JP2012150745A - Authentication printing system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make it possible to normally operate an authentication printing system even when a client PC has a firewall.SOLUTION: In an authentication printing system through a network, a print client transmitting a print job to a printer comprises; a means to transmit a printing start notice including prescribed information through broadcast communication at the start of printing; a means to receive information about the printer which performs printing, from a prescribed terminal through unicast communication; and a means to transmit the print job to the printer based on the information about the printer.

Description

  The present invention relates to an authentication printing system via a network and a program thereof.

  With the recent improvement in security awareness, authentication functions are being used in network printing systems. In a conventional network printing system, when a print instruction is issued from a client PC, a print job is immediately sent from the client PC to the printer. Therefore, before the user who has instructed printing sends a print job to the printer, There were cases where output started, and there was a problem of mistaking printed materials by others or taking away printed materials by malicious means.

  In the authentication printing system, a user goes to a printer and authenticates himself / herself with an authentication device installed in the vicinity of the printer or in the printer itself (for example, holding an IC card over an IC card reader), and the user is authenticated ( The printout is output for the first time when authentication is successful). By using such an authentication printing system, it has become possible to improve the security problem of the conventional network printing system. Non-Patent Document 1 is an example.

Silex Technology Co., Ltd. Home Page <URL: http://www.silex.jp/products/secureprint/selecureprint.html>

  Hereinafter, the authentication printing system disclosed in Non-Patent Document 1 will be outlined. When referring to the authentication printing system, the authentication printing system disclosed in Non-Patent Document 1 is shown.

  FIG. 1 is an overall view of the authentication printing system. The client PC 101, the authentication BOX 102, and the printer 104 are connected to the network. A card reader 103 is connected to the authentication BOX 102 via a peripheral device I / F. The authentication BOX 102 is installed for each printer 104. In FIG. 1, since there is only one printer, there is only one authentication BOX. However, when there are a plurality of printers, the number of authentication BOXes corresponding to this is also installed. As will be described later, the authentication BOX 102 holds the printer model name and IP address of the printer 104. Since these pieces of information are specific information of the printer to which the authentication BOX corresponds, the information is different for each printer.

  FIG. 7 is a sequence diagram when printing is performed in the conventional authentication printing system. In step 701, the client PC 101 starts printing from the application. Thereafter, in step 702, the authentication wait state is entered. At this time, the print job is not sent to the printer 104 but is stored in the client PC 101.

  Next, the user who has instructed printing goes to the authentication BOX 102 installed near the printer, and holds his IC card over the card reader 103 connected to the authentication BOX 102. The authentication BOX 102 reads the card ID of the IC card via the card reader 103 (step 703) and sends it out by broadcast communication (step 704). At this time, in addition to the card ID, the printer model name and printer IP address provided in advance in the authentication BOX 102 are also transmitted. Since these pieces of information are transmitted by broadcast communication, the communication reaches all network terminals belonging to the same subnet as the authentication BOX 102.

  In step 705, the client PC 101 receives these pieces of information sent from the authentication BOX 102, and performs authentication by collating the card ID provided in advance with the received card ID. If the identity of the card ID is recognized as a result of the authentication (when the authentication is successful), this is notified to the authentication BOX 102 (step 706), and the stored print job is sent to the printer 104. (Step 707). In step 708, the printer 104 prints the received print job. Printing in the authentication printing system is performed in such a flow.

  By the way, many of the recent network terminals have a function of monitoring communication sent from the network by means of a firewall and blocking it in some cases. With such a firewall, it is possible to block communications that may cause harm to network terminals.

  Many of the communications that are blocked by firewalls are actually dangerous, to some extent, but some communications have legitimate purposes. A typical example of such communication is called broadcast communication. In general, broadcast communication itself is not dangerous communication. However, because there are dangerous aspects such as being able to bring down the network terminal depending on the usage, many firewalls are set to block broadcast communication.

  As already described, the authentication printing system uses broadcast communication to notify the client PC 101 of the card ID, printer model name, and printer IP address (step 704 in FIG. 7). However, this communication may be blocked by the firewall provided in the client PC 101, which may hinder the normal operation of the authentication printing system.

  The present invention improves such problems of the authentication printing system. That is, even if the client PC is equipped with a firewall, it is possible to operate the authentication printing system normally.

  A first form according to the present invention is a print client that transmits a print job to a printer in an authentication printing system via a network, and print start notification including predetermined information at the start of printing by broadcast communication. A print client comprising: means for transmitting; means for receiving information about a printer that performs printing from a predetermined terminal by unicast communication; and means for transmitting a print job to the printer based on the information about the printer.

  The predetermined information is typically information indicating the start of printing, but this includes at least the IP address information of the print client. Other information may be any information as long as it can recognize the start of printing.

