MANAGEMENT SYSTEM INCLUDING FIRST AND SECOND INFORMATION- PROCESSING APPARATUSES CONNECTED TO EACH OTHER VIA FIREWALL

• US 20190319921A1
• Filed: 04/12/2019
• Published: 10/17/2019
• Est. Priority Date: 04/13/2018
• Status: Active Grant

• Current Assignee: Brother Kogyo Kabushiki Kaisha (Brother Industries Limited)
• Original Assignee: Brother Kogyo Kabushiki Kaisha (Brother Industries Limited)
• Inventors: NISHIZAKI, Takashi
• Granted Patent: US 10,917,383 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

A management system includes: a first information-processing apparatus connected with the Internet; and a second information-processing apparatus connected with a local network connected to the Internet via a firewall. The first information-processing apparatus transmits communication information and an installer to a request source that has transmitted an installer request. After the mediation program is installed on the second information-processing apparatus, a specific communication mode in which the firewall allows transmission of a specific command from the first information-processing apparatus to the second information-processing apparatus is started using the communication information. The specific command includes a specific instruction for a device connected with the second information-processing apparatus via the local network. The specific command is generated independently of requests that the second information-processing apparatus transmits. Under the specific communication mode, the first information-processing apparatus transmits the specific command to the second information-processing apparatus via the firewall.

Claims

1. A management system comprising:

a first information-processing apparatus configured to connect with the Internet and comprising a first controller; and

a second information-processing apparatus configured to connect with a local network and comprising a second controller, the local network being connected to the Internet via a firewall,

wherein the first controller is configured to perform;

(a1) receiving an installer request requesting an installer for installing a mediation program;

(a2) acquiring an address of the first information-processing apparatus; and

(a3) transmitting, in response to performing the (a1) receiving, set information to a request source apparatus which has issued the installer request, the set information including;

communication information including the address acquired in the (a2) acquiring; and

installer information representing the installer,

wherein, after the first controller performs the (a3) transmitting, the mediation program is installed on the second information-processing apparatus by the installer represented by the installer information included in the set information transmitted in the (a3) transmitting,

wherein, after the mediation program is installed on the second information-processing apparatus, a specific communication mode is started using the communication information included in the set information transmitted in the (a3) transmitting, the specific communication mode being a communication mode in which the firewall allows transmission of a specific command from the first information-processing apparatus to the second information-processing apparatus, the specific command including a specific instruction for a device configured to connect with the second information-processing apparatus via the local network, the specific command being generated independently of requests that the second information-processing apparatus transmits,

wherein the first controller being configured to further perform;

(a4) transmitting, under the specific communication mode, the specific command to the second information-processing apparatus via the firewall,

wherein the second controller is configured to perform;

(b1) receiving, under the specific communication mode, the specific command via the firewall; and

(b2) transmitting, in response to performing the (b1) receiving, a specific response to the specific command to the first information-processing apparatus via the firewall, and

wherein the first controller is configured to further perform;

(a5) receiving the specific response from the second information-processing apparatus via the firewall.

2. The management system according to claim 1, wherein the specific communication mode is started by the second controller in accordance with the installed mediation program.

3. The management system according to claim 1, wherein the first information-processing apparatus further comprises a memory stores therein a correlation database,

wherein the first controller is configured to further perform:

(a6) generating, after performing the (a1) receiving, an apparatus ID; and

(a7) registering, in the correlation database, a record including the generated apparatus ID,

wherein the set information transmitted in the (a3) transmitting further includes the generated apparatus ID,

wherein the second controller is configured to further perform;

(b3) transmitting, after the second program is installed on the second information-processing apparatus, an apparatus registration request to the first information-processing apparatus via the firewall, the apparatus registration request requesting to register the second information-processing apparatus, the apparatus registration request including the apparatus ID included in the set information transmitted in the (a3) transmitting,

wherein the first controller is configured to further perform;

(a8) receiving the apparatus registration request from the second information-processing apparatus via the firewall;

(a9) determining whether a record including the apparatus ID included in the received apparatus registration request exists in the correlation database; and

