DE102011078894A1 - Device for logical separation for routing and desired tunneling transmission of device-related technical parameters of e.g. document output system, has protocol filter gateway guiding technical device-related data into separate network - Google Patents

Abstract

The device has a protocol filter gateway for separating pressure flow data and technical device-related data from each other based on a used network protocol. The protocol filter gateway guides the technical device-related data into a separate network, which is logically independent of a local network and connected with an infrastructure for evaluating and further-processing the data. The protocol filter gateway includes a supplementary port forwarding function and an IEEE 802.1 Qinterface for connection in wireless local area networks. Independent claims are also included for the following: (1) a method for logical separation for routing and desired tunneling transmission of device-related technical parameters of a productive system i.e. document output system (2) a system for logical separation for routing and desired tunneling transmission of device-related technical parameters of a productive system i.e. document output system.

Description

1. Overview

Without limitation of the general public, for the application of LAN and web-based remote service systems, in particular for firmware updates, but also for the remote maintenance of productive systems, so-called output systems via appropriate device management systems, proposed a solution that eliminates or at least minimizes and keeps within manageable limits typical IT security gaps with regard to firewall penetration, data stream sniffering and general IT security of large corporate networks.

• 1. durch die Anwendung eines Protokollfilter-Gateways vorzugsweise mit eigener CPU für die Erfüllung einer Protokollfilterfunktion,
• 2. durch die Verwendung eines zweiten, zusätzlichen, logisch getrennten z. B. virtuellen LAN für die Service-bezogenen Daten (Routingfunktion) und
• 3. eine gewünschtenfalls die beiden erste Punkte ergänzende Möglichkeit durch Port Setting für Inbound und Outbound Traffic, sowie einem in das Protokollfilter-Gateway implementiertes Port-Forwarding (Portforwarding-Funktion), in Abhängigkeit vom verwendeten Produktivsystem (ggf. Output-System, etwa Outputdevice wie Drucker) ab.

Among other things, the solution proposed is a remote service system based on a protocol data filter which strictly and logically separates the service-related data of the productive system or output systems from the production stream data, for example print stream data

• 1. by the use of a protocol filter gateway preferably with its own CPU for the fulfillment of a protocol filter function,
• 2. by the use of a second, additional, logically separated z. B. Virtual LAN for the service-related data (routing function) and
• 3. If desired, supplementing the first two points by port setting for inbound and outbound traffic, as well as a port forwarding (port forwarding function) implemented in the protocol filter gateway, depending on the productive system used (if applicable, output system, such as output device like printers).

The optional third solution feature, in combination with the first solution feature, can provide additional IT security through port forwarding.

In particular, a gateway is also provided, in particular a protocol filter gateway, for transmitting device-related or service-related data separately from user data or productive data via a network which is logically independent of a productive network.

2. Background

Today, in the most varied environments, output systems are operated, which represent a considerable cost factor in the overall business of an individual operator. Managed Print Service (MPS), or Managed Document Service (MDS) for some manufacturers, is intended to reduce these costs for the operator. Nevertheless, the operator's desire is to constantly ensure the availability of output systems with high output quality.

• – ein kundenorientiertes Helpdesk System mit Ticketverwaltung, Tracking und selbstwachsendem Knowledge Managementsytem,
• – ein pro-aktives und effektives Service Management,
• – ein IT – integratives Abrechnungssystem,
• – das Outputmanagement-System selbst.

Important cost factors in the operation of output systems are:

• - a customer-oriented helpdesk system with ticket management, tracking and self-growing knowledge management system,
• - pro-active and effective service management,
• - an IT integrated payroll system,
• - the output management system itself.

While the output management system is typically selected and determined in terms of purchase and installation according to the customer's request, the 3 other points mainly relate to the service management system of the service provider.

3. State of the art

Helpdesk systems are very diverse and some of them can already read service-related data from the machines. So z. For example, Numara Soft's footprint (as well as other asset management systems) uses the Public MIB to read the name, manufacturer, serial number, and head count of printers. Data from the Private MIB, such as other meters, toner levels, or service alarms, is not recognized.

• – Störungsbeseitigung mit oder ohne Ersatzteilaustausch
• – Regelmäßige Wartung
• – Netzwerkintegration (bei Erlaubnis durch Kunden häufig über Remote Desktop Lösung möglich)
• – Colour Calibration
• – Firmware Update.