  More preferably, the information about the printer includes at least one of a printer IP address and a printer model name.

  According to a second aspect of the present invention, in an authenticated printing system via a network, a print client that transmits a print job to a printer transmits a print start notification including predetermined information by broadcast communication at the start of printing. A program that functions as means, means for receiving information about a printer that performs printing from a predetermined terminal by unicast communication, and means for transmitting a print job to the printer based on the information about the printer.

  The predetermined information is typically information indicating the start of printing, but this includes at least the IP address information of the print client. Other information may be any information as long as it can recognize the start of printing.

  More preferably, the information about the printer includes at least one of a printer IP address and a printer model name.

A third form according to the present invention is a print client that transmits a print job to a printer in an authentication printing system via a network, and broadcasts the first identification information at a predetermined location at the start of printing. Transmitting means, means for receiving second identification information from a predetermined terminal by unicast communication, means for verifying the first identification information and the received second identification information, As a result, a print client comprising means for transmitting a print job when the identification information is identical.

  According to a fourth aspect of the present invention, in an authentication printing system via a network, a print client that transmits a print job to a printer is notified by broadcast communication of first identification information at a predetermined location at the start of printing. Means for transmitting, means for receiving second identification information from a predetermined terminal by unicast communication, means for collating the first identification information with the received second identification information, the result of collation, identification A program that functions as a means to send a print job when the identity of information is recognized.

  According to a fifth aspect of the present invention, there is provided an authentication information transmitting apparatus for notifying a print client of authentication information in an authentication printing system via a network, comprising: means for reading the authentication information; and broadcast communication transmitted by the print client. An authentication information transmitting apparatus comprising: means for receiving; means for specifying a transmission source of received broadcast communication; and means for transmitting the read authentication information to the transmission source by unicast communication.

  A sixth embodiment according to the present invention is an authentication apparatus for notifying a print client of an authentication result in an authentication printing system via a network, the first authentication information reading means, the first authentication information, Means for collating the second authentication information at a predetermined location; means for receiving broadcast communication transmitted by the print client; means for identifying the transmission source of broadcast communication; An authentication apparatus comprising: means for transmitting by unicast communication.

  In the present invention, when printing is started on the client PC, the card ID is notified by broadcast communication from the client PC. Since the notification is broadcast communication, all authentication BOXes can recognize the card ID and the IP address of the client PC that is the transmission source of the card ID. In this way, unicast communication, not broadcast communication, can be used for notification of information such as a card ID from the authentication BOX to the client PC. As a result, the authentication printing system can be operated even in a network environment where a client PC having a firewall set to block broadcast communication exists, and the authentication printing system is adapted to more network environments. be able to.

Embodiments according to the present invention will be described below with reference to the drawings.
[Example 1]
[System overview]
The overall system diagram is the same as that of Non-Patent Document 1, that is, as shown in FIG.
[Function block diagram]

  FIG. 2 is a functional block diagram of the client PC 101. The application 201 instructs printing, and is specifically word processing software or spreadsheet software. The card ID 202 is an identifier for identifying a print instructor (user), and is stored in advance in a hard disk (not shown) of the client PC 101 or the like.

  The print start notifying unit 203 is a unit that notifies the authentication BOX 102 that the client PC 101 has started printing via the network I / F 208. Specifically, the start of printing is notified by notifying the card ID 202. Since this notification is performed by broadcast communication, even if there are a plurality of authentication boxes 102 on the network, all the authentication boxes 102 can recognize the user who has started printing. Although the client PC 101 is provided with a firewall, the notification of the start of printing is not normally blocked. The reason for this is that the communication to be blocked by the firewall is usually inbound communication, that is, communication that enters the client PC 101, and communication that is transmitted outward from the client PC 101 (outbound communication). This is because there are relatively few cases.

  The spool area 204 is a storage area for accumulating print data output from the application 201 as a print job, and is specifically an HDD (not shown) of the client PC 101.

  The authentication unit 206 performs authentication by comparing the card ID with the card ID 202 held by the client PC 101 among the card ID, printer model name, and printer IP address received from the authentication BOX 102 via the network I / F 208. If successful, the authentication result notification means 207 is notified of this fact. At the same time, the printer model name and printer IP address are notified to the print job transmission unit 205. Note that the communication sent from the authentication BOX 102 is performed by unicast communication, and is not normally blocked by the firewall of the client PC 101.

  The authentication result notifying unit 207 notifies the authentication result of the card ID notified from the authenticating unit 206 to the authentication BOX 102 and also notifies the print job transmitting unit 205.

  The print job transmission unit 205 converts the print job stored in the spool area 204 based on the notification from the authentication result notification unit 207 into a data format suitable for the printer based on the printer model name notified from the authentication unit 206. After conversion, a print job is sent to the notified printer IP address. Actually, it is transmitted when the result of the authentication is successful (identity of the card ID is recognized).