(a10) registering, in response to determining that a record including the apparatus ID included in the received apparatus registration request exists in the correlation database, registration permission information in the record including the apparatus ID included in the received apparatus registration request, the registration permission information indicating that registration of the second information apparatus has been permitted,

wherein the second controller is configured to further perform;

(b4) transmitting, under the specific communication mode, an instruction request to the first information-processing apparatus via the firewall, the instruction request including the apparatus ID included in the set information transmitted in the (a3) transmitting,

wherein the first controller is configured to further perform;

(a11) receiving, under the specific communication mode, the instruction request from the second information-processing apparatus via the firewall, and

wherein the (a4) transmitting is performed in response to the correlation database having a record including both of;

the apparatus ID included in the received instruction request; and

the registration permission information.

4. The management system according to claim 3, wherein the first controller is configured to further perform:

(a12) receiving a device registration request via the firewall from the second information-processing apparatus identified by the apparatus ID included in the record determined in the (a9) determining to exist in the correlation database, the device registration request requesting to register the device, the device registration request including the apparatus ID and a device ID for identifying the device;

(a13) adding, to the correlation database, a new record for the device identified by the device ID included in the received device registration request;

(a14) registering, in the new record, the device ID and the apparatus ID which are included in the received device registration request;

(a15) acquiring instruction information and identification information, the instruction information including a base instruction for the device, the identification information being for identifying the device ID of the device;

(a16) specifying a device ID on the basis of the acquired instruction information;

(a17) specifying, from the correlation database, a record including the specified device ID;

(a18) specifying an apparatus ID included in the specified record;

(a19) generating the specific command including;

the specific instruction corresponding to the base instruction included in the acquired instruction information; and

the device ID specified in the (a16) specifying; and

(a20) determining whether the apparatus ID specified in the (a18) specifying matches the apparatus ID included in the received instruction request, and

wherein the (a4) transmitting is performed in response to the first controller determining that the apparatus ID specified in the (a18) specifying matches the apparatus ID included in the received instruction request.

5. The management system according to claim 4, wherein the firewall allows the second information-processing apparatus to receive, from the first information-processing apparatus via the firewall, responses to transmissions from the second information-processing apparatus to the first information-processing apparatus,

wherein the first controller is configured to further perform:

(a20) transmitting, in response to receiving in the (a8) receiving the apparatus registration request that includes the apparatus ID included in the record in which the registration permission information is registered in the (a10) registering, a device search instruction to the second information-processing apparatus via the firewall as a response to the apparatus registration request, the device search instruction instructing to acquire the device ID of the device connected via the local network to the second information-processing apparatus, and

wherein, in the (a12) receiving, the device registration request is received as a response to the device search instruction transmitted in the (a20) transmitting.

6. The management system according to claim 4, wherein the first controller is configured to further perform:

(a21) determining, after performing the (a12) receiving, whether a record including the apparatus ID included in the received device registration request exists in the correlation database; and

(a22) transmitting, in response to the first controller determining that a record including the apparatus ID included in the received device registration request does not exist in the correlation database, a registration denied notification via the firewall to the second information-processing apparatus as a response to the received device registration request, the registration denied notification indicating that registration of the device ID included in the received device registration request has been denied, and

wherein the (a13) adding and the (a14) registering are performed in response to the first controller determining that a record including the apparatus ID included in the received device registration request exists in the correlation database.

7. The management system according to claim 3, wherein the firewall allows the second information-processing apparatus to receive, from the first information-processing apparatus via the firewall, responses to transmissions from the second information-processing apparatus to the first information-processing apparatus,

wherein the second controller is configured to further perform:

(b5) transmitting, after the mediation program is installed on the second information-processing apparatus, an initial start notification to the first information-processing apparatus via the firewall,

wherein the first controller is configured to further perform;

(a23) receiving the initial start notification from the second information-processing apparatus via the firewall;

(a24) transmitting, in response to performing the (a23) receiving, an apparatus ID request to the second information-processing apparatus via the firewall as a response to the received initial start notification, the apparatus ID request being a request requesting to transmit the apparatus ID; and

(a25) transmitting, in response to performing the (a10) registering, a specific communication mode start request via the firewall to the first information-processing apparatus as a response to the received apparatus registration request, the specific communication mode start request being a request requesting to start the specific communication mode.

8. The management system according to claim 3, wherein the first controller is configured to further perform:

(a26) generating display data representing the correlation database;

(a27) receiving a display data request; and

(a28) outputting, in response to performing the (a27) receiving, the generated display data.

9. The management system according to claim 3, wherein the firewall allows the second information-processing apparatus to receive, from the first information-processing apparatus via the firewall, responses to transmissions from the second information-processing apparatus to the first information-processing apparatus,

wherein the second controller is configured to further perform:

(b6) transmitting, in accordance with the installer installed on the second information-processing apparatus, a mediation program transmission request to the first information-processing apparatus via the firewall, the mediation program transmission request being a request requesting to transmit the mediation program, the mediation program transmission request including the apparatus ID, and

wherein the first controller is configured to further perform;

(a29) receiving the mediation program transmission request from the second information-processing apparatus via the firewall;

(a30) determining, in response to performing the (a29) receiving, whether the registration permission information is registered in the record including the apparatus ID included in the received mediation program transmission request;

(a31) transmitting, in response to determining that the registration permission information is registered in the record including the apparatus ID included in the received mediation program transmission request, a transmission denied notification to the second information-processing apparatus via the firewall as a response to the received mediation program transmission request, the transmission denied notification indicating that transmission of the mediation program has been denied; and

(a32) transmitting, in response to determining that the registration permission information is not registered in the record including the apparatus ID included in the received mediation program transmission request, the mediation program to the second information-processing apparatus via the firewall as a response to the received mediation program transmission request.

10. The management system according to claim 3, wherein the firewall allows the second information-processing apparatus to receive, from the first information-processing apparatus via the firewall, responses to transmissions from the second information-processing apparatus to the first information-processing apparatus,

wherein the first controller is configured to further perform:

(a33) registering location information in the record including the generated apparatus ID is registered,

wherein the second controller is configured to further perform;

(b7) transmitting, in accordance with the installer installed on the second information-processing apparatus, an installation permission request to the first information-processing apparatus via the firewall, the installation permission request requesting to permit installation of the mediation program on the second information-processing apparatus, the installation permission request including;

location information of the second information processing-apparatus; and

the apparatus ID included in the set information transmitted in the (a3) transmitting, and

wherein the first controller is configured to further perform;

(a34) determining, in response to receiving the installation permission request, whether the correlation database has a record including both of the location information and the apparatus ID which are included in the received installation permission request;

(a35) transmitting, in response to determining that the correlation database does not have a record including both of the location information and the apparatus ID which are included in the received installation permission request, an installation denied notification to the second information-processing apparatus via the firewall as a response to the received installation permission request, the installation denied notification indicating that installation of the mediation program has been denied; and

(a36) transmitting, in response to determining that the correlation database has a record including both of the location information and the apparatus ID which are included in the received installation permission request, an installation allowed notification to the second information-processing apparatus via the firewall as a response to the received installation permission request, the installation allowed notification indicating that installation of the mediation program has been permitted.

11. The management system according to claim 1, wherein the first information-processing apparatus further comprises a memory in which a correlation database is stored,

wherein the first controller is configured to further perform:

(a37) receiving one or more pieces of location information;

(a38) generating, in response to performing the (a37) receiving, one or more apparatus IDs corresponding to respective ones of the one or more pieces of location information;

(a39) adding, to the correlation database, one or more records corresponding to respective ones of the one or more apparatus IDs generated in the (a38) generating;

(a40) registering, in each of the one or more records added in the (a40) adding, the corresponding apparatus ID and the corresponding location information in association with each other;

(a41) determining, after receiving the installer request in the (a1) receiving, whether the correlation database has a record including the location information corresponding to information included in the received installer request; and

(a42) determining, in response to determining that the correlation database does not have a record including the location information corresponding to information included in the received installer request, not to perform the (a3) transmitting, and

wherein the (a3) transmitting is performed in response to the first controller determining that the correlation database has a record including the location information corresponding to information included in the received installer request.

