JP2017211885A - Pull print system and pull print method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a pull-print that steps over a fire wall at a security level in accordance with a secrecy level of documents.SOLUTION: A pull print system 100 comprises: a network 140 that has a connection control function constituting a fire wall F1; a plurality of client terminals that is connected to the network inside the fire wall; and an authentication device that is connected to the terminal via the network inside the fire wall, and controls the connection control function. An image formation device is connected to a network 240 outside the fire wall. The authentication device is configured to: execute authentication processing in response to a request from the image formation device; control the connection control function on the basis of an authentication success to permit transmission of print data to the image formation device from inside the fire wall; and execute the authentication processing, using at least one client terminal different from the client terminal used in creation of the print data of the terminals.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a pull print system and a pull print method, and an image forming apparatus and an authentication apparatus used for the pull print system, and more particularly to a system for ensuring confidentiality of a document.

  In recent years, a method of storing print data in advance on a server or client terminal, sending the print data in response to a print request from the image forming apparatus, and outputting a printed matter from the image forming apparatus (also called pull printing). Has been proposed. For pull printing, a method has also been proposed in which print data is stored in a client terminal or the like on a network in a firewall and is printed by an image forming apparatus outside the firewall (Patent Document 1).

Japanese Patent Laying-Open No. 2015-095233

  However, in the technique of Patent Document 1, if an account that can use pull printing is used, a document as print data can be acquired from the outside of the firewall without limitation regardless of the confidentiality of the document. There was a problem.

  The present invention has been made in view of such a situation, and an object of the present invention is to provide a pull print system capable of realizing pull print across a firewall at a security level corresponding to the confidentiality of a document. .

  The present invention provides a pull printing system that performs printing using an image forming apparatus. The pull print system includes a network having a connection control function that configures a firewall, a plurality of client terminals connected to the network inside the firewall, and the network inside the firewall via the network. An authentication device connected to a plurality of client terminals and controlling the connection control function, wherein the image forming device is connected to the network outside the firewall, and the authentication device is connected to the image forming device. Performing an authentication process in response to a request from the server, controlling the connection control function based on the authentication success of the authentication process, permitting transmission of print data from the inside of the firewall to the image forming apparatus, The authentication device includes the print data of the plurality of client terminals. The client terminal used to generate the performing the authentication process by using another of the at least one client terminal.

  The present invention provides a pull printing method. The pull printing method includes a step of preparing a network having a connection control function that constitutes a firewall, a step of connecting a plurality of client terminals to the network inside the firewall, and the network inside the firewall. Connecting the plurality of client terminals and the authentication device via the network, controlling the connection control function by the authentication device, connecting the image forming apparatus existing outside the firewall to the network, and The authentication apparatus executes an authentication process in response to a request from the image forming apparatus, controls the connection control function based on the authentication success of the authentication process, and prints from the inside of the firewall to the image forming apparatus A step of permitting transmission of data, wherein the authentication process The client terminal is used to generate the print data of the plurality of client terminals are performed using another of the at least one client terminal.

  According to the present invention, it is possible to realize pull printing across a firewall at a security level corresponding to the confidentiality of a document.

It is a block diagram which shows the function structure of the pull print system which concerns on one Embodiment of this invention. It is a flowchart which shows the procedure of the pull print process which concerns on one Embodiment. It is a flowchart which shows the procedure of the pull print preparation process which concerns on one Embodiment. It is a block diagram which shows the data flow in the pull print preparation process which concerns on one Embodiment. It is a block diagram which shows the data flow in the pull print request process which concerns on one Embodiment. It is a block diagram which shows the data flow in the document authentication process which concerns on one Embodiment. It is a block diagram which shows the data flow in the print data transmission process which concerns on one Embodiment. It is a block diagram which shows the data flow in the data transmission permission cancellation | release process which concerns on one Embodiment.

  Hereinafter, modes for carrying out the present invention (hereinafter referred to as “embodiments”) will be described with reference to the drawings.

  FIG. 1 is a block diagram showing a functional configuration of a pull print system 100 according to an embodiment of the present invention. Three client terminals 110a, 110b, and 110c, an authentication server 120, and an image forming apparatus 130 are provided. Each of these devices includes main storage means (not shown) such as RAM and ROM, and control means (not shown) such as MPU (Micro Processing Unit) and CPU (Central Processing Unit). The control means has a controller function related to various I / O, USB (Universal Serial Bus), bus, and other hardware interfaces, and controls the entire apparatus. The authentication server 120 is also called an authentication device.