For a pro-active and IT-integrated service management, however, more information is to be taken from the output systems in order to prevent on-site visits by the technician or at least to make them so effective that the problem is solved with a high degree of certainty at the first visit becomes. Nevertheless, only about 10% of all helpdesk error messages are resolved and in 90% of cases a technician visit is due. There are quite considerable costs to pay for a visit without replacement parts. For smaller machines one can expect a visit and for large and in production plants with 5-10 visits per year. Content of visits are typically:

• - Troubleshooting with or without replacement of spare parts
• - Regular maintenance
• - Network integration (often possible via remote desktop solution if granted by customers)
• - Color Calibration
• - Firmware update.

While the first two points are difficult to eliminate, but at best to be made highly effective by appropriate measures, z. As network problems and firmware update, so software-related actions, quite with remote tools are done.

Also the "annoying" Meter reading, which the service provider needs for click contracts (billing of all costs over a fixed price per page black and color print A4) for typically monthly or quarterly billing, is an important topic in this context. Meter readings are still carried out frequently via telephone, fax, or the customer enters the meter data manually into a web portal of the service provider. In addition to the effort of multiple data entry, the sources of error are manifold. It can alone for a service provider incur significant costs.

Another significant cost factor is the small "toner stores" the service provider needs to create with the customer so that the user has toner available whenever his machines run out of toner. In an example of a color output device with 4 toner cartridges of 150 € store at least 600 € for a machine at the customer, with correspondingly high total costs or correspondingly high capital expenditure (inventory capital) in a fleet of many color machines. In addition, often runs the control of toner consumption by the customer from the helm, so that the costs increase uncontrollably with the service provider.

As a result, there is a need to collect data that will allow the service provider to deliver the toner when it is really needed, just in time. This requires the information of the devices to be used to indicate toner level of each cartridge and report it to the outside.

• – Übertragung der Tonerlevel der Kartuschen
• – Übertragung aller Zählerstände
• – Übertragung des Papiervorrates in den unterschiedlichen Kassetten
• – Übertragung von Fehlermeldungen verschiedenster Art
• – Übertagung der UI-Textmeldungen
• – Selbständiges Suchen nach neuer Firmware und automatisches Updaten.

By remote service taking advantage of the information and data that the output systems provide today in their so-called private MIB (Management Information Base) or offer as online services, it is in principle easily possible, the number of on-site technician visits to reduce. Typically, the following may be considered:

• - Transfer the toner level of the cartridges
• - Transmission of all meter readings
• - Transfer of paper stock in different cassettes
• - Transmission of error messages of various kinds
• - Transmission of UI text messages
• - Independent search for new firmware and automatic updating.

Finally, more or less all outpus systems maintain such service-related data as MIB via SNMP or other private protocols (eg Canon: CPCA) or corresponding online services. They just have to be read out and processed.

To this end, output system manufacturers typically provide their customers with a proprietary device management software or cloud solution that is generally capable of fully and extensively reading and monitoring the service related data of their own devices. Also interfaces of their systems to other IT systems, eg. The ERP systems of the service poroviders are offered.

• 1. KonicaMinolta: CS Remote Care, M2M GPRS Box über proprietäte Service Schnittstelle
• 2. Lexmark: Fleetmanager, Markvision
• 3. Kyocera: Kyocount
• 4. Hewlett Packard: HP Device Manager, Open View
• 5. Canon: e-Maintenance, Image Ware
• 6. Ricoh: @Remote
• 7. Sharp: PAU
• 8. Toshiba: eFleetmanagement System: eFMS
• 9. Xerox: SMart eSolution

Examples of proprietary device management systems are (without claim to completeness) such as:

• 1. KonicaMinolta: CS Remote Care, M2M GPRS Box via proprietary service interface
• 2. Lexmark: Fleet Manager, Markvision
• 3. Kyocera: Kyocount
• 4. Hewlett Packard: HP Device Manager, Open View
• 5. Canon: e-Maintenance, Image Ware
• 6. Ricoh: @Remote
• 7. Sharp: PAU
• 8. Toshiba: eFleet Management System: eFMS
• 9. Xerox: SMart eSolution

It is in this context as a more detailed example on the content of the disclosure WO 02/078318 A1 , as well as a further example of the content of the published patent application WO 02/077718 A1 , referenced.

• – Printaudit (Canada)
• – FM Audit (USA)
• – Printfleet (Canada)
• – Netaphor (USA)
• – BITS (UK)

Einige der genannten Lösungen sind SaaS-Lösungen, wie z. B. die von der Firma Printaudit (Kanada).A disadvantage of proprietary systems is typically that they typically can not read and evaluate the private MIB or other competitive engine protocols. Most service providers, who usually handle more than one brand of output device, are not satisfied because you can not install a unified system among all customers with a wide variety of output devices. This shortcoming is addressed by vendor-independent platforms and solutions that typically have contracts with all or most of the relevant vendors to use their private MIB and protocols. Such independent platforms are offered as either locally installed software or as a cloud solution in the form of a web portal (SaaS). The most important suppliers on the world market are:

• - Printaudit (Canada)
• - FM Audit (USA)
• - Printfleet (Canada)
• - Netaphor (USA)
• - BITS (UK)

Some of these solutions are SaaS solutions, such as: B. by the company Printaudit (Canada).

