JP2019012401A - Remote communication system - Google Patents

Abstract

To provide a remote communication system that can improve security when an image forming apparatus is controlled from an electronic apparatus present outside a network to which the image forming apparatus belongs.SOLUTION: In a remote communication system, a session relay system 60 notifies a remote maintenance system 50 of a session ID (S147); the remote maintenance system 50 executes notification of the session ID to an image forming apparatus 20 and a connection terminal 40 (S149, S150); the image forming apparatus 20 and connection terminal 40 respectively establish connections using the session ID with the session relay system 60; the session relay system 60 associates the connections established respectively with the image forming apparatus 20 and connection terminal 40 with the session ID to relay a remote session between the image forming apparatus 20 and connection terminal 40.SELECTED DRAWING: Figure 8

Description

  The present invention relates to a remote communication system that performs communication between an image forming apparatus and an electronic device that exists outside a network to which the image forming apparatus belongs.

  2. Description of the Related Art Conventionally, a system that performs communication between an image forming apparatus and an electronic device existing inside a LAN (Local Area Network) to which the image forming apparatus belongs is known (see, for example, Patent Document 1). The system described in Patent Document 1 displays a UI (User Interface) screen generated by an electronic device on the image forming apparatus, and causes the image forming apparatus to perform printing based on print data stored in the electronic device. .

JP 2006-238199 A

  However, in the system described in Patent Document 1, it is assumed that the image forming apparatus is controlled from an electronic device existing inside the LAN to which the image forming apparatus belongs, and the network of the image forming apparatus belongs to. There is a problem in terms of security in order to control the image forming apparatus from an external electronic device.

  SUMMARY An advantage of some aspects of the invention is that it provides a remote communication system capable of improving security when an image forming apparatus is controlled from an electronic device existing outside a network to which the image forming apparatus belongs.

  The remote communication system of the present invention includes an image forming apparatus, an electronic device existing outside a network to which the image forming apparatus belongs, a session relay system that relays a session between the image forming apparatus and the electronic device, A session management system for managing the session, wherein the session relay system notifies the session management system of a first session ID and a second session ID for identifying communication by the session in the session relay system. The session management system executes notification of the first session ID to the electronic device and notification of the second session ID to the image forming apparatus, and the electronic device transmits the session relay Use the first session ID with the system The image forming apparatus establishes a connection using the second session ID with the session relay system, and the session relay system is established with the electronic device. The session is relayed by associating a connection and a connection established between the image forming apparatus with the first session ID and the second session ID.

  With this configuration, in the remote communication system of the present invention, among the electronic devices existing outside the network to which the image forming apparatus belongs, only the electronic device to which the first session ID is notified from the session management system is used. Since the session with the image forming apparatus relayed by the above is established, it is possible to improve security when the image forming apparatus is controlled from an electronic device existing outside the network to which the image forming apparatus belongs.

  In the remote communication system of the present invention, the first session ID and the second session ID may be the same session ID.

  With this configuration, the remote communication system of the present invention does not need to associate two different session IDs with each other in the session relay system, so that the session ID processing in the session relay system can be simplified.

  In the remote communication system of the present invention, the connection using the first session ID established between the session relay system and the electronic device, and established between the session relay system and the image forming apparatus. At least one of the connections using the second session ID may be an encrypted communication connection.

  With this configuration, the remote communication system of the present invention encrypts at least a part of the session path between the electronic device and the image forming apparatus relayed by the session relay system, and therefore cracks the image forming apparatus. The occurrence of unauthorized use such as can be suppressed.

  In the remote communication system of the present invention, the session management system receives a request to start the session from the electronic device when a user of the electronic device is logged in to the session management system, and the session management system If the request to start the session is not received from the electronic device, at least the notification of the first session ID to the electronic device and the notification of the second session ID to the image forming apparatus One need not be executed.

  With this configuration, the remote communication system according to the present invention allows the session between the electronic device and the image forming apparatus to be relayed by the session relay system only when the user of the electronic device can log in to the session management system. Since it is established, the security of this session can be improved.

  In the remote communication system of the present invention, the session management system, when the start of the session is not approved by a user of the image forming apparatus, notifies the electronic apparatus of the first session ID, and the image It is not necessary to execute at least one of the notification of the second session ID to the forming apparatus.

  With this configuration, the remote communication system of the present invention establishes a session between the electronic device and the image forming apparatus that is relayed by the session relay system only when the start of the session is approved by the user of the image forming apparatus. Therefore, the security of this session can be improved.

  In the remote communication system of the present invention, the session relay system requests the first session ID and the second session ID by requesting the first session ID and the second session ID from the session management system. The session ID is notified to the session management system, and the session relay system receives the first session ID and the second session ID each time the first session ID and the second session ID are requested from the session management system. At least one of the second session IDs may be changed.

  With this configuration, the remote communication system of the present invention enables at least one of the first session ID and the second session ID each time a session between the electronic device and the image forming apparatus relayed by the session relay system is established. The security of this session can be improved.

  In the remote communication system of the present invention, the electronic device receives screen data displayed on the image forming apparatus from the image forming apparatus via the session and displays a screen based on the data. An operation on a screen displayed based on data is received and the operation is transmitted to the image forming apparatus via the session, and the image forming apparatus responds to the operation received from the electronic device via the session. It may work.