  The three client terminals 110a, 110b, and 110c, the authentication server 120, and the image forming apparatus 130 are connected to each other via an internal network 140. The internal network 140 has a connection control function for constructing the firewall F1. In this example, the connection control function is controlled by the authentication server 120. The firewall F1 controls communication between the external system 200 (for example, the external network 240 having the firewall F2 and the image forming apparatus 160 connected thereto), and maintains the safety of the internal network 140.

  The client terminal 110a is a terminal used by a managerial user (in this example, for example, a boss of the user of the client terminal 110c). The client terminal 110b is a terminal used by the security administrator. The client terminal 110c is a terminal used by general users. In this example, it is assumed that the user of the client terminal 110c executes pull printing.

  FIG. 2 is a flowchart illustrating a procedure of pull print processing according to an embodiment. In step S10, the user executes pull print preparation processing. The pull print preparation process is a process of preparing print data in advance so that the pull print process can be performed. The pull print process is a method in which print data is transmitted in response to a print request from the image forming apparatus and is output from the image forming apparatus. In this example, the pull print system 100 transmits print data to the image forming apparatus 160 connected to the external network 240 outside the firewall F1.

FIG. 3 is a flowchart showing a procedure of pull print preparation processing according to an embodiment. FIG. 4 is a block diagram illustrating a data flow in pull print preparation processing according to an embodiment. In step S11, the user executes pull print setting processing. The pull print setting process includes the following settings.
(1) Position of the image forming apparatus (outside the firewall F1 or inside the firewall F1)
(2) Concealment level of the document to be printed (high secrecy level 3, medium secrecy level 2, low secrecy level 1)

  In this example, the high confidentiality 3 is highly confidential confidential information, and is a confidential level that becomes a problem for the entire company when information is leaked. Medium confidentiality 2 is confidential and confidential information. If information is leaked, it is not a problem for the entire company, but it is a confidential level at which the person in charge must take responsibility. Low confidentiality 1 is a confidential level that does not cause a problem even if information is leaked.

  In this example, it is assumed that the user is set to perform pull-up printing in the image forming apparatus 160 outside the firewall F1. That is, it is assumed that the position outside the firewall F1 is selected as the position of the image forming apparatus. The confidentiality of the document to be printed is automatically set according to the confidentiality of the document to be printed. Specifically, for example, the number is automatically set by using a number (1 to 3) representing the degree of confidentiality stored as attribute data of the document data.

  In step S12, the user executes print data generation processing using the client terminal 110c. In this example, the print data generation process is a process for generating print data in a format that can be printed by an arbitrary image forming apparatus as, for example, document data as a pdf file or other general-purpose file format.

  The client terminal 110 c transmits print data to the image forming apparatus 130 connected to the internal network 140. The client terminal 110c further sends information indicating that the print data is set to execute pull-up printing in the image forming apparatus 160 outside the firewall F1 to the authentication server 120 together with a number representing the confidentiality of the document. Send. The client terminal 110c requests an authentication key (in this example, a one-time authentication key) from the authentication server 120.

In step S13, the authentication server 120 sets an authentication client based on a number representing the confidentiality of the document. Specifically, in the present embodiment, the setting is made as follows.
(1) Concealment level 3: two client terminals 110a and 110b
(2) Concealment level 2: 1 client terminal 110b
(3) Confidentiality 1: No setting

  As a result, in order to print a confidentiality level 3 document outside the firewall F1, authentication by a manager user and a security administrator is required. In order to print a confidentiality level 2 document outside the firewall F1, authentication by only the security administrator is required. To print a confidentiality level 1 document outside the firewall F1, authentication by the client terminal is not required. In this example, it is assumed that two client terminals 110a and 110b are set with a secrecy of 3. The client terminals 110a and 110b set as the authentication client terminal are notified from the authentication server 120 to the client terminal 110c.

  In step S14, the authentication server 120 issues a plurality of authentication keys (for example, passwords). Specifically, when the degree of secrecy is 3, the authentication server 120 performs the following process. The authentication server 120 transmits a total of two authentication keys to the two client terminals 110a and 110b, respectively, and executes authentication reservation. The authentication reservation is data communication for reserving an authentication process in the pull-up process. The authentication server 120 further issues a one-time authentication key for the user of the client terminal 110c to access from the image forming apparatus 160 side. The one-time authentication key is transmitted to the client terminal 110c.

