JP2013008173A - Image processing system, and access control method and program thereof - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform simple security policy setting when a new image forming apparatus is connected on a network.SOLUTION: An access control method in an image processing system in which a plurality of image forming apparatuses 101 and a policy server 102 for performing the security policy management of the image forming apparatus 101 are connected via a network 201 includes the steps of: periodically searching for the image forming apparatus 101 connected to the network 201; determining whether the image forming apparatus 101 searched in the above mentioned step is a type of an image forming apparatus 101 already registered in the policy server 102 or another type of an image forming apparatus 101; and notifying the image forming apparatus 101 searched in the above mentioned step of security policy information set in the policy server 102.

Description

  The present invention relates to an image processing system, an access control method thereof, and a program.

  Due to the increase in management items in recent image forming apparatus management and the increase in the number of image forming apparatuses to be managed, there is a demand for reduction in management cost (TCO) of the person in charge of image forming apparatus management. At the same time, when an image forming apparatus having a new function is added to the network, there is a demand for reducing the number of management work steps by easily setting a security policy.

  Conventionally, when a new function is added to the image forming apparatus, when controlling permission / prohibition of the function, a screen for prompting authentication for the new function is displayed on the image forming apparatus, and a user ID and a password are input. In other words, a method such as determination based on success or failure of the input content is used (see Patent Document 1).

JP 2006-172398 A

  However, the management method in the conventional image forming apparatus management system has the following problems.

  First, when a new function is selected for the image forming apparatus, it is necessary to perform an authentication process by displaying a new authentication screen on the display screen on the image forming apparatus. However, the conventional technology cannot be used in an environment where individual user management is not performed.

  Therefore, an object of the present invention is to provide a simple access control method for a case where an image forming apparatus having a new addition function is added to a network without performing authentication processing for each user.

An access control method in an image processing system in which a plurality of image forming apparatuses and a policy server that performs security policy management of the image forming apparatus are connected via a network,
Periodically searching for the image forming apparatus connected to the network;
Determining whether the image forming apparatus searched in the step is an image forming apparatus of a type already registered in the policy server or another type;
And notifying the image forming apparatus searched in the step of security policy information set in a policy server.

  According to the present invention, it is possible to perform access control for each model for a plurality of image forming apparatuses newly installed on a network without performing authentication processing for each user. Management costs for managers are reduced.

It is a figure which shows the operation | movement outline | summary of the image processing system in one Embodiment which concerns on this invention. It is a figure which shows the main hardware modules of each apparatus in this embodiment. It is a figure which shows the software module structure of the server in this embodiment. It is a figure which shows the structure of the access right control management program in this embodiment. FIG. 3 is a diagram illustrating a list showing security levels, functions, and usage restrictions set in the image forming apparatus. FIG. 3 is a diagram illustrating a list showing security levels, functions, and usage restrictions set in the image forming apparatus. It is a flowchart which shows the processing content of the access right control management program in this embodiment. It is a flowchart which shows the processing content of the access right control management program in this embodiment. It is a flowchart which shows the processing content of the access right control management program in this embodiment. It is a figure which shows the example of the management information utilized for the access right control management program in this embodiment. 6 is a diagram illustrating an example of list information of an image forming apparatus used for an access right control management program in the present embodiment. FIG. FIG. 4 is a diagram illustrating an example of model information, function, and function restriction list information of an image forming apparatus managed by an access right control management program in the present embodiment. FIG. 4 is a diagram illustrating an example of model information, function, and function restriction list information of an image forming apparatus managed by an access right control management program in the present embodiment. FIG. 4 is a diagram illustrating an example of model information, function, and function restriction list information of an image forming apparatus managed by an access right control management program in the present embodiment.

  The best mode for carrying out the present invention will be described below with reference to the drawings.