[Function block diagram of authentication BOX]
FIG. 3 is a functional block diagram of the authentication BOX 102. A network I / F 301 is an interface for connecting to the network, and a peripheral device I / F 305 is an interface for connecting to the card reader 103.

  The print start notification receiving unit 302 is a unit that receives a print start notification from the client PC 101. Specifically, the card ID is received. The registration unit 303 stores the received card ID and the IP address of the transmission source client PC 101 in the storage area 304 in association with each other.

  The card ID reading means 306 is means for reading the card ID of the IC card held over the card reader 103. The client PC specifying unit 307 searches the storage area 304 using the read card ID as a key, and specifies the IP address of the client PC 101 corresponding to the corresponding card ID. The card ID transmission unit 308 transmits a card ID toward the identified client PC 101. The transmission is performed by unicast communication because the client PC 101 has already been specified.

  The authentication result notification receiving unit 309 is a unit that receives an authentication result from the client PC 101. The deletion unit 310 searches the storage area 304 using the transmission source IP address of the received authentication result notification as a key, and deletes the IP address of the corresponding client PC and the corresponding card ID from the storage area 304.

[Operation flow]
FIG. 4 is a diagram showing the operation flows of the print start notifying unit 203, the authenticating unit 206, the authentication result notifying unit 207, and the print job transmitting unit 205 and their relations. As is apparent from the figure, the print start notification unit 203 and the other three units operate independently. The authentication unit 206, the authentication result notification unit 207, and the print job transmission unit 205 operate by exchanging data with each other.

[Operation flow of print start notification means]
In step 401, it is determined whether or not the start of printing has been detected. Specifically, the determination is made based on whether the print job is spooled in the spool area 204. If the start of printing is detected, in step 402, the authentication BOX 102 is notified accordingly.

[Operation Flow of Authentication Unit 206]
In step 411, it is determined whether the card ID, printer model name, and printer IP address are received from the authentication BOX 102. If it has been received, the authentication means 206 performs verification of the card ID at step 412 and determines the result at step 413. As a result of authentication, if the identity of the card ID is recognized, the process proceeds to step 414, otherwise returns to step 411. In step 414, the printer model name and printer IP address are notified to the print job transmission unit 205. In step 415, the authentication result is notified to the authentication result notifying means 207.

[Operation Flow of Authentication Result Notification Unit 207]
In step 421, it is determined whether an authentication result is received from the authentication unit 206. If received, the process proceeds to step 422. In step 422, the authentication BOX 102 is notified of the authentication result. In step 423, the print job transmission unit 205 is instructed to transmit a print job.

[Operation Flow of Print Job Transmission Unit 205]
In step 431, it is determined whether or not a print instruction has been received from the authentication result notifying unit 207. In step 432, the print job in the spool area 204 is converted into a data format suitable for the printer based on the printer model name notified from the authentication unit 206, and the print job converted in the same manner toward the IP address of the received printer. Send.

[Sequence Diagram]
FIG. 5 is a diagram showing a sequence from when printing is performed by the client PC 101 to when printing is started by the printer 104.

  In step 501, the client PC 101 starts printing. Accordingly, the client PC 101 transmits a print start notification by broadcast communication (step 502). This notification includes the card ID.

  In step 503, the authentication BOX 102 registers the received card ID and the IP address of the client PC 101 that is the transmission source. In step 504, the card ID of the IC card held over the card reader 103 is read. The card ID read in step 505 and the card ID registered in step 503 are collated, and the corresponding client PC 101 is specified. Thereafter, the card ID, printer model name, and printer IP address are notified to the identified client PC 101 by unicast communication (step 506).

  In step 507, the client PC 101 authenticates the received card ID and its own card ID, notifies the result to the authentication BOX 102 (step 508), and print IP address notified from the authentication BOX 102 of the print job. (Step 510).

  In step 509, the authentication BOX 102 refers to the IP address of the registered client PC using the IP address of the client PC that is the transmission source in step 508 as a key, and obtains the card ID corresponding to the IP address of the corresponding client PC. delete. In step 511, the printer 104 prints the received print job.

  Since step 501 is transmitted by broadcast communication, the card ID transmitted from the client PC and the corresponding IP address are also stored in a storage area other than the predetermined authentication BOX. Since these pieces of information are kept unless they are intentionally deleted, they may be deleted after a certain time, or the data may be deleted when the notification in step 508 is received as a broadcast.

[Example 2]
In the first embodiment, the print start notification shown in step 502 of FIG. 5 is performed only once at the start of printing. If the authentication BOX 102 cannot receive the notification for some reason, the authentication BOX 102 cannot identify the client PC to which the read card ID is to be transmitted, and the authentication printing system does not function normally.

