JP2008177830A - Information distribution system, server device, information distributing program, and image processor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a multifunction device capable of improving secrecy at a client device as a distribution destination of a generated event and accepting many distribution requests even with a small number of resources such as incorporated equipment. <P>SOLUTION: An information distribution system has: an open key information registering unit 203 which relates and registers in an open key information storage unit 204 transmission source IP addresses and open key information for ciphering events included in requests to distribute the events from a plurality of terminal devices; a notice information ciphering unit 206 which ciphers the events respectively based upon open key information of a transmission source IP address corresponding to a distribution destination IP address of a generated event; and a notice information distributing unit 208 which puts a plurality of enciphered events in one set to generate a multicast packet and distributes the multicast packet to the terminals. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an information distribution technique, and more particularly to an information distribution technique that improves the confidentiality of information to be distributed.

2. Description of the Related Art A client-server type information distribution system is known that includes a client device that sends a distribution request and a server device that distributes notification information such as a job end event to the client device in response to the distribution request. For example, according to Patent Document 1, unicast distribution and multicast distribution are dynamically changed according to the number of distribution requests from the client apparatus, and high responsiveness on the client apparatus side and on the server apparatus side. To reduce the processing load.
JP 2000-181836 A

  By the way, when the notification information described above is highly confidential notification information, there is a possibility of eavesdropping. Therefore, it is desirable to encrypt the notification information when distributing it. However, when all users using the information distribution system encrypt the notification information using, for example, a shared key cryptosystem, all users who have received the notification information can decrypt the information using the shared key. For this reason, even users who are not related to the information for notification can browse, and this is not a desirable distribution mode when distributing highly confidential information.

  The present invention has been made in view of such circumstances, and improves the confidentiality of the notification information in the client device, and also enables information that can accept many distribution requests even with few resources such as embedded devices. It is an object to provide a distribution system, a server device, an information distribution program, and an image processing device.

In the information distribution system of the present invention, a plurality of client devices that transmit a notification information distribution request and a server device that distributes each notification information to the client device in response to the distribution request are connected via a communication network. In this information distribution system, the server device registers the transmission source information included in the distribution request from the plurality of client devices and the encryption information for encrypting the notification information in association with each other in the storage means. Registration means, encryption means for encrypting the notification information based on the encrypted information of the transmission source information corresponding to the distribution destination information of the notification information, and a plurality of encrypted notification information. A notification unit configured to generate a notification information group and delivering the notification information group to the client device, and the client device decrypts the notification information encrypted with the encrypted information. That comprises a decoded information, is characterized in that it has a decoding means for decoding on the basis of the notification information that is encrypted is included in the notification information group to the decoding information.
According to this configuration, a plurality of pieces of notification information are each encrypted by the encryption information of the client device corresponding to the distribution destination, and are combined into a set and distributed to the client device. Since the client device can decrypt the notification information only with the decryption information corresponding to its own encrypted information, the confidentiality of the delivered notification information is improved.

The present invention also provides transmission means for the server device to include shared information for sharing encryption and decryption of the notification information, encrypting the shared information based on the received encrypted information, and transmitting to the client device. In addition, the encryption unit encrypts the notification information based on the shared information when the notification information is distributed to all of the client devices, and the decryption unit includes the notification information. Is decrypted based on the received shared information.
According to this configuration, the notification information may be encrypted using the shared information as long as the information is distributed in common to the client devices.

In addition, the present invention is characterized in that the distribution means generates a notification information group every predetermined time.
According to this configuration, the reference for generating the notification information group may be a time unit.

Further, the present invention is characterized in that the server device has a determination unit that determines either unicast distribution or multicast distribution based on the number of distribution requests.
According to this configuration, unicast distribution or multicast distribution may be determined based on the number of distribution requests.

Further, the present invention is characterized in that the distribution means determines whether or not to generate a notification information group according to the type of notification information.
According to this configuration, a notification information group may be generated according to the type of notification information.

