JP4906767B2 - Print management system, print management method, terminal, server, print compatible server - Google Patents

Description

  The present invention relates to a print management system, a print management method, a terminal, a server (for example, a blade server), and a print-compatible server, and more specifically, from a printer connected to a terminal that constitutes a thin client system together with the server. The present invention relates to a technique for controlling a printing process. The server only needs to have resources that can be used by the thin client, and the name is not limited to the server. For example, it includes a PC.

  Because of the need for information leakage countermeasures and internal control in companies, etc., the client computer is a dedicated computer (thin client) that has only a minimum function such as display and input, or that can be used without a hard disk device. A thin client concept has emerged in which resources such as application software are centrally managed by a server (for example, a blade server).

As a technique related to such a thin client system, for example, a thin client, a printer directly connected to the thin client, or a printer connected via a local network, and the thin client are installed in different locations, and the thin client And a server for storing data and performing application processing based on instructions from the thin client, and transmitting processing results to the thin client, and from a user who uses the thin client When there is a print instruction, the server acquires printer information of a printer that performs printing, generates print data from the printer information and the user's print instruction, and generates watermark information based on the user information. And the printing finger The watermark information is embedded in the print data according to, and transmitted to the thin client, and the thin client prints the print data embedded with the watermark information transmitted from the server from the printer. (Refer patent document 1) etc. are proposed.
JP 2007-34830 A

  Thin clients are often carried with users when they go out because of their portability. Under such circumstances, a request from a thin client user to perform print processing naturally occurs. However, in a thin client system that is premised on establishing a secure usage environment, if the printing process is executed indefinitely from a printer connected to a thin client on the go, the assumption in the thin client system may be broken. .

  Accordingly, the present invention has been made in view of the above problems, and a main object of the present invention is to provide a technique that enables printing processing from a printer connected to a thin client while ensuring appropriate security.

  In the present invention, a print-compatible server for a thin client is prepared. The print server receives print data from the server, temporarily stores the print data, executes predetermined processing, and performs printing with a printer connected to the thin client side via a USB cable or the like. This predetermined process includes at least one of (1) recording an output log and (2) authentication of a thin client user.

  Further, (1) the output log includes a log regarding a print data transmission request from the server to the print compatible server, and a log regarding a print instruction from the print compatible server to the printer. Further, (2) user authentication includes authentication when a print request is sent from the server to the print compatible server, and authentication when a print instruction is issued from the print compatible server to the printer.

  More specifically, the print management system of the present invention that solves the above problem is a computer system that manages print processing from a printer connected to a terminal that constitutes a thin client system together with a server, and the terminal is the terminal. The storage unit for storing the driver of the printer connected to the server and the designation of the print target file from the file stored in the server established with the terminal are accepted by the input interface, and the print target file The printer output image file from the server to another server connected to the server after executing a file generation instructing unit for instructing the server to generate a printer output image file and an authentication process for the user of the terminal The transfer request is accepted by the input interface, and the authentication process A file transfer instruction means for instructing the server to transfer the printer output image file including the authenticated user ID and executing authentication processing for the user of the terminal, and then accessing the other server. Of the data storage area provided in the storage device of the other server, the pre-print file storage folder that stores the pre-print printer output image file that is associated with the user ID authenticated by the authentication process. Accepting the designation of the printer output image file to be printed by the input interface, reading the printer output image file to be printed from the other server, and using the driver in the storage means for the printer output image file Print processing means for executing a print instruction to the printer. The server transmits a list of files stored in the storage device to the storage unit that stores the driver of the printer connected to the terminal and the connection established, and from the list A file generation instruction receiving unit that receives designation of a print target file and a printer output image file generation instruction for the print target file from the terminal, and the print target according to the printer output image file generation instruction The file is read from the storage device, a printer output image file is generated from the file to be printed based on the driver in the storage unit, and stored in the memory. The file generation unit and the terminal user are authenticated by the authentication process. The transfer instruction of the printer output image file including the user ID. And a file transfer means for reading the printer output image file from the memory and transferring the printer output image file from the server to another server connected to the server. The other server includes a data storage area for each ID of a user authorized to execute a printing process by connecting a predetermined printer to the terminal, and outputs the printer from the server. A file storage processing means for receiving the image file if it has been transferred and storing it in a pre-printing file storage folder in a storage area associated with the user ID attached to the printer output image file; For the terminal that has received access through the user authentication process, the other server has a data storage device. A list of printer output image files in the pre-print file storage folder associated with the user ID authenticated in the authentication process in the data storage area, and a printer to be printed from the list Accepts the designation of the output image file, reads the printer output image file to be printed from the storage device and sends it to the terminal, and moves the corresponding printer output image file from the pre-print file storage folder to the post-print file storage folder And file moving means.

  In the print management system, when the other server reads the printer output image file to be printed from the storage device and transmits it to the terminal, the ID and transmission time of the corresponding printer output image file transmitted to the terminal It is also possible to have a print log recording means for storing a print log including at least the above information in a storage device in association with the user ID.

  In the print management system, the terminal receives a print end notification from the printer after instructing the printer to print the printer output image file, and converts the printer output image file into the printer output image file. It is also possible to have image erasing means for performing erasure processing from the temporary storage means.

  The print management method of the present invention is a method for managing print processing from a printer connected to a terminal constituting a thin client system together with a server, wherein the terminal stores a driver of the printer connected to the terminal. The server receives the designation of the file to be printed from among the files stored in the server and stored in the server established with the terminal, and generates a printer output image file for the file to be printed. Instructing and executing the authentication process for the user of the terminal, accepting the transfer request of the printer output image file from the server to another server connected to the server through the input interface, and authenticating by the authentication process. A transfer instruction of the printer output image file including the ID of the user To the server, execute authentication processing for the user of the terminal, access the other server, and the data stored in the storage device of the other server is authenticated in the authentication processing. The input interface accepts the designation of the printer output image file to be printed from the pre-print file storage folder associated with the user ID and stores the pre-print printer output image file. A printer output image file is read from the other server, a print instruction to the printer is executed using the driver in the storage unit for the printer output image file, and the server acquires a driver for the printer connected to the terminal. The server stores a storage device for the terminal that has been stored and stored in the storage means. A list of files to be stored is transmitted, designation of a file to be printed from the list, and an instruction to generate a printer output image file for the file to be printed are received from the terminal, and generation of the printer output image file is received In response to the instruction, the print target file is read from the storage device, a printer output image file is generated from the print target file based on the driver in the storage unit, and stored in the memory, and authentication processing for the user of the terminal The printer output image file transfer instruction including the ID of the user who has been authenticated in step S5 is received from the terminal, the printer output image file is read from the memory, and the server is connected to the server connected to the server. Transfer processing of the printer output image file The other server is provided with a data storage area for each user ID authorized to execute a printing process by connecting a predetermined printer to the terminal, and the printer output image from the server. If the file has been transferred, it is received and stored in the pre-print file storage folder in the storage area associated with the user ID attached to the printer output image file, and the user authentication process is performed. The printer output in the pre-print file storage folder associated with the user ID authenticated in the authentication process in the data storage area provided in the storage device of the other server for the terminal that has received access Send a list of image files, accept the specification of the printer output image file to be printed from the list, and The printer output image file to be printed from the storage device and transmitted to the terminal, the appropriate printer output image file from the pre-press file storage folder is moved to the post-printing file storage folder, characterized in that.

