JP4626459B2 - Image processing apparatus, image processing method, and image processing program - Google Patents

Description

  The present invention relates to an image processing apparatus, an image processing method, and an image processing program, and more particularly, to improvement of security in an apparatus such as a multifunction machine shared by a plurality of users.

  The multifunction machine has a plurality of functions such as image scanning, printing, FAX transmission, and image data file output, and has many parameters that can be set such as input resolution and document type. On the other hand, individual users often use multifunction devices in a standardized form to some extent. Therefore, in order to easily realize the standardized processing, there exists a multifunction device having a function capable of registering and executing a job template. Here, the job template is information defining a series of processing types and parameters, and is described in a language such as XML, for example. In a multi-function peripheral having a job template function, a user can easily implement the standard processing defined in the job template by calling the registered job template from the storage unit of the multi-function peripheral and instructing the execution. Also, the user can easily cause the multi-function peripheral to execute a process in which some parameters are changed by modifying an existing job template.

  For example, the job template can describe a process of transferring image data obtained by scanning. Since this image transfer uses ftp (File Transfer Protocol), SMB (Server Message Block) protocol, etc., it is necessary to input a user name and a password. The MFP checks whether the user has authority for the requested image transfer process by checking the password registered in advance corresponding to the entered user name and the entered password. Authenticate.

  Processing for inputting a user name and password required for such authentication processing to the multifunction peripheral can also be performed by the job template. That is, the user can describe a user name and password in a job template according to a predetermined format. When this job template is executed, the multi-function peripheral performs authentication based on the user name and password described in the job template.

  Now, information such as the above-mentioned user name and password is highly concealed. For this reason, for example, when a job template is taken out from a multifunction peripheral to a client computer via a network or the like for correction or the like, a system that does not leak such confidential information is required.

  Therefore, conventionally, the confidential information is hidden and displayed so as not to expose the user to the specific client computer side software prepared for taking out the job template, and the communication path between the client computer and the multifunction peripheral is SSL, etc. By using this method, it is possible to prevent leakage of confidential information. However, in this method, there is a possibility that secret information may be stolen using malicious software on the client computer side.

  Therefore, in order to take out a job template from the multifunction device to the client computer with higher security, a method of encrypting a secret part by an encryption method that can be decrypted only by the multifunction device is known. In this method, since the confidential information cannot be decrypted on the client computer, the confidential information is prevented from leaking to the user.

  The method of encrypting confidential information on the multifunction device side described above is a reply attack in which a new job template is created on the client computer side by copying and pasting a portion including the confidential information and executed on the multifunction device. There was a problem that it was possible. Another problem is that another user can use the job template registered in the multifunction peripheral as it is to perform a reply attack. Due to these problems, in the above-described image transfer example, for example, image data created by another person is stored in the user management area of the transfer destination, resulting in inconvenience such as insufficient storage capacity or trouble in management. obtain.

  The present invention has been made to solve the above-described problems, and an image processing apparatus, an image processing method, and an image that prevent a user from performing processing by using confidential information described in a job template by a user. An object is to provide a processing program.

  An image processing apparatus according to the present invention includes a process definition information storage unit that stores process definition information that defines a process related to an image, a process execution unit that executes the process based on the process definition information specified by an execution user, An authentication means for performing user authentication as to whether or not the execution user is an authorized user set in the process definition information, and protection target information used for the user authentication is described in the process definition information And processing definition information processing means for rewriting the processing definition information and adding the processing for causing the execution user to input the protection target information separately.

  In another image processing apparatus according to the present invention, the process definition information processing unit performs the rewriting when the process definition information is stored in the storage unit.

  In still another image processing apparatus according to the present invention, the process definition information processing unit stores the storage unit stored in the storage unit when a security level set in the image processing apparatus is changed to a predetermined level or more. The rewriting is performed on the process definition information.

  In another image processing apparatus according to the present invention, the process definition information processing unit detects a user authentication process using the protection target information described in the process definition information while the process execution unit is executing the process. If so, the rewriting is performed.

  In another image processing apparatus according to the present invention, the processing definition information processing unit performs the rewriting when the processing definition information designated by the execution user is retrieved from the storage unit, The process definition information is passed to the process execution means.