<First Embodiment>
FIG. 1 is a diagram showing a configuration and an outline of operation of an image processing system in which the present embodiment operates. In FIG. 1, reference numeral 101 denotes an image forming apparatus that executes copying, printing, faxing, and the like. The user selects a function such as copying or faxing on the image forming apparatus 101, and executes a printing process by copying or a fax transmission process. A security policy management server 102 manages function restrictions of the image forming apparatus 101. In this embodiment, how the security policy management server 102 performs function restriction on the image forming apparatus 101 when a new image forming apparatus 101 is connected to the network 201 will be described.

  FIG. 2 is a diagram showing main hardware modules of each device in the present embodiment shown in FIG. 1, and the function of the hardware module in each device will be described below with reference to FIG.

  In the figure, reference numeral 201 denotes a network line. The network line 201 is a physical line that constitutes a network between devices, and usually a twisted pair cable, a coaxial cable, an optical fiber, or the like is used.

  The security policy management server 102 in the image processing system shown in FIG. 1 is realized as the server shown in FIG. As hardware modules constituting the server 102, there are a network board 202, a CPU board 203, a video interface 204, an I / O interface 205, and a disk interface 206. The CPU board 203 includes a CPU 2031, a ROM 2032, and a RAM 2033. Further, there are a CRT 207, a keyboard 208, a mouse 209, and a hard disk drive (HD) 210 connected to each module. In the HD 210, a plurality of hard disk units are connected in parallel to ensure high-speed data transfer and high reliability. In these hard disk units, a database may be constructed according to the nature of software operating on the server 102.

Further, as hardware modules constituting the image forming apparatus 101, there are a network board 211 corresponding to peripheral devices, a controller board 212 of a composite function copying machine, and a print engine 220 as recording means (printing means). Furthermore, an operation panel controller 216, an operation panel 217, a scanner controller 215, a scanner unit 214, a modem 213, a hard disk controller 218, and an HD 219 are provided. Note that the system according to the present embodiment can include a plurality of image forming apparatuses 101 in addition to the image forming apparatus 101.

  FIG. 3 is a diagram illustrating a software module configuration in the server 102. In this figure, 301 is an operating system (OS), 302 is a library, 303 is an application, and includes an access right control management program 304 as a part of the application 303. A hardware control program 305 includes a network control program 306 and a hard disk (HD) control program 307 as part of the hardware control program.

  FIG. 4 is a diagram showing the configuration of the access right control management program 304. The access right control management program 304 is realized as one of the applications 303 on the server 102. In the figure, a management program 401 is the main part of the access right control management program 304, and controls the entire program. The communication program 402 performs communication between the image forming apparatus 101 and the server 102 using the network control program 405, and the distribution of the security level to the image forming apparatus 101 and the setting of the security level from the image forming apparatus 101 are completed. Receive notifications.

  FIG. 5A and FIG. 5B are diagrams illustrating an example of a list indicating a security level set in the image forming apparatus 101 and a function usage restriction corresponding to the security level. The list information shown in this figure is stored in the HD 219 of the image forming apparatus 101 at the time of product shipment. Further, when the image forming apparatus 101 is activated or when a function restriction setting request is issued from the server 102, it is read from the HD 219 via the HD controller 218 from the controller board 212 and used to restrict the functions of the image forming apparatus 101. It is what is done.

  Indicates a combination of usage restrictions (○ indicates that it can be used and × indicates that it cannot be used) for each function of the image forming apparatus 101 according to the security level (“strong”, “medium”, “weak”) ing. 5A and 5B show that the functions of the image forming apparatus 101 are different.

  Hereinafter, the access right control processing by the access right control management program 304 in this embodiment will be described with reference to the flowchart of FIG. Note that the access right control management program 304 according to this flow is stored in the HD 210 of the server 102, read out to the RAM 2033, and executed by the CPU 2031.

  First, in step S601, management information including security levels (in this embodiment, three types of “strong”, “medium”, and “weak” in the present embodiment) currently stored in the HD 210 of the server 102 is read into the RAM 2033. . An example of management information used for the access right control management program 304 is shown in FIG. In this example, the security level is set to “medium”.