  Further, a terminal of the present invention is a terminal that is connected to a server via a network and constitutes a thin client system with the server, a storage unit that stores a driver of a printer connected to the terminal, the terminal A file generation instruction means for accepting designation of a print target file from among files stored in a server in which connection has been established by an input interface and instructing the server to generate a printer output image file for the print target file; Execute the authentication process for the user of the terminal, accept the transfer request of the printer output image file from the server to the other server connected to the server through the input interface, and have been authenticated by the authentication process. A transfer instruction for the printer output image file including the user ID. The file transfer instruction means and the authentication processing for the user of the terminal are executed, the other server is accessed, and the other server includes the authentication in the data storage area provided in the storage device. The input interface accepts the designation of the printer output image file to be printed from the pre-print file storage folder that stores the pre-print printer output image file that is linked to the user ID authenticated in the process. A print processing unit that reads the printer output image file to be printed from the other server and executes a print instruction for the printer output image file using the driver in the storage unit. It is characterized by.

  The server of the present invention is a server that is connected to a terminal via a network and constitutes a thin client system with the terminal, and a connection is established with storage means for storing a driver of a printer connected to the terminal. In addition, the server transmits a list of files stored in the storage device to the terminal, specifies a print target file from the list, and generates a printer output image file for the print target file. In response to a file generation instruction reception unit received from the terminal and the printer output image file generation instruction, the print target file is read from the storage device, and the printer output is output from the print target file based on the driver in the storage unit. A file generation means for generating an image file and storing it in a memory; The printer output image file transfer instruction including the ID of the user authenticated in the authentication process for the last user is received from the terminal, the printer output image file is read from the memory, and the server File transfer means for transferring the printer output image file to another server connected to the server.

  The print-compatible server of the present invention is a server connected to a terminal and a server constituting a thin client system via a network, and a predetermined printer is connected to the terminal to execute print processing. The storage device has a data storage area for each ID of a user who is authorized to receive the printer output image file transferred from the server, and uses it to accompany the printer output image file Among the storage areas associated with the user ID, the server has a storage device for the file storage processing means stored in the pre-print file storage folder and the terminal that has received access through the user authentication process. The pre-print file storage folder associated with the user ID authenticated in the authentication process in the data storage area The printer output image file list is sent, the designation of the printer output image file to be printed is received from the list, and the printer output image file to be printed is read from the storage device and sent to the terminal. And a file moving means for moving the corresponding printer output image file from the pre-print file storage folder to the post-print file storage folder.

  In addition, the problems disclosed by the present application and the solutions thereof will be clarified by the embodiments of the present invention and the drawings.

  According to the present invention, it is possible to perform printing processing from a printer connected to a thin client while ensuring appropriate security.

--- System configuration ---
Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a network configuration diagram of a thin client system 10 which is a print management system of the present embodiment. A thin client system 10 shown in FIG. 1 includes a plurality of blade servers 300, a management server 400 that manages the blade server 300, a plurality of thin clients 200 (terminals), and a print-compatible server that are connected to each other via a network 140. 100 (another server). The data communication between the thin client 200 and the blade server 300 may be performed via the management server 400, or directly processed between the thin client 200 and the blade server 300 without going through the management server. It may be.

  The print compatible server 100, the thin client 200, and the blade server 300 are connected to a LAN (Local Area Network) 145 that is an internal network built in a company or the like. The LAN 145 is connected to a network 140 such as a WAN (Wide Area Network) via a router 146. It can be assumed that the thin client 200 is not connected to an internal network (such as a company) but is connected to an external network constructed at an office of another company, a hotel as a lodging place during a business trip, a station, or the like. In this case, the thin client 200 is connected to a LAN 147 that is an external network, and is connected to a network 140 such as a WAN via a router 148.

  The blade server 300 constructs a VPN (Virtual Private Network) with the thin client 200, and receives input information (operation contents of the input device) sent from the thin client 200 via the VPN. In addition to processing, video information indicating the processing result (desktop screen of the display device) is transmitted to the thin client 200. The blade server 300 is a server device that is normally used without locally connecting input / output devices.

  Next, each device constituting the thin client system 10 as the print management system in the present embodiment will be described. FIG. 2 is a diagram illustrating a configuration example of the print correspondence server 100 according to the present embodiment. The print-compatible server 100 reads a program 102 stored in the hard disk drive 101 or the like so as to have a function for realizing the present invention into the RAM 103 and executes it by the CPU 104 which is an arithmetic device.

  The print compatible server 100 includes an input interface 105 such as various buttons, an output interface 106 such as a display, a NIC (Network Interface Card) 107 that handles data exchange with the thin client 200 and the blade server 300, and the like. have.

  The print compatible server 100 is connected to the thin client 200 and the blade server 300 via the NIC 107 via a network 140 such as the Internet or a LAN, and executes data exchange. The print-compatible server 100 includes a flash ROM 108, a video card 130 for outputting video data to a display, a bridge 109 that relays a bus connecting the units 101 to 130, and a power source 120.

  The flash ROM 108 stores a BIOS 135. After the power supply 120 is turned on, the CPU 104 first accesses the flash ROM 108 and executes the BIOS 135 to recognize the system configuration of the print corresponding server 100. The hard disk drive 101 stores an OS 115 in addition to each functional unit (means) and tables. The OS 115 is a program for the CPU 104 to control the units 101 to 120 of the print corresponding server 100 in an integrated manner to execute each unit described below. In accordance with the BIOS 135, the CPU 104 loads the OS 115 from the hard disk drive 101 to the RAM 103 and executes it. As a result, the CPU 104 comprehensively controls each unit of the print corresponding server 100.

