JP2006107277A - Network system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a network system with which even an available image processor can be retrieved under a state in which security is secured. <P>SOLUTION: In the system connecting a terminal and the image processor to a network, the terminal is provided with an input means for inputting a user name and password, an enciphering means for enciphering the user name with the password, and a means for transmitting a retrieval message including enciphering data. The image processor is provided with: a register recording means for registering the data consisting of the user name and the password; a means for receiving the retrieval message; a means for acquiring the enciphered data from the received retrieval message and comparing them with data registered with a local host; and a notification means for notifying a transmitter of the retrieval message that the processor is available when the data coincide with a pair of the user name and the password registered with the local host. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a system that uses an image processing apparatus such as a printer, a scanner, or an MFP via a network, and more particularly to a technique for improving security in such a system.

  Patent Document 1 is a document in which security measures are taken when an image processing apparatus is used in a network. In this technology, when a print request is sent from a terminal to a printer on a network, a print job is encrypted using public key cryptography, and the legitimate printer receives the encrypted data, decrypts it, and prints it. . This prevents the print data from leaking to a third party on the network and enhances safety.

However, in an environment where multiple printing devices and terminals are connected to a network, such as a LAN, each terminal needs to search for a printing device that can LOG IN prior to printing. It has not yet been secured.
That is, in order to search for an available printing device on the network, the user name is put in the search message and broadcast to the network, and the available printing device receives the search message and can use it from the user name. If it becomes clear, a response is returned.
Japanese Patent No. 3281235

For this reason, in the above network system, the search message flows through the network as it is, and as a result, the third party can easily know the user name.
In the case of a LAN as a network, a firewall is provided so that unauthorized access from outside the LAN is not possible. In an environment where a connected printing device is to be used, it is impossible to prevent an unauthorized third party from knowing the user name, and as a result, the third party impersonates an available user and prints. There is a danger of using the device.

Although the above has been described with respect to the printing apparatus, there is a similar problem with a scanner or an MFP, and since it is common to image processing apparatuses, it is an urgent need to solve it.
SUMMARY OF THE INVENTION In view of the above, an object of the present invention is to provide a network system that can be used in a state where security is ensured even when searching for an available image processing apparatus.

In order to achieve the above object, the present invention provides a system in which a terminal and an image processing apparatus are connected to a network, the terminal encrypting the user name with a password, an input means for inputting the user name and the password. The image processing apparatus includes: a registration recording unit that pre-registers data including a user name and a password; and a search message. If it matches the combination of the means to receive, the means to obtain encrypted data from the received search message and compare it with the data registered in its own device, and the user name and password registered in its own device And a notification means for notifying the sender of the search message that the search message is available.

According to the above configuration, since the user name is encrypted even at the time of search, it is very rarely known to a third party, and in the available image processing apparatus, the same user name, Since the data created from the password is owned, the search will not be hindered.
Here, the search message may be broadcast to the network.

If the broadcast method is used, all of the terminals and image processing devices connected to the network receive the search message, but the image processing records and registers the same user name and password combination as the encrypted data included in the search message. Only the device can confirm the match, so the desired purpose can be achieved.
The search message may specify a port different from the port to which the print data is input, and the receiving unit may open the same port as the port specified by the search message.

With this configuration, since the print data and the input port are different, there is no need to provide an identifier for the data.
The data created from the user name and password in the registration recording means is data obtained by encrypting the user name with the password, and the comparison means encrypts the received search message encrypted data and the registration recording means. It can be set as the structure which compares the data which were performed and detects what corresponds.

  With this configuration, comparison processing is facilitated on the image processing apparatus side. In particular, an image processing apparatus in which many users are registered is convenient because it does not require the trouble of trying to decrypt using many registered and recorded passwords.