  With this configuration, the remote communication system according to the present invention displays the same screen as the screen displayed on the image forming apparatus on the electronic apparatus existing outside the network to which the image forming apparatus belongs, thereby Since the image forming apparatus is operated, the image forming apparatus can be easily operated at low cost from an electronic apparatus existing outside the network to which the image forming apparatus belongs.

  The remote communication system of the present invention can improve security when the image forming apparatus is controlled from an electronic device existing outside the network to which the image forming apparatus belongs.

It is a block diagram of the remote communication system which concerns on one embodiment of this invention. FIG. 2 is a block diagram of the image forming apparatus shown in FIG. 1 in the case of an MFP. It is a block diagram of the connection terminal shown in FIG. It is a figure which shows the function implement | achieved by the remote maintenance system shown in FIG. It is a figure which shows the function implement | achieved by the session relay system shown in FIG. It is a sequence diagram of operation | movement of the remote communication system shown in FIG. 1 when the user of a connection terminal logs in to a remote maintenance system. It is a sequence diagram of operation | movement of the remote communication system shown in FIG. 1 in the case of performing remote maintenance via a remote maintenance system. It is a sequence diagram of operation | movement of the remote communication system shown in FIG. 1 in the case of starting a remote session. FIG. 9 is a sequence diagram for establishing a device-side session shown in FIG. 8. FIG. 9 is a sequence diagram of session establishment side session establishment shown in FIG. 8. It is a figure which shows an example of the screen for remote session approval displayed in the operation | movement shown in FIG. FIG. 2 is a sequence diagram of the operation of the remote communication system shown in FIG. 1 when the image forming apparatus operates in response to a request from a connection terminal via a remote session. (A) It is a figure which shows the HTTP data which a server application processes in the operation | movement shown in FIG. (B) It is a figure which shows the HTTP data for relaying the HTTP data shown to Fig.13 (a) on the internet. FIG. 2 is a sequence diagram of an operation of the remote communication system shown in FIG. 1 when a remote session is terminated. FIG. 15 is a sequence diagram for ending the device-side session shown in FIG. 14.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

  First, the configuration of the remote communication system according to the present embodiment will be described.

  FIG. 1 is a block diagram of a remote communication system 10 according to the present embodiment.

  As shown in FIG. 1, a remote communication system 10 includes an image forming apparatus 20, a gateway 30 that connects a network such as a LAN (Local Area Network) to which the image forming apparatus 20 belongs to a network such as the Internet, and the image forming apparatus. Remote communication for controlling communication between a connection terminal 40 as an electronic device existing outside the network to which the network 20 belongs, an image forming apparatus included in the remote communication system 10, and a connection terminal included in the remote communication system 10 And a control system 15.

  The remote communication control system 15 includes a remote maintenance system 50 that is a cloud service that performs remote maintenance on an image forming apparatus included in the remote communication system 10 in response to an instruction from a connection terminal included in the remote communication system 10. A cloud that relays a direct interconnection between the image forming apparatus included in the remote communication system 10 and the connection terminal included in the remote communication system 10, that is, a peer-to-peer session (hereinafter referred to as a “remote session”). And a session relay system 60 as a service.

  The remote communication system 10 can include an image forming apparatus in addition to the image forming apparatus 20 in a network to which the image forming apparatus 20 belongs. In addition to the network to which the image forming apparatus 20 belongs, the remote communication system 10 can include a network to which the image forming apparatus belongs. The image forming apparatus included in the remote communication system 10 is, for example, an image forming apparatus such as an MFP (Multifunction Peripheral), a printer dedicated machine, a copy dedicated machine, a fax dedicated machine, or a scanner dedicated machine.

  The gateway 30 constitutes a firewall that prevents attacks from the outside of the network to which the image forming apparatus 20 belongs. Therefore, communication between the image forming apparatus included in the remote communication system 10 and the remote maintenance system 50 is performed by the image forming apparatus included in the remote communication system 10 to the remote maintenance system 50 by XMPP (Extensible Messaging and Presence Protocol). Maintained by staying connected.

  The remote communication system 10 can include a connection terminal in addition to the connection terminal 40. The connection terminal included in the remote communication system 10 is a computer such as a PC (Personal Computer).

  The remote maintenance system 50 is configured by, for example, a server computer. The remote maintenance executed by the remote maintenance system 50 is maintenance such as confirmation of the counter of the image forming apparatus and installation of firmware on the image forming apparatus, for example. The remote maintenance system 50 not only performs remote maintenance, but also manages remote sessions. That is, the remote maintenance system 50 constitutes a session management system of the present invention.

  The session relay system 60 is configured by, for example, a server computer.

  The image forming apparatus included in the remote communication system 10 and the remote maintenance system 50 can communicate via a network such as the Internet. The image forming apparatus included in the remote communication system 10 and the session relay system 60 can communicate via a network such as the Internet. The connection terminal included in the remote communication system 10 and the remote maintenance system 50 can communicate with each other via a network such as the Internet. The connection terminal included in the remote communication system 10 and the session relay system 60 can communicate with each other via a network such as the Internet. The remote maintenance system 50 and the session relay system 60 can communicate via a network such as the Internet.

  FIG. 2 is a block diagram of the image forming apparatus 20 in the case of an MFP.

  An image forming apparatus 20 illustrated in FIG. 2 includes an operation unit 21 that is an input device such as buttons for inputting various operations, and a display unit 22 that is a display device such as an LCD (Liquid Crystal Display) that displays various information. And a scanner 23 that reads an image from a document, a printer 24 that prints an image on a recording medium such as paper, an external facsimile apparatus not shown, and a communication line such as a public telephone line A fax communication unit 25, which is a fax device that performs fax communication, and a communication unit 26, which is a communication device that communicates with an external device via a network or directly by wire or wireless without going through the network, Semiconductor memory, HDD (Hard Dis) Drive) and a storage unit 27 is a nonvolatile storage device such as, and a control unit 28 for controlling the entire image forming apparatus 20.