  Subsequently, functional units that are configured and held by the print server 100 based on the program 102 will be described. It is assumed that the print compatible server 100 has the pre-print file storage folder 126, the post-print file storage folder 127, and the log storage folder 128 in the hard disk drive 101.

  Such a print-compatible server 100 includes a data storage area 125 for each ID of a user who is authorized to connect a predetermined printer 30 to the thin client 200 and execute print processing. . If the printer output image file is transferred from the blade server 300, it is received and stored in the pre-print file storage folder 126 in the storage area associated with the user ID attached to the printer output image file. The file storage processing means 110 is stored.

  In addition, the print compatible server 100 can be used for the thin client 200 that has received access through a user authentication process in the authentication process in the data storage area 125 provided in the storage device 101 of the print compatible server 100. Sending a list of printer output image files in the pre-print file storage folder 126 associated with the authenticated user ID, and accepting designation of a printer output image file to be printed from the list; A file move that reads the printer output image file to be printed from the storage device 101 and transmits it to the thin client 200, and moves the corresponding printer output image file from the pre-print file storage folder 126 to the post-print file storage folder 127. Means 111 Obtain.

  Further, the print corresponding server 100 reads the printer output image file to be printed from the storage device 101 and transmits it to the thin client 200, and the ID and the transmission of the corresponding printer output image file transmitted to the thin client 200 are transmitted. The print log recording unit 112 may store a print log including at least time information in the log storage folder 128 in the storage device 101 in association with the user ID.

  The print-compatible server 100 includes an encrypted communication program 115 for performing encrypted communication when communicating with the thin client 200. The encrypted communication program 115 will be described later.

  FIG. 3 is a diagram illustrating a configuration example of the thin client 200 as a terminal according to the present embodiment. On the other hand, the thin client 200 is a device that uses the blade server 300 via the network 140 by use allocation processing of the management server 400, and includes a hard disk drive 201 (or TPM) or the like to have a function for realizing the present invention. The program 202 stored in is stored in the RAM 203 and is executed by the CPU 204 as an arithmetic unit.

  The thin client 200 also exchanges data with an input interface 205 such as various keyboards and buttons generally provided in a computer device, an output interface 206 such as a display, and the print compatible server 100 and the blade server 300. NIC207 which bears.

  The thin client 200 is connected to the print compatible server 100, the blade server 300, and the management server 400 via the network 207 such as the Internet, a LAN, and a serial interface communication line by the NIC 207, and executes data exchange. .

  In this embodiment, such a thin client 200 is assumed not to be a so-called HDD-less type thin client terminal but to a terminal obtained by converting an existing PC having a normal HDD into a thin client. Regarding the technology for converting a general PC into a thin client terminal, an existing technology (such as connecting a USB memory built in an OS to a USB interface of a general PC and executing a series of thin client processes such as OS activation, VPN connection, management server authentication) Reference: http://www.hitachi-ics.co.jp/product/seihin/jyourou/sec/sec.html) Of course, not only a terminal obtained by converting such a general PC into a thin client terminal, but a thin client terminal that is an HDD-less type but includes a connection interface for the printer 30 may be assumed.

  Further, the thin client 200 includes a USB port 244 for connecting various devices, a flash ROM 208, an I / O connector 260 for connecting a keyboard and a mouse, a video card 230 for connecting a display, and each unit 201. ˜260, a bridge 209 that relays the bus connected to 260, and a power source 220. After the power supply 220 is turned on, the CPU 204 first accesses the flash ROM 208 and executes the BIOS 235 to recognize the system configuration of the thin client 200.

  The OS 236 in the flash ROM 208 is a program for the CPU 204 to control each unit 201 to 260 of the thin client 200 and execute a program corresponding to each unit described later. In accordance with the BIOS 235, the CPU 204 loads the OS 236 from the flash ROM 208 to the RAM 203 and executes it. Note that the OS 236 of this embodiment uses a relatively small size that can be stored in the flash ROM 208 such as an embedded OS. The hard disk drive 201 or the flash ROM 208 serves as a storage means for storing the printer driver 31 of the printer 30 connected to the thin client 200 (in the example of FIG. 3, the printer driver 31 is stored in the hard disk drive 201).

  Next, functional units that the thin client 200 as the terminal configures and holds in the hard disk drive 201 (or TPM) based on the program 202 will be described. The thin client 200 accepts designation of a print target file from among the files stored in the blade server 300 that has established a connection with the thin client 200 by the input interface 205, and outputs a printer output image of the print target file. A file generation instruction unit 210 that instructs the blade server 300 to generate a file is provided. Since the stored file of the blade server 300 with which connection has been established can be searched and displayed from the thin client 200 using a general file management program, the file generation instruction unit 210 outputs a list of files stored in the blade server 300 It is displayed on the interface 206, and the designation of the file to be printed by the user is accepted by a click event such as a mouse.

  In addition, the thin client 200 executes an authentication process for the user of the thin client 200, and then transfers the printer output image file from the blade server 300 to the print compatible server 100 connected to the blade server 300. File transfer instructing means 211 is provided for accepting a request by the input interface 205 and instructing the blade server 300 to transfer the printer output image file including the user ID authenticated by the authentication process. The authentication process for the user of the thin client 200 may be assumed to be a normal authentication process when using the thin client in the thin client system, for example.

  Further, the thin client 200 accesses the print corresponding server 100 after executing an authentication process for the user of the thin client 200, and stores the data storage area 125 provided in the storage device 101 in the print corresponding server 100. Of these, the printer output image file to be printed is designated from the pre-print file storage folder 126 that stores the pre-print printer output image file linked to the user ID authenticated by the authentication process. Accepted by the input interface 205, reads out the printer output image file to be printed from the print compatible server 100, and uses the printer driver 31 in the storage means 201 for the printer output image file to print instructions to the printer 30 Run That includes a print processing unit 212.

  The thin client 200 receives a print end notification from the printer 30 after printing instructions to the printer 30 for the printer output image file, or monitors the operation of the printer 30. An image erasing unit 213 may be provided that senses the end of printing and erases the printer output image file from a temporary storage unit of the printer output image file, for example, the RAM 203. In this case, it is assumed that the thin client 200 temporarily stores the printer output image file acquired from the print compatible server 100 in the RAM 203 and outputs it to the printer 30.