12. The management system according to claim 11, wherein the first controller is configured to further perform:

(a43) registering, in response to performing the (a3) transmitting, transmission completion information in the record determined in the (a41) determining to include the location information corresponding to the information included in the received installer request, the transmission completion information indicating that the set information has been transmitted;

(a44) generating display data representing the correlation database;

(a45) receiving a display data request; and

(a46) outputting, in response to performing the (a45) receiving, the generated display data.

13. The management system according to claim 4, wherein the first controller is configured to further perform:

(a47) requesting, via the Internet, a management server to register the device ID, the management server being configured to connect with the Internet; and

wherein the (a15) acquiring is performed after the first controller performs the (a47) requesting,

wherein, in the (a15) acquiring, the instruction information is acquired from the management server,

wherein the first controller is configured to further perform;

(a48) transmitting specific information to the management server via the Internet as a response to the instruction information, the specific information being information corresponding to the specific response received in the (a5) receiving, and

wherein the identification information included in the instruction information is the device ID.

14. A non-transitory computer-readable storage medium storing computer-readable instructions for a first information-processing apparatus, the first information-processing apparatus being configured to connect with the Internet and comprising a processor, the computer-readable instructions, when executed by the processor, causing the first information-processing apparatus to perform:

(a1) receiving an installer request requesting an installer for installing a mediation program on a second information-processing apparatus, the second information-processing apparatus being configured to connect with a local network, the local network being connected to the Internet via a firewall;

(a2) acquiring an address of the first information-processing apparatus; and

(a3) transmitting, in response to performing the (a1) receiving, set information to a request source apparatus which has issued the installer request, the set information including;

communication information including the address acquired in the (a2) acquiring; and

installer information representing the installer,

wherein, after the first controller performs the (a3) transmitting, the mediation program is installed on the second information-processing apparatus by the installer represented by the installer information included in the set information transmitted in the (a3) transmitting,

wherein, after the mediation program is installed on the second information-processing apparatus, a specific communication mode is started using the communication information included in the set information transmitted in the (a3) transmitting, the specific communication mode being a communication mode in which the firewall allows transmission of a specific command from the first information-processing apparatus to the second information-processing apparatus, the specific command including a specific instruction for a device configured to connect with the second information-processing apparatus via the local network, the specific command being generated independently of requests that the second information-processing apparatus transmits, and

wherein the first controller being configured to further perform;

(a4) transmitting, under the specific communication mode, the specific command to the second information-processing apparatus via the firewall; and

(a5) receiving a response to the specific command from the second information-processing apparatus via the firewall.

15. A method for managing a device, comprising:

under control of a first information-processing apparatus configured to connect with the Internet,

(a1) receiving, an installer request requesting an installer for installing a mediation program on a second information-processing apparatus, the second information-processing apparatus being configured to connect with a local network, the local network being connected to the Internet via a firewall;

(a2) acquiring an address of the first information-processing apparatus;

(a3) transmitting, in response to performing the (a1) receiving, set information to a request source apparatus which has issued the installer request, the set information including;

communication information including the address acquired in the (a2) acquiring; and

installer information representing the installer, wherein, after the first controller performs the (a3) transmitting, the mediation program is installed on the second information-processing apparatus by the installer represented by the installer information included in the set information transmitted in the (a3) transmitting, wherein, after the mediation program is installed on the second information-processing apparatus, a specific communication mode is started using the communication information included in the set information transmitted in the (a3) transmitting, the specific communication mode being a communication mode in which the firewall allows transmission of a specific command from the first information-processing apparatus to the second information-processing apparatus, the specific command including a specific instruction for a device configured to connect with the second information-processing apparatus via the local network, the specific command being generated independently of requests that the second information-processing apparatus transmits;

(a4) transmitting, under the specific communication mode, the specific command to the second information-processing apparatus via the firewall; and

(a5) receiving a response to the specific command from the second information-processing apparatus via the firewall.