  The control unit 28 includes, for example, a CPU (Central Processing Unit), a ROM (Read Only Memory) storing a program and various data, and a RAM (Random Access Memory) used as a work area of the CPU. Yes. The CPU executes a program stored in the ROM or the storage unit 27.

  The control unit 28 executes a program stored in the ROM or the storage unit 27 to thereby execute a server application 28a used via a remote session from a connection terminal included in the remote communication system 10, and a session relay system 60 ( And a Cloud Hub Agent 28b for controlling communication with the network.

  The control unit 28 can implement a server application in addition to the server application 28a by executing a program stored in the ROM or the storage unit 27.

  As a server application realized by the control unit 28, for example, various setting states of the image forming apparatus 20 are notified to the outside of the network to which the image forming apparatus 20 belongs, and from outside the network to which the image forming apparatus 20 belongs. There is a Web Server that accepts various settings of the image forming apparatus 20. As a server application realized by the control unit 28, for example, data of a screen (for example, a web page) displayed on the display unit 22 of the image forming apparatus 20 is transmitted outside the network to which the image forming apparatus 20 belongs. In addition, there is a Remote APP Server that receives an operation on a screen displayed based on this data from outside the network to which the image forming apparatus 20 belongs and operates the image forming apparatus 20 in accordance with the received operation.

  The server application realized by the control unit 28 can be identified by the application ID.

  FIG. 3 is a block diagram of the connection terminal 40.

  As shown in FIG. 3, the connection terminal 40 includes an operation unit 41 that is an input device such as a keyboard and a mouse for inputting various operations, and a display unit 42 that is a display device such as an LCD that displays various information. And a communication unit 43 that is a communication device that communicates with an external device directly via a network or via a network without using a network, and a nonvolatile memory such as a semiconductor memory or HDD that stores various types of information. The storage unit 44 is a storage device, and the control unit 45 is configured to control the entire connection terminal 40.

  The control unit 45 includes, for example, a CPU, a ROM that stores programs and various data, and a RAM that is used as a work area of the CPU. The CPU executes a program stored in the ROM or the storage unit 44.

  The control unit 45 executes a program stored in the ROM or the storage unit 44 to execute login processing to the remote maintenance system 50 and a remote unit that instructs the remote maintenance system 50 to perform remote maintenance. A maintenance instruction unit 45b, a client 45c that uses a server application of the image forming apparatus included in the remote communication system 10 via a remote session, and a remote session control unit 45d that controls the remote session are realized.

  The control unit 45 can implement a client in addition to the client 45c by executing a program stored in the ROM or the storage unit 44.

  As a client realized by the control unit 45, for example, the setting status notified from the Web Server as a server application is displayed on the display unit 42, and various settings input from the operation unit 41 are displayed on the Web Server. There is a Web Browser that instructs the user. Further, as a client realized by the control unit 45, for example, a screen based on screen data received from a Remote APP Server as a server application is displayed on the display unit 42. There is an application such as Remote APP Client that transmits the input operation to this Remote APP Server.

  The client realized by the control unit 45 can be identified by the application ID. Note that the application ID for identifying the client realized by the control unit 45 is the same as the application ID for identifying the server application of the image forming apparatus corresponding to this client.

  FIG. 4 is a diagram illustrating functions realized by the remote maintenance system 50.

  As shown in FIG. 4, the remote maintenance system 50 includes a login permission determination unit 51 that determines whether or not to allow a user to log in by executing a specific program, and a remote maintenance unit that executes remote maintenance. 52 and session management means 53 for managing a remote session.

  FIG. 5 is a diagram illustrating functions realized by the session relay system 60.

  As illustrated in FIG. 5, the session relay system 60 implements a Cloud Hub 61 that controls communication with the image forming apparatus included in the remote communication system 10 by executing a specific program. The session relay system 60 can realize a Cloud Hub in addition to the Cloud Hub 61 by executing a specific program.

  The session relay system 60 implements a Web Agent 62 that controls communication with a connection terminal included in the remote communication system 10 by executing a specific program. The session relay system 60 can realize a Web Agent in addition to the Web Agent 62 by executing a specific program.

  The session relay system 60 stores a log about a remote session and a master 63 that determines which Cloud Hub the image forming apparatus is connected to and which Web Agent the connection terminal is connected to by executing a specific program. The session management database 64 is realized.

  The Cloud Hub included in the session relay system 60 and the Web Agent included in the session relay system 60 have a one-to-one relationship. That is, the number of Cloud Hubs included in the session relay system 60 and the number of Web Agents included in the session relay system 60 are the same.

  When an image forming apparatus included in the remote communication system 10 is connected to the session relay system 60, the master 63 determines which image forming apparatus is connected to which Cloud Hub. However, in the following, detailed description of the operation of the Master 63 is omitted.

  Similarly, when a connection terminal included in the remote communication system 10 connects to the session relay system 60, the Master 63 determines which of the connection terminals is connected to which Web Agent. However, in the following, detailed description of the operation of the Master 63 is omitted.

  Next, the operation of the remote communication system 10 will be described.