  Note that the thin client 200 includes the certificate information about the user stored in the portable storage medium 50 (USB memory) connected to the USB port 244 and the user ID and password input through the input interface 205. Naturally, a thin client terminal is provided with a function of executing blade server allocation request processing for the management server 400 and connection establishment processing with the blade server 300 using the information.

  Further, the thin client 200 transmits the operation information input through the input interface 205 of the thin client 200 to the address of the blade server 300 as the connection establishment process with the blade server 300 is executed. Naturally, the thin client terminal also has a function of receiving video information corresponding to the operation information from the blade server 300 and displaying it on the output interface 206 of the thin client 200.

  The thin client 200 includes a remote client program 270 and an encrypted communication program 271 in the hard disk drive 201 (or TPM). The remote client program 270 is a program for the thin client 200 to remotely access the desktop of the blade server 300, and is, for example, a VNC client (viewer) program. The CPU 204 loads the remote client program 270 from the hard disk drive 201 to the RAM 203 and executes it in accordance with the OS 236. As a result, the CPU 204 transmits the input information (operation contents of the keyboard and mouse) of the I / O connector 260 to the blade server 300 via the network 140 such as VPN, and the relevant information via the network 140 such as VPN. The video information (display desktop screen) sent from the blade server 300 is output to an output interface 206 such as a display connected to the video card 230.

  The encrypted communication program 271 is a communication program for constructing a secure communication network such as VPN with the blade server 300 having the address notified from the remote client program 270. For example, a communication program using IPsec can be assumed. In accordance with the OS 236, the CPU 204 loads the encrypted communication program 271 from the hard disk drive 201 into the RAM 203 and executes it. As a result, the CPU 204 transmits a communication start request to the blade server 300 assigned to the self-thin client 200 via the NIC 207, constructs a network such as a VPN with the blade server 300, and the VPN etc. And communicates with the blade server 300 via the network.

  Further, the thin client 200 in this embodiment includes device information 273 in the hard disk drive 201. The device information 273 is authentication information for the thin client 200 included in the connection establishment request when the connection establishment request is transmitted from the thin client 200. Specifically, for example, the ID, model number, MAC address, etc. of the thin client 200 can be assumed.

  In the present embodiment, the thin client 200 is referred to as a TPM (Trusted Platform Module) instead of the hard disk drive 201 instead of the means 210 to 213, the remote client program 270, the encrypted communication program 271, and the device information 273. It may be contained in the chip.

  This TPM has a function similar to that of a security chip mounted on a smart card (IC card). It is a hardware chip that has an asymmetric key calculation function and tamper resistance for safe storage of these keys. is there. The functions of this TPM include, for example, RSA (Rivest-Shamir-Adleman Scheme) private key generation / storage, RSA private key computation (signature, encryption, decryption), SHA-1 (Secure Hash Algorithm 1) hash Calculation, platform state information (software measurement) retention (PCR), key, certificate, credential trust chain retention, high-quality random number generation, non-volatile memory, other opt-in and I / O It is done.

  The TPM has a function to securely store and notify platform status information (software measurement values) in a register PCR (Platform Configuration Registers) in the TPM, in addition to generating, storing, and calculating cryptographic keys (asymmetric keys). Have. In the latest specification of TPM, functions such as locality and delegation (authority delegation) are further added. The TPM is physically attached to platform parts (motherboard or the like).

  FIG. 4 is a diagram illustrating a configuration example of the blade server 300 as an information processing apparatus according to the present embodiment. On the other hand, the blade server 300 is a device that accepts the usage from the thin client 200 via the network by the usage allocation process of the management server 400, and has an HDD (hard disk drive) 301 or the like to have a function for realizing the present invention. The program 302 stored in is stored in the RAM 303 and is executed by the CPU 304 serving as an arithmetic unit.

  Further, the blade server 300 includes an input interface 305 such as various keyboards and buttons generally provided in a computer device, and an output interface 306 such as a display as necessary. In addition, the print server 100 and the thin client 200 are provided. And NIC 307 responsible for data exchange with the management server 400 and the like.

  The blade server 300 is connected to the print compatible server 100, the thin client 200, the management server 400, and the like via the network 140 such as the Internet or a LAN through the NIC 307, and executes data exchange. In addition, the blade server 300 includes a flash ROM (Read Only Memory) 308, a video card 330 that generates desktop video information, a bridge 309 that relays these units 301 to 330 and the bus, a power source, and the like. 320.

  The flash ROM 308 stores a BIOS (Basic Input / Output System) 335. The CPU 304 first recognizes the system configuration of the blade server 300 by accessing the flash ROM 308 and executing the BIOS 335 after the power source 320 is turned on. The flash ROM 308 or the hard disk drive 301 stores the printer driver 31 of the printer 30 connected to the thin client 200 (stored in the hard disk drive 301 in the example of FIG. 4).

  A description will be given of functional units configured and retained by the blade server 300 based on the program 302, for example. The blade server 300 transmits a list of files stored in the storage device 301 by the blade server 300 to the thin client 200 with which the connection has been established, and designates a file to be printed from the list and prints the file. A file generation instruction receiving unit 310 is provided that receives an instruction for generating a printer output image file for the target file from the thin client 200.

  The blade server 300 reads the print target file from the storage device 301 in response to the printer output image file generation instruction, and outputs the printer output from the print target file based on the printer driver 31 in the storage unit 301. A file generation unit 311 that generates an image file and stores it in the RAM 303 is provided.

  Further, the blade server 300 receives an instruction to transfer the printer output image file including the ID of the user who has been authenticated in the authentication process for the user of the thin client 200 from the thin client 200, and File transfer means 312 is provided for reading the printer output image file from the RAM 303 and transferring the printer output image file from the blade server 300 to the print compatible server 100 connected to the blade server 300.

  The blade server 300 receives the operation information from the thin client 200 as the connection establishment process with the thin client 200 is executed, and performs information processing according to the operation content indicated by the operation information. Of course, the blade server in the thin client system has a function of transmitting video information indicating the result to the thin client 200.