All SaaS solutions provide web access for the output devices to the web portal required. But the locally operated server platforms also need regular external access to update their software, the MIB's new devices or debugging. The central server of such a SaaS solution can provide a significant number of additional updates per week regarding new devices and the completion of MIBs.

Although such technologies have been known and used for several years, there are also many concerns about the use of such technologies, which accordingly are not yet used to the extent that they can offer. A particularly important reason may be security concerns of the responsible IT management. There is thus a great need to catch up with the introduction of such systems and methods.

Another, here not further relevant approach was implemented in remote service systems of the previously largely operated as a standalone devices of the company. Xerox, which usually allowed access via fax ports or terminal software access. Such a solution is hardly practical for fleets with a large number of individual devices.

4. Criticism of the state of the art - limits of safety acceptance of today's systems

IT-critical customers and security-sensitive areas deny reporting on the production LAN for security reasons. These are mostly users with very large or many and expensive output systems, where a remote service would appear particularly useful.

The denial of IT therefore excludes data traffic from the output devices (or in general the productive system or productive devices) via the firewall from the network. But this is exactly what is needed for an automatic data transmission of the devices to a service provider. In addition, external access to the devices through the network through the firewall, as required, for example, when updating firmware automatically, is often completely prohibited for IT critical organizations.

Thus, the further development and increase of the efficiency of remote service systems for output systems through integrative IT networking with other systems of the service provider or the manufacturer of the devices is a dilemma.

• a) Druckdatenströme (bzw. allgemein Produktivdatenströme) von den Service bezogenen Datenströmen der Output-Systeme (bzw. Produktiv-Systeme) durch geeignete Filter getrennt werden (Filterfunktion),
• b) Druckdatenströme (bzw. Produktivdatenströme) am Verlassen des Produktions-LAN des Anwenders gehindert werden und nur mit dem Output-System (bzw. Produktivsystem) kommunizieren,
• c) Service bezogene Datenströme des Output-Systems (bzw. Produktiv-Systems) ausschließlich in ein separates Netzwerk gelangen und nach außen geroutet werden (Routingfunktion), und
• d) von außen keine Fremddaten in das Produktions-LAN des Kunden bzw. Anwenders gelangen können (Firewallfunktion).

The question then arises, how can one address the security concerns, or rather, how can they be eliminated in order to be able to realize the technically necessary network accesses to the output systems? However, it must always be assumed that 100% IT security does not exist and will not exist. In order to get as close to the optimum as possible, it is necessary to develop an IT solution that ensures that

• a) print data streams (or generally productive data streams) are separated from the service-related data streams of the output systems (or productive systems) by suitable filters (filter function),
• b) print data streams (or productive data streams) are prevented from leaving the user's production LAN and communicate only with the output system (or productive system),
• c) service-related data streams of the output system (or productive system) only get into a separate network and are routed to the outside (routing function), and
• d) from outside, no external data can reach the production LAN of the customer or user (firewall function).

• e) durch das IT-Management des Anwenders ständig eine Kontrolle durch Monitoring darüber besteht, welche Datenströme wohin geleitet werden und was enthalten ist (Logging-Funktion), und
• f) die Datenstromtrennung durch eine unabhängige Zertifizierungsautorität bestätigt und zertifiziert ist.

Ideally, it can also be provided that

• e) the user's IT management constantly monitors by monitoring which data streams are routed to where and what is contained (logging function), and
• f) the data stream separation is certified and certified by an independent certification authority.

In order to meet these (technical) requirements, technical solutions are proposed herewith, as already mentioned in the form of a brief overview and explained in more detail below with reference to exemplary embodiments.

It should be noted that the mentioned output systems or productive systems can in particular be office machines such as copiers, printers, scanners and fax machines and multifunctional devices having corresponding functionalities. However, the proposed solutions are also applicable to completely different devices and systems that are intended or suitable for connection to the productive LAN of a user and are generally suitable for remote maintenance or remote support by a service provider or manufacturer or supplier. The term productive system or productive device should be understood in this general sense. The preceding and following remarks in relation to output systems are only to be regarded as exemplary in this respect. However, it is without question that the versions relating to the output system are particularly relevant Examples of application for the inventions and further education proposals hereby given.

5. Suggested solutions

It is proposed to use a packet filter with special functionality. A packet filter or protocol filter is software that filters incoming and outgoing traffic on a computer network according to specified criteria. On the one hand, this helps to protect and protect the network from attackers and, on the other hand, to separate data streams that can be routed to logically different networks. Just as important as the protection against attackers from the outside is the protection against unwanted outgoing packets. A packet filter can work as a firewall or be part of a firewall, or it can be an intelligent gateway, which channels data streams into different networks.

Since packet filter u. a. used to implement the concept of a firewall, they offer to separate the various data streams, which should not be mixed for security reasons. Packet filters are also used in routers to prevent data packets from being sent to or from a network that contain invalid sender or destination addresses.

Are z. For example, as data in a network is packaged and sent by the sending host into packets, each packet that wants to pass the packet filter is examined. Based on the data present in each packet, such as sender and recipient address or protocol type, the packet filter decides what to do with this packet based on filter rules. An invalid package that can not pass the filter is usually discarded.

A packet filter can automatically generate a rule for an outbound packet that accepts the response to that packet within a specific time window (in the range of minutes). If the answer does not come or if the time is exceeded, the rule will expire. The packet filter defines rules that determine whether single or contiguous packets are allowed to pass through the gateway or are blocked. Such a rule would be for example: discard all packets coming from a specific IP address. However, because attackers can come from arbitrary IP addresses, it is more practicable to go the opposite way and pass only packets that come from certain IP addresses.

A way to improve the security of communication z. B. between corporate networks or in such gateways continues to increase, is a so-called port knocking, in which the sender before receiving a connection sends a previously agreed sequence of packets and the port is then opened.

• 1. die intelligente Trennung der Datenströme mit Druckdateninhalt (allgemein Produktivdateninhalt) vom Datenstrom mit Service-Daten Inhalt anhand von Protokoll- bzw. Datenpaketmerkmalen (Filterfunktion),
• 2. die Schaffung eines zweiten, unabhängigen Netzwerkes zur Kommunikation der technischen Daten der Output Systeme, z. B. in Form eines virtuellen LANs, insbesondere VPN (Virtual Private Network), oder auf Basis eines vom Produktiv-LAN völlig unabhängigen, über den räumlichen Bereich des Anwenders hinausgehenden Drahtlos-Netzwerks (insbesondere Mobiltelefonie-Netzwerk bzw. Drahtlos/Mobil-Internet-Zugang-Netzwerk, etwa unter Nutzung eines Standards wie GMS, GPRS, UMTS, LTE), wodurch eine getrennte logische und ggf. auch getrennte physikalische Kommunikationsebene für die Nutzung durch eine Routingfunktion geschaffen wird,
• 3. optional die zusätzliche Trennung der Datenströme durch Definieren jeweils zugeordneter Ports und Realisierung eines Port Forwarding (Portforwarding-Funktion).

On the basis of the packet filter, it is further proposed:

• 1. the intelligent separation of the data streams with print data content (generally productive data content) from the data stream with service data content on the basis of protocol or data packet features (filter function),
• 2. the creation of a second, independent network for communicating the technical data of the output systems, eg. B. in the form of a virtual LAN, in particular VPN (Virtual Private Network), or based on a completely independent of the productive LAN, beyond the spatial area of the user's wireless network (in particular mobile telephony network or wireless / mobile Internet Access network, for example using a standard such as GMS, GPRS, UMTS, LTE), whereby a separate logical and possibly also separate physical communication layer for use by a routing function is created,
• 3. optionally the additional separation of the data streams by defining each assigned ports and implementing a port forwarding (port forwarding function).

The technical implementation of the proposed solutions 1.-3. can z. B. expediently done in a packet or protocol filter gateway.

An examination and filtering of the data streams / data packets can be carried out according to their properties and features or protocols used, such as, for example, LPD, SMB, SMTP, http, SNMP, https, UDP, CPCA (CPCA is a canonical protocol), etc. For service data of Output-System mostly the last 4 named protocols are used. The analysis of the data streams according to protocols used (filter function) and the routing can preferably take place in a switch, if necessary or expediently using a CPU.

Optionally, and depending on the technical possibilities, a clear port assignment for inbound and outbound traffic in the output system (or generally in the productive system) and port forwarding in the protocol filter gateway according to section 3 can be implemented to increase security. However, it is also conceivable that the separation of the data streams with print data content (generally productive data content) from the data stream with service data content takes place solely on the basis of the respectively used port, ie the respective port is the sole protocol or data packet feature to which the filter function attaches , This simplifies filtering, with correspondingly lower requirements for the packet filter.

The central solution feature of some of the proposed solutions thus provided is a protocol data filter, for. In the form of a protocol filter gateway, which may have port forwarding for filtered data streams.

