay device that refers to an address conversion result of a transmission data relaying unit to perform inverse conversion on a destination virtual Internet Protocol (IP) address into the original address.

A router, which is an example of a relay device that relays communication between networks, refers to information such as a forwarding table and relays data. For example, a router forwards data from an external network to a device in a device of an internal network. The router identifies the device as a transfer destination in accordance with the forwarding table.

In the related art, in the case where a new device is registered in an internal network, an administrator of the internal network registers the new device in the router. Thus, there is a disadvantage that it is cumbersome for the administrator to grasp devices in the internal network and to perform setting of the registration and other processes.

SUMMARY

The present disclosure has been devised in view of the above circumstances, and an object thereof is to simplify setting operation in a relay device.

To achieve the abovementioned object, according to an aspect of the present invention, a relay device reflecting one aspect of the present invention comprises: a hardware processor that refers to association information associating an address of a device and a port number in a first network with a port number of a second network to relay communication between the device in the first network and a device in the second network, wherein the hardware processor dynamically changes the association information on the basis of a state of the device in the first network.

DETAILED DESCRIPTION OF EMBODIMENTS

Hereinafter, one or more embodiments of a relay device according to the present invention will be described with reference to the drawings. However, the scope of the invention is not limited to the disclosed embodiments. In the following description, the same parts and components are denoted by the same symbol. Their names and functions are also the same. Therefore, descriptions thereof are not repeated.

FIG. 1is a diagram for explaining an outline of the present disclosure. InFIG. 1, three states A to C of a network system1including a router4according to the present disclosure are illustrated. The network system1includes three devices each denoted by one of symbols2to5(a PC server2, an MFP3, and a storage device5) which communicate with an external network via the router4.FIG. 2is a diagram illustrating an example of a specific configuration of the network system1. InFIG. 2, an example of IP addresses and port numbers assigned to each of the PC server2, the MFP3, and the storage device5is illustrated.

The router4relays communication among the devices in the network system1and the external network in accordance with a forwarding table40and the IP addresses of the respective devices and the port numbers in the network system1. In the present disclosure, the forwarding table is an example of association information for associating port numbers in a plurality of networks with each other. Information that the router4uses for data transfer between networks may be in any form and is not limited to those having a table structure as illustrated inFIG. 3.

The router4transfers data from the external network (external network NT inFIG. 2) to a transfer destination in the network system1. The router4identifies a device as the transfer destination in accordance with the forwarding table. The transfer destination is selected from among one or more of the PC server2, the MFP3, and the storage device5. Furthermore, the router4transfers data from a device in the network system1to a transfer destination in the external network identified by the forwarding table.

State A inFIG. 1illustrates a case where the forwarding table40does not include an entry of a source in the external network having transmitted the data to the router4. In this case, the router4transfers the data received from the source to all the devices (the PC server2, the MFP3, and the storage device5) in the network system1(arrows A01to A03).

State B inFIG. 1illustrates that the MFP3responds in accordance with the transfer of state A. The response is indicated by an arrow A11.

State C inFIG. 1illustrates that the router4changes the forwarding table40in accordance with the response of state B. In state C, the router4changes the forwarding table40such that information associating the source of the data of state A with the source of the response of state B is added.

FIG. 3is a diagram illustrating an example of contents of the forwarding table40. As illustrated inFIG. 3, the forwarding table40associates a protocol, an external port number, a LAN side IP address, and a LAN side port number. The protocol is a protocol of transmitted and received data. The external port number is a port number associated with data transmitted from the external network side. The LAN side IP address is an IP address in the network system1. The LAN side port number is a port number of each of the devices in the network system1. IP addresses and port numbers illustrated inFIG. 3conform to the example of the IP addresses and the port numbers ofFIG. 2.

For example, a forwarding table40ofFIG. 3associates an external port number “9100” with a LAN side port number “9100” of a LAN side IP address “192.168.1.40”. Therefore, when data of the port number “9100” is received from the external network, the router4transfers the data to the port number “9100” of the MFP3corresponding to the LAN side IP address “192.168.1.40” of the LAN side port number “9100”.

The forwarding table40ofFIG. 3has an entry including an external port number “1”. However, in this entry, the external port number “1” is not associated with any LAN side IP address or any LAN side port number. Due to this, upon receiving data of the port number “1” from the external network, the router4does not transfer the data to any of the devices in the network system1and transmits, to a source of the data, information indicating that transmission of data of that port number is prohibited. In this manner, registration of an external port number not associated with a LAN side IP address or a LAN side port number in the forwarding table40means that the forwarding table40prohibits transfer data of that external port number in the network system1.

