JP2006295241A - Image forming apparatus and its control program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an image forming apparatus where security can be improved. <P>SOLUTION: When the data of a plurality of jobs is erased in the image forming apparatus, where data are erased by overwriting the data use region of an HDD with data a plurality of times, first-time erasure is performed with respect to all the data jobs (S603, S605), followed by second-time and subsequent erasure (S607). <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an image forming apparatus and a control program for the image forming apparatus, and in particular, when image data is discarded in an image forming apparatus having a function of storing and storing image data in a storage unit. The present invention relates to an image forming apparatus that performs overwriting for erasing an image so that the image data cannot be restored, and a control program for the image forming apparatus.

  Many image forming apparatuses such as an MFP (Multi Function Peripheral) in recent years use an HDD (Hard Disk Drive) to store a large amount of image data. When this HDD is discarded or intentionally removed, there is a possibility that the data that should have been erased may flow out of the HDD, and there is a possibility that the data may be abused to cause trouble.

  In order to improve security, it is recommended that when the image data is discarded, the entire data use area of the HDD is overwritten and erased at least once with a fixed pattern.

  In particular, for data with high confidentiality, not only overwriting with “00” data but also overwriting multiple times with data such as “AA” and “FF” is recommended. That is, the same job is erased a plurality of times continuously. By doing so, it is possible to make the image data stored in the HDD unrecoverable.

  In addition, when overwriting for erasure, when a new image write request is made, a new image is written after the erasure is executed. In addition, when there is a request for erasing an image during image writing, image writing is awaited. That is, a new job is executed after image erasure.

  With regard to the above-described data erasing technique, the following Patent Document 1 discloses a technique for starting erasing at the time when a request for the next job is entered, at the time of auto clearing, or at the time of transition to the energy saving mode.

  Patent Document 2 discloses the following matters.

  • When executing an interrupt job, if the interrupt job size is small, erase the interrupt job and start the interrupted job.

  -Deletion is started when a predetermined time elapses after the job ends. Further, even before a predetermined time elapses, erasing is started by erasing key ON.

  • Set the erase time and erase. If the job is in operation at that time, the deletion is made to wait.

  Store the job history, determine the time period when the standby state continues, and delete it there.

Patent Document 3 discloses setting the number of erasures according to the security level.
JP 2003-125184 A JP 2003-37719 A JP 2004-153517 A

  However, when overwriting multiple times, there is a problem that a long time is required for overwriting. In general, since “00”, “AA”, and “FF” are overwritten three times for each job, it is necessary to wait for a long time until the subsequent job starts to be erased. It was a security issue in time. That is, when an image erasure request for a plurality of jobs occurs, the next job is erased after performing multiple overwrite erasures of the previous job, so the previous job has a large number of images. In such a case, there is a possibility that the next job will be erased for a long time.

  SUMMARY An advantage of some aspects of the invention is that it provides an image forming apparatus capable of improving security and a control program for the image forming apparatus.

  In order to achieve the above object, according to one aspect of the present invention, an image forming apparatus includes: a storage unit that stores data; and an erasing unit that erases data by overwriting the data use area of the storage unit a plurality of times. In the case of erasing a plurality of data, an execution means for executing the second and subsequent erasures after performing the first erasure on all data.

  Preferably, the image forming apparatus further includes an identification unit that identifies security levels of a plurality of data, and the execution unit performs the first erasure on all the data when a plurality of data having the same security level is erased collectively. After that, the second and subsequent erases are executed.

  Preferably, the execution means executes the second and subsequent erasures after performing the first erasure on all the data when erasing a plurality of data of the same user all at once.

  According to another aspect of the present invention, the control program for an image forming apparatus is a control program for an image forming apparatus having a storage unit for storing data, and the data use area of the storage unit is overwritten multiple times. Thus, in the case of erasing data, and when erasing a plurality of data, the computer executes an execution step of executing the second and subsequent erasures after performing the first erasure on all data. .