  In another image processing apparatus according to the present invention, the processing definition information processing means further deletes the protection target information as the rewriting.

  Another image processing apparatus according to the present invention includes a process definition information storage unit that stores process definition information that defines a process related to an image, and a process execution unit that executes the process based on the process definition information designated by an execution user. Authentication means for performing user authentication as to whether or not the execution user is an authorized user set in the process definition information, and protection target information used for the user authentication is described in the process definition information. Process definition information processing means for rewriting the process definition information, and when the process definition information processing means is retrieved from the storage means, as the rewrite, The protection target information is deleted.

  An image processing method according to the present invention is a method for storing process definition information defining a process related to an image and executing the process based on the process definition information designated by an execution user. A process definition information processing step for rewriting the process definition information and adding a process for causing the execution user to input the protection target information separately when protection target information used for user authentication is described; Based on the protection target information input in accordance with the process added in the process definition information processing step, user authentication is performed as to whether or not the execution user is an authorized user set in the process definition information. And an authentication step to be performed.

  An image processing program according to the present invention includes: a procedure for registering process definition information defining a process related to an image in a computer; a procedure for performing the process based on the process definition information designated by an execution user; If the procedure for performing user authentication as to whether or not the user is an authorized user set in the process definition information and the protection target information used for the user authentication are described in the process definition information, the process definition A process definition information processing procedure for adding a process for causing the execution user to input the protection target information separately by rewriting information is executed.

  According to the present invention, even if the user describes the protection target information in the process definition information, the user who intends to execute the process definition information must input the protection target information again, so the process definition information is used as it is. Reply attacks can be prevented. When the process definition information is extracted from the image processing apparatus, the protection target information described in the process definition information is deleted. Therefore, copy and paste the protection target information to generate and execute new process definition information. Reply attacks can be prevented.

  DESCRIPTION OF THE PREFERRED EMBODIMENTS A multi-function machine that is an embodiment of the present invention (hereinafter referred to as an embodiment) will be described below with reference to the drawings.

[First Embodiment]
FIG. 1 is a block diagram showing a schematic configuration of a multifunction machine according to the present embodiment. The MFP 1 includes a controller 2, an image input terminal (IIT) 4, an image output terminal (IOT) 6, a user interface (UI) 8, and a communication interface 10.

  The IIT 4 is composed of an image scanner and reads an image on a medium such as paper to generate image data. The IOT 6 is composed of a printer, and forms an image on a medium such as printing paper based on image data. The UI 8 is a means for various display outputs to the user and for the user to perform operation input, and can be configured by, for example, a liquid crystal display and a touch panel arranged on the surface thereof. The communication interface 10 is means for connecting the multifunction device 1 to a network and enabling communication with other devices on the network.

  The controller 2 includes, for example, a CPU, and performs processing such as image data processing and user authentication in addition to control of these units by execution of a program. In addition, the controller 2 includes a storage unit including, for example, a hard disk device or a semiconductor memory device, and a job template is stored in the storage unit.

  Next, the operation of the multifunction device 1 will be described. FIG. 2 is a block diagram showing a schematic configuration related to registration / execution of a job template (JT) in the multifunction machine 1. The multifunction machine 1 is connected to a PC 20 that is a client computer via a network. The controller 2 of the multifunction machine 1 includes a JT rewriting unit 22, a JT pool 24, a security level storage unit 26, and a JT execution unit 28. Specifically, the JT rewriting unit 22 is configured using a CPU, and performs a process of rewriting a job template by a program executed on the CPU. When the protection target information such as the user's password is described in the job template, the rewrite processing is changed to a content that prevents the protection target information from being known to others.

  The JT pool 24 is means for storing and holding registered job templates, and is configured using a storage unit provided in the controller 2. The security level storage unit 26 is means for storing and holding a parameter indicating a security level set by the administrator or the like in the multifunction device 1. For example, the storage area in the storage unit in the controller 2 is provided. The JT execution unit 28 is configured using a CPU, and performs a process of executing a job template by a program executed on the CPU.

  FIG. 3 is a schematic functional block diagram of a configuration in which the JT rewriting unit 22 performs a rewriting process when registering a job template from the PC 20 to the multifunction device 1. The user creates a job template on the PC 20 and transmits the created job template 30 to the multifunction device 1 for registration.