  First, the operation of the remote communication system 10 when the user of the connection terminal 40 logs in to the remote maintenance system 50 will be described.

  FIG. 6 is a sequence diagram of the operation of the remote communication system 10 when the user of the connection terminal 40 logs in to the remote maintenance system 50.

  The user of the connection terminal 40 can instruct login to the remote maintenance system 50 by inputting the user ID and password via the operation unit 41. When the login unit 45a of the connection terminal 40 receives an instruction to log in to the remote maintenance system 50, the user ID and the password input via the operation unit 41 are notified to the remote maintenance system 50 as shown in FIG. By doing so, the login processing to the remote maintenance system 50 is executed (S101).

  When the login request is made from the connection terminal 40, the login permission judgment means 51 of the remote maintenance system 50 determines whether or not to allow the user to log in based on the combination of the user ID and password notified from the connection terminal 40. Based on the determination (S102), the determination result is returned to the connection terminal 40 (S103).

  Next, the operation of the remote communication system 10 when performing remote maintenance via the remote maintenance system 50 will be described.

  FIG. 7 is a sequence diagram of the operation of the remote communication system 10 when remote maintenance is executed via the remote maintenance system 50.

  When the user of the connection terminal 40 is logged in to the remote maintenance system 50, a specific image forming apparatus via the remote maintenance system 50 (hereinafter described as the image forming apparatus 20 in the description of the operation shown in FIG. 7). .) Remote maintenance can be instructed via the operation unit 41. When receiving the remote maintenance instruction via the remote maintenance system 50, the remote maintenance instruction unit 45b of the connection terminal 40 sets the device ID of the image forming apparatus 20 instructed via the operation unit 41 as shown in FIG. By notifying the remote maintenance system 50, the remote maintenance system 50 is instructed to perform remote maintenance instructed via the operation unit 41 (S121).

  When remote maintenance is instructed from the connection terminal 40, the remote maintenance means 52 of the remote maintenance system 50 performs maintenance instructed from the connection terminal 40 to the image forming apparatus 20 designated as the remote maintenance target from the connection terminal 40. Requested by XMPP (S122).

  When maintenance is requested from the remote maintenance system 50, the control unit 28 of the image forming apparatus 20 executes the maintenance requested from the remote maintenance system 50 (S123), and the maintenance execution result is sent to the remote maintenance system 50 by XMPP. Notification is made (S124).

  When the maintenance result is notified from the image forming apparatus 20, the remote maintenance unit 52 of the remote maintenance system 50 notifies the connection terminal 40 of the execution result notified from the image forming apparatus 20 (S 125).

  Next, the operation of the remote communication system 10 when starting a remote session will be described.

  FIG. 8 is a sequence diagram of the operation of the remote communication system 10 when starting a remote session. FIG. 9 is a sequence diagram of the device-side session establishment shown in FIG. FIG. 10 is a sequence diagram of session establishment on the connection terminal side shown in FIG.

  When the user of the connection terminal 40 is logged in to the remote maintenance system 50, the user specifies the specific client (hereinafter, described as the client 45c in the description of the operation shown in FIGS. 8 to 10). Via the operation unit 41 can be instructed to start a remote session with the image forming apparatus (hereinafter, described as the image forming apparatus 20 in the description of the operations shown in FIGS. 8 to 10). Upon receiving an instruction to start a remote session, the remote session control unit 45d of the connection terminal 40 receives the device ID of the image forming apparatus 20 instructed via the operation unit 41 and the operation as shown in FIGS. The remote maintenance system 50 is requested to start a remote session by notifying the remote maintenance system 50 of the application ID of the client 45c instructed via the unit 41 (S141).

  When the user of the connection terminal 40 instructs the start of a remote session with the image forming apparatus 20 via the operation unit 41, the user of the connection terminal 40 instructs the start of the remote session with the image forming apparatus 20 via the operation unit 41. Prior to this, it is preferable to separately notify the user of the image forming apparatus 20 in advance, for example, by telephone or the like that he / she wishes to start a remote session with the image forming apparatus 20.

  When the session management unit 53 of the remote maintenance system 50 accepts the request of S141, the session management unit 53 notifies the image forming apparatus 20 specified by the device ID notified in S141 of the application ID notified in S141, thereby providing a remote session. Is requested by XMPP (S142).

  Of the server applications of the image forming apparatus 20, the server application 28a specified by the application ID notified in S142 receives a request in S142 and accepts an instruction as to whether or not to approve the start of the remote session. The display screen 70 (see FIG. 11) is displayed on the display unit 22 (S143).

  FIG. 11 is a diagram illustrating an example of the remote session approval screen 70.

  The remote session approval screen 70 shown in FIG. 11 includes a message 71 asking whether or not to approve a remote session, a YES button 72 for accepting an instruction to approve the start of the remote session, and a remote session start disapproval. And a NO button 73 for receiving an instruction. A user of the image forming apparatus 20 can press either the YES button 72 or the NO button 73 via the operation unit 21.

  As shown in FIGS. 8 to 10, when the YES button 72 is pressed via the operation unit 21, the server application 28a notifies the remote maintenance system 50 by XMPP that the remote session has been approved (S144).

  Although not shown, when the NO button 73 is pressed via the operation unit 21 on the remote session approval screen 70 displayed on the display unit 22 in S143, the remote communication system 10 performs the following operation. To work. First, the server application 28a of the image forming apparatus 20 notifies the remote maintenance system 50 by XMPP that the remote session has not been approved. Next, the session management means 53 of the remote maintenance system 50 notifies the connection terminal 40 that the remote session has not been approved. Then, the remote session control means 45d of the connection terminal 40 displays on the display unit 42 that the remote session has not been approved.