  According to the present invention, when erasing a plurality of data, after the first erasure is performed on all the data, the second and subsequent erasures can be executed, so that security can be improved. An image forming apparatus and a control program for the image forming apparatus can be provided.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a schematic sectional view showing a schematic configuration of a tandem color copier (MFP) to which an image processing apparatus according to one embodiment of the present invention is applied.

  Referring to FIG. 1, a color copying machine 100 includes an image reader (IR) unit 101 that reads image data from a document, an image processing apparatus 10, and a printer unit 102 that prints an image on paper. .

  A document placed on the document table 103 of the image reader unit 101 is irradiated by an exposure lamp 105 provided in the scanner 104. The scanner 104 is moved in the direction of the arrow by the scanner motor 112 to scan the entire document. The reflected light from the document surface forms an image on the CCD 110 via the mirrors 106 to 108 and the condenser lens. The CCD 110 converts the reflected light from the document surface into RGB color data (analog signal) and outputs it to the image processing apparatus 10. The color data output from the CCD 110 to the image processing apparatus 10 is referred to as image data.

  The image processing device 10 performs predetermined image processing on the image data input from the CCD 110 and outputs a digital signal to the laser device 113.

  Here, the digital signal output from the image processing apparatus 10 to the laser apparatus 113 includes cyan image color data C, magenta image color data M, yellow image color data Y, and black image color. Data K. The laser device 113 outputs laser beams to the photosensitive drums 115C, 115M, 115Y, and 115K for cyan, magenta, yellow, and black, respectively, based on the input image color data C, M, Y, and K.

  In the printer unit 102, the laser beam output from the laser device 113 exposes the photosensitive drums 115C, 115M, 115Y, and 115K charged by the chargers 114C, 114M, 114Y, and 114K, and forms an electrostatic latent image. . The electrostatic latent images on the photosensitive drums 115C, 115M, 115Y, and 115K are developed by the four color developing devices 116C, 116M, 116Y, and 116K of cyan, magenta, yellow, and black.

  On the other hand, endless belt 130 is suspended by drive roller 133A and fixed rollers 133B, 133C, and 133D so as not to be loosened. When the driving roller 133A rotates counterclockwise in the figure, the endless belt 130 rotates counterclockwise in the figure at a predetermined speed.

  An appropriate sheet is conveyed from the sheet feeding cassettes 120 to 122, and the sheet is supplied from the timing roller 131 to the endless belt 130. The paper supplied to the endless belt 130 is carried on the endless belt 130 and is conveyed leftward in the drawing. As a result, the sheet comes into contact with the photosensitive drums 115C, 115M, 115Y, and 115K in the order of cyan, magenta, yellow, and black. When the sheet comes into contact with each of the photosensitive drums 115C, 115M, 115Y, and 115K, the toner image developed on the photosensitive drum by the transfer chargers 117C, 117M, 117Y, and 117K paired with the photosensitive drums is applied to the sheet. Transcribed.

  The sheet on which the toner image is transferred is heated by the fixing roller pair 132. As a result, the toner is melted and fixed on the paper. Thereafter, the paper is discharged from the printer unit 102.

  FIG. 2 is a diagram illustrating a configuration of an image input / output device included in the image processing apparatus 10 of FIG.

  As shown in the figure, the image input / output device 1 includes an IR image interface (I / F) and a printer I / F.

  The image input / output device 1 is connected to the image reader unit 101 by an IR image I / F, and is connected to the printer unit 102 by a printer I / F. The image input / output device 1 includes a CPU 12, a bus arbiter 13, a memory controller PCI bridge 14, an image memory 15, a work memory 16, a backup memory 17, an HDD (hard disk drive) 3, an operation panel 4, and a memory even when the power is turned off. Are configured with a battery 18, an EtherNet (registered trademark) 19, and an EtherNet (registered trademark) controller 20.