  The multifunction device 1 receives the job template 30 transmitted from the PC 20 via the network via the communication interface 10. The received job template 30 is transferred to the JT rewriting unit 22 and rewritten as necessary. FIG. 4 is a schematic process flow diagram of the rewriting process performed by the JT rewriting unit 22. The JT rewrite unit 22 refers to the security level set in the security level storage unit 26, and performs the rewrite process described below when the set level is a predetermined value or higher, that is, when high security is required. In other cases, it is determined that the rewriting process is unnecessary, and the job template 30 is output as it is to the JT pool 24 as the job template 32 (S40).

  If a high security level is set, it is checked as a rewrite process whether there is a description of authority information including protection target information in the job template 30 (S42). For example, the JT rewriting unit 22 searches for an “AuthInfo” tag in a job template described in XML shown as an example later. When the JT rewrite unit 22 finds the description of the authority information (S44), it deletes the user password that is the protection target information included in the description (S46), and further tries to execute the job template. A description requesting the user to input a password is added to the job template (S48). The job template 32 generated by this rewriting is registered in the JT pool 24. On the other hand, when the authority information is not described (S44), the JT rewriting unit 22 outputs the job template 30 as it is to the JT pool 24 as the job template 32.

  FIG. 5 is an explanatory diagram showing an example of a job template 30 created by the user, and shows a job template described in XML. The job template shown in FIG. 5 includes a processing instruction to scan an image with IIT4 and transfer the generated image data to a designated transfer destination, and is surrounded by “AuthInfo” tags for authentication with respect to ftp. Includes a description 60 of authority information. This description 60 includes a user name enclosed by an “OperatorName” tag and a password enclosed by a “Password” tag. When this job template is selected and executed, user authentication in ftp or the like is performed based on the authority information described in the job template, and the user can save the trouble of inputting a password or the like again.

  When the set security level is low, the JT rewriting unit 22 can register the job template input by the user in the JT pool 24 as it is. When this security setting is at a low level or at a medium level, the JT rewriting unit 22 rewrites the description 60 as shown in FIG. 6, and the MFP 1 decrypts the user name and password. As a description 62 replaced with a cipher that can be used, a job template including the description 62 may be registered in the JT pool 24.

  On the other hand, when the JT rewrite unit 22 detects that the security setting is at a high level in the determination process S40, the JT rewrite unit 22 performs the rewrite processes S46 and S48. FIG. 7 is an explanatory diagram showing an example of the job template rewritten by the rewriting processes S46 and S48, and is generated corresponding to the job template shown in FIG. In the description of the job template in FIG. 7, the portion corresponding to the description 60 in FIG. In the description 64, among the authority information described by the user, the encrypted user name is described, but the password is deleted in step S46. Further, the JT rewriting unit 22 adds descriptions 66 and 68 to the job template in step S48. The description 66 represents a process for prompting the user to input a character string representing a password, and the description 68 is for taking the character string input corresponding to the description 66 into the process as a password. The JT rewriting unit 22 registers the rewritten job template as shown in FIG.

  As described above, the user can select and execute the job template registered in the JT pool 24 from the PC 20 or the UI 8. When the job template instructed to execute includes an encrypted user name and password as in the description 62 in FIG. 6, the JT execution unit 28 decrypts them and authority information stored in the storage unit The user is authenticated by checking the correspondence between the user name and password registered in advance in the file. If the job template for which execution has been instructed has been rewritten as shown in FIG. 7, the JT execution unit 28 requests the user who has instructed execution to input a password. Then, the JT execution unit 28 determines whether the input password and the user name encrypted and described in the job template match those registered in the authority information file, and the execution instructing user determines that the job template Authenticates whether the person has the right to execute

  Further, as a configuration in which the JT rewriting unit 22 performs the rewriting process when registering the job template from the PC 20 to the multifunction device 1, a configuration corresponding to the schematic functional block diagram shown in FIG. 8 is possible. In the configuration shown in FIG. 8, the controller 2 temporarily stores the job template 30 input from the PC 20 to the multifunction device 1 in the JT pool 24 as it is. Thereafter, the JT rewriting unit 22 appropriately retrieves the job template 30 from the JT pool 24, and performs the rewriting process described above with reference to the flowchart of FIG. 4 according to the security level set in the security level storage unit 26. The job template 32 is generated. The generated job template 32 is stored in the JT pool 24, and the previously registered job template 30 is replaced with this job template 32. According to this configuration, for example, the JT rewriting unit 22 can perform the rewriting process when the CPU load of the controller 2 is low, and the other processes of the controller 2 can be efficiently executed.