  The blade server 300 stores a remote server program 370, an encrypted communication program 371, and an OS (Operating System) 336 in the HDD 301. The OS 336 is a program for the CPU 304 to control each unit 301 to 330 of the blade server 300 and execute each program that implements each unit such as the units 310 to 312. The CPU 304 loads the OS 336 from the HDD 301 to the RAM 303 and executes it in accordance with the BIOS 335. As a result, the CPU 304 comprehensively controls the units 301 to 330 of the blade server 300.

  The remote server program 370 is a program for enabling the desktop of the blade server 300 to be remotely operated from the thin client 200, for example, a VNC (Virtual Network Computing) server program developed at AT & T Cambridge Laboratory. . The CPU 304 loads the remote server program 370 from the HDD 301 to the RAM 303 and executes it in accordance with the OS 336. Thereby, the CPU 304 receives and processes the input information (keyboard and mouse operation contents) sent from the thin client 200 via the network 140 such as VPN, and also displays video information (display desktop screen of the display) indicating the processing result. ) Is transmitted to the thin client 200 via the network 140 such as VPN.

  The encrypted communication program 371 is a communication program for constructing a network 140 such as VPN with the thin client 200, and is a communication program using IPsec (Security Architecture for the Internet Protocol), for example. The CPU 304 loads the encrypted communication program 371 from the HDD 301 to the RAM 303 and executes it in accordance with the OS 336. As a result, the CPU 304 constructs a secure network 140 such as VPN with the thin client 200 in accordance with the connection establishment request received from the thin client 200 via the NIC 307, and the thin client 200 and the thin client 200 via this VPN. Communicate.

  FIG. 5 is a diagram illustrating a configuration example of the IC chip 55 provided in the portable storage medium 50 of the present embodiment. As an example of the portable storage medium 50, an IC chip 55 is stored in an appropriate storage case 51 such as a plastic housing, and connected to the USB interface of the thin client 200 so as to be able to perform data communication. Can be given. Such an IC chip 55 includes a CPU 601 and a memory 602. As the portable storage medium 50, an authentication device (in which a personal certificate, a private key, a password, and various application software necessary for mobile use are preinstalled in a memory card in which an IC card unit and a flash memory are integrated) Trade name: KeyMobile) can be used. Information that the portable storage medium 50 stores in the memory 602 includes authentication information 603 storing a chip ID, a personal certificate, a secret key, and a password, and information on the blade server 300 that is the allocation destination of the thin client 200. Address 604, address 605 of the management server 400 that performs use allocation processing between the thin client 200 and the blade server 300, and software 606 (software that executes personal authentication processing regarding the OS and the user of the portable storage medium 50) Etc.).

  The management server 400 stores information stored in the portable storage medium 50 used by each user of the thin client 200 and the blade server 300 serving as a usage allocation destination of the thin client 200 associated with the portable storage medium 50. An allocation management table for storing the correspondence relationship between the thin client 200 and the blade server 300 is stored in an appropriate storage device such as a hard disk. Is a general management server in a thin client system. Therefore, descriptions of functions provided in the management server 400 and processing performed when establishing a connection between the thin client 200 and the blade server 300 are omitted.

  In addition, each of the units 110 to 112, 210 to 213, and 310 to 312 in the print compatible server 100, the thin client 200, the blade server 300, and the like constituting the information processing system 10 described so far may be realized as hardware. Alternatively, it may be realized as a program stored in an appropriate storage device such as a memory or an HDD (Hard Disk Drive). In this case, the CPUs 104, 204, 304 and the like read the corresponding program from the storage device to the RAMs 103, 203, 303 and the like in accordance with the execution of the program, and execute it.

  In addition to the Internet and LAN, the network 140 may employ various networks such as an ATM line, a dedicated line, a WAN (Wide Area Network), a power line network, a wireless network, a public line network, and a mobile phone network. I can do it. If a virtual private network technology such as VPN (Virtual Private Network) is used, communication with improved security is established when the Internet is adopted.

--- Database structure ---
Next, the structure of the file storage folder used by the print corresponding server 100 configuring the information processing system 10 according to the present embodiment will be described. FIG. 6 is a diagram showing an example of the data structure of (a) the pre-print file storage folder 126, (b) the post-print file storage folder 127, and (c) the log storage folder 128 in this embodiment. These pre-print file storage folder 126, post-print file storage folder 127, and log storage folder 128 are all stored in a data storage area 125 provided in the storage device 101 of the print compatible server 100. The data storage area 125 is set for each ID of a user who is permitted to connect the predetermined printer 30 to the thin client 200 and execute print processing. Accordingly, the data storage area 125, the pre-print file storage folder 126, the post-print file storage folder 127, and the log storage folder 128 are set in advance in the storage device 101 of the print compatible server 100 by the administrator of the thin client system 10 or the like. Has been.

  The pre-print file storage folder 126 is a folder serving as a storage destination in which the file storage processing unit 110 stores the printer output image file transferred from the blade server. The pre-print file storage area 126 is a collection of records in which, for example, a user ID is associated with a printer output image file (before printing).

  The post-print file storage area 127 is a folder to which a printer output image file that has been transmitted from the print corresponding server 100 to the thin client 200 is moved from the pre-print file storage folder 126. The post-print file storage area 127 is a collection of records in which, for example, a user ID is associated with a printer output image file (eg, a file name includes a temporary movement).

  The log storage folder 128 is a storage area for storing a print log including at least the ID of the printer output image file transmitted from the print corresponding server 100 to the thin client 200 and information on the transmission time. For example, it is a collection of records in which a log file name (eg, the original printer output image file name has an extension “log”) is associated with the user ID.

--- Processing flow example 1 ---
First, the flow of establishing a connection between the thin client 200 and the blade server 300 will be described. FIG. 7 is a diagram showing a processing flow example 1 of the print management method in the present embodiment. First, it is assumed that a user possessing the portable storage medium 50 in the form of a USB device or the like considers using the blade server 300 via the thin client 200. In this case, the user connects the portable storage medium 50 to the USB port 244 of the thin client 200. The portable storage medium 50 includes an authentication device (trade name) in which a personal certificate, a private key, and various application software necessary for mobile use are preinstalled in a memory card in which an IC card unit and a flash memory are integrated. : KeyMobile).

  Such an authentication device is not a mere storage device, but stores an authentication application, and can execute an authentication process in cooperation with the thin client 200 of the connection destination. Accordingly, when the portable storage medium 50 is connected to the USB port 244 of the thin client 200, for example, an authentication application is started from the storage area of the portable storage medium 50, and appropriate authentication information (user ID, password) If there is no input from the input interface 205 or the like, control is performed so that the necessary program of the thin client 200 cannot be started (s10).

  If the authentication process for the use of the thin client 200 is OK in the authentication application for the portable storage medium 50 (s100: OK), the thin client 200 executes the process for reading the information stored in the portable storage medium 50. The read information (including the address of the management server) is stored in the RAM 203 (s101). On the other hand, if the authentication processing for the use of the thin client 200 in the authentication application of the portable storage medium 50 is NG (s100: NG), the portable storage medium 50 and the thin client 200 use the thin client 200. The subsequent processing is terminated without accepting itself.

  Subsequent to step s101, the thin client 200 stores the storage information of the portable storage medium 50 read from the RAM 203, for example, addressed to the address of the management server 400 included as the storage information of the portable storage medium 50. (Example: device information 273 in the hard disk drive 201 or TPM 201) is included in the usage allocation request of the blade server 300 and transmitted (s102). In this process, the encrypted communication program 271 is started in the thin client 200. The encrypted communication program 271 reads the address of the management server 400 from the RAM 203, secures a network between the thin client 200 and the management server 400, and constructs a secure network environment with communication data encryption.

  On the other hand, the management server 400 receives the usage allocation request including the storage information of the portable storage medium 50 from the thin client 200 (s103), and stores the storage information of the portable storage medium 50 included in the usage allocation request. It collates with a predetermined allocation management table (s104). In this assignment management table, if the blade server 300 is assigned in advance for each thin client 200, the management server 400 identifies the address of the blade server 300 assigned to the thin client 200. Then, this is notified to the thin client 200 that is the transmission source of the use allocation request (s105).

  The thin client 200 receives the address of the assignment destination blade server 300 from the management server 400 (s106). The thin client 200 that has obtained the address of the blade server 300 in this way transmits a connection establishment request including at least information for authentication of the thin client 200 or the user to the address of the blade server 300 that is the allocation destination of use ( s107).

  On the other hand, the blade server 300 receives the connection establishment request transmitted from the thin client 200, and executes an authentication process based on the authentication information of the thin client 200 or the user included in the connection establishment request (s108). ). If it is determined in this authentication process that the connection establishment request can be accepted (s108: OK), the determination result is returned as response data to the thin client 200 (s109).

  On the other hand, the thin client 200 that has transmitted the connection establishment request receives the response data returned from the blade server 300, and if the response data is “connection establishment is possible” (s110: OK), A connection establishment process between the blade server 300 and the thin client 200 via the network 140 is executed (s111). If the response data returned by the blade server 300 is “connection is impossible” (s110: NG), the subsequent processing is terminated.

  In the connection establishment process, the remote client program 270 stored in the hard disk drive 201 (or TPM) of the thin client 200 may transmit an authentication request to the address of the blade server 300. In response to this authentication request, the blade server 300 returns, for example, a login ID, password, or biometric information input request to the thin client 200. When the thin client 200 returns a login ID, password, etc. in response to the input request, the blade server 300 manages the login ID, password, or biometric information managed by itself, and the login ID, password derived from the thin client 200. Alternatively, it is determined whether or not the biometric information matches, and finally the availability of the blade server 300 is determined.

  Subsequently, the thin client 200 transmits the operation information input through the input interface 205 of the thin client 200 to the address of the blade server 300 in accordance with the execution of the connection establishment process (s112). In addition, the blade server 300 receives the operation information from the thin client 200 and executes information according to the operation content indicated by the operation information as the connection establishment process with the thin client 200 is executed according to the determination result. Processing is performed, and video information indicating the result is transmitted to the thin client 200 (s113). The thin client 200 receives this video information and displays it on the output interface 206 (s114).

--- Processing flow example 2 ---
Hereinafter, the actual procedure of the print management method in the present embodiment will be described with reference to the drawings. Various operations corresponding to the print management method described below are realized by programs that are read out and executed in the RAMs of the print compatible server 100, the thin client 200, and the blade server 300 that constitute the print management system 10, respectively. The And this program is comprised from the code | cord | chord for performing the various operation | movement demonstrated below.

  FIG. 8 is a diagram showing a processing flow example 2 of the print management method in the present embodiment. Here, it is assumed that the connection between the thin client 200 and the blade server 300 is established as shown in the above-described processing flow example 1. Here, the file generation instruction receiving means 310 of the blade server 300 searches the file management system provided in the blade server 300 for files stored in the storage device 301 by the blade server 300, and generates a list thereof (s200). ). Then, the list is transmitted to the thin client 200 with which the connection has been established (s201).

  On the other hand, the file generation instruction unit 210 of the thin client 200 receives the list from the blade server 300 that has established a connection with the thin client 200 and displays the list on the output interface 205 such as a display device. Then, the designation of the print target file from the list is accepted by the input interface 205 (s202), and the blade server 300 is instructed to generate a printer output image file for the print target file (s203). This printer output image file generation instruction corresponds to, for example, checking a check box such as “output to file” in a print dialog in a program that accepts a print target file designation from the list.

  On the other hand, the file generation instruction receiving means 310 of the blade server 300 receives from the thin client 200 the designation of the print target file from the list and the generation instruction of the printer output image file for the print target file ( s204).

  Subsequently, the file generation unit 311 of the blade server 300 reads the print target file from the storage device 301 in response to the generation instruction of the printer output image file, and the printer driver 31 in the storage unit 301 from the print target file. Based on the above, a printer output image file is generated and stored in the RAM 303 (s205). The generation of the printer output image file in the blade server 300 is generally the same as the processing executed when “print to file” is designated in the print dialog and a print instruction is given.

  In addition, the file transfer instruction unit 211 of the thin client 200 performs authentication processing for the user of the thin client 200 (for example, certificate data stored in the portable storage medium 50 and a user ID input through the input interface 205). , Using the password as authentication information and executing on the authentication platform of the thin client system 10), and then inputting the transfer request of the printer output image file from the blade server 300 to the print corresponding server 100 This is accepted by the interface 205 (s206). If the authentication processing result for the user is authentication NG, the process ends without accepting a printer output image file transfer instruction.

  The file transfer instruction unit 211 of the thin client 200 instructs the blade server 300 to transfer the printer output image file including the ID of the user authenticated by the authentication process, for example, “10263587” (s207). .

