JP5176394B2 - COMMUNICATION DEVICE, NETWORK SYSTEM, COMMUNICATION DEVICE CONTROL METHOD, AND COMPUTER PROGRAM - Google Patents

Description

  The present invention relates to a communication device that exchanges data, a network system that includes a plurality of communication devices, a data exchange method, and the like.

  In recent years, not only personal computers but also image forming apparatuses called MFPs (Multi Function Peripherals) or multifunction peripherals have been equipped with a TCP / IP communication function. Along with this, it has become possible to easily construct a network system called an intranet in an organization such as a government office, a company, or a school by using a personal computer or an image forming apparatus. And it became possible to mutually use the functions between the devices constituting the network system.

  Patent Document 1 discloses a method of sharing functions between apparatuses. According to the method disclosed in Japanese Patent Laid-Open No. 2004-228688, for each multi-function peripheral configuring the network system, a control unit that searches for a predetermined device included in another multi-function peripheral and causes the device to execute a function is provided.

  In addition, each device constituting the network system is used by a plurality of users. As the number of users increases, the amount of confidential information handled by the network system also increases. In order to prevent leakage of confidential information to others, it is necessary for each user to pay close attention. However, the larger the number of users, the more difficult it is to ask all users. No matter how much care you take, you can accidentally leak. Therefore, a mechanism for security measures is introduced into the network system.

  Patent Documents 2 and 3 disclose communication restriction methods for protecting the security of a network system.

  According to the method disclosed in Patent Document 2, a communication instruction is received from a host computer connected to a communication device, whether or not to restrict data communication to a predetermined destination is set, and data communication to a predetermined destination is set. Is set so as not to limit the data, the data communication to the predetermined destination is executed according to the communication instruction. When the setting for restricting the data communication to the predetermined destination is made, the data communication to the predetermined destination is terminated without being executed.

According to the method disclosed in Patent Document 3, in a communication apparatus that inputs a destination by a user operation and performs a communication operation to the destination, a telephone directory in which one or more pieces of destination information to be referred to when connecting to each destination are registered A destination direct input means for directly inputting a destination, and a destination direct input prohibition setting means for setting whether to prohibit use of the destination direct input means when a user inputs a destination. . When it is registered in the destination direct input prohibition setting means that the use of the destination direct input means is prohibited, the input operation of the destination direct input means is prohibited and the destination referring to the telephone directory means Allow input operations.
JP 2006-184935 A JP 2006-301857 A JP 2005-268922 A

  By the way, in the network system, there are devices having a function of performing communication with the outside of the network system, and there are devices not having the function.

  If this function is shared, a device that does not have this function can communicate with the outside of the network system.

  For example, when one device in the network system has a fax function, if the fax function is shared, not only that device but also other devices can communicate with the outside of the network system. it can. That is, a device that does not have a fax function can have a device that has a fax function substitute for communication with the outside of the network system.

  Naturally, security measures are also required when the communication with the outside of the network system is performed. If security-related settings are not applied properly during substitution, unexpected troubles may occur.

  However, the security rules set in advance for each device may differ from device to device. In this case, it is important how to determine whether or not to execute communication at the time of substitution. However, the conventional method cannot distinguish this well.

  In view of such a problem, the present invention determines whether or not communication with a specific partner outside the network system may be performed for security when one device substitutes for the other device. It is an object to discriminate more accurately than in the past.

A communication apparatus according to an aspect of the present invention is a communication apparatus provided in a predetermined network system, and stores external communication restriction information storage means for storing external communication restriction information indicating restrictions on communication with the outside of the network system. And a designation method in which designation of a device as an external counterpart device that is a communication partner of the communication device and is outside the network system is prohibited by inputting identification information of the device one by one Despite being indicated in the external communication restriction information, when the user makes the designation by the designation method, it is permitted to communicate with the communication apparatus that is outside the network system. display a list of there devices, a list display unit, device user from the list is selected as the external partner device That communicates the query whether it is possible for security, performed on a second communication device having a function of communicating with the apparatus is and the selection provided to the network system, the external communication The external communication restriction stored in the external communication restriction information storage means for determining whether or not to allow communication with a device selected by the user as the external partner device from the list. Based on information and an answer from the second communication device regarding the inquiry, external communication permission / rejection determination means, and a device selected by the user as the external counterpart device from the list may communicate with If it is determined by said external communication acceptability determining means, a request to the effect to be performed in place of the communication with the selected device the communication device, the second through Performed on apparatus, and having a communication substitute request means.