The forwarding table40inFIG. 3associates an external port number “21” to a LAN side port number “21” of the LAN side IP address “192.168.1.40” and the LAN side port number “21” of the LAN side IP address “192.168.1.50”. Therefore, when the router4receives data of the port number “21” corresponding to the LAN side IP address “192.168.1.50” from the PC server2, the router4transfers the data to a device corresponding to the external port number “21”.

Modes of changing the forwarding table are listed below.

(Addition of Port Number)

The forwarding table40ofFIG. 3does not include an entry corresponding to an external port number “80”. Therefore, upon receiving data of the external port number “80”, the router4transfers the data to all the devices (the PC server2, the MFP3, and the storage device5) in the network system1. Upon receiving a response to the data, the router4changes the forwarding table40by adding information associating a destination of the response to the port number “80”.FIG. 4is a diagram illustrating another example of the forwarding table40after the change.

The forwarding table40ofFIG. 4contains an entry for the protocol “TCP/UDP (HTTP)” as compared to the forwarding table40ofFIG. 3. In this entry, the external port number “80” is associated with the LAN side port number “80” of the LAN side IP address “192.168.1.40”.

(Deletion of Port Number)

For example, when identifying uninstallation of any application in a device in the network system1, the router4changes the forwarding table40by deleting an entry of a port number of a protocol used by the application.

For example, in the case where the information illustrated inFIG. 4is registered as the forwarding table40, when the router4detects that the MFP3(LAN side IP address “192.168.1.40” (seeFIG. 2)) has uninstalled an application that processes the HTTP protocol, the router4changes the state of the forwarding table40from that ofFIG. 4to that ofFIG. 3. The forwarding table40ofFIG. 4contains an entry for the protocol “TCP/UDP (HTTP)” while the forwarding table40ofFIG. 3does not contain such an entry. That is, upon detecting that the MFP3has uninstalled the application that processes the HTTP protocol, the router4deletes an entry related to the HTTP protocol from the forwarding table40.

In the present specification, information indicating that transmission of data of a port number is prohibited is also referred to as “prohibition information”. For example, when the router4receives error responses from within the network system1for a given port number, the router4updates the forwarding table by registering prohibition information for the port number.FIG. 5is a diagram illustrating still another example of the forwarding table40after the change.

For example, it is assumed that the router4has received data of the port number “9100” (protocol “TCP/UDP (LPR)”) from the external network and, in response to this, has transferred the data to the LAN side port number “9100” of the MFP3(LAN side IP address “192.168.1.40”). Upon receiving an error response from the MFP3as a response to this, the router4updates the forwarding table by registering prohibition information in the external port number “9100”. As a result, the state of the forwarding table40is changed from that ofFIG. 3to that ofFIG. 5.

InFIG. 3, the external port number “9100” is associated with the LAN side port number “9100” of the LAN side IP address “192.168.1.40” (MFP3). On the other hand, inFIG. 5, the external port number “9100” is registered in the forwarding table in a state not associated with a LAN side IP address or a LAN side port number. That is, the router4registers the external port number “9100” without associating with a LAN side IP address or a LAN side port number and thereby registers the prohibition information for the external port number “9100” in the forwarding table.

[4. Configuration of Network System]

The network system1is configured, for example, as an integrated network system.FIG. 6is a diagram illustrating a configuration example of a network system. As illustrated inFIG. 6, the network system1includes the PC server2, the MFP3, the router4, and the storage device5. A configuration of each of the above will be described below.

The PC server2implements a function as a network server. The PC server2includes an authentication server10, a storage11, a display12, an operator13, an application controller14, and a communication interface (I/F)15.

The communication interface15is implemented by, for example, a network card. The PC server2is configured to communicate with other devices via the communication interface15.

The authentication server10is for authenticating a user who uses the MFP3. The authentication server10is implemented, for example, by a processor executing a predetermined program in a hardware configuration including a processor (central processing unit (CPU)201inFIG. 8to be described later) and a memory. The authentication server10functions as an authentication processor21that performs authentication processing of authenticating a user by executing a predetermined program by the processor, an authority manager22that manages authority when each user uses the MFP3, and an application manager23that manages applications28that operate the MFP3.