Embodiments of the present invention will be described below.
<Overall configuration>
FIG. 1 shows the overall configuration of the network system. Two LANs 1 and 2, MFP 3 and printer 4 are connected to a WAN such as the Internet via routers R 1 and R 2 and modems M 1 and M 2, respectively. Computer terminals T11, T12, T21, T22,... Are connected to each LAN. In addition to the terminal, an MFP 5 is connected to the LAN 1 as an example of an image processing apparatus.
Each router R1, R2 has a global IP address on the WAN side. Each terminal and MFP in the LAN is assigned a local IP address in the LAN. The router's NAT (Network Address Translator) function allows global IP addresses and local IP addresses to be converted to each other. The LANs 1 and 2 and the MFP 3 and the scanner 4 can communicate with each other using, for example, the TCP / IP protocol.
<Device configuration>
FIG. 2 shows the configuration of the terminals T11, T12, T21, T22,. Each terminal includes a communication interface 1, an input interface 2, a search message creation application 3, an encryption application 4, a requested job management program 5, and an output interface 6 in addition to the CPU, ROM, and RAM as shown in the figure.
The communication interface 1 transmits / receives data to / from the LAN according to the TCP / IP protocol. The input interface 2 receives data input from input devices such as a keyboard and a mouse. The output interface 6 mainly performs display output to a display attached to the terminal. The search message creation application 3 is an application that is activated when searching for an image processing apparatus that can be used on the network. The search message creation application 3 requests necessary inputs such as a user name and a password, and creates a search message when these are entered. Details will be described later. The encryption application 4 is an application that encrypts the input user name with the input password. The requested job management program 5 stores management information such as which job is requested from which device in a program to be started when a request is made to an image processing apparatus that can use job processing after the search, and the execution status of the requested job management program 5 is stored. Monitor.
<Configuration of image processing device>
FIG. 3 shows configurations of the MFP 3 and the printer 4 as image processing apparatuses. As shown in the figure, in addition to the CPU, ROM, and RAM, a communication interface 11, a registration storage unit 12, a verification application 13, a response message creation application 14, and a job processing unit 15 are provided.
The communication interface 11 communicates with the terminal and has the same function as the communication interface of the terminal. The registration storage unit 12 accepts registration from a network administrator or the like in advance and stores a user name and password. The data stored in the registration storage unit is shown in FIG.

The collation application 13 collates the encrypted user name sent as an attachment to the search message with the data stored in the registration recording unit, and searches for a match. The response message creation application 14 is activated when the collation application determines that they match, and creates a predetermined response message. If the image processing apparatus is a scanner, the job processing unit 15 reads a set original. If the image processing apparatus is a printer, the job processing unit 15 prints the requested job. If the image processing apparatus is an MFP, the job processing unit 15 scans according to the request. , Print or fax.
<Operation>
Next, operations between the terminal and the image processing apparatus will be described with reference to FIGS.
First, the CPU of each terminal waits for an event to occur (S1). An event is generated by input from an input device such as a keyboard or data received through a communication I / F. When an event occurs, it is determined whether it is a search instruction of the image processing apparatus, a print instruction, a scan or FAX instruction.
If the event is a print instruction, a scan, or a fax instruction, a subroutine is executed in which the requested job is transmitted to an available printer or MFP, respectively (S2, S3). On the other hand, if the event is a search instruction for an available image processing apparatus, the process proceeds to step S5.
The search instruction event usually occurs when the user issues an instruction to search on the input screen, but, for example, it is automatically generated when the terminal is newly connected to the network. You can also

  When the CPU receives this event, the display switches to a screen for inputting a user name and password, and waits for an input from the user (S5). The user name and password are, for example, alphanumeric characters and are set to 8 characters or less, and the user name and password that have been delivered to the network administrator and registered in advance are used. The user name and password must be registered in the image processing apparatus existing on the network by the network administrator or the user himself / herself.

Here, the network covers not only the LAN to which the user belongs, but also the Internet and other LANs connected through the Internet.
For example, if "USER-ABC" is entered as the user name and "DROWSSAP" is entered as the password, the well-known DES (Data Encryption Standard) encryption is performed (S6), and the encrypted data is added to the search message. (S7) and transmitted to the network (S8).

FIG. 6 shows the format of the search message. As a search message, Search-Key and Sender-IP are described as shown. Other description contents may include a message for designating a search target as a scanner, MFP, or printer model, and a message for limiting other functions.
In the Search-Key, data obtained by encrypting a user ID with a password is described. Sender-IP is the IP address of the sending terminal. This address is necessary for use as the destination of the response message.

  The search message is broadcast without specifying a destination. For example, if the terminal T1 in the LAN 1 transmits the search message, it is received by each terminal and MFP in the LAN and sent to the Internet via the router R1. In this case, the global address on the WAN side of the router R1 is written in the header of the packet storing the search message by the NAT function of the router. The search message sent to the Internet is received by the MFP 3 and the printer 4 via the modem. At the same time, it is also received by router R2 of LAN2. In the router R2, it is converted into a private address by the NAT function and transmitted to each terminal in the LAN2. However, since the search message is a search for an available image processing device, even if the search message is received by the terminal, the terminal itself does not register and record data created from the user name and password, and has a function of creating a response message. Since there is no response message, no response message is sent back.