Further, the server device of the present invention associates the transmission source information included in the notification information delivery request from the plurality of client devices with the encryption information for encrypting the notification information in the storage unit. Registration means for registration, encryption means for encryption based on encryption information of transmission source information corresponding to distribution destination information of notification information, and notification of a plurality of encrypted notification information as a set And a distribution means for generating a notification information group and distributing the notification information group to a client device.
According to this configuration, a plurality of pieces of notification information are each encrypted by the encryption information of the client device corresponding to the distribution destination, and are combined into a set and distributed to the client device.

Further, the information distribution program of the present invention stores the transmission source information included in the notification information distribution request from the plurality of client devices and the encrypted information for encrypting the notification information in association with each other. Registration step, encryption step based on the encrypted information of the transmission source information corresponding to the distribution destination information of the notification information, and a plurality of encrypted notification information as a set Generating a group and delivering the notification information group to the client device.
According to this configuration, a plurality of pieces of notification information are each encrypted by the encryption information of the client device corresponding to the distribution destination, and are combined into a set and distributed to the client device.

In addition, an image processing apparatus according to the present invention includes the server apparatus described above.
According to this configuration, the server apparatus described above may be included in the image processing apparatus.

  According to the present invention, since the notification information is encrypted and distributed by the encrypted information included in the client device, other client devices cannot decrypt the notification information, and the confidentiality of the notification information is improved. To do. In addition, since the encrypted notification information is distributed as a set, a large amount of notification information can be received even with few resources such as embedded devices.

Hereinafter, embodiments of the present invention will be specifically described with reference to the drawings.
FIG. 1 is a configuration diagram of an information distribution system according to an embodiment of the present invention.
As shown in FIG. 1, the information distribution system includes terminal devices 100 to 100 m, a multifunction device 200, and the like. The terminal devices 100 to 100 m and the multifunction device 200 are connected via a network 300.

  The terminal device 100 is an example of a client device according to the present invention, and includes a display device such as a CRT or a liquid crystal display, an input device such as a keyboard or a mouse, and a control device that controls these operations. The terminal device 100 transmits a distribution request for distributing notification information (hereinafter referred to as an event) to the multifunction device 200 and receives an event transmitted from the multifunction device 200.

  The multifunction device 200 is an example of a server device or an image processing device according to the present invention, and includes at least one of a printing function, a copying function, a facsimile function, a scanner function, an electronic mail transmission / reception function, and the like. Each function is operated in accordance with an instruction from the terminal device 100 or an operation unit formed on itself, and an event is distributed in response to a distribution request from the terminal device 100.

  The network 300 may be either the Internet or an intranet. In the case of an intranet, the network 300 may be either a wired system using cables or a wireless system using radio waves.

Next, details of the configuration of each apparatus will be described with reference to the drawings.
FIG. 2 is a functional block diagram showing the main part of the terminal device 100. 2 includes a processing device such as a CPU (Central Processing Unit), a semiconductor storage device such as a DRAM (Dynamic Random Access Memory), an SRAM (Static RAM), and a ROM (Read Only Memory), and an HD ( Each function is realized by the CPU reading a required program stored in the ROM and performing calculations according to the program. The same applies to functional blocks described later.

  As shown in FIG. 2, the terminal device 100 includes a key information storage unit 101, a distribution request transmission unit 102, a first transmission / reception unit 103, a notification information reception unit 104, a notification information decryption unit 105, and a shared key information reception unit. 106 or the like.

  The key information storage unit 101 stores public key information which is an example of encryption information of the present invention and secret key information which is an example of decryption information of the present invention. The key information is generated by required software, and the public key information is used to encrypt an event transmitted from the multifunction device 200 to the terminal device 100. The secret key information is used for decrypting the encrypted event. The public key information and the secret key information are formed as a pair, and are different for each terminal device 100. Therefore, for example, an event encrypted with the public key information of a certain terminal device 100 is not decrypted with the secret key information of another terminal device 100a.