The storage11is an auxiliary storage device configured by, for example, a semiconductor memory or a magnetic disk device. The storage11stores user information25in which information on a user who uses the MFP3is registered in advance, authority information26in which authority for each user to use the MFP3is registered in advance, and application information27in which information on the applications28installed in the PC server2and remotely controlling the MFP3is registered in advance.

The display12and the operator13function as a user interface of a user using the PC server2. The display12is formed by, for example, a color liquid crystal display and displays various display screens to a user using the PC server2. The operator13receives an operation input from a user using the PC server2, and is formed by, for example, a keyboard, a mouse, a touch panel arranged on a screen of the display12, and the like.

The application controller14activates the applications28that causes the MFP3to operate in the PC server2. As illustrated inFIG. 6, in the PC server2, a plurality of applications28ato28eare installed as applications28for operating the MFP3. The application controller14selects and activates at least one application28from among the plurality of applications28ato28e.

For example, a copy application28auses a copy function of the MFP3, and is capable of causing the MFP3to execute a copy job. A scan application28buses a scan function of the MFP3, and is capable of causing the MFP3to execute a scan job. A print application28cuses the print function of the MFP3and is capable of causing the MFP3to execute a print job. A cloud connection application28dis connected to a cloud server on the cloud and allows the cloud server and the MFP3to mutually cooperate. For example, the cloud connection application28dallows the cloud server to transfer job data to the MFP3, or allows the MFP3to transfer job data to the cloud server. An MFP cooperation application28eis an application for allowing a plurality of MFPs to cooperate with each other, for example, allowing one MFP to transfer job data to another MFP. When these applications28ato28eare activated by the application controller14, the PC server2can remotely control the MFP3to execute a job. When it is not necessary to distinguish among the plurality of applications28ato28e, they are collectively referred to as applications28.

When a user who intends to use the MFP3inputs a user ID and a password to the operator13, the authentication processor21of the authentication server10performs authentication processing of authenticating the user. That is, the authentication processor21reads the user information25from the storage11, determines whether the combination of the user ID and the password input by the user is registered in the user information25. If the same combination is registered in the user information25, the authentication is successful, and the authenticated user is identified. On the other hand, if the same combination as the combination of the user ID and the password input by the user is not registered in the user information25, the authentication processor21determines that the authentication has failed.

When the user is authenticated in the authentication processing, the authentication processor21notifies the authority manager22of information on the authenticated user. The authority manager22extracts authority information on the authenticated user from among authority information of a plurality of users registered in the authority information26and outputs the extracted information to the authentication processor21. As a result, the authentication processor21can acquire the authority information for the authenticated user to use the MFP3as the user is authenticated in the authentication processing.

Upon acquiring the authority information on the authenticated user, the authentication processor21notifies the application manager23of a function available to the authenticated user or a function unavailable to the authenticated user on the basis of the authority information, and requests application information on any of the applications28available to the authenticated user. When the function available to the authenticated user or the function unavailable to the authenticated user is notified from the authentication processor21, the application manager23extracts, from information registered in the application information27, application information on the applications28available to the authenticated user, and outputs the information to the authentication processor21. As a result, the authentication processor21can acquire the application information on the applications28available to the authenticated user as the user is authenticated in the authentication processing.

When a user is authenticated in the authentication processing, the authentication processor21generates unique identification information related to the PC server2. This identification information may be, for example, an IP address of the PC server2or a server certificate certifying issuance by the authentication server10.

When authenticating the user in the authentication process, the authentication processor21further shifts an operation state of the PC server2from a logout state to a login state. The login state is an operation state in which the authenticated user identified in the authentication process can use the MFP3. The authentication processor21establishes a session for communicating with the MFP3by a predetermined protocol upon shifting the PC server2to the login state and transmits login information to the MFP3via the session. The login information includes various information as described below in addition to the application information on the applications28available to the authenticated user.

Having transmitted the login information to the MFP3, the authentication processor21causes the application controller14to function. As a result, the application controller14operates in the PC server2to allow the applications28to be activated. The authentication processor21notifies the application controller14of the application information on the applications28available to the authenticated user as the application controller14is caused to function.

When the application controller14functions as the PC server2shifts to the login state, the application controller14specifies applications28available to the authenticated user from among the plurality of applications28ato28eon the basis of the application information notified from the authentication processor21. Then, the application controller14generates an application selection screen allowing the identified applications28to be selected and displays the screen on the display12. This allows the authenticated user to select any of the applications28available to the user and to give an activation instruction after logging in to the PC server2. When the applications28are selected by the authenticated user, the application controller14executes a program corresponding to the selected applications28to activate the applications28.