  The bus arbiter 13 includes a transfer control unit 131, and the transfer control unit 131 controls data transfer. Further, it is possible to perform data communication with an external PC by EtherNet (registered trademark) 19.

  The flow of image data is roughly divided into two types: image input and image output. Further, there are types of copy jobs, scan jobs, and printer jobs as jobs for each application.

  The flow of image data in these jobs will be described by the control unit shown in FIG. 2 separately for image input, image output, and image erasure.

[Image input]
-Copy job, scan job IR unit 101-> IR image I / F-> image memory 15-> HDD 3
-Printer job PC-> EtherNet (registered trademark) 19-> EtherNet (registered trademark) controller 20-> image memory 15-> HDD 3
[Image output]
Copy job, printer job (1) When an image exists in the image memory 15 Image memory 15 → Printer I / F → Printer unit 102
(2) When no image exists in the image memory 15 HDD3 → Image memory 15 → Printer I / F → Printer unit 102
Scan job (1) When an image exists in the image memory 15 Image memory 15 → EtherNet (registered trademark) controller 20 → EtherNet (registered trademark) 19 → PC
(2) When no image exists in the image memory 15 HDD3 → Image memory 15 → EtherNet (registered trademark) controller 20 → EtherNet (registered trademark) 19 → PC
[Erase image]
Image memory 15 → HDD 3
When performing image registration, the image input / output device 1 always writes an image to the HDD 3 after inputting image data. Therefore, an image can be stored even when the power is turned off.

  However, some images transferred to the HDD 3 need to remain even when the power is turned off, depending on the job mode, and others need not. Specifically, for normal copy and print jobs, it is not necessary to leave an image when the power is turned off. However, if the data once registered is used many times as in the HDD accumulation mode, the power It is necessary to back up even if it is turned off.

  In this embodiment, when the data stored in the HDD becomes unnecessary, the data stored in the HDD 3 is deleted in order to delete the data remaining in the HDD 3 for the purpose of erasing the data so that it cannot be reproduced as a security measure. Overwrite control is performed.

  FIG. 3 is a diagram showing a configuration of image data management information for managing images stored in the image input / output device 1.

  The image data management information stores where the image exists in the image memory and the HDD for each job unit composed of a plurality of pages for image input / output control and image erasure.

  Even if a power failure occurs in the middle of image deletion or the power is turned off carelessly, the image data management information (with the job type turned off) can be deleted when the power is turned on again. Therefore, it is necessary to always back up (regardless of whether or not it is necessary to store the image data). Therefore, the image data management information is stored in the backup memory 17.

  In the image data management information, job data attributes, job HDD operation states, and information on each page are recorded for each job.

  As job data attributes, a user ID, security level, BOX job identification information, and BOX job data discard time are recorded.

  As the job HDD operation state, a write request, a read request, the number of erase requests, the number of erased times, a job unit erase state, and a page unit erase state are recorded.

  As the information of each page, a start address of data on the image memory and HDD, an image state, and an image erased flag are recorded for each page.

  Various job mode information is registered in the job data attribute.

  As the user ID, the ID of the user who registered the job is registered. Specifically, the ID of the person who registered the job in the MFP is registered.

  The security level is a level of security given to the job. In this embodiment, the security level can be registered for each job.

  The BOX job identification information is information for registering whether the job is a job (BOX job) to be retained even when the power is turned off.

  The BOX job data discard time indicates the valid period when the job is a BOX job. At the time of BOX job registration, the data discard time is registered based on the BOX data retention period that is registered in advance as the setting for the entire MFP.

  The job HDD operation state indicates an operation state of a job related to the HDD including data deletion of the HDD.

  The write request means a request for writing an image to the HDD and is registered together with the page number. The read request means an image read request from the HDD and is registered together with the page number. The number of erase requests sets how many times data is overwritten when data is erased. The number of erasure requests is set according to the erasure request mode, and in this embodiment, there is a case where erasure is performed once or three times.