A communication apparatus according to another aspect of the present invention is a communication apparatus provided in a predetermined network system, and stores external communication restriction information indicating external communication restriction information indicating restrictions on communication with the outside of the network system. A storage means, a device information storage means for storing first device information indicating a device outside the network system and authorized to communicate with the communication device, and a communication partner of the communication device. A second communication device provided in the network system and external to the network system and having a function of communicating with an external counterpart device that is a device outside the network system. Device information acquisition means for acquiring second device information indicating a device authorized to communicate with the second communication device; Although the external communication restriction information indicates that the designation method in which designation of a device as an external counterpart device is performed by inputting the identification information of the device one character at a time is specified by the user, In accordance with the designation method, based on the first device information stored in the device information storage unit and the second device information acquired by the device information acquisition unit, the network system Displaying a list of devices that are external and authorized to communicate with the communication device and devices that are external to the network system and authorized to communicate with the second communication device; Whether it is possible to communicate with the list display means and the device selected by the user as the external counterpart device from the list Whether to communicate with the device selected by the user as the external partner device from the list. External communication permission / rejection determination means for performing the determination based on the external communication restriction information stored in the external communication restriction information storage means and an answer from the second communication device regarding the inquiry, and from the list Request that communication with the selected device should be performed instead of the communication device when the external communication permission / non-permission determining means determines that the user may communicate with the device selected as the external counterpart device Communication proxy requesting means for performing the above operation on the second communication device.

A network system according to an aspect of the present invention is a network system including a first communication device and a second communication device that can be connected to each other, and the first communication device includes an external device of the network system. First external communication restriction information storage means for storing first external communication restriction information indicating restrictions on communication with the communication device, and a device that is a communication partner of the first communication device and is outside the network system. In spite of the fact that the first external communication restriction information indicates that the designation method in which designation of a device as an external partner device is performed by inputting the identification information of the device one by one is prohibited, When the designation is made by the designation method, it is permitted to communicate with the first communication device that is outside the network system. A list display means for displaying a list of existing devices, and an inquiry as to whether communication with a device selected by the user as the external counterpart device from the list is possible in terms of security. External communication availability inquiry means for the communication device is provided, and the second communication device stores second external communication restriction information indicating restriction on communication with the outside of the network system. Second external communication restriction information storage means and answer means for performing an answer to the inquiry based on the second external communication restriction information. The first communication device further includes the list. Determining whether or not communication with a device selected by the user as the external partner device from among the first external communication restriction information and the second communication device is performed. If the external communication permission / non-permission determination unit determines that communication with the external communication permission / non-permission device may be performed based on the first communication, the communication with the external partner device is performed according to the first communication. A proxy device requesting means for making a request to be performed instead of the device to the second communication device, and the second communication device further includes the first communication device. Communication proxy means for proxying communication with the external counterpart device based on the request is provided.

A network system including a first communication device and a second communication device that can be connected to each other according to another aspect of the present invention, wherein the first communication device is connected to the outside of the network system. First external communication restriction information storage means for storing first external communication restriction information indicating restrictions relating to communication, and being allowed to communicate with the first communication device outside the network system. First device information storage means for storing first device information indicating the device, and the second communication device is external to the network system and communicates with the second communication device. Second device information storage means for storing second device information indicating a device permitted to perform is provided, and the first communication device further includes the second communication device. The device information acquisition means for acquiring the second device information and identification of the device as an external partner device that is a communication partner of the first communication device and a device external to the network system Even though the first external communication restriction information indicates that the designation method performed by inputting information one character at a time is prohibited, when the user performs the designation by the designation method, Based on the first device information stored in the first device information storage means and the second device information acquired by the device information acquisition means, the first information is outside the network system and the first device information is stored. A device that is permitted to communicate with a communication device and a device that is external to the network system and that communicates with the second communication device. A list display means for displaying a list of devices, and an inquiry as to whether or not it is possible to communicate with a device selected by the user as the external counterpart device from the list, in the second communication External communication permission / inquiry inquiry means for the device is provided, and the second communication device further stores second external communication restriction information indicating restriction regarding communication with the outside of the network system. A second external communication restriction information storage means; and an answer means for performing an answer to the inquiry based on the second external communication restriction information. The first communication device further includes the The first stored in the first external communication restriction information storage means determines whether or not the user may communicate with the device selected as the external counterpart device from the list. Communication may be performed with an external communication permission / rejection determination unit that is performed based on the external communication restriction information and the answer from the second communication device, and a device that the user has selected as the external partner device from the list. A communication agent that makes a request to the second communication device to perform communication with the selected device instead of the first communication device when determined by the external communication permission determination unit Requesting means is provided, and the second communication device is further provided with communication proxy means for proxying communication with the external counterpart device based on the request from the first communication device. It is characterized by that.