  Meanwhile, the file transfer unit 312 of the blade server 300 receives the printer output image file transfer instruction including the user ID “10263587” from the thin client 200 (s208). Then, the printer output image file is read from the RAM 303, and the printer output image file is transferred from the blade server 300 to the print corresponding server 100 (s209).

  On the other hand, the file storage processing unit 110 of the print compatible server 100 receives the printer output image file transferred from the blade server 300 (s210). Then, the file storage processing unit 110 searches the storage device 101 for a storage area associated with the user ID “10263587” attached to the printer output image file, and sets the pre-print file set for the user ID “10263587”. The printer output image file is stored in the storage folder 126 (s211).

  Thereafter, the print processing unit 212 of the thin client 200 accesses the print corresponding server 100 after executing an authentication process for the user of the thin client 200 (re-execution of the process similar to step s206 above). (S212). The pre-print file storage area 126 associated with the ID of the user authenticated by the authentication process, for example, “10263587”, of the data storage area 125 provided in the storage device 101 of the print compatible server 100. Is sent to the print corresponding server 100 (s213).

  The file moving unit 111 of the print corresponding server 100 sends the pre-print file storage folder associated with the ID “10263587” of the user authenticated by the authentication process to the thin client 200 that has issued the browsing request. The list of printer output image files in 126 is transmitted (s214).

  Therefore, the print processing unit 212 of the thin client 200 receives the list and designates a printer output image file to be printed (from the user of the thin client 200) from the list, using an input interface. At 205 (s215).

  On the other hand, the file moving unit 111 of the print compatible server 100 receives the designation of the printer output image file to be printed from the list from the thin client 200 and stores the printer output image file to be printed in the storage device 101. Are read out and transmitted to the thin client 200 (s216). Further, the printer output image file is moved from the pre-print file storage folder 126 to the post-print file storage folder 127 (s217). Further, the print log recording unit 112 of the print corresponding server 100 sends the ID and transmission time of the corresponding printer output image file transmitted to the thin client 200 when the printer output image file to be printed is transmitted to the thin client 200. A print log including at least information is stored in the log storage folder 128 in the storage device 101 in association with the user ID “10263587” (s218).

  On the other hand, the print processing unit 212 of the thin client 200 receives the printer output image file to be printed from the print corresponding server 100 and uses the printer driver 31 in the storage unit 201 for the printer output image file. A print instruction to the printer 30 is executed (s219). The printer 30 executes printing of the printer output image file in response to a print instruction from the thin client 200.

  Further, the image erasing unit 213 of the thin client 200 receives a print end notification from the printer 30 after instructing the printer 30 to print the printer output image file, or performs the operation of the printer 30. Monitoring is performed to detect the end of printing, and the printer output image file is erased from the temporary storage means of the printer output image file, for example, the RAM 203 (s220).

  The authentication medium 50 is preferably assumed to be the authentication device, but may be assumed to be a mobile phone having similar functions and connectivity with the thin client 200.

  According to the present invention, it is possible to perform printing processing from a printer connected to a thin client while ensuring appropriate security.

  As mentioned above, although embodiment of this invention was described concretely based on the embodiment, it is not limited to this and can be variously changed in the range which does not deviate from the summary.

1 is a network configuration diagram of a thin client system which is a print management system of the present embodiment. FIG. It is a figure which shows the structural example of the thin client which is a terminal of this embodiment. It is a figure which shows the structural example of the blade server of this embodiment. It is a figure which shows the structural example of the print corresponding | compatible server of this embodiment. It is a figure which shows the structural example of the IC chip with which the portable storage medium of this embodiment is provided. It is a figure which shows each data structure example of (a) file storage folder before printing in this embodiment, (b), file storage folder after printing, and (c) log storage folder. It is a figure which shows the example 1 of a processing flow of the printing management method in this embodiment. It is a figure which shows the processing flow example 2 of the printing management method in this embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Print management system 30 Printer 31 Printer driver 50 Portable storage medium 51 Storage case 55 IC chip 60 Portable storage medium reader 100 Print corresponding server (other server)
101, 301 HDD (Hard Disk Drive)
102, 202, 302 Program 103, 303 RAM (Random Access Memory)
104, 204, 304 CPU (Central Processing Unit)
105, 205, 305 Input interface 106, 206, 306 Output interface 107, 207, 307 Communication device, NIC (Network Interface Card)
108, 208, 308 Flash ROM
109, 209, 309 Bridge 110 File storage processing means 111 File movement means 112 Print log recording means 115, 236, 336 OS
120, 220, 320 Power supply 125 Data storage area 126 File storage folder before printing 127 File storage folder after printing 128 Log storage folder 130, 230, 330 Video card 135, 235, 335 BIOS
140 Network 200 Thin client (terminal)
201 TPM (Trusted Platform Module)
203 RAM (Random Access Memory), temporary storage unit 210 file generation instruction unit 211 file transfer instruction unit 212 print processing unit 213 image erasing unit 244 USB port 260 I / O connector 270 remote client program 271 and 371 encrypted communication program 273 device Information 300 Blade server 310 File generation instruction reception means 311 File generation means 312 File transfer means 370 Remote server program 400 Management server

Claims (7)

A computer system that manages print processing from a printer connected to a terminal that constitutes a thin client system together with a server,
The terminal
Storage means for storing a driver of a printer connected to the terminal;
File generation that accepts the designation of a file to be printed from among the files stored in the server that has established a connection with the terminal at the input interface, and instructs the server to generate a printer output image file for the file to be printed Instruction means;
After executing the authentication process for the user of the terminal, the transfer request for the printer output image file from the server to another server connected to the server is accepted by the input interface, and the authentication process is performed. File transfer instruction means for instructing the server to transfer the printer output image file including the user ID;
After executing the authentication process for the user of the terminal, the other server is accessed, and the data stored in the storage device of the other server is associated with the ID of the user authenticated by the authentication process. The designation of the printer output image file to be printed from the pre-print file storage folder for storing the printer output image file before printing is received by the input interface, and the printer output image file to be printed is received by the input interface. Print processing means that reads out from another server and executes a print instruction to the printer using a driver in the storage means for the printer output image file,
The server
Storage means for storing a driver of a printer connected to the terminal;
A list of files stored in the storage device by the server is transmitted to the terminal that has been established, designation of a print target file from the list, and an instruction to generate a printer output image file for the print target file Receiving a file generation instruction receiving means from the terminal;
In response to an instruction to generate the printer output image file, the file to be printed is read from a storage device, a printer output image file is generated from the print target file based on a driver in the storage unit, and stored in a memory. Means,
The printer output image file transfer instruction including the ID of the user authenticated in the authentication process for the user of the terminal is received from the terminal, the printer output image file is read from the memory, and the server File transfer means for transferring the printer output image file from the server to another server connected to the server,
The other server is
A storage device is provided with a data storage area for each user ID authorized to execute a printing process by connecting a predetermined printer to the terminal,
If the printer output image file is transferred from the server, it is received and stored in the pre-print file storage folder in the storage area associated with the user ID attached to the printer output image file. , File storage processing means,
The pre-print file associated with the user ID authenticated by the authentication process in the data storage area provided in the storage device of the other server for the terminal that has received access through the user authentication process A list of printer output image files in a storage folder is transmitted, designation of a printer output image file to be printed from the list is received, the printer output image file to be printed is read from a storage device, and the terminal And a file moving means for moving the corresponding printer output image file from the pre-printing file storage folder to the post-printing file storage folder,
A print management system characterized by that. The other server is
As the printer output image file to be printed is read from the storage device and transmitted to the terminal, a print log including at least the ID of the corresponding printer output image file transmitted to the terminal and the transmission time information is stored in the user. The print management system according to claim 1, further comprising a print log recording unit that stores the print log in association with the ID. The terminal is
An image erasure unit that receives a print end notification from the printer after a print instruction for the printer output image file to the printer and erases the printer output image file from the temporary storage unit of the printer output image file. The print management system according to claim 1, further comprising: A method for managing print processing from a printer connected to a terminal constituting a thin client system together with a server,
The terminal is
Store the printer driver connected to the terminal in the storage means,
Accept the designation of the print target file from among the files stored in the server stored in the server with which the connection has been established, and instruct the server to generate a printer output image file for the print target file.
After executing the authentication process for the user of the terminal, the transfer request for the printer output image file from the server to another server connected to the server is accepted by the input interface, and the authentication process is performed. Instruct the server to transfer the printer output image file including the user ID,
After executing the authentication process for the user of the terminal, the other server is accessed, and the data stored in the storage device of the other server is associated with the ID of the user authenticated by the authentication process. The designation of the printer output image file to be printed from the pre-print file storage folder for storing the printer output image file before printing is received by the input interface, and the printer output image file to be printed is received by the input interface. Read from the other server, execute the print instruction to the printer using the driver in the storage unit for the printer output image file,
The server is
Storing a driver of a printer connected to the terminal in a storage unit;
A list of files stored in the storage device by the server is transmitted to the terminal that has been established, designation of a print target file from the list, and an instruction to generate a printer output image file for the print target file From the terminal,
In response to the printer output image file generation instruction, the print target file is read from a storage device, a printer output image file is generated from the print target file based on a driver in the storage unit, and stored in a memory.
The printer output image file transfer instruction including the ID of the user authenticated in the authentication process for the user of the terminal is received from the terminal, the printer output image file is read from the memory, and the server The printer output image file is transferred from the server to the other server connected to the server,
The other server is
A storage device is provided with a data storage area for each user ID authorized to execute a printing process by connecting a predetermined printer to the terminal,
If the printer output image file is transferred from the server, it is received and stored in the pre-print file storage folder in the storage area associated with the user ID attached to the printer output image file. ,
The pre-print file associated with the user ID authenticated by the authentication process in the data storage area provided in the storage device of the other server for the terminal that has received access through the user authentication process A list of printer output image files in a storage folder is transmitted, designation of a printer output image file to be printed from the list is received, the printer output image file to be printed is read from a storage device, and the terminal And the corresponding printer output image file is moved from the pre-print file storage folder to the post-print file storage folder.
A print management method. A terminal connected to a server via a network and constituting a thin client system with the server,
Storage means for storing a driver of a printer connected to the terminal;
File generation that accepts the designation of a file to be printed from among the files stored in the server that has established a connection with the terminal at the input interface, and instructs the server to generate a printer output image file for the file to be printed Instruction means;
After executing the authentication process for the user of the terminal, the transfer request for the printer output image file from the server to another server connected to the server is accepted by the input interface, and the authentication process is performed. File transfer instruction means for instructing the server to transfer the printer output image file including the user ID;
After executing the authentication process for the user of the terminal, the other server is accessed, and the data stored in the storage device of the other server is associated with the ID of the user authenticated by the authentication process. The designation of the printer output image file to be printed from the pre-print file storage folder for storing the printer output image file before printing is received by the input interface, and the printer output image file to be printed is received by the input interface. A print processing unit that reads out from another server and executes a print instruction to the printer using a driver in the storage unit for the printer output image file;
A terminal characterized by comprising: A server connected to a terminal via a network and constituting a thin client system with the terminal,
Storage means for storing a driver of a printer connected to the terminal;
A list of files stored in the storage device by the server is transmitted to the terminal that has been established, designation of a print target file from the list, and an instruction to generate a printer output image file for the print target file Receiving a file generation instruction receiving means from the terminal;
In response to an instruction to generate the printer output image file, the file to be printed is read from a storage device, a printer output image file is generated from the print target file based on a driver in the storage unit, and stored in a memory. Means,
The printer output image file transfer instruction including the ID of the user authenticated in the authentication process for the user of the terminal is received from the terminal, the printer output image file is read from the memory, and the server A file transfer means for transferring the printer output image file from the server to another server connected to the server;
The server characterized by having. A server connected to a terminal and a server constituting a thin client system via a network,
A storage device is provided with a data storage area for each user ID authorized to execute a printing process by connecting a predetermined printer to the terminal,
If the printer output image file has been transferred from the server, the file is received and stored in the pre-print file storage folder in the storage area associated with the user ID attached to the printer output image file. Storage processing means;
Storage of the pre-printed file associated with the user ID authenticated by the authentication processing in the data storage area provided in the storage device for the terminal that has received access through the user authentication processing A list of printer output image files in the folder is transmitted, designation of a printer output image file to be printed is received from the list, the printer output image file to be printed is read from a storage device, and is sent to the terminal. A file moving means for transmitting and moving the corresponding printer output image file from the pre-print file storage folder to the post-print file storage folder;
And a print-compatible server.

Images