  Upon receiving the notification in S144, the session management unit 53 of the remote maintenance system 50 requests connection information from the session relay system 60 through an API (Application Program Interface) (S145).

  Upon receiving the request of S145, the Cloud Hub 61 of the session relay system 60 generates a session ID for identifying the communication by the remote session in the session relay system 60 (S146), and performs remote maintenance using the generated session ID as connection information. The system 50 is notified by API (S147). As the session ID, for example, random identification information such as a RAN64 encoding so that a random number sequence generated by a hash algorithm such as HMAC (Hash-based Message Authentication Code) can be handled on HTTP (Hypertext Transfer Protocol) is used. Adopted.

  When the session ID is notified in S147, the session management means 53 of the remote maintenance system 50 generates a token for the remote maintenance system 50 to recognize the valid period of the remote session (S148), and the generated token and S147 The image ID is notified to the image forming apparatus 20 by XMPP (S149).

  Next, the session management unit 53 notifies the connection terminal 40 that the token and the session ID have been acquired (S150).

  When the token and session ID are notified in S149, the server application 28a of the image forming apparatus 20 activates the Cloud Hub Agent 28b in which the token and session ID notified in S149 are set (S171).

  Next, the Cloud Hub Agent 28b notifies the session relay system 60 of the set token and session ID, thereby requesting the session relay system 60 to establish a session (S172).

  Among the Cloud Hubs of the session relay system 60, the Cloud Hub 61 associated with the session ID notified in S172 receives the request in S172 and authenticates the token notified in S172 to the remote maintenance system 50 through the API. A request is made (S173). Therefore, the session management means 53 of the remote maintenance system 50 executes the authentication requested in S173 (S174), and notifies the authentication result to the session relay system 60 by the API (S175).

  When the Cloud Hub 61 of the session relay system 60 is notified of the success of the authentication in S175, the log indicating that the session with the image forming apparatus 20 has been started is stored in the session management database 64 (S176), and stored in S176. The log is notified to the remote maintenance system 50 together with the token by API (S177). Therefore, the session management means 53 of the remote maintenance system 50 manages the log notified in S177 as the log of the remote session identified by the token notified in S177 (S178), and indicates that this log has been managed as a session A reply is sent to the relay system 60 by API (S179).

  When the Cloud Hub 61 of the session relay system 60 is notified of the success of the authentication in S175, the Cloud Hub 61 notifies the image forming apparatus 20 that a session with the image forming apparatus 20 has been established (S180). That is, an HTTP-based WebSocket connection is established between the image forming apparatus 20 and the session relay system 60.

  The remote session control means 45d of the connection terminal 40 requests the connection information from the remote maintenance system 50 by polling until the connection information can be acquired from the remote maintenance system 50 after the process of S141 (S201).

  When the session management means 53 of the remote maintenance system 50 receives the request of S201, when the token has already been generated in S148, the session information is connected to the session ID notified from the session relay system 60 in S147. To the connection terminal 40 (S202).

  When the token and session ID are notified in S202, the remote session control unit 45d of the connection terminal 40 activates the client 45c in which the token and session ID notified in S202 are set (S203).

  Next, the client 45c notifies the session relay system 60 of the set token and session ID, thereby requesting the session relay system 60 to establish a session (S204).

  Among the Web Agents of the session relay system 60, when receiving the request in S204, the Web Agent 62 associated with the session ID notified in S204 notifies the Cloud Hub 61 of the token and session ID notified in S204. To request establishment of a session to the Cloud Hub 61 (S205).

  When receiving the request of S205, the Cloud Hub 61 of the session relay system 60 requests the remote maintenance system 50 by the API to authenticate with the token notified in S205 (S206). Therefore, the session management means 53 of the remote maintenance system 50 executes the authentication requested in S206 (S207), and notifies the authentication result to the session relay system 60 by API (S208).

  When the Cloud Hub 61 of the session relay system 60 is notified of the success of the authentication in S208, it stores a log indicating that the session with the connection terminal 40 has started in the session management database 64 (S209), and the log stored in S209 Together with the token to the remote maintenance system 50 by API (S210). Therefore, the session management means 53 of the remote maintenance system 50 manages the log notified in S210 as a log of the remote session identified by the token notified in S210 (S211), and indicates that this log is managed as a session A reply is sent to the relay system 60 by API (S212).

  When the Cloud Hub 61 of the session relay system 60 is notified of the success of the authentication in S208, the Cloud Hub 61 notifies the Web Agent 62 that the session with the connection terminal 40 has been established (S213). Therefore, the Web Agent 62 notifies the connection terminal 40 that the session with the connection terminal 40 has been established (S214). That is, an HTTP-based WebSocket connection is established between the connection terminal 40 and the session relay system 60.

  The session relay system 60 is established between the WebSocket connection established with the image forming apparatus 20 by the operation shown in FIGS. 8 to 10 and the connection terminal 40 by the operation shown in FIGS. The WebSocket connection is associated with the session ID. Therefore, a remote session is established by the operations shown in FIGS.

  Next, the operation of the remote communication system 10 when the image forming apparatus 20 operates in response to a request from the connection terminal 40 via a remote session will be described.

  FIG. 12 is a sequence diagram of the operation of the remote communication system 10 when the image forming apparatus 20 operates in response to a request from the connection terminal 40 via a remote session.