  The erased number of times indicates the number of times erase is actually completed. The job unit deletion state is set when a job is discarded by a user operation (instruction). The job erase execution state is set from the receipt of the erase request to the completion of the erase.

  The page unit erasure state indicates an execution state when a page that is no longer needed automatically is erased in page units at the end of printing the last copy during job execution, and registers the page number and whether or not it is being executed.

  As page information, there is attribute information for each page. A storage address on the image memory, a storage address on the HDD, and an image state are set for each page.

  In the present embodiment, the input image is temporarily stored in the image memory 15 and transferred to the HDD 3 in units of pages. Therefore, there are the following cases regarding the image state.

1. No image (before image input)
2. It exists only in the image memory 15.

  3. It exists in both the image memory 15 and the HDD 3.

  4). It exists only in the HDD 3.

5. Before executing image deletion & HDD3 erasure The above information is stored in the page attribute information and is referred to when the image needs to be taken out. At this time, if the image exists only in the HDD 3, after the image is once restored (read out) from the HDD 3 to the image memory 15, processing such as transmission of a print or scan-out job to the PC is performed.

  The image data management information is discarded on a job-by-job basis when an image is no longer needed and when HDD overwriting for each page is completed.

  FIG. 4 is a flowchart showing the operation of the main routine of the image input / output control process related to image erasure executed by the image input / output device 1.

  Referring to the figure, when the image input / output device 1 is powered on, a startup process for the image input / output device 1 is started in step S101. Here, as a process at the time of start-up, a process necessary when the power is turned off while an image on the HDD 3 is not erased is performed.

  In step S102, all processes related to image input are performed. Specifically, if there is a request for image input, image input from IR or image input from the outside via EtherNet (registered trademark) is performed, and the image is stored in the image memory 15.

  In step S103, all processes related to image output are performed. Specifically, if there is a request for image output, the image is read out from the image memory 15, and the printer prints the image or transmits the scan-out image data to the outside via EtherNet (registered trademark).

  In step S104, an erasure request registration process for erasing the HDD image is performed. Details of this will be described later.

  In step S105, HDD access processing is performed. Details of this will be described later.

  When the above process ends, the process proceeds to step S102 again to repeat the same process.

  In this embodiment, there are three types of image input (image data writing to the HDD), image output (reading image data from the HDD), and HDD image erasing (data overwriting by writing invalid data to the HDD). Although access may occur simultaneously, these switching processes will be described with reference to the following flowchart.

  FIG. 5 is a flowchart showing details of the image input processing subroutine of step S102 of FIG.

  This subroutine has a state configuration. In step S201, the value of the image input state is determined, and the processing steps are executed sequentially. Hereinafter, processing in each state will be described.

-Image input state 0
In the image input state 0, it is determined in step S202 whether or not there is an image input request. If there is a request, a memory securing process is executed in step S203. Specifically, the image input request means activation of image input from the IR in page units of copy jobs and scan jobs, and activation of image input from the PC in page units of printer jobs.

  Thereafter, in step S204, it is determined whether the reservation is successful. If OK, the process proceeds to step S205, and the image state is set to “no image” and the image input state is updated to “1” (S206).

  If the reservation fails in step S204, the image input state is not updated, and this processing is continued when this subroutine is called next time.

-Image input state 1
In the image input state 1, after starting the image input process in step S212, the image input state is updated to “2” (S213).

-Image input state 2
In the image input state 2, it is determined whether or not the image input process is completed in step S222. If completed, the HDD write request registration process is started in step S223. Specifically, the request and the page number are registered in the write request for the job HDD operation state of the image data management information (S223). In step S224, the image state is “existing only in the image memory”. Further, the image input state is updated to “3” (S225).

-Image input state 3
In the image input state 3, it is determined whether or not the HDD writing is completed in step S232, and if the writing is completed, the HDD writing request in the job HDD state of the image data management information is reset to enter the writing completed state (S233).