  The distribution request transmission unit 102 generates a distribution request to be transmitted to the multifunction device 200, extracts public key information from the key information storage unit 101, and includes the public request information in the distribution request. The generated distribution request is sent to the first transmission / reception unit 103.

  The first transmission / reception unit 103 transmits a distribution request to the multi-function device 200 and receives a notification information group (hereinafter referred to as a multicast packet) that is a set of events or a plurality of events transmitted from the multi-function device 200. To do. The transmission / reception unit 103 transmits / receives image information and various other information in addition to the above information.

  The notification information receiving unit 104 receives an event or a multicast packet among various types of information received by the first transmission / reception unit 103. When a multicast packet is received, the event grouped in the multicast packet is divided into event units. The received event or the divided event is sent to the notification information decoding unit 105.

  The notification information decryption unit 105 is an example of a decryption unit of the present invention, and decrypts an encrypted event. More specifically, decryption is performed by extracting either secret key information stored in the key information storage unit 101 or shared key information described later received by the shared key information receiving unit 106.

  The shared key information receiving unit 106 receives the shared key information among various types of information received by the first transmission / reception unit 103. The shared key information is an example of shared information according to the present invention, and is information that enables both encryption and decryption of an event. The event encrypted by the shared key information corresponds to an event with low confidentiality such as an event for notifying that the multifunction device 200 is short of printing paper.

FIG. 3 is a functional block diagram showing the main part of the multifunction device 200.
As shown in FIG. 3, the MFP 200 includes a second transmission / reception unit 201, a distribution request reception unit 202, a public key information registration unit 203, a public key information storage unit 204, a notification information holding unit 205, a notification information encryption. Unit 206, notification method determination unit 207, notification information distribution unit 208, shared key information transmission unit 209, and the like.

  The second transmission / reception unit 201 receives a distribution request or the like transmitted from the terminal device 100 and transmits an event, a multicast packet, or shared key information to the terminal device 100. In addition, image information and other various information are transmitted / received to / from the terminal device 100.

  The distribution request receiving unit 202 receives a distribution request among various information received by the second transmitting / receiving unit 201. Then, the transmission source IP address and public key information of the terminal device 100 included in the distribution request are sent to the public key information registration unit 203. Further, the communication method determination unit 207 is controlled according to the number of distribution requests received.

  The public key information registration unit 203 is an example of a registration unit according to the present invention. The public key information registration unit 203 associates the received public key information with the transmission source IP address of the terminal device 100 serving as the transmission source, and It is registered in the public key information storage unit 204 as an example.

  The notification information holding unit 205 holds the generated event until a predetermined time elapses. The predetermined time is, for example, about 1 second, but is not limited to a second unit such as a minute unit or a time unit. When a new event occurs before the predetermined time elapses, the held event and the newly generated event are held as a set and held as a multicast packet. Further, when a new event occurs before the predetermined time elapses, the newly generated event is added to the multicast packet and held. It should be noted that whether events are grouped together may be classified according to the type of event.

  The notification information encryption unit 206 is an example of the encryption unit of the present invention, extracts an event or the like held in the notification information storage unit 205, and is classified if the event distribution destination is specified. The public key information of the source IP address corresponding to the distribution destination IP address of the event is extracted from the public key information storage unit 204, and the event is determined based on the extracted public key information. Encrypt. When a multicast packet is extracted, the multicast packet is divided into event units, and encrypted for each divided event. As a result, each highly confidential event is encrypted based on the public key information of the distribution destination.

  Further, when the distribution destination of the extracted event or the divided event is not specified, it is determined that the event is a low confidentiality event, and the shared key information stored in the shared key information transmitting unit 209 is used. Encrypt the event. As described above, the level of confidentiality of an event can be determined based on whether or not an event delivery destination is specified.

  The encrypted event is sent to the notification information transmission unit 208. When the encrypted event is an event divided from the multicast packet, each encrypted event is transmitted after being converted into the multicast packet state again.