  Note that the access on the image forming apparatus 160 side is not necessarily a one-time authentication key, but may be a login password that is routinely used by the user of the client terminal 110c. However, if a one-time authentication key can be used, a login password need not be used outside the company, which is preferable for security reasons.

  In step S15, the image forming apparatus 130 executes a print data storage process. In the print data storage process, the image forming apparatus 130 stores the print data in a storage unit (not shown) included in the image forming apparatus 130. The image forming apparatus 130 transmits a path in which print data is stored to the authentication server 120. The storage location of the print data may be the client terminal 110c, or the print data may be generated during the pull print process.

  FIG. 5 is a block diagram showing a data flow in pull print request processing according to an embodiment. FIG. 6 is a block diagram showing a data flow in the document authentication process according to the embodiment. In step S <b> 20, the user executes pull print request processing using the image forming apparatus 160. The pull print request process is a process for requesting the pull print system 100 to download print data from the image forming apparatus 160.

  In step S30, the authentication server 120 executes a personal authentication process. The personal authentication process is performed by transmitting a user ID and a one-time authentication key to the authentication server 120 via the image forming apparatus 160. The authentication server 120 starts a timer in response to the start of the personal authentication process.

  The user further transmits information (for example, a host name and an IP address) for identifying the client terminals 110a and 110b set as the authentication client terminals in the internal network 140 to the authentication server 120 via the image forming apparatus 160. (See FIG. 5).

  In step S40, the authentication server 120 executes document authentication processing. In the document authentication process, the authentication server 120 requests an authentication inquiry from the client terminals 110a and 110b specified based on the received host name (see FIG. 6). In the client terminal 110a, a manager user (in this example, for example, a boss of the user of the client terminal 110c) performs an authentication process using an authentication key acquired in advance from the authentication server 120. In the client terminal 110b, the security administrator executes an authentication process using the authentication key acquired from the authentication server 120 in advance.

  However, the authentication server 120 starts a timer in response to the start of the personal authentication process, and when a predetermined time has elapsed in advance, the pull print process is processed as an authentication failure in order to ensure security safety. Is done. Note that the client terminals 110a and 110b may be configured to confirm the document printed with the print data and the degree of secrecy thereof at the time of authentication.

  In step S50, the authentication server 120 executes a data transmission permission process. The data transmission permission process is a process for permitting transmission of preset print data to the outside of the internal network 140 in response to successful authentication by the client terminals 110a and 110b (see FIG. 6). The authentication server 120 further notifies the image forming apparatus 160 of the address of the image forming apparatus 130 as a print data request destination.

  FIG. 7 is a block diagram illustrating a data flow in print data transmission processing according to an embodiment. In step S60, the image forming apparatus 130 executes a print data transmission process. The print data transmission process is a process for transmitting print data from the image forming apparatus 130 to the image forming apparatus 160. The print data transmission process is started in response to a print data request from the image forming apparatus 160 to the image forming apparatus 130.

  FIG. 8 is a block diagram showing a data flow in a data transmission permission release process according to an embodiment. In step S70, the authentication server 120 executes a data transmission permission release process. The data transmission permission release process is executed in response to a reception completion notification from the image forming apparatus 160 to the authentication server 120. On the other hand, the image forming apparatus 130 ends the print data transmission process in response to the reception completion notification from the image forming apparatus 160 to the image forming apparatus 130 and deletes the print data. Thereby, the internal network 140 can return to the original state and maintain high security.

  As described above, according to the present embodiment, since authentication processing is required for each document to be printed for a highly confidential document, it is possible to effectively suppress outflow of the highly confidential document to the outside. Pull printing can be realized in the image forming apparatus 160 outside the firewall F1. Further, in the present embodiment, authentication is performed using the number of authentication client terminals set according to the confidentiality level of the document, so that a pull print across the firewall F1 is performed at a security level corresponding to the confidentiality level of the document. Can be realized.

  As a result, it is possible to print on the go without storing the document data in a device capable of storing data, such as a non-volatile medium, a portable terminal, or a PC. As a result, it is possible to effectively suppress the outflow of documents with high confidentiality outside the company.

  The present invention can be implemented not only in the above embodiments but also in the following modifications.

  Modification 1: In the above embodiment, the personal authentication process is performed by transmitting the user ID and the one-time authentication key to the authentication server 120 via the external image forming apparatus. There is no limitation on the method of inputting data such as an authentication key, and it can be input to an external image forming apparatus by any method.

  Specifically, for example, an input device of an external image forming apparatus may be used, or a non-volatile storage medium such as a USB memory or a portable terminal may be connected and input by near field communication. . The mobile terminal may transmit the GPS information acquired by the mobile terminal in addition to the user ID and the one-time authentication key.

  Modification 2: In the above embodiment, the data input to the external image forming apparatus may be configured in, for example, a ticket format, for example, a pull print job ticket. The pull print job ticket can be configured, for example, as a Simple Object Access Protocol (SOAP) message. The SOAP message of the pull print job ticket is a data file having a SOAP envelope including the SOAP main body. In addition to the user ID and the one-time authentication key, the SOAP main body includes the host names of the client terminals 110a and 110b set as authentication client terminals.

  Modification 3: In the above embodiment, there is no limit to the external image forming apparatus that performs pull printing, but the position of the image forming apparatus may be limited to a preset range, for example. Specifically, the user may input geographical information of a planned business trip destination from the client terminal 110c, for example, in the pull print setting process (step S11). The authentication server 120 generates an authentication key using geographical information (for example, GPS information) of a planned business trip destination, and the GPS acquired by the mobile terminal when authenticating with one of the two client terminals 110a and 110b. Information is also used to check consistency (match).

  Modification 4: In the above embodiment, authentication is performed by the client terminal in response to a pull print request from an external image forming apparatus, but it is not always necessary to perform authentication at the time of a pull print request from an external image forming apparatus. Specifically, for example, authentication may be completed in advance during the pull print preparation process (step S10). However, in this case, for example, when a pull-up request is made within a preset time from an image forming apparatus at a position (within a preset range or within a predetermined error range) that matches the preset position. It is preferable to ensure security by allowing print data to be downloaded only to

100 Pull print system 130, 160 Image forming apparatus 110a, 110b, 110c Client terminal 120 Authentication server 140 Internal network 240 External network

Claims (6)

A pull printing system that performs printing using an image forming apparatus,
A network having a connection control function that constitutes a firewall;
A plurality of client terminals connected to the network inside the firewall;
An authentication device connected to the plurality of client terminals via the network inside the firewall and controlling the connection control function;
With
The image forming apparatus is connected to the network outside the firewall,
The authentication apparatus executes an authentication process in response to a request from the image forming apparatus, controls the connection control function based on the authentication success of the authentication process, and transmits from the inside of the firewall to the image forming apparatus. Allow transmission of print data,
The pull printing system, wherein the authentication device uses at least one client terminal different from the client terminal used for generating the print data among the plurality of client terminals. The pull print system according to claim 1,
The authentication apparatus is a pull print system that executes the authentication process using a larger number of client terminals as the confidentiality of the print data is higher. The pull print system according to claim 1 or 2,
The pull printing system, wherein the authentication device determines the number of client terminals used for the authentication processing based on a user authority of a client terminal used for generating the print data. The pull print system according to any one of claims 1 to 3,
The pull printing system in which the authentication apparatus uses the position information acquired from the image forming apparatus as a condition for the authentication success to match a preset position. The pull print system according to any one of claims 1 to 4,
The pull printing system, wherein the authentication device uses the authentication process as a condition for successful authentication to be completed within a preset time from a request from the image forming apparatus. A pull print method,
Preparing a network having a connection control function to configure a firewall;
Connecting a plurality of client terminals to the network inside the firewall;
Connecting the plurality of client terminals and an authentication device via the network inside the firewall, and controlling the connection control function by the authentication device;
Connecting an image forming apparatus existing outside the firewall to the network;
The authentication apparatus executes an authentication process in response to a request from the image forming apparatus, controls the connection control function based on the authentication success of the authentication process, and prints from the inside of the firewall to the image forming apparatus Allowing the transmission of data; and
With
The pull-printing method, wherein the authentication process is executed using at least one client terminal different from the client terminal used for generating the print data among the plurality of client terminals.