Network management apparatus, management server, client terminal, and control method therefor

• US 20070282895A1
• Filed: 11/09/2005
• Published: 12/06/2007
• Est. Priority Date: 11/09/2004
• Status: Active Grant

• Current Assignee: Canon Hi-Tech Limited (Canon Inc.), Canon Kabushiki Kaisha (Canon Inc.)
• Original Assignee: Canon Hi-Tech Limited (Canon Inc.)
• Inventors: Uchida, Ahimusa, Sakamaki, Hisashi, Mochizuki, Kouichi
• Granted Patent: US 9,231,825 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/0869 Validating the configuration within one network element
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

Configuration information representing the configuration elements of a client PC or the like on a network is compared with initial configuration information. When the configuration information changes, it is determined whether the configuration is proper. If the configuration is improper, the function of a corresponding configuration element to the network is inhibited. This can prevent an unstable state of the system, leakage of information, and a decrease in reliability of the network system upon a change in network configuration.

Claims

1. A network management apparatus comprising:

first acquisition means for acquiring information representing network configuration elements;

second acquisition means for acquiring again information representing network configuration elements; and

determination means for determining from the pieces of information acquired by said first acquisition means and said second acquisition means whether a network configuration is proper.

2. The apparatus according to claim 1, wherein said determination means detects a change in the network configuration elements from a change in data flowing through a network, and determines on the basis of a detection result whether the network configuration is proper.

3. The apparatus according to claim 2, wherein said determination means detects a change in the network configuration elements from a change in address data which flows when a computer terminal is added to a network.

4. The apparatus according to claim 3, further comprising inhibition means for, when said determination means determines that the network configuration is improper, inhibiting access by the terminal to a network.

5. A management server which manages at least one terminal connected to a network, comprising:

first acquisition means for acquiring configuration information representing elements which build a network;

storage means for storing the configuration information acquired by said first acquisition means as initial permissible configuration information;

second acquisition means for acquiring again configuration information representing elements which build the network after acquisition by said first acquisition means; and

determination means for determining whether the elements represented by the configuration information acquired by said second acquisition means include an additional element which is not included in elements represented by the initial permissible configuration information stored in said storage means.

6. The server according to claim 5, wherein the configuration information contains identification information of each terminal connected to the network.

7. The server according to claim 5, wherein the configuration information contains hardware configuration information on an external device connected to each client terminal connected to the network.

8. The server according to claim 5, wherein the configuration information contains software configuration information installed in each client terminal connected to the network.

9. The server according to claim 5, further comprising stall instruction transmission means for, when said determination means determines that the additional element exists, transmitting a predetermined stall instruction to a client terminal associated with the additional element.

10. The server according to claim 9, wherein the stall instruction includes a client terminal power-off instruction or a network connection inhibit instruction.

11. The server according to claim 9, wherein the stall instruction includes an instruction to a BIOS of the client terminal.

12. The server according to claim 5, further comprising notification means for, when said determination means determines that the additional element exists, issuing a notification that the additional element exists.

13. The server according to claim 5, further comprising recording means for, when said determination means determines that the additional element exists, recording presence of the additional element.

14. The server according to claim 5, further comprising processing means for, when said determination means determines that the additional element exists, executing a predetermined process corresponding to an additional content.

15. The server according to claim 5, wherein said second acquisition means acquires configuration information upon activation of each client terminal.

16. The server according to claim 5, wherein said second acquisition means acquires configuration information upon connection of each client terminal to an external device.

17. The server according to claim 5, wherein said second acquisition means acquires configuration information of each client terminal upon lapse of every predetermined time.

23. An information processing apparatus functioning as a client terminal which is connected to a management server defined in claim 5 via a network, comprising:

transmission means for transmitting configuration information of the client terminal to the management server;

reception means for receiving a stall instruction from the management server; and

control means for stopping a predetermined function upon reception of the stall instruction by said reception means.

24. The apparatus according to claim 23, wherein said control means includes power control means for powering off the information processing apparatus.

25. The apparatus according to claim 24, wherein a power-off program is stored in a ROM which stores a BIOS, and said power control means includes means for executing the power-off program.

26. The apparatus according to claim 23, wherein said control means includes network control means for cutting off network access by a general application program in the client terminal.

27. A method of controlling an information processing apparatus functioning as a client terminal which is connected to a management server defined in claim 5 via a network, comprising:

a transmission step of transmitting configuration information of the client terminal to the management server in response to a request from the management server when a configuration of the client terminal changes;

a reception step of receiving a stall instruction from the management server; and

a control step of stopping a predetermined function upon reception of the stall instruction in the reception step.