  The notification method determination unit 207 is an example of a determination unit of the present invention, and determines an event distribution method based on the control of the distribution request reception unit 206. For example, when the distribution request receiving unit 206 receives a distribution request from only one terminal device 100, the notification information transmitting unit 208 is controlled to distribute the event by unicast, and the distribution request receiving unit 206 When receiving a distribution request from a plurality of terminal devices 100 to 100m, the notification information transmitting unit 208 is controlled to distribute the event by multicast.

  The notification information distribution unit 208 is an example of a distribution unit according to the present invention, and is based on the control of the notification method determination unit 207 for a multicast packet including an encrypted event or a plurality of encrypted events. A notification method is determined and sent to the second transmission / reception unit 201.

  The shared key information transmission unit 209 is an example of the transmission unit of the present invention. The distribution request reception unit 202 receives the distribution request, and the stored shared key information is used as the IP address of the event distribution destination. It encrypts with corresponding public key information, and transmits to the terminal device 100 which sent the delivery request. As a result, the terminal device 100 decrypts the shared key information encrypted based on the private key information included in the terminal device 100 and holds the shared key information. The event encrypted with the shared key information of the multifunction device 200 can be decrypted with the shared key information held by the terminal device 100. The shared key information is generated by required software.

Next, the operation of the terminal device 100 will be described with reference to the drawings.
FIG. 4 is a flowchart illustrating an example of a distribution request process in the terminal device.
First, the terminal device 100 extracts public key information from the key information storage unit 101, and generates a distribution request including the public key information (step S1). Next, the generated distribution request is transmitted to the MFP 200 (step S2). As a result, an event distribution request is made to the multifunction device 200. After the distribution request, the shared key information transmitted from the multifunction device 200 is received (step S3). Since the shared key information is encrypted, it is decrypted based on the secret key information held by the terminal device 100. As a result, the terminal device 100 holds the shared key information, and can decrypt it when receiving an event encrypted with the shared key information.

FIG. 5 is a flowchart showing an example of the decoding process in the terminal device.
The terminal device 100 first receives a multicast packet from the image information transmitted to and received from the multifunction device 200 (step S11), and divides the multicast packet into event units (step S12). If an event is received instead of a multicast packet, steps S11 and S12 are omitted.

  Next, the terminal device 100 determines whether or not the received event or the divided event has been unprocessed (step S13). If it is determined that there is an unprocessed event, it is determined whether or not any encrypted event can be decrypted using the shared key information (step S14).

  If the terminal device 100 determines that the encrypted event can be decrypted using the shared key information, the terminal device 100 decrypts the event using the shared key information (step S17), and the process of step S13 again. Return to. On the other hand, if it is determined that the encrypted event cannot be decrypted using the shared key information, then it is determined whether the event can be decrypted using the private key information. (Step S15).

  If the terminal device 100 determines that the encrypted event can be decrypted using the private key information, the terminal device 100 decrypts the event using the private key information (step S16), and the process of step S13 again. Return to. On the other hand, if it is determined that the encrypted event cannot be decrypted using the private key information, the event is not decrypted. A mark (flag) such as a decryption process is added, and the process returns to step S13.

  As described above, the terminal device 100 can decrypt the received event or the divided event using the shared key information or the secret key information, and cannot decrypt the received event or the like. Can be determined not to be an event for itself. Thereby, the confidentiality of the event between the terminal devices 100 can be ensured.

Next, the operation of the multifunction device 200 will be described with reference to the drawings.
FIG. 6 is a flowchart showing an example of a response process of the multi-function peripheral to the distribution request, and FIG. 7 is a diagram showing an example of a public key information table.
The multifunction device 200 first receives a distribution request from the terminal device 100 (step S21). Note that the multi-function device 200 can also receive distribution requests from a plurality of terminal devices 100.