[Second Embodiment]
A multifunction machine according to the second embodiment of the present invention has the configuration shown in FIG. In the present embodiment, the job template registered in the JT pool 24 is rewritten when the security level set in the multifunction device 1 rises above a predetermined value. The controller 2 has the configuration shown in FIG. In addition, a security level change detection unit 70 is further provided. Hereinafter, the same reference numerals are given to components having the same functions as those in the first embodiment, and the description will be simplified.

  FIG. 9 is a schematic functional block diagram for explaining the operation of the multifunction device 1 of the present embodiment. For example, a user-created job template 30 from the PC 20 is already registered in the JT pool 24. An administrator of the multifunction device 1 can change the security level set in the security level storage unit 26, and the security level change detection unit 70 monitors the change. When the security level change detection unit 70 detects a change in the security level, the security level change detection unit 70 instructs the JT rewriting unit 22 to perform a job template rewriting process.

  Upon receiving the instruction, the JT rewriting unit 22 executes the rewriting process described with reference to FIG. 4 in the first embodiment for each job template registered in the JT pool 24. For example, when the security level is changed to a high level equal to or higher than a predetermined value (S40), the JT rewriting unit 22 deletes the password described in advance in the job template (S46), and rewrites the password and requests the user to describe again. Add (S48).

[Third Embodiment]
The multifunction peripheral according to the third embodiment of the present invention rewrites the job template registered in the JT pool 24 immediately before the execution. The multifunction device 1 has the configuration shown in FIGS. 1 and 2, and hereinafter, the components having the same functions as those of the first embodiment are denoted by the same reference numerals and the description thereof is simplified.

  FIG. 10 is a schematic functional block diagram for explaining the operation of the multifunction machine 1 of the present embodiment. For example, a user-created job template 30 from the PC 20 is already registered in the JT pool 24. The user selects a job template registered in the JT pool 24 from the PC 20 or UI 8 and issues an execution instruction. The controller 2 passes the job template instructed to be executed to the JT rewriting unit 22.

  The JT rewriting unit 22 executes the rewriting process described with reference to FIG. 4 in the first embodiment for the job template input from the JT pool 24. At this time, the JT rewriting unit 22 can refer to the security level set in the security level storage unit 26 and perform rewriting according to the level. For example, when the security level is a high level equal to or higher than a predetermined value (S40), the JT rewriting unit 22 deletes the password described in advance in the job template (S46), and adds a description for the user to input the password again. Rewriting (S48) is performed.

  The rewritten job template 32 is transferred from the JT rewriting unit 22 to the JT execution unit 28, and the JT execution unit 28 executes the input job template 32. When the security level is set high, the job template 32 is rewritten as shown in FIG. 7, and in this case, the JT execution unit 28 requests the user who has instructed the execution to input a password. Then, the JT execution unit 28 determines whether the input password and the user name encrypted and described in the job template match those registered in the authority information file in the storage unit of the controller 2 and executed. It is authenticated whether the instructing user is a person who has the authority to execute the job template. The JT execution unit 28 executes substantial processing such as ftp included in the instructed job template 32 when the execution user can be authenticated, and notifies the execution user when the authentication fails. The substantial process included in the job template 32 is not executed.

