JP2017097619A - Information processing device, data erasure method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information processing device capable of reducing the possibility of causing omission of erasure of data stored in a secondary storage device while preventing unprocessed data from being forcedly erased from the second storage device when data stored in a storage device is erased.SOLUTION: The information processing device provided with a storage part includes erasure means for erasing data stored in the storage part according to an instruction from a user, specification means for specifying prescribed data in data to be erased on the basis of the instruction, determination means for determining whether data specified as the prescribed data by the specification means is processed, and control means for causing the erasure means to erase the data to be erased on the basis of the instruction after transmitting data determined to have not been processed by the determination means to a user corresponding to the data.SELECTED DRAWING: Figure 4

Description

  The present invention relates to an information processing apparatus, a data erasing method, and a program.

  In many cases, embedded devices are equipped with a secondary storage device that holds various data. Examples of the secondary storage device include an HDD, a flash memory, a USB memory, and an SD card. As a usage form of the secondary storage device, there is a case where the user attaches the secondary storage device to an embedded device, holds data in the secondary storage device, and then removes and stores the data. In this case, the user recognizes that he / she manages the data stored in the secondary storage device. On the other hand, there are cases where the secondary storage device is integrated with an embedded device or mounted on a hardware board. In this case, each user stores or stores data in a secondary storage device that is shared and used. For this reason, the user may not recognize that his / her own data is stored in the secondary storage device, or may be less conscious.

  When the secondary storage device is included as part of the embedded device, for example, when the device is discarded or returned after the lease period expires, internal user data held in the secondary storage device Omission of erasure can occur. As a result, personal information and confidential information may be leaked to the outside. In order to prevent such information leakage, embedded devices may have a function to return the device settings and stored data to the factory default state and a function to erase the stored data. There is (for example, Patent Document 1). Information leakage can be prevented by discarding or returning after executing this function.

Japanese Patent Laid-Open No. 2003-157681

  In the prior art, when there is a data erasure instruction from the user in an embedded device, the secondary storage device is forcibly initialized or physically formatted, or highly confidential data is extracted and forcibly erased. To do.

  However, in a form in which an embedded device is shared and used by a plurality of users, for example, a user who temporarily stores data in a secondary storage device and uses the data as necessary after a while has passed. Consider the case. In this case, all the stored data is erased by an erasure instruction from another user, and the user who stored the data may not be able to use the data at all.

  In order to solve the above problems, the present invention has the following configuration. That is, an information processing apparatus including a storage unit, and according to an instruction from a user, an erasing unit for erasing data stored in the storage unit, and predetermined data among data to be erased based on the instruction Specifying means for specifying, determining means for determining whether or not the data specified as the predetermined data by the specifying means has been processed, and data determined not to be processed by the determining means Control means for causing the erasing means to erase data to be erased based on the instruction.

  According to the present invention, it is possible to reduce the possibility of omission of erasure of data stored in the secondary storage device while preventing unprocessed data from being forcibly erased from the secondary storage device.

1 is a schematic diagram of a system including a print processing apparatus according to the present invention. The figure which shows the structural example of the controller which concerns on this invention. The figure which shows the example of the management table of the job of the secondary memory | storage device part which concerns on this invention. 6 is a flowchart for executing erasure of the secondary storage device according to the first embodiment. 10 is a flowchart for erasing execution of the secondary storage device according to the second embodiment.

<First embodiment>
Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings. In the description of the embodiment of the present invention, an image forming apparatus that performs print processing is used as an example of an information processing apparatus of an embedded device. The embedded device applied in the present embodiment is not limited to the image forming apparatus.

[System configuration]
FIG. 1 is a schematic diagram of a system including an image forming apparatus according to the present invention. In FIG. 1, a host computer 101, which is an information processing apparatus, and an image forming apparatus 102 are communicably connected to each other. The host computer 101 corresponds to a general information processing apparatus such as a PC (Personal Computer). The image forming apparatus 102 includes an operation unit 301, a controller unit 302, and a printing unit 303.

  Print data is sent from the host computer 101 to the image forming apparatus 102. The controller unit 302 generates raster data for each page based on the print data received from the host computer 101 and sends it to the printing unit 303. The printing unit 303 forms a latent image on a photosensitive drum (not shown) based on raster data supplied from the controller unit 302, and transfers the latent image onto a recording medium such as paper to fix the image. Is printed (formed).