  Next, the multifunction device 200 registers the public key information included in the distribution request and the IP address of the transmission source in the public key information storage unit 204 in association with each other (step S22). More specifically, as shown in FIG. 7, for example, the MFP 200 receives the IP address “192.168.0.1” and “public key information A” of the terminal device 100 that is the transmission source from the distribution request of the terminal device 100. Are registered in association with each other. Similarly, the IP address “192.168.1.3” and “public key information B” of the terminal device 100a, and the IP address “192.168.2.4” and “public key information C” of the terminal device 100m are set. Register in association. Thereby, the multifunction device 200 holds the IP address of each terminal device 100 and the public key information in association with each other. When the multifunction device 200 receives a distribution request from the terminal device 100 having the same IP address as the IP address already registered in the public key information storage unit 204, registration related to the distribution request is performed to avoid duplication. Processing may not be performed.

  Next, the multifunction device 200 transmits the shared key information it holds to all the terminal devices 100 that have requested distribution (step S23), and ends the response processing for the distribution request from the terminal device 100.

  FIG. 8 is a flowchart showing an example of multicast packet generation processing in the multifunction device 200, FIG. 9 is a conceptual diagram showing an example of a multicast packet, and FIG. 10 is a conceptual diagram showing another example of a multicast packet.

  When an event occurs in the multifunction device 200, the multifunction device 200 first determines whether or not a multicast packet is already held (step S31). If it is determined that the multicast packet is already held, the generated event is added to the multicast packet (step S32).

  Referring to FIG. 9 as an example, the multicast packet holds “event 1” and “event 2” as shown in FIG. 9A. When a new event occurs when the multicast packet is in the state shown in FIG. 9A, “event 3” is added as a new occurrence event as shown in FIG. 9B. As described above, when a new event occurs while the MFP 200 holds the multicast packet, the event is added to the multicast packet.

  On the other hand, if it is determined that the multicast packet is not yet held, first, a multicast packet frame is generated as shown in FIG. 10 (a), and the event that occurred is shown in FIG. 10 (b). It is held in the multicast packet frame (step S33). In this way, a multicast packet is generated. Thereafter, a timer for determining an additional time limit for a newly occurring event is started (step S34), and the process is terminated. Furthermore, when a new event occurs and is within the event addition time limit, the event is added to the generated multicast packet in the process of step S32.

FIG. 11 is a flowchart illustrating an example of encryption and distribution processing in the multifunction device 200.
The multi-function device 200 first divides the generated multicast packet into event units (step S41). If no multicast packet has been generated, the process of step S41 is omitted.

  Next, the multi-function device 200 determines whether an unprocessed event is held (step S42). If it is determined that the multifunction device 200 holds an unprocessed event, it is further determined whether or not a distribution destination of the event is specified (step S43).

  Here, when the multifunction device 200 determines that the distribution destination of the unprocessed event has not been specified, the multifunction device 200 interprets the event as an event with low confidentiality between the terminal devices 100, and the multifunction device 200. Encrypts the event using its own shared key information (step S46), and returns to the process of step S42.

  On the other hand, when the MFP 200 determines that the distribution destination of the unprocessed event is specified, public key information corresponding to the distribution destination of the event is acquired from the public key information storage unit 204 ( In step S44), the public key information is used for encryption (step S45). Thereby, the event for which the distribution destination is specified is an event that can be decoded only by the terminal device 100 that is the distribution destination. The multifunction device 200 encrypts the event and then returns to the process of step S42.

  If the MFP 200 determines in the process of step S42 that no unprocessed event is held, then the MFP 200 determines whether or not the distribution destinations of all events included in the multicast packet are the same. Judgment is made (step S47). If the MFP 200 determines that all the events included in the multicast packet have the same delivery destination, the MFP 200 distributes the multicast packet by unicast (step S48). The multicast packet is distributed by multicast (step S49).

  Note that the present invention is not limited to the above-described embodiment, and various modifications can be made without departing from the scope of the invention. For example, the program of the present invention can be provided not only by communication means but also stored in a recording medium such as a CD-ROM. In the above-described embodiment, the description has been made using the multifunction peripheral. However, the apparatus is not limited to the multifunction peripheral as long as the apparatus has a function of distributing the notification information.