  According to the present invention, when one device substitutes the other device for communication with a specific partner outside the network system, it is more accurately determined whether or not the communication can be performed for security reasons. can do.

  1 is a diagram showing an example of the overall configuration of the intranet 1, FIG. 2 is a diagram showing an example of the appearance of the image processing device 2, FIG. 3 is a diagram showing an example of the hardware configuration of the image processing device 2, and FIG. FIG. 5 is a diagram illustrating an example of a functional configuration of the image processing apparatus 2 having a transmission proxy request program, and FIG. 5 is a diagram illustrating an example of a functional configuration of the image processing apparatus 2 having a transmission proxy program.

  As shown in FIG. 1, the intranet 1 includes a plurality of image processing apparatuses 2A, 2B, 2C,..., An LDAP server 3, a router 4, and a communication line 5. The intranet 1 is constructed in an organization such as a government office, a company, or a school, for example.

  The intranet 1 may be a network system in a narrow area such as a LAN, or may be a plurality of LANs that are separated from each other (for example, a LAN in each of a Tokyo office, an Osaka office, and a Nagoya office). ) May be a network system such as a VPN (Virtual Private Network).

  The image processing apparatuses 2A, 2B, 2C,..., The LDAP server 3, and the router 4 are given unique IP addresses and MAC addresses.

  The image processing apparatuses 2A, 2B, 2C,... And the LDAP server 3 are connected to each other via a communication line 5 and exchange data based on a protocol such as FTP (File Transfer Protocol) or SMB (Server Message Block). be able to. Furthermore, data can be exchanged with an external network device via the router 4. Hereinafter, the image processing apparatuses 2A, 2B, 2C,... Are collectively referred to as “image processing apparatus 2”.

  The image processing apparatus 2 is a processing apparatus in which various functions such as copying, scanning, faxing, network printing, e-mail, or box are integrated. In general, it may be called a multifunction peripheral, an MFP (Multi Function Peripherals), or an image forming apparatus.

  The “box function” is a storage area corresponding to a folder or directory in a personal computer called a “box” or “personal box” for each user who uses the image processing apparatus 2. It is a function that allows you to save document data etc. in file units in the box. One box can be shared by a plurality of users.

  “Network printing” is a function for receiving image data from a personal computer via a communication line and printing the image on paper. Sometimes called a “network printer function” or a “PC print function”.

  2 and 3, the image processing apparatus 2 includes a CPU 20a, a RAM 20b, a ROM 20c, a hard disk 20d, a scanner 20e, a printing unit 20f, an operation button group 20g, displays 20h1, 20h2, a document feeder 20j, and a paper feeding unit 20k. , A tray 20m, a modem 20n, and a network card 20p.

  The operation button group 20g includes a plurality of buttons (keys) for inputting numbers, characters, symbols, and the like and a circuit for recognizing and transmitting the pressed button to the CPU 20a.

  The displays 20h1 and 20h2 are a screen for giving a message or an instruction to the user, a screen for the user to input setting contents and processing contents, and a screen showing an image read by the scanner 20e and a processing result by the CPU 20a. Etc. are displayed. In the present embodiment, touch panels are used as the displays 20h1 and 20h2. Therefore, the displays 20h1 and 20h2 have a function of detecting a position on the touch panel touched by the user with a finger and transmitting a signal indicating the detection result to the CPU 20a. Hereinafter, the displays 20h1 and 20h2 are collectively referred to as “display 20h”.