  In step S <b> 602, the server 102 reads the list information of the image forming apparatus 101 managed by the HD 210 into the RAM 2033. An example of the list information of the image forming apparatus 101 used for the access right control management program 304 is shown in FIG. In this example, three types of eight image forming apparatuses 101 (MFPs) are managed, and information on MAC addresses for uniquely identifying the image forming apparatuses 101 is also managed. .

  In step S603, the image forming apparatus 101 on the network 201 is searched. As a search method, a Get-request packet for acquiring management data such as the type name of the image forming apparatus 101 is transmitted by broadcast or multicast to the network 201 to which the server 102 is connected. For example, a method of creating a list of image forming apparatuses 101 that have returned correct management data with a Get-response packet is considered.

  In step S604, the list information read in step S602 is compared with the information searched in step S603, and it is determined whether a new image forming apparatus 101 has been added to the network 201.

  If it is determined in step S604 that the image forming apparatus 101 has been added, it is determined in step S605 whether the added image forming apparatus 101 is a new model or the same model already managed by the server 102.

  If it is determined in step S605 that the model is a new model, a security level (“medium” in this embodiment) is transmitted to the image forming apparatus 101 in step S607. The reason for transmitting only the security level is that at this point, the server 102 cannot know what function the newly searched image forming apparatus 101 has.

  If it is determined in step S605 that the model is an existing model, in step S606, information on the security level, function, and usage restriction as shown in FIG. 5A is transmitted to the image forming apparatus 101. .

  In step S608, it is determined whether a notification that information such as a security level has been correctly set is received from the image forming apparatus 101 that has transmitted in step S606 or step S607. If received, in step S609, the server 102 updates the list information and security level, function, and usage restriction information of the image forming apparatus 101 managed by the HD 210.

  If it is determined in step S604 that it has not been added, it is determined in step S610 whether the search processing of the image forming apparatus 101 is to be continued or to be ended. When continuing, it returns to the process of step S601, and when complete | finishing a search, the process of the access right control management program 304 is complete | finished.

  Next, the processing on the image forming apparatus 101 side when the security level, the function, and the usage restriction information are transmitted to the image forming apparatus 101 in step S606 of the flowchart of FIG. 6 will be described using the flowchart of FIG. To do.

  Note that an access right setting program (not shown) according to this flow is stored in the HD 219 of the image forming apparatus 101, stored in the HD 210 of the server 102, and read out to a RAM (not shown) on the controller board 212. And executed by a CPU (not shown).

  First, in step S701, it is determined whether a notification from the server 102 has been received. If received, in step S702, the function of the image forming apparatus 101 is restricted based on the security level, function, and usage restriction information notified from the server 102. In step S703, the server 102 is notified that the setting of the function restriction of the image forming apparatus 101 has been completed, and the process ends.

  Next, the processing on the image forming apparatus 101 side when only the security level is transmitted to the image forming apparatus 101 in step S606 of the flowchart of FIG. 6 will be described using the flowchart of FIG.

  Note that an access right setting program (not shown) according to this flow is stored in the HD 219 of the image forming apparatus 101, stored in the HD 210 of the server 102, and read out to a RAM (not shown) on the controller board 212. And executed by a CPU (not shown).

  First, in step S801, it is determined whether a notification from the server 102 has been received. If received, in step S802, the security level notified from the server 102 is referred to, and the function restriction corresponding to the security level preset in the image forming apparatus 101 is validated. In step S 803, detailed information on the function restriction (security level, function, function restriction) enabled in step S 802 is transmitted to the server 102. In step S804, the server 102 is notified that the setting of the function restriction of the image forming apparatus 101 has been completed, and the process ends.

  11A, 11B, and 11C show examples of model information, function, and usage restriction list information of the image forming apparatus 101 managed by the access right control management program 304 in the server 102. FIG. FIG. Note that the list information shown in this figure is stored in the HD 210 of the server 102. Further, it is read out to the RAM 2033 by the access right control management program 304, rewritten by the CPU 2031 as necessary, and then stored in the HD 210.

  FIG. 11A shows what usage restrictions are imposed on the functions of the three types of models.