It may be desirable to have the protocol data filter invisible in the network z. B. without own IP address in the direction of LAN to operate. This can be achieved by assigning the IP address obtained from the subnet of the LAN to the gateway and creating the connection of the output system to the gateway via a separate subnet visible in LAN.

Provided among other things, generally a method and a device for logical separation, for IT-secure routing and tunneled tunneled passing device-related technical parameters and data of a document output system or general productive system, which at the same time for communication of print data streams or generally productive data streams integrated into a local network is, in particular, by providing or using a protocol filter gateway, which separates the print stream data or productive stream data on the one hand and the technical device-related data on the other hand based on the network protocols used logs and the technical machine-related data in a logical and possibly also physically independent of the local network (separate) network, which is connected to an infrastructure for the evaluation and further processing of the data.

The protocol filter gateway can advantageously additionally or as the sole basis for the filtering implement a port forwarding function that separates the ports set in the document output systems for the device-related technical and / or print stream / productive stream data from each other and separately forwards.

In general, the protocol filter gateway can have at least one LAN or / and WLAN interface provided for connecting a productive device or output device and at least one LAN or / and WLAN interface provided for connection to the productive LAN. However, the protocol filter gateway can also be integrated into an associated productive device or output device or connected to it in some other way.

The separate from the productive LAN network for the transmission of machine-related data or service data can be realized on the basis of a so-called VLAN tagging, which allows the use of a physical Ethernet / LAN connection through multiple independent logical networks. The protocol filter gateway can generally, but in particular with regard to the addressed VLAN tagging, via a IEEE 802.1Q interface to the LAN or / and wireless LAN (WLAN) connection.

It is therefore preferred that the logically independent network is designed as a VLAN, which is realized, for example, as a WiFi or WLAN network or carrier VPN. Implementation based on a wireless standard such as GMS, GPRS, UMTS, LTE or the like also appears particularly expedient.

The protocol filter gateway can expediently not allow its own IP address to be visible from the point of view of the productive LAN in which the print stream data or productive stream data are communicated.

Without limitation of generality, the devices, systems, methods and applications or uses defined in the appended claims are also specifically provided.

6. Examples

The scheme of 1 shows as an example the principle of a protocol filter gateway according to the invention, which is connected between a printer and the productive LAN of a user. Service-related data of the output device are not left in the production network, but are directed to a separate VLAN. In this case, the VLAN is a UMTS network with connection to a service data server or to a corresponding manufacturer portal or a manufacturer-independent device portal, for example of the type generally known as such (see, for example, e-Maintenance , @Remote, and "My Device Portal"). For this purpose, the protocol filter gateway has an integrated UMTS modem and, preferably, a firewall separating the UMTS network from the productive LAN.

The separation of the service-related data of the output device from the data streams with print data content is carried out essentially by using an advanced routing functionality on the Layer 3 (Network) of the OSI model. Layer 3 forms the first decision level. Further follow-up decisions are made on the basis of the further layers if necessary.

As in 2 respectively. 3 The protocol filter gateway assumes a router-like function as a connection between the network elements LAN, output system and mobile network.

The Port of the Protocol Filter Gateway connected to the LAN becomes part of the LAN Subnet (Subnet A) and obtains an IP address visible on the LAN. For the output system, another sub-network (subnetwork B) is created, which can preferably accommodate only two IP addresses. The primary IP address (XXX1) is occupied by the port of the filter gateway, the secondary address (XXX2) is occupied by the output system. Other addresses are not permitted in this preferred embodiment.

The remaining third port of the protocol filter gateway, which establishes the connection to the mobile network, gets another IP address, which is assigned to the device by the provider of the mobile network (such as UMTS or GPRS) in the course of logging into the network.

The data separation in the protocol filter gateway now follows the following scheme. Data which reach the protocol filter gateway from the subnetwork A (destination address is in this case the IP address of the protocol filter gateway in the subnetwork A) are made available to the subnetwork B via a NAT routing. Routing from subnet A into the mobile network is always prevented by the protocol filter gateway. Thus, a data transfer from the LAN is excluded in the mobile network and vice versa.

• 1.) Handelt es sich um IP-Pakete deren IP-Header (OSI-Modell Layer 3) IP-Ziel-Adressen des Sub-Netzes A beinhalten, so werden diese über die Reverse-NAT-Funktionalität des Protokollfilter-Gateways zurück in das Sub-Netz A übermittelt.
• 2.) Alle weiteren Datenpakete, die die Regel 1 nicht erfüllen, werden zunächst daraufhin untersucht, welche Protokolle Verwendung finden (deep packet inspection: OSI Layer 4–7 Überprüfung). Protokolle, die gemäß der Sicherheitskonfiguration des Protokollfilter-Gateways freigegeben wurden, werden dann ebenfalls über eine NAT-Funktionalität ins Mobilfunknetz weitergeleitet. IP-Pakete, deren Protokolle für ein Routing nicht freigegeben wurden, werden verworfen.