  When a remote session is established by the operations shown in FIGS. 8 to 10, the user of the connection terminal 40 can instruct a request for the image forming apparatus 20 via the operation unit 41. When the client 45c of the connection terminal 40 receives a request instruction for the image forming apparatus 20, as shown in FIG. 12, the client 45c generates an HTTP request for notifying the request instructed via the operation unit 41 (S231). .

  Here, the structure of the HTTP request generated in S232 will be described.

  FIG. 13A shows HTTP data 80 processed by the server application 28a. FIG. 13B is a diagram showing HTTP data 90 for relaying the HTTP data 80 shown in FIG. 13A on the Internet.

  As shown in FIG. 13, the HTTP data 80 includes an HTTP header 81 and an HTTP body 82. The HTTP data 90 includes an HTTP header 91 for relay on the Internet, and HTTP data 80 as an HTTP body 92. The HTTP header 91 includes an application ID 91a for specifying the server application 28a.

  The client 45c generates HTTP data having the same structure as the HTTP data 90 shown in FIG. 13B as an HTTP request for notifying a request instructed via the operation unit 41. Here, the session ID is stored in a location corresponding to the HTTP header 91.

  As shown in FIG. 12, the client 45c of the connection terminal 40 transmits the HTTP request generated in S231 to the session relay system 60 through the WebSocket connection (S232).

  Among the Web Agents of the session relay system 60, when the Web Agent 62 associated with the session ID included in the HTTP request transmitted in S232 is transmitted in S232, the HTTP request is transmitted to the Cloud Hub 61. Pass (S233). Accordingly, the Cloud Hub 61 transmits the HTTP request to the image forming apparatus 20 through the WebSocket connection corresponding to the session ID included in the HTTP request (S234).

  When an HTTP request is transmitted in S234, the Cloud Hub Agent 28b of the image forming apparatus 20 identifies the server application 28a corresponding to the application ID included in the HTTP request (S235).

  Next, the Cloud Hub Agent 28b generates an HTTP request obtained by removing the HTTP header for relay on the Internet from the HTTP request transmitted in S234 (S236). Here, the HTTP request generated in S236 is HTTP data having the same structure as the HTTP data 80 shown in FIG.

  Next, the Cloud Hub Agent 28b passes the HTTP request generated in S236 to the server application 28a identified in S235 (S237).

  When the HTTP request is passed in S237, the server application 28a generates an HTTP response corresponding to the HTTP request (S238). Here, the HTTP response generated in S238 is HTTP data having the same structure as the HTTP data 80 shown in FIG.

  Next, the server application 28a passes the HTTP response generated in S238 to the Cloud Hub Agent 28b (S239).

  When the HTTP response is passed in S239, the Cloud Hub Agent 28b generates an HTTP response in which an HTTP header for relay on the Internet is attached to the HTTP response passed in S239 (S240). Here, the HTTP response generated in S240 is HTTP data having the same structure as the HTTP data 90 shown in FIG. The session ID is stored in a location corresponding to the HTTP header 91.

  The Cloud Hub Agent 28b transmits the HTTP response generated in S240 to the session relay system 60 through the WebSocket connection (S241).

  Among the Cloud Hubs of the session relay system 60, the Cloud Hub 61 associated with the session ID included in the HTTP response transmitted in S241 sends the HTTP response to the Web Agent 62 when the HTTP response is transmitted in S241. Pass (S242). Therefore, the Web Agent 62 transmits this HTTP response to the connection terminal 40 through the WebSocket connection corresponding to the session ID included in this HTTP response (S243).

  Therefore, the client 45c of the connection terminal 40 can receive the HTTP response transmitted in S243.

  Next, the operation of the remote communication system 10 when ending the remote session will be described.

  FIG. 14 is a sequence diagram of the operation of the remote communication system 10 when the remote session is terminated. FIG. 15 is a sequence diagram for ending the device-side session shown in FIG.

  The user of the connection terminal 40 uses a specific server application (hereinafter, FIG. 14 and FIG. 15) of a specific image forming apparatus (hereinafter, described as the image forming apparatus 20 in the description of the operation shown in FIGS. 14 and 15). In the description of the operation shown in FIG. 5, the server application 28a is described as an example). When the remote session control unit 45d of the connection terminal 40 receives the instruction to end the remote session, as shown in FIG. 14 and FIG. 15, the client 45c receives the token and session ID of the remote session instructed via the operation unit 41. Is notified to the client 45c to end the remote session (S261). Therefore, the client 45c requests the session relay system 60 to end the remote session requested in S261 by WebSocket connection (S262).

  Among the Web Agents of the session relay system 60, when the Web Agent 62 associated with the session ID included in the request in S262 is requested to end the remote session in S262, the Web Agent 62 passes this request to the Cloud Hub 61 (S263). Therefore, the Cloud Hub 61 requests the remote maintenance system 50 to end the remote session identified by the token included in this request by using the API (S264).

  When the session management unit 53 of the remote maintenance system 50 receives the request of S264, it requests the end of the remote session to the image forming apparatus 20 that is the target of the remote session of S264 by XMPP (S265).

  Next, the session management means 53 notifies the session relay system 60 by API that the request for termination of the remote session has been accepted (S266).

  When the Cloud Hub 61 of the session relay system 60 is notified of acceptance of the remote session termination request in S266, it stores a log indicating that the session with the connection terminal 40 is terminated in the session management database 64 (S267). The log stored in S267 is notified to the remote maintenance system 50 together with the token by API (S268). Therefore, the session management means 53 of the remote maintenance system 50 manages the log notified in S268 as a log of the remote session identified by the token notified in S268 (S269), and indicates that this log is managed as a session A reply is sent to the relay system 60 by API (S270).

  When receiving the reply in S270, the Cloud Hub 61 of the session relay system 60 notifies the Web Agent 62 of the end of the WebSocket connection between the connection terminal 40 and the session relay system 60 (S271). Therefore, the Web Agent 62 notifies the connection terminal 40 of the end of the WebSocket connection between the connection terminal 40 and the session relay system 60 (S272).

  Upon receiving the notification of S272, the client 45c of the connection terminal 40 notifies the remote session control means 45d of the end of the WebSocket connection between the connection terminal 40 and the session relay system 60 (S273), and ends its operation. .

  Therefore, the remote session control unit 45d can display on the display unit 42 that the WebSocket connection between the connection terminal 40 and the session relay system 60 has ended, for example.

  Among the server applications of the image forming apparatus 20, when receiving the request of S265, the server application 28a of the target remote session received in S265 notifies the Cloud Hub Agent 28b of the token and session ID of the remote session. Thus, the end of the remote session is requested to the Cloud Hub Agent 28b (S291). Accordingly, the Cloud Hub Agent 28b requests the session relay system 60 to end the remote session requested in S291 through the WebSocket connection (S292).

  When receiving the request of S292, the Cloud Hub 61 of the session relay system 60 requests the remote maintenance system 50 to end the remote session identified by the token included in this request by the API (S293).

  Upon receiving the request of S293, the session management means 53 of the remote maintenance system 50 notifies the session relay system 60 by API that the remote session termination request has been received (S294).

  When the Cloud Hub 61 of the session relay system 60 is notified of acceptance of the remote session termination request in S294, it stores a log indicating that the session with the image forming apparatus 20 is terminated in the session management database 64 (S295). The log stored in S295 is notified to the remote maintenance system 50 together with the token by API (S296). Therefore, the session management means 53 of the remote maintenance system 50 manages the log notified in S296 as the log of the remote session identified by the token notified in S296 (S297), and indicates that the log is managed as a session A reply is sent to the relay system 60 by API (S298).

  When receiving the reply in S298, the Cloud Hub 61 of the session relay system 60 notifies the image forming apparatus 20 of the end of the WebSocket connection between the image forming apparatus 20 and the session relay system 60 (S299).

  When receiving the notification of S299, the Cloud Hub Agent 28b of the image forming apparatus 20 ends its operation.

  Note that the session management unit 53 of the remote maintenance system 50 notifies that the log indicating the end of the session between the image forming apparatus 20 and the session relay system 60 has been notified from the session relay system 60, and the connection terminal 40 and the session relay. The remote session of the image forming apparatus 20 and the connection terminal 40 via the session relay system 60 ends when it is confirmed that the log indicating the end of the session between the systems 60 has been notified from the session relay system 60. Judge that When the session management unit 53 determines that the remote session of the image forming apparatus 20 and the connection terminal 40 via the session relay system 60 has not ended, the session management unit 53 and the connection terminal 40 via the session relay system 60 Do not allow establishment of 40 new remote sessions.

  As described above, in the remote communication system 10, the image forming apparatus 20 establishes the WebSocket connection using the session ID with the session relay system 60 (S171 to S180), and the connection terminal 40 performs the session relay. A WebSocket connection using a session ID is established with the system 60 (S201 to S214), and the session relay system 60 is established between the connection established with the connection terminal 40 and the image forming apparatus 20. The remote session is relayed by associating the established connection with the session ID (S231 to S243). With this configuration, in the remote communication system 10, among the connection terminals existing outside the network to which the image forming apparatus 20 belongs, only the connection terminal 40 notified of the session ID from the remote maintenance system 50 is transmitted by the session relay system 60. Since a remote session with the relayed image forming apparatus 20 is established, it is possible to improve security when the image forming apparatus 20 is controlled from the connection terminal 40 existing outside the network to which the image forming apparatus 20 belongs.

  In the remote communication system 10, the session ID used by the WebSocket connection established between the image forming apparatus 20 and the session relay system 60 and the WebSocket connection established between the connection terminal 40 and the session relay system 60 are used. Session ID is the same session ID. With this configuration, the remote communication system 10 does not need to associate two different session IDs with each other in the session relay system 60, so that the session ID processing in the session relay system 60 can be simplified. The session ID used by the WebSocket connection established between the image forming apparatus 20 and the session relay system 60, and the session ID used by the WebSocket connection established between the connection terminal 40 and the session relay system 60 May be different from each other as long as they are associated with each other in the session relay system 60.

  In the remote communication system 10, at least one of the WebSocket connection established between the session relay system 60 and the connection terminal 40 and the WebSocket connection established between the session relay system 60 and the image forming apparatus 20 is SSL ( It may be an encrypted communication connection such as Secure Sockets Layer. With this configuration, the remote communication system 10 encrypts at least part of the path of the remote session between the connection terminal 40 and the image forming apparatus 20 that is relayed by the session relay system 60. On the other hand, the occurrence of illegal use such as cracking can be suppressed.