  In FIG. 11B, the function and use restrictions are set with the image forming apparatus 101 newly added on the network as the “model D” in FIG. 11B by the access right control processing shown in the flowchart of FIG. Indicates that it has been set.

  However, when the image forming apparatus 101 newly connected to the network 201 is of a different model, the server 102 cannot know what function the image forming apparatus 101 has. Therefore, the server 102 notifies the image forming apparatus 101 only of the security level shown in FIG. 9 (in this embodiment, “medium”). In this case, the image forming apparatus 101 refers to the security level sent from the server 102 and a list showing the function usage restrictions corresponding to the security level and the security level shown in FIG. Make restrictions. As an example, if FIG. 5B is the list information that the newly added image forming apparatus 101 has, the security level is “medium”, so the fax and remote fax functions cannot be used. It also indicates that the copy, print, and remote copy functions are set to be usable.

  Furthermore, the list information held by the server 102 is updated by the process of transmitting detailed information on the function restriction (security level, function, function restriction) information to the server 102 shown in step S803 of the flowchart of FIG. FIG. 11C shows a state in which the list information of the server 102 is updated (functions and usage restrictions of “model D” are recorded).

101 image forming apparatus 102 security policy management server 201 network

Claims (7)

An access control method in an image processing system in which a plurality of image forming apparatuses (101) and a policy server (102) that performs security policy management of the image forming apparatus (101) are connected via a network (201),
Periodically searching for the image forming apparatus (101) connected to the network (201) (S603);
It is determined whether the image forming apparatus (101) searched in step (S603) is a type of image forming apparatus (101) already registered in the policy server (102) or another type. Step (S605);
An access control method comprising a step (S606, S607) of notifying the security policy information set in the policy server (102) to the image forming apparatus (101) searched in the step. It is determined whether the image forming apparatus (101) searched in step (S603) is a type of image forming apparatus (101) already registered in the policy server (102) or another type. When it is determined in step (S605) that the type is already registered, the method includes a step (S606) of transmitting security level information and use restriction information corresponding to the security level to the image forming apparatus. The access control method according to claim 1, wherein: It is determined whether the image forming apparatus (101) searched in step (S603) is a type of image forming apparatus (101) already registered in the policy server (102) or another type. The access control method according to claim 1, further comprising a step (S607) of transmitting only security level information when it is determined in step (S605) that it is of another type. An image processing system in which a plurality of image forming apparatuses (101) and a policy server (102) that performs security policy management of the image forming apparatus (101) are connected via a network (201),
Search means (S603) for periodically searching the image forming apparatus (101) connected to the network (201);
It is determined whether the image forming apparatus (101) searched by the searching means (S603) is the type of image forming apparatus (101) already registered in the policy server (102) or another type. Determination means to perform (S605);
It has means (S606, S607) for notifying the security policy information set in the policy server (102) to the image forming apparatus (101) searched by the search means (S603). Image processing system. It is determined whether the image forming apparatus (101) searched by the searching means (S603) is the type of image forming apparatus (101) already registered in the policy server (102) or another type. When the determination unit (S605) determines that the type is already registered, the transmission unit (101) transmits security level information and use restriction information corresponding to the security level to the image forming apparatus (101). 5. The image processing system according to claim 4, further comprising S606). It is determined whether the image forming apparatus (101) searched by the searching means (S603) is the type of image forming apparatus (101) already registered in the policy server (102) or another type. 5. The image processing system according to claim 4, further comprising: a transmission unit (S607) that transmits only the security level information when the determination unit (605) determines that the type is another type. A program that performs access control in an image processing system in which a plurality of image forming apparatuses (101) and a policy server (102) that performs security policy management of the image forming apparatus (101) are connected via a network (201). And
Periodically searching for the image forming apparatus (101) connected to the network (201) (S603);
It is determined whether the image forming apparatus (101) searched in step (S603) is a type of image forming apparatus (101) already registered in the policy server (102) or another type. Step (S605);
Causing the computer to execute steps (S606, S607) of notifying the security policy information set in the policy server (102) to the image forming apparatus (101) searched in the step (S603). Program.

Images