  Further, the data in the image memory 15 is deleted (S234), and the image state is “existing only in the HDD” (S235). Since a series of page-by-page image input processing is completed, the image input state is initialized and prepared for image input processing for the next page (S236).

  FIG. 6 is a flowchart showing details of the image output processing subroutine of step S103 of FIG.

  This subroutine has a state configuration similar to the image input. In step S301, the value of the image output state is determined, and the processing steps are executed sequentially. Hereinafter, processing in each state will be described.

・ Image output state 0
In the image output state 0, it is determined in step S302 whether there is an image output request. If there is a request, the request and page number are registered in the job HDD operation state read request in step S303. Specifically, the image output request means activation of printing of a copy job and a printer job in units of pages, or activation of transmission of a scan-out job to a PC in units of pages. Thereafter, the image output state is updated to “1” (S304).

-Image output state 1
In the image output state 1, it is determined in step S312 whether or not the HDD reading process is completed. If completed, the process proceeds to step S313. The read request is reset to a read completion state (S314).

  Furthermore, after starting the image output process in step S315, the image output state is updated to “2” (S316).

-Image output state 2
In the image output state 2, it is determined in step S322 whether or not the image output process is completed. If completed, the image memory data is deleted (S323), and the image state is “existing only in HDD”. (S324).

  Further, in step S325, it is automatically determined whether or not the image erasure condition is satisfied. If the image erasure condition is satisfied, the image state is set to “image deletion completion & before HDD erasure execution” (S326), and then the job HDD operation state erasure request is issued. The number of requests and the page number corresponding to the security level are registered in the number of times (S327).

  This completes the series of page-by-page image output processes, so the image output state is initialized and prepared for the image output process for the next page (S328).

  FIG. 7 is a flowchart showing details of the erase registration processing subroutine of step S104 of FIG.

  In this subroutine, image deletion and deletion are registered by determining whether there is a request for discarding in units of jobs based on input from the operation panel or determination of the job discarding time of the BOX job, or operation from the PC. is there.

  The determination of the BOX job discard time is to automatically delete a job (BOX job) held on the HDD even when the power is turned off. Since the deletion time is registered in advance in the job data attribute from the job registration time and the effective period, the job data attribute is activated by determining whether or not this time has been reached.

  First, in step S401, it is determined whether there is a job unit discard request. This is based on the input from the above-described operation panel or the determination of the job discard time. If it exists, in step S402, the image state is set to “image deletion completion & before HDD deletion execution” for all pages of the job in the image data management information. Display.

  Specifically, this calculation is performed by obtaining the product of the number of pages present in the job, the HDD data write time per page, and the number of erase requests.

  In step S404, it is determined whether or not there is a BOX job discard request for the logged-in user (logged-in user). If the BOX job for the logged-in user is discarded, the login user deletion determination screen is displayed in step S405. Display processing is performed. In step S405, a login user deletion determination process is performed. Details of this subroutine will be described later.

  If there is no discard request job in step S401, the process proceeds to step S407, and it is determined whether the erasure delay timer is operating. If the erasure determination delay timer is in operation, it is determined in step S408 that the erasure determination delay timer count has ended. If not, the process proceeds to step S405, and the same processing as described above is performed.

  When there is no BOX discard request for the logged-in user in step S404, or when the erase determination delay timer count ends in step S408, the process proceeds to step S409, and an HDD data erase request for each job is registered.

  FIG. 8 is a flowchart showing details of the logged-in user deletion determination processing subroutine in step S406 of FIG.

  This subroutine determines whether or not to immediately delete the logged-in user's job by an input from the operation panel.

  First, in step S411, it is determined whether or not to immediately perform deletion in response to canceling the job of the currently displayed login user. If there is no input indicating that the erasure is not performed immediately, it is determined in step S412 whether the erasure determination delay timer is operating. If it is not in operation, the process proceeds to step S413, the erase determination delay timer is set, this subroutine is terminated, and the delay timer count is awaited.