Data of the sub-network B, that is, data that can only come from the output system due to the limited size of the bubble network B, are treated according to the embodiment described here according to the rules described below.

• 1.) If it concerns IP packets whose IP headers (OSI model layer 3) IP address addresses of the sub-net A contain, these are over the reverse NAT functionality of the protocol filter gateway back into the Subnet A is transmitted.
• 2.) All other data packets that do not comply with Rule 1 are first examined to determine which protocols are used (deep packet inspection: OSI Layer 4-7 check). Protocols that have been released according to the security configuration of the protocol filter gateway are then also forwarded to the mobile network via a NAT functionality. IP packets whose protocols have not been released for routing are discarded.

The functionality described above ensures that connections to the output system can only be initiated by the output system itself. If external connection structures are desired, they can be made possible by the call-knocking process already described in the introduction. In addition, it is possible to store fixed IP addresses in the protocol filter gateway, which can be used to enable dedicated connections from these IP addresses.

The scheme of 4 shows as an example the port forwarding for inbound and outbound traffic as an expedient development of a protocol filter gateway according to the invention. Shown are two output systems, communicating with a maintenance server via a respective protocol filter gateway with integrated firewall function via a physically separate from the production LAN, physically independent wireless network, over the Internet. The firewall function is illustrated by a brick icon which separates a network branch common to the output systems from the productive LAN with connected PC workstations. In fact, it is preferred that each protocol filter gateway has its own firewall and the protocol filter gateways are connected directly to the productive LAN. 5 corresponds to 1 , with additional specification of the port forwarding function.

An application example refers to a firmware update for output devices. As an example, the update of the firmware via a remote service connection to the respective output device (printer) is investigated for a printer series of the manufacturer Canon, which is considered as an example. These Canon machines are equipped with a self-contained firmware update mechanism that includes an auto-update that seems to be well-suited for realizing a remote function. Possible update procedures are in the overview of 6 listed. With the auto-update feature (column local UI in 3 ), which is time programmable, the machine automatically searches for new firmware on a regular basis. When she finds what she is looking for, she automatically downloads from the Canon CDS server, shut down and automatically reboots the machine.

This transfer takes place in the https protocol and establishes a web service to the Canon CDS server. The machine authenticates itself according to a proprietary procedure.

This auto-update process can be used directly for the realization of the invention proposal by the corresponding data traffic via a protocol data filter according to the invention, ie z. B. via a protocol filter gateway, via a separate from the production LAN of the respective user, separate network is guided approximately on the basis of UMTS on the Canon's own CDS server. For this purpose, each output system should be connected to the production LAN via its own protocol filter gateway which has an integrated UMTS modem, for example. Through a firewall-like blocking and separation, the service arrives The data stream in the https protocol through the protocol data filter does not enter the production network and print data streams can not reach the UMTS network for service data.

As far as different ports can be set for such an output system (or general productive system) for the different data streams, this can be used for additional tunneling and even more security. The possibility of setting ports for different data streams is possible, for example, with devices from Toshiba.

For example, a protocol data filter designed as a protocol filter gateway could be provided by an independent authority, e.g. B. an organization such as the TÜV in Germany, be certified in terms of its IT security. To avoid changes after installation, for example by a new firmware of the protocol filter gateway, this could be burned to a ROM.

The use of such a protocol filter or protocol filter gateway for the explained data stream separation has the advantage of high network security on the one hand and on the other hand allows the use of existing remote service infrastructures of the manufacturer or service provider, what significant cost and time savings during the introductory phase.

For explanation shows 7 An example of this is a device fleet that communicates with a CDS server and is managed via a device portal (M2M Portal). The production LAN infrastructure of the user or customer of the service provider remains untouched. Only a second logical LAN level is established, e.g. Here, for example, as a VLAN via which the service data is communicated without coming into contact with the print data stream (generally production data stream) in the production LAN. In the example of 4 is each production device of the example executed as a printer production devices 1, 2 and 3 via a respective protocol filter gateways PFG1, PFG2 and PFG3 on the production LAN and thus connected to a server of the user (customer). The production LAN is isolated from the Internet via a firewall. Each of the protocol filter gateways is implemented with a wireless interface, in particular a wireless modem, such as UMTS modem, via which the data connection with the CDS server and the device portal (M2M Portal), bypassing the production LAN and the firewall is made.