  The operation unit 301 is used as a user interface. The controller unit 302 receives a desired operation instruction from the user via the operation unit 301. Further, the controller unit 302 displays the processing content of the image forming apparatus 102 and a warning to the user via the operation unit 301.

  FIG. 2 is a block diagram illustrating a configuration example of the controller unit 302. The controller unit 302 includes an operation unit IF unit 401, a network IF unit 402, an intermediate data generation unit 403, a ROM 404, a RAM 405, a printing unit IF unit 406, a DMA control unit 407, a rendering unit 408, a CPU 409, an NVRAM 410, and an external memory IF unit 411. , And a secondary storage unit 421, and these parts are connected to each other via a bus 420 so that they can communicate with each other. The operation unit IF unit 401 performs data communication between the operation unit 301 and the controller unit 302. The network IF unit 402 is connected to an external device such as the host computer 101 via a network 413 such as a LAN (Local Area Network) and controls communication between the devices. The intermediate data generation unit 403 converts a print job received from the host computer 101 via the network IF unit 402 into intermediate data for processing inside the image forming apparatus 102. A ROM 404 is a non-volatile storage unit, and holds program codes related to processing according to the present embodiment and other control processing performed by the image forming apparatus 102. The ROM 404 is used as a program storage area used for activation and a job spool area, and is mounted on the board of the controller unit 302. The RAM 405 is a volatile storage unit, provides a work area when the CPU 409 performs processing, and is used to use various data. Data stored in the RAM 405 by the CPU 409 includes print data received via the network IF unit 402, intermediate data generated by interpreting the print data, and a bitmap generated by rendering the intermediate data. Furthermore, there are various temporary processing statuses necessary for other processing.

  A printing unit IF unit 406 controls communication with the printing unit 303. The DMA control unit 407 controls DMA transfer between the RAM 405 and the printing unit IF unit 406 or between the RAM 405 and the secondary storage unit 421. The rendering unit 408 develops a bitmap image according to the intermediate data stored in the RAM 405. The expanded bitmap data is stored in the RAM 405.

  The CPU 409 controls the entire image forming apparatus 102 by reading and executing a program stored in the ROM 404 or the like. The CPU 409 recognizes the state of the printing unit 303 via the printing unit IF unit 406. The CPU 409 receives user settings and instruction contents from the operation unit 301 via the operation unit IF unit 401. The CPU 409 transfers the bitmap data stored in the RAM 405 to the printing unit IF unit 406 via the DMA control unit 407. The CPU 409 controls each device connected to the bus 420 based on the control program code stored in the ROM 404.

  The NVRAM 410 is a nonvolatile memory for holding setting information of the image forming apparatus 102. The external memory IF unit 411 can read and write various data such as image data, program data, and device setting data from a removable external memory 304 such as a USB memory. The secondary storage unit 421 is a storage unit provided in the image forming apparatus 102 and stores print data, log information, and the like received via the network IF unit 402. Examples of the secondary storage unit 421 include an HDD and an SD card, and normally, it is assumed that the image forming apparatus 102 is not attached or detached.

  As a function of the image forming apparatus 102, there is a normal print function for receiving a print job from the host computer 101 and immediately printing out the print job. In addition to the normal print function, the image forming apparatus 102 stores the received print job in the secondary storage unit 421 once and operates it from the operation unit 301 to enable print output. And stored job printing can be executed.

  With secure printing, when authentication information such as a personal identification number is added when a print job is transmitted from the host computer 101, the print data is not immediately printed out, but temporarily stored in the secondary storage unit 421. When the user who knows the authentication information inputs the authentication information from the operation unit 301, print output using the print data is executed. By using this function, it is possible to prevent the risk of leaving a highly confidential document as it is printed out.

  In the stored job print, when a print job is transmitted from the host computer 101, the print job is stored in the secondary storage unit 421 by instructing the image forming apparatus 102 to store the print job instead of printing it out. The data stored in the secondary storage unit 421 can be printed by operating from the operation unit 301 of the image forming apparatus 102, and the trouble of operating the host computer 101 each time printing can be omitted.

  As described above, when printing a highly confidential document or the like, a means for temporarily storing the document data in the secondary storage unit 421 and executing printing by operating the operation unit 301 by the user is widely used. Yes. In this embodiment, in addition to the normal print function, two types of print functions are given as an example. However, if the function temporarily holds data using the secondary storage unit 421, The present invention can be applied as the predetermined processing, and is not limited to the above.

[Job management table]
FIG. 3 shows an example of a job management table according to the present embodiment. When the print data received from the host computer 101 is stored in the secondary storage unit 421, the CPU 409 interprets the job information of the print data. The print data job information includes information such as a job ID, job owner, job name, job size, secure flag, and storage destination number. The CPU 409 extracts such information and registers it in the management table. Furthermore, the CPU 409 registers the date and time when the print data was saved, the last print date and time printed out by the printing unit 303, and the like in the management table and updates them according to the processing status.

  A job in which “1” is set in the secure flag item of the management table indicates a job related to secure printing. On the other hand, a job for which “0” is set indicates that the job has a print function other than that. A job for which the storage destination is set in the storage destination number item of the management table indicates that it is a job for stored job printing. On the other hand, when this item is not set, it indicates that the job relates to another print function.

  The management table manages job status and user information. The management table may be stored and managed in a storage unit (for example, the secondary storage unit 421) of the image forming apparatus 102, or stored and managed in a management server (not shown) connected on the network 413. May be. When managed by an external device on the network 413, the management table may be called and used at the time of erasing.

  Further, the CPU 409 obtains an e-mail address associated with the user who has instructed execution of printing by connecting to a management server (not shown) of an e-mail address connected to the network 413, and uses the management table. sign up. By using this registered e-mail address, various notifications can be sent by e-mail to the user who has instructed execution of printing. Note that when sending mail to the user, the mail is sent using a Web server (not shown).

[Processing flow]
The erasing process of the secondary storage unit 421 in the image forming apparatus 102 according to the embodiment of the present invention will be described with reference to the flowchart of FIG. This process is realized by the CPU 409 reading and executing a program stored in the ROM 404 or the like.

  When the user instructs execution of erasure of data stored in the secondary storage device unit 421, the CPU 409 confirms the data stored in the secondary storage device unit 421 in S501. Here, the data stored in the secondary storage unit 421 is confirmed as the data of interest in order. Further, an instruction to execute data erasure from the user may be received via a screen (not shown) displayed on the host computer 101, or a screen (not shown) displayed on the operation unit 301 of the image forming apparatus 102. ) May be accepted. Further, the execution of data erasure here may be all erasure (initialization) of data stored in the secondary storage unit 421, or data with high confidentiality may be targeted for erasure.

  In step S502, the CPU 409 determines whether the data of interest stored in the secondary storage unit 421 is secure print data. Here, with reference to the management table shown in FIG. 3, it is determined whether or not the secure flag of the job corresponding to the data of interest is “1”. If it is secure print data (YES in S502), the process proceeds to S504. If it is not secure print data (NO in S502), the process proceeds to S503.

  In step S <b> 503, the CPU 409 determines whether the data of interest stored in the secondary storage unit 421 is stored job print data. Here, with reference to the management table shown in FIG. 3, it is determined whether or not the job storage destination number corresponding to the data of interest is set. If it is stored job print data (YES in S503), the process proceeds to S504. If it is not stored job print data (NO in S503), the process proceeds to S506.

  In step S504, the CPU 409 determines whether the data of interest stored in the secondary storage device unit 421 is unoutput print data. If it is unoutput print data (YES in S504), the process proceeds to S505. If it is not unoutput print data (NO in S504), the process proceeds to S506. Here, if the print data is not yet output (that is, the print data has been output), the data relating to any print function is deleted from the secondary storage device.

  In step S505, the CPU 409 identifies the data of interest as data to be transmitted, and sets that fact. Thereafter, the process proceeds to S506.

  In step S <b> 506, the CPU 409 determines whether the confirmation process has been completed for all data stored in the secondary storage device unit 421. If the confirmation process has been completed for all the data (YES in S506), the process proceeds to S507. If not completed (NO in S506), the process returns to S501, and the CPU 409 determines the data for which the confirmation process has not been completed as the data of interest. Repeat the process.

  In step S507, the CPU 409 determines whether there is data set as transmission target data as a result of the confirmation processing. If there is data set as transmission target data (YES in S507), the process proceeds to S508. If not (NO in S507), the process proceeds to S509.

  In step S508, the CPU 409 transmits the data set as the transmission target data attached to a mail to the user who has instructed the job related to the predata. Here, the CPU 409 refers to the management table shown in FIG. 3 and instructs the destination registered in the e-mail address of the corresponding job to send a mail.

  In S509, the CPU 409 executes an erasing process on all data stored in the secondary storage device unit 421. Here, any erasing method or method may be used for the secondary storage unit 421. Thereafter, this processing flow ends.