  In order to improve such a problem, in this embodiment, as shown in FIG. 6, step 601 of the print start notification unit 203 and step 631 of the print job transmission unit 205 are provided. Specifically, the print start notification unit 203 repeats the print start notification to the authentication BOX 102 until the print job is transmitted. As a result, even if the print start notification is lost for some reason, the notification will eventually reach the authentication BOX 102.

  Further, as shown in step 631 of the print job transmission unit 205, after the print job is transmitted to the printer 104, the print start notification unit 203 notifies the print start notification unit 203 of this fact, so that the print start notification unit 203 The start notification loop can be removed.

[Other Examples]
In the embodiments so far, the authentication process is performed by the client PC 101. However, this authentication process can also be performed on the authentication BOX 102 side. In this case, since the actual authentication has already been completed at the time of step 505 in FIG. 5, the information to be sent at step 506 may be only the printer model name and the printer IP address.

  Further, as an application example, when the authentication BOX 102 itself has a table for associating the IP address of the client PC with the card ID, it is not necessary for the client to transmit the card ID information also in step 502 of FIG. In this case, the client PC only needs to transmit its own IP address information (usually included in the header), and there is no need to transmit / receive the card ID on the network.

In the above embodiments, the same client PC performs the creation of a print job by an application and the subsequent exchange with the authentication BOX. However, after the client PC creates a print job, it sends it to the intermediate server. The subsequent exchange with the authentication BOX can be performed by the intermediate server. This form has an advantage that the client PC can be released from the printing process at an early stage.
[Summary]

In the present invention, when printing is started on the client PC, the card ID is notified by broadcast communication from the client PC. Since the notification is broadcast communication, all authentication BOXes can recognize the card ID and the IP address of the client PC that is the transmission source of the card ID. In this way, unicast communication, not broadcast communication, can be used for notification of information such as a card ID from the authentication BOX to the client PC. As a result, the authentication printing system can be operated even in a network environment where a client PC having a firewall set to block broadcast communication exists, and the authentication printing system is adapted to more network environments. be able to.

Overall view of authentication system Functional block diagram of client PC Functional block diagram of authentication BOX Operation flow of each means and related diagram (1) Sequence diagram during printing Operation flow of each means and related diagram (2) Conventional technology

203 Print start notification means 205 Print job transmission means 207 Authentication result notification means 302 Print start notification reception means 306 Card ID reading means 307 Client PC identification means 308 Card ID transmission means 309 Authentication result notification reception means

Claims (8)

A print client that sends a print job to a printer in an authenticated printing system via a network,
Means for transmitting a print start notification including predetermined information at the start of printing by broadcast communication;
Means for receiving information about a printer that performs printing from a predetermined terminal by unicast communication;
Means for sending a print job to the printer based on information about the printer;
With print client.   The print client according to claim 1, wherein the information about the printer includes at least one of an IP address of a printer and a model name of the printer. In an authenticated printing system via a network, a print client that sends a print job to a printer
Means for transmitting a print start notification including predetermined information at the start of printing by broadcast communication;
Means for receiving information about a printer that performs printing from a predetermined terminal by unicast communication;
Means for sending a print job to the printer based on information about the printer;
Program to function as.   The program according to claim 3, wherein the information about the printer includes at least one of an IP address of a printer and a model name of the printer. A print client that sends a print job to a printer in an authenticated printing system via a network,
Means for transmitting, by broadcast communication, first identification information at a predetermined location at the start of printing;
Means for receiving second identification information from a predetermined terminal by unicast communication;
Means for collating the first identification information with the received second identification information;
If the identification information is identical as a result of the verification, a means for sending a print job,
With print client. In an authenticated printing system via a network, a print client that sends a print job to a printer
Means for transmitting, by broadcast communication, first identification information at a predetermined location at the start of printing;
Means for receiving second identification information from a predetermined terminal by unicast communication;
Means for collating the first identification information with the received second identification information;
If the identification information is identical as a result of the verification, a means for sending a print job,
Program to make it function. An authentication information transmitting apparatus for notifying a print client of authentication information in an authentication printing system via a network,
Means for reading the authentication information;
Means for receiving broadcast communications sent by the print client;
Means for identifying a source of the received broadcast communication;
Means for transmitting the read authentication information to the transmission source by unicast communication;
An authentication information transmitting device comprising: An authentication device for notifying a print client of an authentication result in an authentication printing system via a network,
Means for reading the first authentication information;
Means for collating the first authentication information with the second authentication information at a predetermined location;
Means for receiving broadcast communications sent by the print client;
Means for identifying a source of the broadcast communication;
Means for transmitting the collated result to the identified transmission source by unicast communication;
An authentication device comprising: