JP2007034386A - Terminal for network storage access and remote data storage system using the same - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To use a storage device on a network without depending on the network environment of a connection destination device regardless of whether the connection destination is for PC or non-PC. <P>SOLUTION: This USB terminal is provided with a USB interface part 5e for communicating with a device 6, an authentication processing part 5d for performing predetermined authentication processing with an authentication server 1, a radio connection processing part 5b for receiving the connection destination information of a storage device 3 from the processing server 2, and for stretching a path with the storage device 3 on a network, and for transmitting the storage information including at least the information of a folder name or authority relating to the storage area of the storage device 3 to the device 6, and for making the device 6 confirm the storage device 3 at the connection destination and a data processing/converting part 5c for performing predetermined data processing and conversion when receiving the data from the device 6, and for transmitting the data to the storage device 3 as the storage connection destination. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a network storage access terminal and a remote data storage system using the same.

In recent years, storage devices such as a USB memory, an SD card, and a compact flash (registered trademark) drive have been reduced in size and weight, and since their portability has increased, for personal computers / other devices (hereinafter referred to as PCs). It is widely used as an information holding / exchanging means regardless of whether it is for use or non-PC use). On the other hand, nowadays, an environment for appropriately accessing a storage device arranged on a network and writing / reading information is being prepared. However, when accessing such a storage device on the network, a USB terminal is used. Also, a technology for providing security using software that starts up the USB terminal as a key has been developed. In addition, Patent Document 1 discloses a compact wireless storage device including a digital memory accessible from the outside via a wireless antenna.
Japanese Patent Laid-Open No. 2004-310772

  However, when using a storage device such as the USB memory, it may be necessary to physically carry the data in order to exchange data. In such a case, there is a risk of data loss due to loss or impact. End up. In addition, there is a limit to holding extremely large amounts of data, and the storage device itself becomes expensive in proportion to the capacity.

  On the other hand, in the technology using the USB terminal described above, the USB terminal simply provides key information and software, and the processing is left to a terminal such as a connection destination PC. In other words, it is not possible to start up software on any terminal, and it is particularly difficult to leave such processing to a non-PC or the like. There is also a problem that access to authentication information and storage information depends on the network environment of the connection destination terminal.

  Furthermore, the technique disclosed in Patent Document 1 simply includes a memory accessible from the outside, and does not disclose use of a storage device on a network.

  The object of the present invention is to control the use of storage devices on the network, etc. only by connecting to a standard interface regardless of whether the connection destination is for PC or non-PC. An object is to use a storage device on the network, that is, independently perform various processes and communications without imposing a processing burden and without depending on a network environment of a connection destination device.

In order to achieve the above object, according to the first aspect of the present invention, a network storage access terminal that can communicate with an authentication server, a processing server, and a storage device on a network and that connects an external device and the storage device in storage. The interface unit for communicating with the external device, the authentication processing unit for performing a predetermined authentication process with the authentication server, and the storage server connection destination information from the processing server, Based on the information, a path is established between the storage device on the network and storage information including at least folder name and authority information related to the storage area of the storage device is transmitted to the external device. To receive data from the external device and the external device. When predetermined data processing, it performs conversion, network storage access terminal is provided, characterized in that it comprises a data processing and conversion unit that transmits to the storage destination of the storage device. In this first aspect, the network storage access terminal may establish a path with the storage device on the network based on the type of external device received from the external device and the connection destination information. In this case, the storage to be automatically connected is specified according to the type of external device (digital camera, printer, etc.), and data can be appropriately sorted.

  The connection destination information may be determined based on the type of external device.

  In the second aspect of the present invention, a remote data storage system in which an authentication server, a processing server, a storage device, and a network storage access terminal to which an external device is connected is configured to be communicable via a network. A storage device for accumulating data of the external device, an authentication server for authenticating the network storage access terminal, and the network storage access terminal when authentication of the network storage access terminal is established. A processing server that establishes a path between the storage device and the storage device, and transmits a connection completion notification to the network storage access terminal, an interface unit for communicating with the external device, and the authentication server An authentication processing unit that performs a predetermined authentication process with Upon receiving a connection completion notification with the storage device from the processing server, the storage device transmits storage information including at least the folder name and authority information related to the storage area of the storage device to the external device, and the connection destination to the external device A wireless connection processing unit for confirming information of the storage device, and a data processing / conversion unit that performs predetermined data processing and conversion when data is received from the external device and transmits the data to the storage device to which the storage is connected. There is provided a remote data storage system comprising a network storage access terminal provided. Further, in the second aspect, the processing server may further be characterized by establishing a path with the storage device based on a type of external device.

  In this second aspect, the network storage access terminal uploads the information to the processing server at least when the status of the external device changes, and the processing server receives the information and Further, it may be further characterized by transmitting a connection destination change completion notice to the network storage access terminal. As an example of a change in the status of an external device, when the external device is changed from digital video to a digital camera, the information is uploaded to the processing server, and the storage connection destination is automatically changed, so that appropriate storage is performed. This saves you the trouble of manually changing the settings first.

  In the second aspect, the processing server has a connection destination information DB that holds a table including a terminal ID and folder name of a network storage access terminal, a storage address of a storage device, a user authority, and a connection type, It may be further characterized by referring to the table and identifying the corresponding storage device based on the terminal ID of the network storage access terminal and establishing a path.

  According to the present invention, regardless of whether the connection destination is for PC or non-PC, simply connecting to a standard interface places a processing burden on the connection destination device such as use control of storage devices on the network. Network storage access terminal and remote data storage using the same, making use of a storage device on the network, i.e., enabling various kinds of processing and communication independently, without using the network environment of the connection destination device. To provide a system.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings. As an embodiment, a terminal using USB as a standard for an interface unit of a network storage access terminal (hereinafter referred to as “USB terminal”) will be described as an example.

  The USB terminal according to an embodiment of the present invention behaves as a standard storage for a PC / non-PC compatible with a removable storage medium. The storage management server group on the network is wirelessly accessed by the communication function. As an example, the storage management server group means a group including an authentication server, a processing server, and a storage device. Since the data is stored in the storage device on the network, the used capacity can be increased or decreased depending on the situation. Even if lost, the data is not stored in the USB terminal itself, so security can be maintained. Further, no special processing is required in the connection destination device, and the storage destination on the network is not conscious of being in the storage device on the network. Thereby, a user's operation burden is reduced. Details will be described below.

  First, FIG. 1 shows a configuration of a USB terminal and a remote data storage system using the USB terminal according to an embodiment of the present invention. As shown in FIG. 1, the USB terminal 5 includes a wireless interface unit 5a, a wireless connection processing unit 5b, a data processing / conversion unit 5c, an authentication processing unit 5d, a setting information DB 5f, an authentication information DB 5g, an external input unit 5h, and a terminal. An information DB 5i and a USB interface unit 5e are provided. The wireless connection processing unit 5b, the data processing / conversion unit 5c, and the authentication processing unit 5d are realized by, for example, a main control unit such as a CPU reading and executing a computer program stored in a memory (not shown) in advance. It is a function. The USB terminal 5 is capable of communicating with an authentication server 1, a processing server 2, and a storage device 3 that are storage management server groups disposed at remote locations via a wireless base station (AP) 4.

  In such a configuration, the USB terminal 5 communicates with the wireless base station 4 based on a wireless LAN standard such as IEEE802.11 via the wireless interface unit 5a.

  That is, the USB terminal 5 searches for a connectable wireless base station 4 by the wireless connection processing 5b, and then performs predetermined authentication with the authentication server 1 by the authentication processing unit 5d. Thereafter, when authentication is established, the data received from the device 6 via the USB interface unit 5e is processed / converted by the data processing / converting unit 5c, and then processed via the wireless interface unit 5a and the wireless base station 4. The data is transmitted to the storage device 3 via the server 2 or directly. The storage device 3 stores the data in a predetermined area allocated to the terminal.

  In these processes, the setting information DB 5f, the authentication information DB 5g, and the terminal information DB 5i are referred to as appropriate.

  The external input unit 5h conceptually includes, for example, a connection destination changeover switch and a fingerprint reading device. And when the input by these is made, the authentication process part 5d updates the content corresponding to setting information DB5f suitably.

  For example, as shown in FIG. 2A, the USB terminal 5 includes a terminal ID (telephone number, Mac address, etc.), an authentication key (password, etc.), information from the external input unit 5h (switch ON / OFF, fingerprint Data), information on the connected device 6 (model name, type, manufacturer, etc.), connection destination information of the wireless base station 4 (list of connectable wireless base stations 4 etc.), connection destination information of the processing server 2 ( Server address). More specifically, for example, the terminal ID is held in the terminal information DB 5i, the authentication key is held in the authentication information DB 5g, the information from the external input unit 5h in the setting information DB 5f, the information on the connected device 6, The connection destination information of the wireless base station 4 and the connection destination information of the processing server 2 are held by a table or the like. When a device 6 such as a personal computer or a digital camera (non-PC) is connected to the USB interface unit 5e, it is detected and a series of processes as described above are automatically started. At this time, information on the connected device 6 is stored in the setting information DB 5f.

  The authentication server 1 is configured by a Radius server or the like, and includes an authentication information DB 1b. The authentication server 1 refers to the authentication information DB 1b and performs predetermined authentication processing. An example of the authentication table of the authentication information DB 1b is as shown in FIG. 2B, and the terminal ID is associated with user information, password, biometric information, billing information, and the like. The biometric information is referred to only in the case of the USB terminal 5 that uses biometric information obtained by fingerprint reading by the external input unit 5h during authentication.

  The processing server 2 has a connection destination information DB 2b. An example of this connection destination information DB 2b is as shown in FIG. That is, in the connection destination information DB 2b, the terminal ID is associated with the folder name, storage address, authority, connection type, expiration date, connection destination changeover switch, and the like. The processing server 2 refers to the connection destination information DB 2b, selects the storage address of the storage device 3 based on the key information such as the terminal ID transmitted from the USB terminal 5, and establishes a path with the USB terminal 5. For example, a TCP / IP session is established.

  Hereinafter, referring to the flowchart of FIG. 3, an example of processing for establishing a path to the storage apparatus 3 via the processing server 2 and recognizing it as local storage by the remote data storage system according to the embodiment of the present invention will be described. This will be described in detail.

  After inserting the USB terminal 5 into the port of the device 6 and making the device 6 recognize the presence of the storage device (step S1), the wireless connection processing unit 5b makes a request (terminal ID, authentication key, connection destination information of the wireless base station 4). Is searched for a wireless base station 4 capable of wireless communication (step S2). When the wireless base station 4 responds to this request (step S3), the USB terminal 5 obtains information on the connected device 6 and stores it in the setting information DB 5f (step S4). Subsequently, the USB terminal 5 sends a connection request (terminal ID, authentication key, information from the external input unit 5h, information on the connected device 6, information on the connection destination of the wireless base station 4, via the wireless base station 4. (Including connection destination information of the processing server 2) is transmitted to the processing server 2 (steps S5 and S7). This is because the USB terminal 5 performs wireless connection processing by the terminal alone based on locally held information (see FIG. 2A) (step S6). Performing wireless connection processing by a single terminal means that the USB terminal 5 performs wireless connection control and the connection device 6 does not perform connection processing.

  Upon receiving this connection request, the authentication server 1 detects the consistency between the information included in the connection request (for example, the terminal ID and the authentication key) and the authentication information in the authentication information DB 1b (table in FIG. 2B). When the consistency between the two is obtained, the storage address is searched using the terminal ID as a key (table in FIG. 2C), connection processing to the predetermined storage device 3 is started (step S8), and the wireless base station Authentication permission is notified to the USB terminal 5 via the station 4 (steps S9 and S10). Upon receiving this connection permission notification, the USB terminal 5 establishes a wireless connection with the wireless base station 4 (step S11). The processing server 2 establishes a path with the USB terminal 5 via the wireless base station 4 (step S12). Thereby, for example, a TCP / IP session is established. Subsequently, the processing server 2 accesses the storage device 3 having the storage address specified by using the terminal ID as a key in the table of FIG. 2C (step S13), and between the processing server 2 and the storage device 3 A path is established (step S12). Thereafter, the processing server 2 transmits a notification of completion of connection with the storage apparatus 3 (including the folder name and authority specified in FIG. 2C) to the USB terminal 5 (step S15). Upon receiving this connection completion notification, the USB terminal 5 transmits storage information (including the folder name and authority information) to the device 6 (step S16). As described above, the storage connection between the device 6 and the storage device 6 is established, and thereafter data communication becomes possible (step S17).

  Next, with reference to the flowchart of FIG. 4, an example process for establishing a direct path to the storage apparatus 3 and recognizing it as local storage by the remote data storage system according to the embodiment of the present invention will be described in detail. To do.

  After inserting the USB terminal 5 into the port of the device 6 and causing the device 6 to recognize the presence of the storage device (step S21), the wireless connection processing unit 5b makes a request (terminal ID, authentication key, connection destination information of the wireless base station 4) Is searched for a wireless base station 4 capable of wireless communication (step S22). When the wireless base station 4 responds to this request (step S23), the USB terminal 5 obtains information about the connected device 6 (such as the device type of the device 6) and stores it in the setting information DB 5f. (Step S24). Subsequently, the USB terminal 5 sends a connection request (terminal ID, authentication key, information from the external input unit 5h, information on the connected device 6, information on the connection destination of the wireless base station 4, and processing via the wireless base station 4. (Including connection destination information of the server 2) is transmitted to the processing server 2 (steps S25 and S27). This is because the USB terminal 5 performs wireless connection processing by the terminal alone based on locally held information (see FIG. 2A) (step S26).

  Upon receiving this connection request, the authentication server 1 detects the consistency between the information included in the connection request (for example, the authentication ID and the authentication key) and the authentication information in the authentication information DB 1b (table in FIG. 2B). When the consistency between the two is obtained, the storage address is searched using the terminal ID as a key (table in FIG. 2C), and the connection processing to the predetermined storage device 3 is started (step S28). Authentication permission is notified to the USB terminal 5 via the station 4 (steps S29 and S30). Upon receiving this connection permission notification, the USB terminal 5 establishes a wireless connection with the wireless base station 4 (step S31). The subsequent processing is different from FIG.

  The processing server 2 distributes the connection destination information (for example, the folder name, storage address, etc. in FIG. 2C) to the USB terminal 5 via the wireless base station 4 (step S32). In response to this, the USB terminal 5 establishes a path with the storage device 3 (step S33). Thereby, for example, a TCP / IP session is established. Subsequently, the USB terminal 5 transmits storage information (including the folder name and authority information) to the device 6 (step S34). As a result, the storage connection between the device 6 and the storage device 6 is established, and thereafter, data communication is possible (step S35).

  Finally, referring to the flowchart of FIG. 5, an example for changing the connection destination according to the type of the connected device 6 and information from the external input unit 5h by the remote data storage system according to the embodiment of the present invention. This process will be described in detail.

When the status of the device 6 is changed (step S50) or the connection destination changeover switch of the external input unit 5h is operated, this processing is entered. That is, when the USB terminal 6 obtains status change information from the external input unit 5h or the device 6 (step S51), the information is uploaded to the processing server 2 (step S52). For example, when the connection destination changeover switch is changed from the switch 1 to the switch 2, the information is uploaded to the processing server 2. The processing server 2 makes a connection change request (including information such as connection type) to the storage device 3 in order to change the storage destination to be mounted based on the information obtained from the USB terminal 5 (step S53) (step S54). ). As an example, when the terminal ID is “09012345678”, the storage is changed to the storage of the storage address “/ sv02 / kyouyuu” (table in FIG. 2C). As an example in which the status of the device 6 changes, when the device 6 is a digital video camera, when the digital video is changed to the digital camera, the storage location of the digital video image and the digital camera image can be changed. . In this case, when the USB terminal 5 receives the change to the digital camera in Step 50, the USB terminal 5 uploads the information including the connection type to the processing server 2 (Steps 51 and 52), and the processing server 2 is based on the received connection type. The storage to be connected will be changed (table in FIG. 2C) (steps 53 and 54).
Upon receiving this connection change request, the storage apparatus 3 changes the storage destination and re-establishes a path between the storage destination and the processing server 2 (step S55). Thereafter, the processing server 2 transmits a connection destination change completion notification to the USB terminal 5 (step S56). Upon receiving this notification, the USB terminal 5 reflects the storage information on the device 6 (step S57), and thereafter, the storage connection is made between the device 6 and the new storage destination (step S58). Data communication is possible.