  In the remote communication system 10, the remote maintenance system 50 receives a request for starting a remote session (S <b> 141) from the connection terminal 40 when the user of the connection terminal 40 is logged in to the remote maintenance system 50. If the remote session start request is not received from the server, the notification of the session ID to the image forming apparatus 20 (S149) and the notification of the session ID to the connection terminal 40 (S202) are not executed. With this configuration, the remote communication system 10 allows the connection terminal 40 and the image forming apparatus 20 to be relayed by the session relay system 60 only when the user of the connection terminal 40 can log in to the remote maintenance system 50. Since the remote session is established, the security of the remote session can be improved.

  In the remote communication system 10, the remote maintenance system 50 notifies the image forming apparatus 20 of the session ID (S 149) and the connection terminal 40 when the start of the remote session is not approved by the user of the image forming apparatus 20. The session ID notification (S202) is not executed. With this configuration, the remote communication system 10 is connected between the connection terminal 40 and the image forming apparatus 20 that is relayed by the session relay system 60 only when the start of the remote session is approved by the user of the image forming apparatus 20. Since the remote session is established, the security of this remote session can be improved. Note that the remote maintenance system 50 notifies the session ID to the image forming apparatus 20 and the session ID to the connection terminal 40 when the user of the image forming apparatus 20 has not approved the start of the remote session. A configuration in which any one of them is not executed may be used.

  In the remote communication system 10, the session relay system 60 changes the session ID every time a session ID is requested from the remote maintenance system 50 (S145) (S146). With this configuration, the remote communication system 10 changes the session ID every time a remote session between the connection terminal 40 and the image forming apparatus 20 established by the session relay system 60 is established. Can be improved.

  The remote communication system 10 displays the same screen as the screen displayed on the image forming apparatus 20 on the connection terminal 40 existing outside the network to which the image forming apparatus 20 belongs, thereby forming an image from the connection terminal 40. Since the apparatus 20 is operated, the image forming apparatus 20 can be easily operated at low cost from the connection terminal 40 existing outside the network to which the image forming apparatus 20 belongs. For example, the connection terminal 40 displays a setting screen of the image forming apparatus 20 on the display unit 42 to perform various settings for the image forming apparatus 20 such as an address book setting of the image forming apparatus 20. Can be executed by users. Further, the connection terminal 40 displays, for example, a confirmation screen of various information of the image forming apparatus 20 on the display unit 42, thereby confirming an error that has occurred in the image forming apparatus 20 and the number of sheets printed by the image forming apparatus 20. The user of the connection terminal 40 can confirm various information such as confirmation and the remaining amount of toner in the image forming apparatus 20. Further, the connection terminal 40 displays a software installation screen for the image forming apparatus 20 on the display unit 42, for example, to install firmware to the image forming apparatus 20, to install an application to the image forming apparatus 20, etc. It is possible to cause the user of the connection terminal 40 to install various types of software on the image forming apparatus 20.

  Since the connection terminal 40 can communicate with various applications in the image forming apparatus 20 through a remote session, various functions other than maintenance for the image forming apparatus 20 can be realized.

  In this embodiment, the remote communication system 10 can perform remote maintenance as shown in FIG. 7 via a remote maintenance system 50 as a session management system. However, the remote communication system 10 may not be able to perform remote maintenance via the session management system.

DESCRIPTION OF SYMBOLS 10 Remote communication system 20 Image forming apparatus 40 Connection terminal (electronic device)
50 Remote maintenance system (session management system)
60 session relay system

Claims (7)

An image forming apparatus;
An electronic device existing outside the network to which the image forming apparatus belongs;
A session relay system that relays a session between the image forming apparatus and the electronic device;
A session management system for managing the session,
The session relay system notifies the session management system of a first session ID and a second session ID for identifying communication by the session in the session relay system,
The session management system executes notification of the first session ID to the electronic device and notification of the second session ID to the image forming apparatus,
The electronic device establishes a connection using the first session ID with the session relay system,
The image forming apparatus establishes a connection using the second session ID with the session relay system,
The session relay system associates a connection established with the electronic device and a connection established with the image forming apparatus by the first session ID and the second session ID. A remote communication system that relays the session.   The remote communication system according to claim 1, wherein the first session ID and the second session ID are the same session ID.   A connection using the first session ID established between the session relay system and the electronic device, and the second session ID established between the session relay system and the image forming apparatus. The remote communication system according to claim 1 or 2, wherein at least one of the connections to be used is an encrypted communication connection. The session management system accepts a request to start the session from the electronic device when a user of the electronic device is logged in to the session management system,
When the session management system does not accept the request for starting the session from the electronic device, the session management system notifies the electronic device of the first session ID and notifies the image forming apparatus of the second session ID. The remote communication system according to any one of claims 1 to 3, wherein at least one of the notifications is not executed.   When the session start is not approved by the user of the image forming apparatus, the session management system notifies the electronic apparatus of the first session ID and the second image forming apparatus. 5. The remote communication system according to claim 1, wherein at least one of notification of session ID is not executed. When the first session ID and the second session ID are requested from the session management system, the session relay system sends the first session ID and the second session ID to the session management system. Notify
The session relay system changes at least one of the first session ID and the second session ID each time the first session ID and the second session ID are requested from the session management system. The remote communication system according to claim 1, wherein the remote communication system is a remote communication system. The electronic device receives screen data displayed on the image forming apparatus from the image forming apparatus via the session, displays a screen based on the data, and displays the screen based on the data. Receiving an operation and transmitting the operation to the image forming apparatus via the session;
The remote communication system according to claim 1, wherein the image forming apparatus operates in response to the operation received from the electronic device via the session.

Images