  In the above configuration, the job template is rewritten before the job template is transferred to the JT execution unit 28. However, the JT execution unit 28 corresponds to the authority information such as the description 60 and the description 62 during the execution of the job template. For example, it may be configured to branch to a process for obtaining a user input prepared in advance. FIG. 11 is a schematic process flow diagram for explaining the process of the JT execution unit 28 when the description of the authority information is detected during the execution of the job template. The JT execution unit 28 sequentially extracts the description elements of the job template 30 (S80) and executes them (S82). When the extracted element is identified by authority information, for example, an “AuthInfo” tag (S84), the JT execution unit 28 checks the security level set in the security level storage unit 26, and is greater than or equal to a predetermined value. If it is the high level (S86), the authentication process using the password included in the “AuthInfo” tag, for example, is not performed, but instead a process for requesting the user input of the password is executed (S88). On the other hand, if the security level is less than the threshold value, the user input process S88 is not executed, and the authentication process using the information included in the “AuthInfo” tag is performed (S82).

  In the first to third embodiments, rewriting for deleting the password, which is the protection target information, is performed. However, the rewritten job template is registered and executed in the multi-function device 1 and is external to the multi-function device 1, such as the PC 20. If the password is not taken out, it is not always necessary to delete it, and other rewriting that invalidates the description of the password in the job template can be used. For example, an instruction to use a password as a password may be invalidated without deleting the password itself.

[Fourth Embodiment]
The multifunction peripheral according to the fourth embodiment of the present invention rewrites a job template registered in the JT pool 24 when it is taken out from the multifunction peripheral. The multifunction device 1 has the configuration shown in FIGS. 1 and 2, and hereinafter, the components having the same functions as those of the first embodiment are denoted by the same reference numerals and the description thereof is simplified.

  FIG. 12 is a schematic functional block diagram for explaining the operation of the multifunction device 1 of the present embodiment. Here, an example in which a job template is taken out from the multifunction device 1 to the PC 20 will be described. For example, a user-created job template 30 from the PC 20 is already registered in the JT pool 24. A job template created by a user may change some parameters or processing of an existing job template. In such a case, it is easier to edit a similar existing job template 30 than to describe a new job template 30 from scratch. In this case, the user selects a job template registered in the JT pool 24 from the PC 20 and takes it out to the PC 20 to perform editing work on the PC 20. When there is a request for taking out the job template 30 from the PC 20, the controller 2 passes the job template 30 taken out from the JT pool 24 to the JT rewriting unit 22.

  FIG. 13 is a schematic process flow diagram of the rewriting process performed by the JT rewriting unit 22 when taking out a job template from the multifunction machine 1. The JT rewrite unit 22 refers to the security level set in the security level storage unit 26, and performs the rewrite process described below when the set level is a predetermined value or higher, that is, when high security is required. In other cases, it is determined that the rewriting process is unnecessary, and the job template 30 is transferred to the PC 20 as it is (S90).

  If a high security level is set, it is checked as a rewrite process whether there is a description of authority information including protection target information in the job template 30. For example, the JT rewriting unit 22 searches for an “AuthInfo” tag in the job template described in XML (S92). When the JT rewrite unit 22 finds a description of the authority information (S94), it deletes the description of the authority information. As a result, the user name and password enclosed by the “AuthInfo” tag such as description 60 and description 62 are deleted (S96). The job template from which the description of the authority information is deleted is output to the PC 20. On the other hand, when there is no description of the authority information (S94), the JT rewriting unit 22 outputs the job template 30 to the PC 20 as it is. In this way, the job template from which the description of the authority information to be protected is deleted is passed to the PC 20, and the authority information is prevented from leaking to others.

1 is a block diagram illustrating a schematic configuration of a multifunction peripheral according to an embodiment of the present invention. FIG. 3 is a block diagram showing a schematic configuration related to registration / execution of a job template in the multifunction peripheral according to the embodiment of the present invention. FIG. 2 is a schematic functional block diagram of a multifunction peripheral according to the first embodiment that performs rewriting processing when registering a job template. It is a process flow figure of an outline of rewriting processing which adds processing which asks for user input. It is explanatory drawing which shows the example of the job template which the user produced. It is explanatory drawing which shows the example of description which encrypted the description of the authority information which the user produced. It is explanatory drawing which shows the example of the rewritten job template. FIG. 10 is a schematic functional block diagram of another configuration of the multifunction peripheral according to the first embodiment that performs rewriting processing when registering a job template. FIG. 6 is a schematic functional block diagram of a multifunction peripheral according to a second embodiment that performs rewrite processing when a security level changes. FIG. 10 is a schematic functional block diagram of a multifunction peripheral according to a third embodiment that performs rewriting processing immediately before execution of a job template. FIG. 10 is a schematic process flow diagram illustrating a process of a JT execution unit when a description of authority information is detected during job template execution. FIG. 10 is a schematic functional block diagram of a multifunction peripheral according to a fourth embodiment that performs rewriting processing when taking out a job template from the multifunction peripheral. FIG. 10 is a schematic process flow diagram of a rewriting process when a job template is taken out from a multifunction peripheral.