  As described above in detail, according to one embodiment of the present invention, communication is possible via the wireless base station 4 with the authentication server 1, processing server 2, and storage device 3 on the network, such as a PC or a digital camera. Between the authentication server 1 and the USB terminal 5 for connecting the external device (device) 6 that is a non-PC and the storage device 3 for storage purposes, and communicating with the device 6. The connection destination information of the storage device 3 is received from the authentication processing unit 5d that performs predetermined authentication processing and the processing server 2, and a path is established between the storage device 3 on the network based on the connection destination information, and the device 6 Storage information including at least the folder name and authority information related to the storage area of the storage device 3 is transmitted to the device 6 For example, when data such as an image file is received from the wireless connection processing unit 5b for confirming the storage device 3 and the device 6, data processing for performing predetermined data processing, conversion, and transmission to the storage device 3 of the storage connection destination A USB terminal having the conversion unit 5c is provided. Further, the connection destination information may be determined according to the type of the external device 6. For example, when the terminal ID is “09012345678” and the external device 6 is a PC, the storage address is “/ sv01 / wakamatsu” “/ sv02 / kyoyuyu” “/ sv03 / japan-telecom” “/ sv01 / photo”. When connected and the external device 6 is a camera, it is connected to “/ sv01 / photo”.

  Alternatively, remote data in which the authentication server 1, the processing server 2, the storage device 3, and the USB terminal 5 to which the non-PC device 6 such as a PC or a digital camera is connected are configured to be communicable via a network. In the storage system, the storage apparatus 3 for storing the data of the device 6, the authentication server 1 for authenticating the USB terminal 5, and the storage between the USB terminal 5 and the storage when the authentication of the USB terminal 5 is established. Predetermined authentication between the processing server 2 that establishes a path with the device 3 and transmits a connection completion notification to the USB terminal 5, the USB interface unit 5 e for performing device 6 communication, and the authentication server 1 Upon receiving a notification of completion of connection with the storage device 3 from the authentication processing unit 5d for processing and the processing server 2, the storage device 6 is connected to the connected device 6. 3, storage information including at least the folder name and authority information related to the storage area 3, and the wireless connection processing unit 5 b for confirming the connection destination storage device 3 to the device 6, and receiving data from the device 6 A remote data storage system comprising: a USB terminal 5 including a data processing / conversion unit 5c that performs predetermined data processing and conversion in a case where the data is converted and transmits the data to the storage device 3 that is a storage connection destination. Provided. A storage address is specified based on the type of the external device 6, and a path is formed between the storage device 3 and the USB terminal 5.

  The USB terminal 5 uploads the information to the processing server 2 when the status of the device 6 changes or when the changeover switch of the external input unit 5h is operated, and the processing server 2 receives the information. Then, the path to the storage device 3 is reestablished, and then a connection destination change completion notification is transmitted to the USB terminal 5. The processing server 2 has a connection destination information DB 2b that holds a table including the terminal ID and folder name of the USB terminal 5, the storage address of the storage device, the user authority, the connection type, and the connection destination changeover switch. Then, the corresponding storage device is identified based on the terminal ID of the USB terminal 5, and a path is established.

  Thus, according to one embodiment of the present invention, regardless of whether the connection destination is for PC or non-PC, the connection destination device 6 is not subjected to a processing load, and the connection destination device 6 is not connected. The storage device 3 on the network can be used without depending on the network environment. That is, while this USB terminal behaves as a standard storage, it can actually store data by wirelessly accessing the storage device 3 on the network by its own control function and communication function. To do. The used capacity of the storage device 3 can be increased or decreased as appropriate. In addition, since data is not basically stored in the USB terminal itself, security can be maintained even in the case of loss. In particular, when the processing server 2 takes the lead in processing to establish a path with the storage device, even when the authority is changed from the outside during connection, it is possible to respond immediately, and the distributed storage device 3 Even if it is used, there is an advantage that the processing load is not imposed on the USB terminal 5.

  The present invention is not limited to the above-described embodiment, and various improvements and changes can be made without departing from the spirit of the present invention. For example, a display unit may be provided in the USB terminal 5 so that the data transmission status from the device 6 to the storage device 3 is appropriately displayed. In the network storage access terminal described in the claims, the interface unit is not limited to the USB standard, and may have an SD interface or a compact flash (registered trademark) interface. Further, the wireless interface unit in the network storage access terminal can be replaced by adopting a configuration in which, for example, a card in which a wireless LAN communication function is modularized or a cellular phone data communication card can be inserted and connected. Alternatively, a method may be used in which data from the device 6 is temporarily stored in a network storage access terminal and transmitted to the storage device 3 on the network. In this case, data from the device 6 is temporarily stored in a cache memory (not shown) in the network storage access terminal. The data transmission timing can be transmitted according to the state of the wireless communication section (between the wireless base station 4 and the wireless interface unit), the CPU usage rate of the storage device, the traffic situation, and the like.

It is a conceptual diagram which shows the structure of the USB terminal which concerns on one embodiment of this invention, and the remote data storage system using the same. (A) is a table held in the authorization information DB 5f by the USB terminal 5, (b) is an authentication table held in the authentication information DB 1b by the authentication server 1, and (c) is held in the connection destination information DB 2b by the processing server 2. It is an example of a connection destination table. 5 is a flowchart for explaining in detail a local storage operation by the remote data storage system according to the embodiment of the present invention. It is a flowchart for demonstrating in detail the other local storage operation | movement by the remote data storage system which concerns on one embodiment of this invention. It is a flowchart for demonstrating in detail the operation | movement concerning the connection destination change by the remote data storage system which concerns on one embodiment of this invention.

Explanation of symbols

 DESCRIPTION OF SYMBOLS 1 ... Authentication server, 2 ... Processing server, 3 ... Storage apparatus, 4 ... Wireless base station, 5 ... USB terminal, 5a ... Wireless interface part, 5b ... Wireless connection processing part, 5c ... Data processing / conversion part, 5d ... Authentication Processing unit, 5e ... USB interface unit, 5f ... authorization information, 5g ... authentication information, 5h ... external input unit, 5i ... terminal information DB, 6 ... connection destination device.

Claims (6)

A network storage access terminal that can communicate with an authentication server, a processing server, and a storage device on a network and that connects an external device and the storage device in storage.
An interface unit for communicating with the external device;
An authentication processing unit that performs a predetermined authentication process with the authentication server;
The storage server connection destination information is received from the processing server, a path is established with the storage device on the network based on the connection destination information, and the folder name relating to the storage area of the storage device for the external device And a wireless connection processing unit that transmits storage information including at least information of authority and causes the external device to confirm a storage device of a connection destination,
A data processing / conversion unit that, when receiving data from the external device, performs predetermined data processing and conversion, and transmits the data to the storage device connected to the storage;
A network storage access terminal characterized by comprising:   The network according to claim 1, wherein the network storage access terminal establishes a path with a storage device on the network based on the type of external device received from the external device and the connection destination information. Storage access terminal. A remote data storage system in which an authentication server, a processing server, a storage device, and a network storage access terminal to which an external device is connected are configured to be able to communicate via a network,
A storage device for storing data of the external device;
An authentication server for authenticating the network storage access terminal;
A processing server that, when authentication of the network storage access terminal is established, establishes a path between the network storage access terminal and the storage apparatus, and transmits a connection completion notification to the network storage access terminal When,
When receiving an interface unit for communicating with the external device, an authentication processing unit for performing a predetermined authentication process with the authentication server, and a connection completion notification from the processing server to the storage device, the external device A wireless connection processing unit that transmits storage information including at least the folder name and authority information related to the storage area of the storage device and causes the external device to confirm the storage device of the connection destination, and data from the external device A network storage access terminal comprising: a data processing / conversion unit that performs predetermined data processing and conversion when received, and transmits the data to a storage device to which the storage is connected;
A remote data storage system comprising:   The remote data storage system according to claim 3, wherein the processing server establishes a path with the storage device based on a type of external device.   The network storage access terminal uploads the information to the processing server at least when the status of the external device changes, and the processing server receives the information and reestablishes the path to the storage device. 5. The remote data storage system according to claim 3, further comprising transmitting a connection destination change completion notification to the network storage access terminal.   The processing server has a connection destination information DB that holds a table including a terminal ID and folder name of a network storage access terminal, a storage address of a storage device, a user authority, and a connection type. 5. The remote data storage system according to claim 3, further comprising: specifying a corresponding storage device based on a terminal ID of a network storage access terminal and establishing a path.

Images