  The flowchart in FIG. 5 shows processing on the image processing apparatus side that has received a message from the network. First, it is determined whether the message is a search message or a message for requesting job processing (S11). If the message is a job processing request, known processing (document scanning, printing) , FAX) is executed (S12). On the other hand, if it is a search message, the encrypted data contained in the search message is extracted, and the data stored in the registration storage unit is searched and collated using it as a search key (S13). In the registration storage unit, as shown in FIG. 7, registration key data 21, 22,... Are stored together with bibliographic items such as valid / invalid flags and registration date / time. The registration key data 21, 22... Is obtained by encrypting the user ID with a password, and is registered in advance by the user or the network administrator. The valid / invalid flag indicates the validity / invalidity of the encrypted data at the time of retrieval. This flag is not necessary, but can be used when the administrator wants to deny the use of a specific user for security reasons. The registration date is also recorded as management data, although it is not necessary.

If the matched data is registered as a result of the search (S14), a response message is created (S15), and the global address described in the source or header of the search message is transmitted as the destination address (S16). If the matched data is not registered, the process ends without creating a response message.
Although the response message is not shown, information on the source IP address, model, and function (scanner, printer, model name, processing speed, transmission document size, print size, etc.) is recorded in addition to the destination address.

  The terminal that transmitted the search message is in an event waiting state after transmission (S1). When the response message is received, the process proceeds to step S9, and necessary items are stored in addition to the response source address. When there are a plurality of usable image processing apparatuses, a plurality of response messages are sent, but the terminal receives all of them, extracts necessary items, and stores them in a predetermined storage area.

The usable image processing apparatus detected in this way displays necessary items such as the IP address and model name in text as shown in FIG. 8, for example. Of course, instead of the text format, it is possible to use an icon to make the display form easy to understand visually like Explorer of Windows (registered trademark).
In the above embodiment, the search message is broadcast to the network, and all the terminals and the image processing apparatus receive the search message. However, in addition to the broadcast form, the search message is sent to the terminal and the image processing apparatus. May be provided (for example, the image processing apparatus assigns port number 50 as a dedicated port) to be received by the image processing apparatus through the dedicated port. In this way, a search message is not received by a terminal to which no dedicated port is assigned.

The present invention is applied to a network having a network printer, a network scanner, and the like, and improves security when searching for devices such as a network printer and a scanner that can be used by the terminal.

1 is a diagram showing a network configuration as an embodiment of the present invention. FIG. It is a block diagram which shows the structure of a terminal. It is a block diagram which shows the structure of an image processing apparatus. It is a flowchart explaining the operation | movement which a terminal performs. It is a flowchart explaining the operation | movement which an image processing apparatus performs. It is a figure which shows an example of a search message. This is data stored in the registration recording unit. It is a display example of a search result.

Explanation of symbols

T11, T12, T13, T21, T22 terminals
LAN1, 2 WAN network
R1, R2 Router M1, M2 Modem MFP3, 5
4 Scanner

Claims (5)

A system in which a terminal and an image processing apparatus are connected to a network,
The terminal
An input means for entering a user name and password;
An encryption means for encrypting the user name with a password;
Means for transmitting a search message including the encrypted data;
With
The image processing device
Registration recording means for pre-registering data created from a user name and password;
Means for receiving search messages;
Means for obtaining encrypted data from the received search message and comparing it with the data registered in its own device;
A network system comprising: a notification means for notifying a search message transmission source that data can be used when it matches data registered in its own device. The network system according to claim 1, wherein the search message is broadcast to the network. The search message specifies a port different from the port to which print data is input,
2. The network system according to claim 1, wherein the receiving means opens the same port as the port specified in the search message. The data consisting of the user name and password in the registration recording means is data obtained by encrypting the user name with a password,
4. The network system according to claim 1, wherein the comparison unit compares the encrypted data of the received search message with the encrypted data in the registration recording unit, and detects a match. 5. The network system according to claim 1, wherein the transmission means transmits the search message each time the terminal is connected to the network or when the image processing apparatus is used.

Images