Explanation of symbols

  2 controller, 4 image input terminal (IIT), 6 image output terminal (IOT), 8 user interface (UI), 10 communication interface, 20 PC, 22 JT rewrite unit, 24 JT pool, 26 security level storage unit, 28 JT Execution unit, 30, 32 job template, 70 security level change detection unit.

Claims (11)

A process definition information storage means for storing process definition information defining the types and parameters of a series of processes executed by the image processing apparatus ;
A process execution means for executing the process based on the process definition information designated by the execution user;
Authentication means for performing user authentication as to whether or not the execution user is an authorized user set in the process definition information;
If the protected information that is used for the user authentication in the process definition information is described, by performing the rewriting of the processing definition information separately the protected information, the processing for input to the execution user Process definition information processing means to be added to the process definition information;
An image processing apparatus comprising: The image processing apparatus according to claim 1.
The process definition information processing means performs the rewriting when storing the process definition information in the storage means,
An image processing apparatus. The image processing apparatus according to claim 1.
The process definition information processing means performs the rewriting on the process definition information stored in the storage means when a security level set in the image processing apparatus is changed to a predetermined level or higher.
An image processing apparatus. The image processing apparatus according to claim 1.
The process definition information processing means performs the rewriting when the process execution means detects a user authentication process using the protection target information described in the process definition information while the process is being executed.
An image processing apparatus. The image processing apparatus according to claim 1.
The process definition information processing means performs the rewriting when the process definition information designated by the execution user is extracted from the storage means, and passes the rewritten process definition information to the process execution means.
An image processing apparatus. The image processing apparatus according to claim 1.
The processing definition information processing means performs the rewriting when there is a request for extracting the processing definition information from another device connected via a network, and passes the rewritten processing definition information to the other device. thing,
An image processing apparatus. The image processing apparatus according to claims 1 to claim 6,
The image processing apparatus, wherein the processing definition information processing means further deletes the protection target information as the rewriting. The image processing apparatus according to claim 1, wherein:
The process definition information processing means includes, as the rewriting, a process of encrypting a user name of the authorized user and deleting a password in the protection target information, and causing the execution user to separately input the password. An image processing apparatus characterized by being added to the image processing apparatus. A process definition information storage means for storing process definition information defining the types and parameters of a series of processes executed by the image processing apparatus ;
A process execution means for executing the process based on the process definition information designated by the execution user;
Authentication means for performing user authentication as to whether or not the execution user is an authorized user set in the process definition information;
When the protection target information used for the user authentication is described in the process definition information, process definition information processing means for rewriting the process definition information;
Have
The process definition information processing means deletes the protection target information as the rewrite when the process definition information is retrieved from the storage means.
An image processing apparatus. In an image processing method for storing processing definition information defining a type and parameters of a series of processing executed in an image processing apparatus , and executing the processing based on the processing definition information designated by an execution user,
If the protected information that is used for user authentication in the process definition information is described, by performing the rewriting of the processing definition information separately the protected information, the process of processing to be input to the execution user Processing definition information processing step to be added to the definition information;
Based on the protection target information input according to the process added in the process definition information processing step, user authentication is performed as to whether or not the execution user is an authorized user set in the process definition information. An authentication step;
An image processing method comprising: On the computer,
A procedure for registering process definition information defining a type and parameters of a series of processes executed in the image processing apparatus ;
A procedure for performing the process based on the process definition information designated by an execution user;
A procedure for performing user authentication as to whether or not the execution user is an authorized user set in the process definition information;
If the protected information that is used for the user authentication in the process definition information is described, by performing the rewriting of the processing definition information separately the protected information, the processing for input to the execution user Process definition information processing procedure to be added to the process definition information,
An image processing program for executing

Images