  When the erasure determination delay timer is operating in step S412, this subroutine is terminated.

  If there is an input not to delete in step S411, the automatic deletion timing of the login user's BOX job is reset in step S414. Specifically, the deletion time is calculated again from the current time and the BOX job effective period, and is registered again in the image data management information. Thereby, the deletion of the job can be delayed based on the user input.

  FIG. 9 is a flowchart showing details of the HDD access processing subroutine in step S105 of FIG.

  In this subroutine, processing for actually activating access to the HDD is performed in accordance with various requests registered in the image data management information.

  First, image data management information is read in step S501. In step S502, it is determined whether HDD deletion request data exists. This deletion request is actually set in the page-by-page deletion request registration in step S327 in FIG. 6 or the job-by-job deletion request registration in step S409 in FIG.

  If there is no HDD erasure request in step S502, the process proceeds to step S520, and it is determined whether read request data exists. This read request is actually set in step S303 in FIG. If there is a request, the process proceeds to step S521, and a read operation from the HDD is executed.

  If no read request data exists in step S520, the process proceeds to step S530, and it is determined whether write request data exists. This write request is actually set in step S223 of FIG. If there is a request, the process proceeds to step S531, and a write operation to the HDD is executed.

  If there is no write request data in step S530, it is further determined in step S540 whether there is an erase request. If there is, the process proceeds to step S504.

  If there is an HDD erase request in step S502, the process proceeds to step S503, and it is determined whether or not the priority erase mode is set. This mode setting can be registered in advance by the user as a setting for the entire MFP.

  If it is not in the priority erasure mode, the erasure may be postponed, so the process proceeds to step S520 and the same processing as described above is performed.

  If it is the priority erasure mode, it is determined in step S504 whether or not the erasure request job is being executed. If it is being executed, it is determined in step S505 whether read request data for the requested job exists. If it exists, the process proceeds to step S521, and the same processing as described above is performed.

  In step S506, it is determined whether write request data for the requested job exists. If it exists, the process proceeds to step S531, and the same processing as described above is performed.

  With the above processing, if an erase request job is being executed, HDD access for image reading and image writing is preferentially performed, so that productivity can be ensured.

  If the erasure condition is satisfied, an HDD erasure job is determined in step S507. Specifically, the determination is performed according to the image data management information.

  In this case, when a deletion request is set for a plurality of jobs, the following conditions can be adopted as the determination conditions.

  (1) Determine whether a job unit deletion request (for example, deletion by user instruction) or a page unit deletion request (automatic deletion in MFP processing) is registered, giving priority to job unit deletion. To do.

  (2) If a plurality of jobs of the same security level are registered, the number of erasure requests is registered. This preferentially erases data that has never been overwritten and erased.

  (3) When a plurality of jobs with the same user ID are registered, the number of deletion requests is registered.

  FIG. 10 is a flowchart showing the erasure process when a plurality of jobs having the same security level are registered.

  Referring to the figure, in step S601, a job having the same security level is searched. In step S603, it is determined whether or not there is a job with the number of deletions of 0. If YES, the job is overwritten and deleted in step S605, and the process returns to step S603.

  If “NO” in the step S603, erasing is performed for the number of erasure requests in a step S607.

  Note that, when priority is given to deletion in units of jobs as in (1) above, it may be determined whether or not deletion in units of jobs is registered in step S603. When performing processing when a plurality of jobs with the same user ID are registered as in (3) above, a job with the same user ID may be searched in step S601.

  In step S508 in FIG. 9, the HDD data is actually erased.

[Effects of the embodiment]
According to the above embodiment, there are the following effects.

  (1) In an image forming apparatus that stores image data in the HDD, it is possible to set the priority order of erasure of data in the HDD by a user operation. Thereby, the deletion priority or the job execution priority can be selected according to the user's preference. Even in the case of erasure priority, data access can be prioritized if erasure and job data access are the same job.

  With such a configuration, it is possible to select either deletion priority or job data access priority according to the user's preference, thereby improving the usability of the MFP.

  Further, even if the deletion priority is selected, if the data deletion job and the data access job are the same, it is possible to secure the productivity for the job being executed by prioritizing the data access. .

  (2) The HDD data erasure timing can be set by a user operation immediately before the start of erasure.

  That is, at the start of erasing HDD data, the user can select whether or not to erase immediately. As an aid to this user selection, the estimated data erasure time can be displayed at the start of data erasure.

  According to such a configuration, the user can select whether or not to execute the erasure immediately. Therefore, if the user wants to immediately execute a new job according to the use state of the MFP, it is easy to wait for the erasure. Can be realized.

  Also, since the estimated erase time is displayed, the user can easily select whether or not to erase immediately using this time as a guide.

  (3) In the HDD erasure, when a plurality of jobs designated to be erased a plurality of times are collectively erased, the second erasure can be performed after the first erasure is performed on all documents.

  In other words, when erasing a plurality of documents that are designated to be erased a plurality of times at a time when determining the HDD erasure order, the first clear is executed for all the documents, and then the second and subsequent erases are executed. be able to.

  According to this configuration, it is possible to prevent waiting for a delayed job from starting for a long time in any MFP use state, so that it is possible to reduce the waiting time security problem as much as possible.

[Others]
A program for executing the processing in the above-described embodiment can be provided, or the program is recorded on a recording medium such as a CD-ROM, a flexible disk, a hard disk, a ROM, a RAM, or a memory card and provided to the user. You may decide to do it. The program may be downloaded to the apparatus via a communication line such as the Internet.

  Further, the present invention can be applied to a system connected to a network and a system not connected to a network environment.

  In addition, it should be thought that the said embodiment is an illustration and restrictive at no points. The scope of the present invention is defined by the terms of the claims, rather than the description above, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims.

1 is a schematic cross-sectional view showing a schematic configuration of a tandem color copier (MFP) to which an image processing apparatus according to one embodiment of the present invention is applied. It is a figure which shows the structure of the image input / output device contained in the image processing apparatus 10 of FIG. 3 is a diagram showing a configuration of image data management information for managing images stored in the image input / output device 1. FIG. 3 is a flowchart showing an operation of a main routine of an image input / output control process related to image erasing executed by the image input / output device 1 5 is a flowchart showing details of an image input processing subroutine in step S102 of FIG. It is a flowchart which shows the detail of the image output process subroutine of step S103 of FIG. It is a flowchart which shows the detail of the deletion registration process subroutine of step S104 of FIG. It is a flowchart which shows the detail of the login user deletion judgment processing subroutine of step S406 of FIG. 5 is a flowchart showing details of an HDD access processing subroutine of step S105 of FIG. 10 is a flowchart showing an erasing process when a plurality of jobs of the same security level are registered.

Explanation of symbols

1 image input / output processing, 3 HDD, 12 CPU, 15 image memory, 17 backup memory, 100 color copier.

Claims (4)

Storage means for storing data;
Erasing means for erasing the data by overwriting the data use area of the storage means a plurality of times;
An image forming apparatus comprising: execution means for executing the second and subsequent erasures after performing the first erasure on all data when erasing a plurality of data. An identification means for identifying the security levels of the plurality of data;
2. The image according to claim 1, wherein, when a plurality of pieces of data having the same security level are collectively erased, the execution unit executes the second and subsequent erases after performing the first erase on all data. Forming equipment.   2. The image formation according to claim 1, wherein when executing a plurality of pieces of data of the same user in a batch, the execution unit executes the first and second deletions and then executes the second and subsequent deletions. apparatus. A control program for an image forming apparatus provided with storage means for storing data,
An erasing step of erasing the data by overwriting the data use area of the storage means multiple times;
A control program for an image forming apparatus, which, when erasing a plurality of data, causes a computer to execute an execution step of executing the second and subsequent erasures after performing the first erasure on all data.

Images