According to a likewise expedient variant, the respective protocol filter gateway can be connected via at least one Ethernet port IEEE 802.1Q and thus handle tagged frames. The network for the transmission of the service data streams, which is logically separated from the production LAN, could then be realized on the basis of the production LAN and the network for the transmission of the service data streams of the common network infrastructure. For reasons of acceptance alone, however, an execution of the protocol filter gateways, each with integrated wireless interface, for the physical separation of the network for the transmission of the service data streams from the production LAN will usually be preferred.

8th schematically shows an example of a protocol filter gateway according to the invention and illustrates its functions. It is connected to a first LAN network interface on a production LAN and to a second LAN network interface on a production device (device) such as a printer, and with an integrated UMTS interface preferably via the Internet with at least a service server (such as CDS server and / or device portal accordingly 5 ) connectable. The production data streams and the service data streams are separated from each other, and the production LAN and the UMTS-implemented network for transmitting service data streams are partitioned off from each other by a firewall function of the protocol filter gateway.

7th figure list

1 shows the schematic structure of an example of a protocol data filter as a variant protocol filter gateway;

2 shows the realized in one embodiment, the position of the protocol filter gateway in the OSI model;

3 shows the realized in one embodiment position of the protocol filter gateway in the network or between three separate networks;

4 serves as an illustration of the port setting for output systems with protocol filter gateways for inbound and outbound traffic;

5 shows the schematic structure of an example of a protocol data filter as a variant port forwarding protocol filter gateway;

6 lists variants of the firmware update on Canon's image Runner Advanced series;

7 gives an example of fleet management via protocol filter gateways to a service content server as well as an M2M service portal;

8th schematically illustrates the separation of production and service data streams in a protocol filter gateway and the mutual isolation of a production LAN and a network for transmitting service data streams through a firewall function of the protocol filter gateway.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• WO 02/078318 A1 [0018]
• WO 02/077718 A1 [0018]

Cited non-patent literature

• IEEE 802.1Q interface [0044]
• IEEE 802.1Q [0064]

Claims (38)