  In this embodiment, in S508, the data is attached to the e-mail and sent to the user. However, it may be configured to notify the user that the data is simply deleted without attaching the data. Further, depending on the size of the data, the data may be compressed and sent, or whether or not the data is attached and sent may be switched.

  As described above, according to the present embodiment, when an instruction to erase data stored in the secondary storage device is given by a certain user, the data is erased for the user who stored the data according to the type (use) and processing status of the data. Notify before. As a result, when there is a data erasure instruction, it is possible to prevent erasure of data stored in the secondary storage device while preventing unprocessed data from being forcibly erased from the secondary storage device. Can be reduced.

<Second Embodiment>
A second embodiment of the present invention will be described. In the present exemplary embodiment, a configuration in a case where an administrator is set in the image forming apparatus 102 will be described. Note that the system configuration, hardware configuration, and the like are the same as those in the first embodiment, and a detailed description of overlapping portions is omitted.

[Processing flow]
A processing flow according to the present embodiment will be described with reference to FIG. This process is realized by the CPU 409 reading and executing a program stored in the ROM 404 or the like. Since S601 to S606 in FIG. 5 are the same as S501 to S506 in FIG. 4 described in the first embodiment, description thereof is omitted.

  If the confirmation processing is completed for all data in secondary storage unit 421 (YES in S606), in S607, CPU 409 determines whether there is data set as transmission target data as a result of the confirmation processing. Determine whether or not. If there is data set as transmission target data (YES in S607), the process proceeds to S608. If there is no data (NO in S607), the process proceeds to S613.

  In step S608, the CPU 409 determines whether there is an administrator setting in the image forming apparatus. At this time, if there is an image forming apparatus, the CPU 409 further displays an authentication screen (not shown), receives authentication information from the user who has instructed data erasure, and then the user is an administrator. You may make it determine that there exists. If there is an administrator setting (YES in S608), the process proceeds to S609. If there is no administrator setting (NO in S608), the process proceeds to S620.

  In S609, the CPU 409 shifts to the administrator mode. When the mode is shifted to the administrator mode, the user can set the data erasing method via a screen (not shown). In this embodiment, as a setting for the data erasing method, it is possible to set whether to perform deletion after erasing time elapses or forced data erasing after performing transmission processing of unoutput data It becomes. For convenience, the settings related to the above-described erasing method will be referred to as the first, second, and third erasing settings in order.

  In step S610, the CPU 409 determines whether transmission processing (first erasure setting) of unoutputted data to the request source is designated. If this setting has been made (YES in S610), the process proceeds to S620. If this setting has not been made (NO in S610), the process proceeds to S611.

  In S611, the CPU 409 determines whether or not the erasure time setting process (second erasure setting) of the secondary storage unit 421 is designated. If this setting has been made (YES in S611), the process proceeds to S615. If this setting has not been made (NO in S11), the process proceeds to S612.

  In S612, the CPU 409 forcibly executes the erasure process on the data set as the transmission target. In this case, no notification is given to the user who has instructed the job corresponding to the data. Thereafter, the process proceeds to S613.

  In S613, the CPU 409 executes an erasure process on all data stored in the secondary storage device unit 421. Here, any erasing method or method may be used for the secondary storage unit 421.

  In S614, the CPU 409 notifies the administrator of the completion of the erasing process of the data stored in the secondary storage device unit 421. The notification here may be sent by e-mail, or if it is clear that the user who is the administrator is operating via the operation unit 301, the notification content may be displayed on the operation unit. Good. Then, this processing flow ends.

  In step S615, the CPU 409 sets an erasure time for data stored in the secondary storage device unit 421. For example, the CPU 409 sets the time when a predetermined time has elapsed from the current time as the data erasing time. In this case, it is assumed that the predefined time is held in the NVRAM 410 or the like. Further, for example, a user as an administrator may be able to register a predefined time value.

  In step S616, the CPU 409 notifies the user who has instructed the job related to the data, which is set in step S615, by mail. At this time, the CPU 409 refers to the management table and uses the registered e-mail address as the destination.

  In step S617, the CPU 409 determines whether all the data notified in step S616 has been output. If all the data has been output (YES in S617), the process proceeds to S617, and if there is unoutput data (NO in S617), the process proceeds to S618. That is, even when the time set in S616 has not elapsed, when all the data has been processed, the data erasure process is performed.

  In S618, CPU 409 determines whether or not the time set in S615 has elapsed. If the set time has elapsed (YES in S618), the process proceeds to S619. If not (NO in S618), the process returns to S617.