  As described above, according to the present invention, since the event to be distributed is encrypted by the public key information of the distribution destination, the confidentiality of the event can be ensured and the industrial applicability is high.

It is a block diagram of an information delivery system. It is a functional block diagram which shows the principal part structure of a terminal device. FIG. 2 is a functional block diagram illustrating a main configuration of a multifunction machine. It is a flowchart which shows an example of the delivery request process in a terminal device. It is a flowchart which shows an example of the decoding process in a terminal device. 6 is a flowchart illustrating an example of response processing of a multifunction peripheral in response to a distribution request. It is a figure which shows an example of a public key information table. 6 is a flowchart illustrating an example of multicast packet generation processing in the multifunction machine. It is a conceptual diagram which shows an example of a multicast packet. It is a conceptual diagram which shows another example of a multicast packet. 5 is a flowchart illustrating an example of encryption and distribution processing in a multifunction peripheral.

Explanation of symbols

100 to 100 m Terminal device 101 Key information storage unit 102 Distribution request transmission unit 103 First transmission / reception unit 104 Notification information reception unit 105 Notification information decryption unit 106 Shared key information reception unit 200 Multifunction machine 201 Second transmission / reception unit 202 Distribution Request reception unit 203 Public key information registration unit 204 Public key information storage unit 205 Notification information holding unit 206 Notification information encryption unit 207 Notification method determination unit 208 Notification information distribution unit 209 Shared key information transmission unit 300 Network

Claims (8)

An information distribution system in which a plurality of client devices that transmit notification information distribution requests and a server device that distributes the notification information to the client devices in response to the distribution requests are connected via a communication network. There,
The server device
Registration means for associating the transmission source information included in the distribution request from a plurality of the client devices with the encryption information for encrypting the notification information in the storage means;
Encryption means for encrypting each of the notification information based on the encryption information of the transmission source information corresponding to the distribution destination information of the notification information;
A distribution unit configured to generate a notification information group by combining a plurality of encrypted notification information, and to distribute the notification information group to the client device;
The client device is
Comprising decryption information for decrypting the notification information encrypted by the encryption information,
An information distribution system comprising decryption means for decrypting the encrypted notification information included in the notification information group based on the decryption information. The server apparatus further includes a transmission unit that includes shared information that shares encryption and decryption of the notification information, and that encrypts the shared information based on the received encrypted information and transmits the encrypted information to the client apparatus. Prepared,
The encryption means encrypts the notification information based on the shared information when the notification information is notification information distributed in common to all of the client devices,
The decoding means includes
The information distribution system according to claim 1, wherein the notification information is decoded based on the received shared information.   The information distribution system according to claim 1, wherein the distribution unit generates the notification information group every predetermined time. The server device
4. The information distribution system according to claim 1, further comprising: a determination unit configured to determine either unicast distribution or multicast distribution based on the number of distribution requests. 5. .   5. The information distribution system according to claim 1, wherein the distribution unit determines whether to generate the notification information group according to a type of the notification information. . Registration means for associating the transmission source information included in the notification information delivery request from the plurality of client devices with the encryption information for encrypting the notification information in the storage means;
Encryption means for encrypting each based on the encrypted information of the source information corresponding to the delivery destination information of the notification information;
A server apparatus comprising: a distribution unit configured to generate a notification information group by combining a plurality of the encrypted notification information, and to distribute the notification information group to the client apparatus. A step of associating the transmission source information included in the notification information distribution request from the plurality of client devices with the encryption information for encrypting the notification information, and registering them in the storage unit;
Respectively encrypting based on the encrypted information of the source information corresponding to the delivery destination information of the notification information;
An information distribution program for causing a computer to execute a step of generating a notification information group by combining a plurality of encrypted notification information and distributing the notification information group to the client device .   An image processing apparatus comprising the server apparatus according to claim 6.

Images