28. A computer program for a client terminal which is connected to a management server defined in claim 5 via a network, functioning as

transmission means for transmitting configuration information of the client terminal to the management server in response to a request from the management server when a configuration of the client terminal changes,

reception means for receiving a stall instruction from the management server, and

control means for stopping a predetermined function upon reception of the stall instruction by said reception means.

29. A computer-readable storage medium storing a computer program defined in claim 28.

18. A network control method comprising:

a first acquisition step of acquiring information representing network configuration elements;

a second acquisition step of acquiring again information representing configuration elements; and

a determination step of determining from the pieces of information acquired in the first acquisition step and the second acquisition step whether a network configuration is proper.

19. A method of controlling a management server which manages at least one terminal connected to a network, comprising:

a first acquisition step of acquiring configuration information representing elements which build a network;

a registration step of registering the configuration information acquired in the first acquisition step as initial permissible configuration information in predetermined storage means;

a second acquisition step of acquiring again configuration information representing network configuration elements after acquisition in the first acquisition step; and

a determination step of determining presence/absence of an improper element on the network on the basis of the configuration information acquired in the second acquisition step and the initial permissible configuration information stored in the storage means.

20. A computer program which is loaded and executed by a computer and controls a network, comprising:

a first acquisition step of acquiring information representing network configuration elements;

a second acquisition step of acquiring again information representing network configuration elements; and

a determination step of determining from the pieces of information acquired in the first acquisition step and the second acquisition step whether a network configuration is proper.

21. A computer program which is loaded and executed by a computer and functions as a management server for managing at least one client terminal connected to a network, functioning as

first acquisition means for acquiring configuration information representing elements which build the network,

registration means for registering the configuration information acquired by said first acquisition means as initial permissible configuration information in predetermined storage means,

second acquisition means for acquiring again configuration information representing elements which build the network after acquisition by said first acquisition means, and

determination means for determining presence/absence of an improper element on the network on the basis of the configuration information acquired by said second acquisition means and the initial permissible configuration information stored in the storage means.

22. A computer-readable storage medium storing a computer program defined in claim 21.

30. A network management system comprising at least one client terminal connected to a network and a management server for managing each client terminal, said client terminal comprising transmission means for transmitting configuration information of the client terminal to said management server, and

said management server comprising

first reception means for receiving configuration information transmitted from each client terminal,

storage means for associating each configuration information received by said first reception means with information for specifying a corresponding client terminal, and storing the configuration information as initial permissible configuration information,

second reception means for receiving again configuration information of each client terminal after reception by said first reception means, and

determination means for determining whether the configuration information received by said second reception means includes an additional configuration which is not contained in the initial permissible configuration information of the client terminal that is stored by said storage means.

31. A management server which manages at least one client terminal connected to a network, comprising:

acquisition means for acquiring information on each client terminal;

check means for checking the information acquired by said acquisition means; and

control means for controlling a client terminal which poses a problem as a result of the check by said check means by transmitting an instruction which acts on a BIOS of the terminal.

32. The server according to claim 31, wherein the instruction includes a client terminal power-off instruction or a network connection inhibit instruction.

33. A method of controlling a management server which manages at least one client terminal connected to a network, comprising:

an acquisition step of acquiring information on each client terminal;

a check step of checking the information acquired in the acquisition step; and

a control step of controlling a client terminal which poses a problem as a result of the check in the check step by transmitting an instruction which acts on a BIOS of the terminal.

34. A computer program which is loaded and executed by a computer and functions as a management server for managing at least one client terminal connected to a network, functioning as

acquisition means for acquiring information on each client terminal,

check means for checking the information acquired by said acquisition means, and

control means for controlling a client terminal which poses a problem as a result of the check by said check means by transmitting an instruction which acts on a BIOS of the terminal.

35. A computer-readable storage medium storing a computer program defined in claim 34.

36. A network management system comprising at least one client terminal connected to a network and a management server for managing the client terminal,

said client terminal comprising

transmission means for transmitting information on the client terminal to said management server, and

storage means for storing a BIOS which executes an instruction, and

said management server comprising

acquisition means for acquiring information transmitted from each client terminal,

check means for checking the information acquired by said acquisition means, and

control means for controlling a client terminal which poses a problem as a result of the check by said check means by transmitting an instruction which acts on a BIOS of the terminal.

37. A network control method comprising:

an information acquisition step of acquiring information representing a change in network configuration elements from data flowing through a network;

a determination step of determining from the information acquired in the information acquisition step whether a network configuration is proper; and

a control step of controlling access by the network configuration elements to the network when the network configuration is determined in the determination step to be improper.

38. The method according to claim 37, wherein the data includes address data which flows when a network configuration element is added to the network.