Method and device for logical separation, for routing and, if desired, tuned transfer of device-related technical parameters of at least one productive system, in particular at least one document output system, which is simultaneously integrated into a local network for communication of productive stream data, in particular print stream data. Method and device according to claim 1, characterized in that a gateway, in particular protocol filter gateway is provided or used which separates the productive stream data, in particular print stream data, and the technical device-related data, preferably based on the network protocols used, and transmits the technical device-related data in a relation to the local network logically independent, preferably separate network, which is connected to an infrastructure for the evaluation and further processing of this data. Method and device according to claim 2, characterized in that the gateway additionally comprises a port forwarding function which, based on at least one port set in the at least one productive system, in particular document output system, separates the device-related technical data and / or the print stream data from one another and separately forwards. Method and device according to claim 2 or 3, characterized in that the gateway has at least one IEEE 802.1 Q interface, for example for connection to wireless LANs. Method and device according to one of claims 2 to 4, characterized in that the logically independent network is designed as a VLAN. Method and device according to one of claims 2 to 5, characterized in that the logically independent network is a WiFi, a Carrier VPN, a GMS, GPRS, UMTS, or LTE network or the like. Method and device according to one of claims 2 to 6, characterized in that the gateway from the point of view of the productive LAN, in which the productive stream data, in particular print stream data are communicated, no own IP address can be visible. System in which at least one first network or first network segment (hereinafter referred to both as "first network") comprising at least a first network device by means of a gateway selectively, depending on data to be transmitted, with a second network or second network segment (hereinafter both addressed only as a "second network") and with a third network or third network segment (hereinafter both referred to only as "third network") in data transmission connection or can be brought, such that first data only between the first network and the second network and transfer second data only between the first network and the third network. A system according to claim 8, characterized in that the gateway is adapted to carry out a filtering function and / or a port forwarding function comprising the first data from the second data based on at least one of a sender IP address, a destination IP Address, a data-underlying protocol, and a data-set port. A system according to claim 8 or 9, characterized in that the second network comprises at least one, preferably a plurality of second network devices communicating with the first network device in data transmission connection for the transmission of first data, and that via the third network a data transmission connection for the transmission of second data between the first network device and at least a third network device can be produced. A system according to any one of claims 8 to 10, characterized in that the first data is related to the use of at least one function of the first network device by an application running on a second network device, and that the second data comprises device related data of the first network device at least one of meter readings, configuration data, error code data, status code data, firmware data, and operating medium stock data. System according to one of claims 8 to 11, characterized in that the first network device is at least one of an office device, a document output device, a printer, a scanner, a fax machine or a multi-functional device fulfilling several functions. A system according to any one of claims 8 to 12, characterized in that the second network device is a workstation computer or a network server interacting with a workstation computer. System according to one of claims 8 to 13, characterized in that the Data transmission connection for the transmission of second data between the first network device and the third network device is made via the Internet, and that the third network device with respect to a second data to the first network device or second data received from the first network device Internet server or remote maintenance is on the first network device serving desktop computer. System according to one of claims 8 to 14, characterized in that the third network is logically separated from the second network and / or that the third network is a virtual network, preferably a virtual private network (VPN). A system according to any one of claims 8 to 15, characterized in that the third network is provided on the basis of Ethernet infrastructure, based on which the second network is provided. System according to one of claims 8 to 15, characterized in that the third network is provided on the basis of separate from the Ethernet infrastructure of the second network network infrastructure. A system according to claim 17, characterized in that the third network comprises a wireless network, in particular a wireless telephony network. System according to claim 18, characterized in that the gateway has an integrated wireless network interface, in particular GMS, GPRS, UMTS or LTE interface. System according to one of claims 8 to 19, characterized in that the gateway comprises a first network interface for connection to the first network or to the first network device and a second network interface for connection to the second network. System according to one of claims 8 to 20, characterized in that a plurality of first networks are provided which are via a respective own gateway with the first network associated second network and the first network associated third network in data transmission connection or can be brought, for the transmission of first data only between the respective first network and the second network and for the transmission of second data only between the respective first network and the third network. A system according to any one of claims 8 to 21, having the features of at least one of claims 1 to 7 and / or at least one feature removable from the overall disclosure of the present application. Gateway for realizing a system according to one of claims 8 to 22, preferably with the features of at least one of claims 1 to 7 or / and preferably with the gateway-related features of at least one of claims 8 to 21, and / or preferably with at least one feature removable from the overall disclosure of the present application. Method in which at least one first network or first network segment (hereinafter both referred to as "first network") comprising at least a first network device by means of a gateway selectively, depending on data to be transmitted, with a second network or second network segment (hereinafter both addressed only as a "second network") and brought into data communication connection with a third network or third network segment (hereinafter both referred to as "third network" only), such that first data will only be transferred between the first network and the second network and second data is transferred only between the first network and the third network. A method as claimed in claim 24, characterized in that the gateway performs a filtering function and / or a port forwarding function which extracts the first data from the second data based on at least one of a sender IP address, a destination IP address, a protocol underlying the data and a port set for the data. A method according to claim 24 or 25, characterized in that the second network comprises at least one, preferably a plurality of second network devices communicating with the first network device in data transmission connection for the transmission of first data, and that via the third network a data transmission connection for the transmission of second data is established between the first network device and at least one third network device. Method according to one of claims 24 to 26, characterized in that the first data is based on the use of at least one function of the first network device by an application running on a second network device data, and that the second data device-related data of the first network device comprising at least one of meter readings, Configuration data, error code data, status code data, firmware data and operating medium stock data. Method according to one of Claims 24 to 27, characterized in that the first network device is at least one of an office appliance, a document dispenser, a printer, a scanner, a fax machine or a multifunction device fulfilling a plurality of such functions. Method according to one of Claims 24 to 28, characterized in that the second network device is a workstation computer or a network server interacting with a workstation computer. Method according to one of claims 24 to 29, characterized in that the data transmission connection for the transmission of second data between the first network device and the third network device via the Internet is established, and that the third network device, a second data to the first network device supplying or second Data from the first network device receiving Internet server or a workstation computer, from which a remote maintenance is performed with respect to the first network device. Method according to one of claims 24 to 30, characterized in that the third network is logically separated from the second network and / or that the third network is a virtual network, preferably a virtual private network (VPN). Method according to one of claims 24 to 31, characterized in that the third network is provided on the basis of Ethernet infrastructure, is provided based on the second network. Method according to one of claims 24 to 31, characterized in that the third network is provided on the basis of separate from the Ethernet infrastructure of the second network network infrastructure. A method according to claim 33, characterized in that the third network comprises a wireless network, in particular a wireless telephony network. A method according to claim 34, characterized in that the gateway has an integrated wireless network interface, in particular GMS, GPRS, UMTS or LTE interface. A system according to any one of claims 24 to 35, characterized in that the gateway has a first network interface with which it is connected to the first network or to the first network device, and has a second network interface with which it is connected to the second network becomes. System according to one of claims 24 to 36, characterized in that a plurality of first networks are provided, which are brought via a respective own gateway with the first network associated with the second network and the first network associated with the third network in data transmission connection, for the transmission of first data only between the respective first network and the second network and for the transmission of second data only between the respective first network and the third network. A method according to any one of claims 24 to 37, having the features of at least one of claims 1 to 7 and / or at least one feature removable from the overall disclosure of the present application.

Images