  In step S619, the CPU 409 notifies the user that the data is to be deleted because the time notified in step S616 has elapsed. At this time, only data that has not been output but is forcibly deleted may be notified, or it has not been output at the time of notification in S616, but the processing is completed before the set time elapses. As a result, it may be notified that the normal erasure process is performed. Thereafter, the process proceeds to S613.

  In S620, CPU 409 transmits the data set as the transmission target data as an attachment to the user who has instructed the job related to the data. Here, the CPU 409 refers to the management table shown in FIG. 3 and instructs the destination registered in the e-mail address of the corresponding job to send a mail. Thereafter, the process proceeds to S613.

  As described above, according to the present embodiment, in addition to the effects achieved by the first embodiment, a user who is an administrator can select a data erasing method.

<Other embodiments>
The present invention supplies a program that realizes one or more functions of the above-described embodiments to a system or apparatus via a network or a storage medium, and one or more processors in a computer of the system or apparatus read and execute the program This process can be realized. It can also be realized by a circuit (for example, ASIC) that realizes one or more functions.

DESCRIPTION OF SYMBOLS 102 ... Image forming apparatus 301 ... Operation part 302 ... Controller part 421 ... Secondary storage apparatus part

Claims (14)

An information processing apparatus including a storage unit,
In accordance with an instruction from the user, erasing means for erasing data stored in the storage unit;
A specifying means for specifying predetermined data among data to be erased based on the instruction;
Determining means for determining whether or not the data specified as the predetermined data by the specifying means has been processed;
Control means for sending data determined to be unprocessed by the determination means to a user corresponding to the data and causing the deletion means to delete data to be deleted based on the instruction. Information processing apparatus. And further comprising a receiving means for receiving a setting for erasing data by the erasing means,
The information processing apparatus according to claim 1, wherein the control unit switches an erasing method according to a data erasing setting set via the receiving unit.   The control means, when forced erasure is set through the receiving means, causes the erasure means to erase data to be erased based on the instruction without performing the transmission. 2. The information processing apparatus according to 2.   When the setting of the erasure time is instructed via the accepting means, the control means sends the data to be erased based on the instruction to the erasure means without performing the transmission when a predetermined time has elapsed. The information processing apparatus according to claim 2, wherein the information processing apparatus is erased.   When the processing for the data specified as the predetermined data by the specifying means is completed before the predetermined time has elapsed, the control means deletes the data to be deleted based on the instruction at that time. The information processing apparatus according to claim 4, wherein the erasing unit causes the information to be erased.   6. The notification unit according to claim 4, further comprising a notification unit that notifies a user associated with the data specified as the predetermined data by the specifying unit when the predetermined time elapses. Information processing device.   The notifying unit notifies a user associated with the data that the data specified as the predetermined data by the specifying unit is deleted when the predetermined time has elapsed. The information processing apparatus according to claim 6. The information processing apparatus further includes means for determining whether an administrator is set,
8. The information according to claim 2, wherein, when the administrator is set, the receiving unit provides a screen for receiving a data erasure setting and receives the setting. 8. Processing equipment.   9. The storage device according to claim 1, further comprising a holding unit that holds the data in association with the information of a user who has instructed processing of the data when the data is stored in the storage unit. The information processing apparatus according to claim 1.   The information processing apparatus according to any one of claims 1 to 9, wherein the erasing of data by the erasing unit is erasing all of the data stored in the storage unit.   The information processing apparatus according to claim 1, wherein the predetermined data is data used for secure printing or stored job printing.   The information processing apparatus according to claim 1, wherein the information processing apparatus is an image forming apparatus that performs a printing process. A data erasing method in an information processing apparatus including a storage unit,
In accordance with an instruction from the user, an erasing step of erasing data stored in the storage unit,
A specific step of identifying predetermined data among data to be erased based on the instructions;
A determination step of determining whether the data specified as the predetermined data in the specifying step has been processed;
And a control step of erasing data to be erased in the erasing step based on the instruction after transmitting the data judged not processed in the deciding step to a user corresponding to the data. Characteristic data erasing method. A computer having a storage unit,
An erasing unit for erasing data stored in the storage unit according to an instruction from the user,
A specifying means for specifying predetermined data among data to be erased based on the instruction;
Determining means for determining whether or not the data specified as the predetermined data by the specifying means has been processed;
A program for transmitting data determined not to be processed by the determination unit to a user corresponding to the data and causing the deletion unit to delete data to be deleted based on the instruction. .

Images