The applications28activated by the application controller14transmits an access request to the MFP3and starts communication with the MFP3. The access request transmitted at this time may include various information in addition to the application information set in the applications28. Then, the applications28receive a permission notice from the MFP3that permits an access to start processing for remotely controlling the MFP3. That is, the applications28display, on the display12, a job setting screen for setting a job to be executed in the MFP3, performs setting of the job for the MFP3on the basis of job setting operation by the authenticated user. Furthermore, as operation of instructing execution of the job is performed by the authenticated user, the applications28cause the MFP3to execute the job specified by the authenticated user.

When communicating with the MFP3, the applications28execute communication using the session established with the MFP3by the authentication server10, for example, by performing communication by mediated by the application manager23. In this case, the application manager23can establish a session between the applications28and the MFP3by encapsulating information transmitted and received between the applications28and the MFP3by a predetermined protocol. When the application manager23acquires an access request to the MFP3from the applications28which are not under control thereof, however, the application manager23does not encapsulate or transmit such an access request. As a result of this, it is possible to prevent an unauthorized application from transmitting an access request to the MFP3.

The authentication processor21shifts the PC server2from the login state to the logout state on the basis of logout operation by the authenticated user. In response to logging out of the authenticated user, the authentication processor21transmits logout information to the MFP3.

The MFP3implements a function as a multifunction peripheral equipped with functions of a copying machine, a scanner, and a printer. The MFP3includes an authentication cooperation module30, a communication interface35, and a job controller36.

The authentication cooperation module30of the MFP3performs operation in cooperation with the authentication server10of the PC server2. The authentication cooperation module30is implemented by a hardware configuration including a CPU, a memory, and an auxiliary storage device, for example, with the CPU executing a predetermined program. The authentication cooperation module30functions as a received information manager41which manages information transmitted from the authentication server10with the CPU executing a predetermined program, an access detector43which detects an access from the applications28activated in the PC server2, and a determiner44which judges whether to permit an access from the applications28. The authentication cooperation module30has a storage42. The storage42is formed by an auxiliary storage device such as a semiconductor memory or a magnetic disk device.

The job controller31includes a copy interface361a, a scan interface362a, a print interface363a, a BOX interface364a, a copy controller361b, a scan controller362b, a print controller363b, and a storage device364b. The copy interface361a, the scan interface362a, the print interface363a, and the BOX interface364aare interfaces for the external applications28to remotely control the respective functions of the MFP3. By permitting an access from the applications28by the authentication cooperation module30, input and output of various data between the applications28and the copy controller361b, the scan controller362b, the print controller363b, and the storage device364bare permitted.

The MFP3includes a scanner and a printer (not illustrated inFIG. 6). In the MFP3, a copy job is executed by, for example, the scanner and the printer. A scan job is executed by, for example, the scanner. A print job is executed by the printer. The copy controller361bcontrols the execution of the copy job in the MFP3. The scan controller362bcontrols the execution of the scan job in the MFP3. The print controller363bcontrols the execution of the print job in the MFP3. The storage device364bis formed by a magnetic disk device or the like, and stores document data and other data. The copy controller361b, the scan controller362b, and the print controller363bare implemented, for example, by the CPU implemented in the MFP3executing a given program. Storage of document data and other data in the storage device364bis called, for example, “BOX function”. By the BOX function, the MFP3can also function as a server.

The MFP3further includes a display37and an operator38. The display37is implemented by, for example, a display device such as a plasma display. The operator38is implemented by, for example, hardware buttons and/or software buttons displayed on the display37. The copy controller361b, the scan controller362b, and the print controller363bmay control execution of a copy job, a scan job, and a print job, respectively, in accordance with an input to the operator38. The BOX function may be implemented in accordance with an input to the operator38.

The copy controller361b, the scan controller362b, and the print controller363bcan display an execution result and other information of the copy job, the scan job, and the print job, respectively, on the display37. The CPU of the MFP3may display an execution result of the BOX function on the display37.

The communication interface35is implemented by, for example, a network card. The MFP3communicates with other devices via the communication interface35.

The received information manager41of the authentication cooperation module30establishes a session for communicating by a predetermined protocol with the PC server2on the basis of a request from the authentication server10to allow for a state where information transmitted from the authentication server10can be received. Upon receiving login information from the authentication server10, the received information manager41stores and manages the login information in the storage42. The received information manager41manages the login information stored in the storage42until logout information is received from the authentication server10.

After the received information manager41receives the login information and the storage42stores the login information, the access detector43detects an access from the applications28activated in the PC server2. That is, the access detector43detects an access request transmitted from the applications28via the session established with the authentication server10and outputs the access request to the determiner44. By receiving the access request via the session with the authentication server10, the access detector43can determine that the applications28that are the source of the access request has certain reliability. Therefore, when receiving the access request via the session with the authentication server10, the access detector43outputs the access request to the determiner44. When receiving the access request not via the session, the access detector43does not output the access request to the determiner44. As a result, applying a primary filter to the access request before performing the determination by the determiner44allows the security of the network system1to be improved.

Upon acquiring the access request from the access detector43, the determiner44reads the login information stored in the storage42, collates information included in the access request with information included in the login information, and determines whether to permit the access from the application28. That is, when the information included in the login information received from the authentication server10matches the information included in the access request received from the applications28, the determiner44determines that the applications28are highly reliable and permits the access from the applications28. On the other hand, when the information included in the login information does not match the information included in the access request, the determiner44refuses the access from the applications28since the reliability of the applications28cannot be verified. Then, the determiner44notifies the applications28that are a source of the access request of the determination result of the access request.

Upon transmitting a permission notice permitting the access to the applications28, the determiner44instructs the job controller31to release, to the applications28, an interface corresponding to a function available to the authenticated user from among the copy interface361a, the scan interface362a, the print interface363a, and the BOX interface364aand to permit an access from the applications28. As a result, when detecting an access from the interface corresponding to a function available to the authenticated user from among the copy interface361a, the scan interface362a, the print interface363a, and the BOX interface364afrom the applications28that the determiner44has transmitted the permission notice, the job controller31permits the access to allow the function of the MFP3to be used.

The router4implements a function as a router of the network system1.FIG. 7is a diagram illustrating a configuration example of the router4illustrated inFIG. 6.

As illustrated inFIG. 7, the router4includes a storage70, a controller80, a LAN side interface81, and a WAN side interface82. The storage70is implemented by a nonvolatile memory, for example, and includes a forwarding table storage71and a data storage72. The forwarding table storage71stores the forwarding table40(e.g.FIG. 1). The data storage72stores various programs and data used for processing executed in the router4.

The controller80controls operation of the router4. The controller80includes, for example, a processor that executes a program for implementing a router function.

The LAN side interface81is an interface for communicating with other devices in the network system1, and is implemented by, for example, a network card. The WAN side interface82is an interface for communicating with a device on the external network, and is implemented by, for example, a network card.

Returning back toFIG. 6, the storage device5implements a function as a storage device. The storage device5is implemented by, for example, a hard disk compatible with Internet Small Computer System Interface (iSCSI).

Hardware configurations of each of the PC server2, the MFP3, and the router4will be described.

FIG. 8is a diagram illustrating a hardware configuration of the PC server2. The PC server2includes a CPU201which is an arithmetic device functioning as a control device of the PC server2, a hard disk202for storing, in a nonvolatile manner, a program executed by the CPU201and other information, a RAM203functioning as a work space for the CPU201to execute a program, a communication processor204, a display205, and a keyboard206as an example of an input device.

The hard disk202forms the storage11inFIG. 6. By executing a given program, the CPU201forms the authentication server10and the application controller14inFIG. 6. The communication processor204forms the communication interface15inFIG. 6. The display205forms the display12inFIG. 6. The keyboard206forms the operator13inFIG. 6.

FIG. 9is a diagram illustrating a hardware configuration of the MFP3. Referring toFIG. 9, the MFP3includes a CPU301which is an arithmetic device functioning as a control device of the MFP3, a read only memory (ROM)302for storing, in a nonvolatile manner, a program executed by the CPU301as a memory, a random access memory (RAM)303functioning as a work space for the CPU301to execute a program, a communication processor304, an operation panel305forming a display device and an input device, a scanner306for optically reading a document placed on a document table (not illustrated) and obtaining image data, a printer307for fixing the image data on a recording medium (for example, printing paper), and a hard disk308.

The operation panel305includes a touch panel and a group of operation keys (not illustrated). The touch panel may be configured such that a display device such as a liquid crystal display device and a position indication device such as an optical touch panel or a capacitance touch panel overlap with each other. The display device displays an operation screen to specify an indicated position on the operation screen. The CPU301causes the touch panel to display the operation screen on the basis of data for displaying the screen stored therein in advance. An operation signal indicating an indicated position (touched position) specified on the touch panel or a pressed key is input to the CPU301. The CPU301specifies an operation content from the pressed key or the displayed operation screen and the indicated position and executes processing on the basis of the operation content.

By executing a given program, the CPU301forms the respective elements of the authentication cooperation module30ofFIG. 6(the received information manager41, the access detector43, and the determiner44) as well as the respective elements of the job controller36ofFIG. 6(the copy interface361a, the scan interface362a, the print interface363a, the BOX interface364a, the copy controller361b, the scan controller362b, the print controller363b, and the BOX controller364b). The hard disk308forms the storage42inFIG. 6. The display device of the operation panel305forms the display37ofFIG. 6. The input device of the operation panel305forms the operator38ofFIG. 6.

FIG. 10is a diagram illustrating a hardware configuration of the router4. With reference toFIG. 10, the router4includes a CPU401which is an arithmetic device functioning as a control device of the router4, a memory402for storing, in a nonvolatile manner, a program executed by the CPU401or other information, a RAM403functioning as a work space for the CPU401to execute a program, a communication processor404, an indicator405, and an operation button406which is an example of an input device. The indicator405is formed by, for example, one or more lights. The CPU401controls on/off of the lights forming the indicator405in accordance with the state of the router4, for example.

The memory402forms the storage70inFIG. 7. The CPU401forms the controller80inFIG. 7by executing a given program. The communication processor404forms the LAN side interface81and the WAN side interface82inFIG. 7.

Specific operations of the router4when data transmitted from the external network is transferred to a device in the network system1will be described.FIG. 11is an exemplary flowchart of processing for the router4to transfer data received from an external network to a device in the network system1.

Referring toFIG. 1i, in step S10, the CPU401of router4determines whether a port number to which data received from the external network is associated is registered as an external port number in the forwarding table. If determining that the port number of the received data is registered as an external port number (YES in step S10), the CPU401advances the control to step S20, and if determining that it is not registered (NO in step S10), the CPU401advances the control to step S50.

In step S20, the CPU401determines whether the external port number in step S10is associated with prohibition information in the forwarding table. The external port number in step S10is the port number associated with data received by the CPU401from the external network. If determining that the external port number in step S10is associated with prohibition information (YES in step S20), the CPU401advances the control to step S30, and if determining that the external port number is not associated with prohibition information (NO in step S20), the CPU401advances the control to step S40.

In step S30, the CPU401returns a transmission error to the source of the data received from the external network. Thereafter, the processing ofFIG. 11is completed.

In step S40, the CPU401transfers the data received from the external network to a transfer destination identified in accordance with the forwarding table. Thereafter, the processing ofFIG. 11is completed.

In step S50, the CPU401transfers the data received from the external network to all the devices (the PC server2, the MFP3, and the storage device5) in the network system1. Thereafter, the control proceeds to step S60.

In step S60, the CPU401checks a response to the transfer of the data in step S50within a predetermined time period from the transfer and advances the control in accordance with a result of the check. That is, if there is no response from any of the devices in the network system1, the CPU401advances the control to step S70. If there is a response from one of the devices in the network system1, the CPU401advances the control to step S90. If there is a response from a plurality of devices in the network system1, the CPU401advances the control to step S110. In the processing ofFIG. 11, an example of the data received from the external network is data related to a request. An example of the response in step S60is transmission of a processing result corresponding to the request. Another example of the data received from the external network is data related to a file transmission request. Another example of the response in step S60is transmission of the requested file.

In step S70, the CPU401returns a transmission error to a source of the data received from the external network. Thereafter, the control proceeds to step S80.

In step S80, the CPU401registers, in the forwarding table, prohibition information to the port number of the data received from the external network. As a result, the forwarding table is changed, for example, from the state ofFIG. 3to the state ofFIG. 5(by addition of prohibition information of the external port number “9100”). Thereafter, the processing ofFIG. 11is completed.

In step S90, the CPU401transfers the response received from the device in the network system1to a source of the data received from the external network. Thereafter, the control proceeds to step S100.

In step S100, the CPU401adds information associating the port number of the data received from the external network and a port number of the source of the response in step S90to the forwarding table. As a result, the forwarding table is changed, for example, from the state ofFIG. 3to the state ofFIG. 4(by addition of an entry of the external port number “80”). Thereafter, the processing ofFIG. 11is completed.

In step S110, the CPU401selects a device having the highest priority from among the plurality of devices from which a response has received in step S60. The order of priority is determined by, for example, the number of times of processing the port number received from the external network. In one example, the CPU401selects a device having the largest number of times of response to a request for the port number of the received data. Thereafter, the control proceeds to step S120.

In step S120, the CPU401transfers the response transmitted from the device selected in step S110to the source of the data in the external network. Thereafter, the control proceeds to step S130.

In step S130, the CPU401adds information associating the port number of the destination of the data of the external network and a port number of the source of the response in step S120in the network system1to the forwarding table. As a result, the forwarding table is changed, for example, from the state ofFIG. 3to the state ofFIG. 4(by addition of an entry of the external port number “80”). Thereafter, the processing ofFIG. 11is completed.

According to the processing ofFIG. 11described above, the CPU401can change the forwarding table in accordance with response modes of the devices in the network system1. Such a change in accordance with response modes is an example of dynamic change of the forwarding table on the basis of the state of the devices in the network system1.

[7. Installation of Application]

FIG. 12is a diagram illustrating a sequence of processing of installation of an application in the MFP3. In the sequence ofFIG. 12, processing executed by each of the CPU301of the MFP3, the CPU401of the router4, and a license server8in the external network is illustrated.

In the sequence illustrated inFIG. 12, when installation of an application program (“application installation”) is completed in the MFP3(step SA10), the CPU301accesses the license server8of the application via the router4. As a result, the CPU of the MFP3requests a key for completing the installation of the application (activation). Arrows A21and A22inFIG. 12indicate an access from the MFP3to the license server8. For example, after the program of the application is installed, the application is activated by the key of the application to be in a state enabling execution.

When detecting the access to the server in the external network from the CPU301as indicated by the arrow A21, the CPU401detects that the MFP3is accessing the license server8in step SB10. The CPU401compares an address of the access destination of the MFP3with an address of the license server8stored in advance in the hard disk308or other components, and in the case of coincidence, the CPU401detects that the MFP3is accessing the license server8in step SB10.

When the key for completion of the installation is transmitted from the license server8in response to the access in step SA10, the key is transmitted to the MFP3via the router4. InFIG. 12, the transmission of the key is indicated by arrows A23and A24.

When the key is transmitted to the MFP3as indicated by the arrow A24, the CPU401of the router4inquires of the MFP3whether the installation of the application has been completed (arrow A25) in step SB20. In response to this, the CPU301of the MFP3responds to the router4as to whether the installation of the application has been completed in the MFP3(arrow A26).

When notified that the installation of the application has been completed from the MFP3, the CPU401of the router4updates the forwarding table in step SB30. In this update, an entry of a port number corresponding to the application is added to the forwarding table. For example, if the application activation of which has been completed in the MFP3is an application that handles data of the HTTP protocol, an entry associating a port number of the HTTP protocol with the MFP3is added to the forwarding table. More specifically, the state of the forwarding table is changed from that ofFIG. 3to that ofFIG. 4. The entry added inFIG. 4includes the external port number “80”, the LAN side IP address “192.168.1.40”, and the LAN side port number “80”.

According to the sequence ofFIG. 12, when requested of an access to a specific address from a device in the network system1, the router4inquires of the device about the state of the device and changes the association information in accordance with a result of the inquiry. InFIG. 12, as an example of the state of the device, completion of the installation of the application corresponding to the license server8is illustrated.

Note that, in a similar sequence to the sequence ofFIG. 12, the router4may inquire of the MFP3whether uninstallation of a predetermined application has been completed. The router4may update the forwarding table in response to detection of completion of uninstallation of the predetermined application in the MFP3. In the update, prohibition information is registered for a port number corresponding to the application in the forwarding table.

FIG. 13is a diagram illustrating still another example of the forwarding table. For example, in the MFP3, when the uninstallation of the application handling data of the HTTP protocol has been completed, the state of the forwarding table is changed from that ofFIG. 4to that ofFIG. 13. InFIG. 13, in the forwarding table, the external port number “80” is registered without being associated with any specific LAN side IP address or a LAN side port number.

However, when installation of the application is completed in the MFP3after the prohibition information is registered in the external port number “80” as illustrated inFIG. 13, the forwarding table is changed again such that the external port number “80” is associated with the LAN side IP address “192.168.1.40” and the LAN side port number “80” as illustrated inFIG. 4.

According to the sequence ofFIG. 12described above, the CPU401of the router4can change the forwarding table in accordance with modes of installing/uninstalling an application in the MFP3. Such a change of the forwarding table is an example of dynamic change of the forwarding table on the basis of the state of the devices in the network system1.

[8. IP Address when Data is Transferred to External Network]

When returning data from a device in the network system1to the external network, the router4may associate the response with the IP address of the router4, or may associate the response with an IP address of a device as a source of the data in the network system1. The CPU401of the router4determines whether to associate the response with the IP address of the router4or the IP address of the device as the source on the basis of a port number of the response, for example.

FIG. 14is a diagram for explaining a control mode related to transfer of print data. In the control illustrated inFIG. 14, (the CPU401of) the router4transfers print data from an external device901to the MFP3as indicated by an arrow A31. In response to this, the MFP3returns a status as a printer. The router4(CPU401) transfers this response to the external device901in association with the IP address of the MFP3(LAN side IP address “192.168.1.40”).

[9. Control over Acquisition Request of MIB Information]

FIG. 15is a diagram illustrating an example in which the router4transmits a response to an acquisition request of management information base (MIB) information from an external device902.

In the example ofFIG. 15, in response to an acquisition request of MIB information, the router4transfers the acquisition request of MIB information to the respective devices in the network system1(the PC server2, the MFP3, and the storage device5). The respective devices return MIB information thereof to the router4. The router4returns the MIB information of the respective devices to the external device902.

A definition file for avoiding conflict of MIB information of the devices in the network system1is stored in the memory402(FIG. 10) of the router4. When the MIB information returned from two or more devices conflict, in order to solve the conflict, the router4can convert each piece of the conflicting MIB information according to the definition file and then transfer the MIB information to the external device902. As a result, for example, MIB information of the MFP3may be transferred as MIB information of the original MFP3, or may be transferred after being converted to MIB information of a new device name.

The above definition file may integrate MIB information associated with a plurality of functions. For example, the above definition file integrates MIB information of a device in the network system1having a file storing function and MIB information of a device in the network system1having a printing function into a single device. As a result, the external device902can manage a part having the file storing function and a part having the printing function in the network system1as a single device.

[10. Switching Control of Transfer Destination in Accordance with Address of Request Source]

When receiving a request from the external network, the router4may change the forwarding table in accordance with an address of the request source.FIG. 16is a diagram for explaining determination of a transfer destination in accordance with a request source address in the network system.

In the example illustrated inFIG. 16, IP addresses of an external device903, an external device904, and the router4are set as follows:

IP address of the external device903: AAA.LLL.MMM.ZZZ;

IP address of the external device904: AAA.BBB.CCC.XXX; and

IP address of the router4: AAA.BBB.CCC.YYY.

In the above example, a case is assumed where the forwarding table associates a port number of a device in the external network with the PC server2and the MFP3.

In this case, when first sixteen bits of the IP addresses of the device and the router4are common, the router4changes the forwarding table such that data from the device is associated only with the MFP3. That is, upon receiving a request from the external device904, the router4transfers the request to the MFP3.

On the other hand, when the first sixteen bits of the IP addresses of the device and the router4are not common, the router4changes the forwarding table such that the data from the device is associated only with the PC server2. That is, upon receiving the request from the external device903, the router4transfers the request to the PC server2.

In the example ofFIG. 16, the device904with an IP address the first sixteen bits of which are common to those of the router4is considered to be located relatively close to the router4. On the other hand, the device903with an IP address the first sixteen bits of which are not common to those of the router4is considered to be located relatively far from the router4. As a result, data transmitted from a location close to the network system1is transferred to the MFP3to be printed while data transmitted from a location far from the network system is transferred to the PC server2to be accumulated in the PC server2.

The network system1described above includes the PC server2, the MFP3, the router4, and the storage device5. That is, in the network system1, the PC server2, the MFP3, the router4, and the storage device5behave as a single device. On the other hand, each of the PC server2, the MFP3, the router4, and the storage device5may be configured to be a transaction object solely as a separate device.

Processing executed in each of the PC server2, the MFP3, and the router4may be executed by one processor (CPU) as described with reference toFIGS. 8 to 10or may be executed by a plurality of processors.

Although embodiments of the present invention have been described and illustrated in detail, it is clearly understood that the same is by way of illustration and example only and not limitation, the scope of the present invention should be interpreted by terms of the appended claims. The scope of the present invention is intended to include all modifications having equivalent meanings or within a scope equivalent to that of the claims. In addition, the aspects of the invention described in the embodiments and the modifications are intended to be implemented either solely or in combination as far as possible.