  As described above, the operation button group 20g and the display 20h serve as a user interface for the user to directly operate the image processing apparatus 2.

  The scanner 20e optically reads images such as photographs, characters, pictures, charts and the like drawn on a document, and generates digital image data. The image data obtained in this way is used for printing in the printing unit 20f. Alternatively, it is converted into a file in a format such as TIFF (Tagged Image File Format) or PDF (Portable Document Format) and stored in the hard disk 20d or transmitted to another device. The document feeder 20j is used to sequentially send one or more original sheets to the scanner 20e.

  The printing unit 20f prints the image read by the scanner 20e on a recording sheet such as paper or film. The paper supply unit 20k is used to supply a recording sheet suitable for an image to be printed to the printing unit 20f. The recording sheet on which the image is printed by the printing unit 20f, that is, the printed matter, is discharged to the tray 20m.

  The modem 20n is an interface for communicating image data with a fax terminal using a G3 fax protocol via a public line. However, the modem 20n is an optional product. Therefore, some image processing apparatuses 2 have the modem 20n and some image processing apparatuses 2 do not have the modem 20n.

  The network card 20p is a NIC (Network Interface Card) for performing so-called IP communication by TCP / IP or the like with another image forming apparatus 2 or a device external to the intranet 1. When performing fax communication (so-called SIP-FAX) using SIP (Session Initiation Protocol), the network card 20p is used instead of the modem 20n.

  In the ROM 20c or the hard disk 20d, a transmission proxy request program, which is a program for having the other image processing apparatus 2 proxy the transmission of data to the fax terminal, is installed. By starting and executing the transmission proxy request program, the screen display control unit 201, the transmission proxy necessity determination unit 202, the proxy request destination search unit 203, the transmission destination suitability determination unit 204, and the appropriate transmission destination list generation unit illustrated in FIG. 205 and the functions of the transmission proxy request unit 206 are realized in the image processing apparatus 2 itself.

  Furthermore, programs and data for realizing the address book storage unit 231 and the communication restriction information storage unit 232 are stored in the ROM 20c or the hard disk 20d.

  The ROM 20c or the hard disk 20d of the image processing apparatus 2 having the modem 20n is further installed with a transmission proxy program that is a program for proxying the transmission of data to the fax terminal according to a request from another image processing apparatus 2. Yes. By starting and executing the transmission proxy program, the functions of the address book adding unit 211, the direct input permission / rejection response unit 212, and the transmission proxy control unit 213 shown in FIG. 5 are realized in the image processing apparatus 2 itself.

  The LDAP server 3 stores and manages an address book shared by members (users) of the organization in which the intranet 1 is constructed. The address book can be called to the image processing apparatus 2 by LDAP (Lightweight Directory Access Protocol).

  6 is a diagram illustrating an example of the address book 6AD, FIG. 7 is a diagram illustrating an example of the transmission destination designation screen HG1, FIG. 8 is a diagram illustrating an example of the LDAP search screen HG2, and FIG. 9 is a transmission destination address book presentation process. It is a flowchart explaining the example of a flow.

  Next, the processing contents of each unit of the image processing apparatus 2 shown in FIGS. 4 and 5 will be described in detail. For the sake of simplicity of explanation, a case where the functions of electronic mail and SIP-FAX are provided in all image processing apparatuses 2 will be described as an example.

  In FIG. 4, the address book storage unit 231 stores an address book 6AD for users who mainly use the image processing apparatus 2 as shown in FIG. In the address book 6AD, one or a plurality of records are stored for each device such as an organization or an individual on which the user exchanges information on a daily basis.

  “Name” indicates the name of the user of the apparatus. “Protocol” indicates a protocol used in communication with the apparatus. The “identification code” indicates a code for identifying the device when performing communication, such as an e-mail address or a fax number.

  The “prohibition flag” indicates whether communication with the device is prohibited. That is, it can be said that the prohibition flag is also one of the communication restriction information. When the prohibition flag indicates “1”, communication with the apparatus using the protocol is prohibited. When the prohibition flag indicates “0”, the communication is permitted in principle. However, other requirements described later are also taken into consideration for whether communication is permitted or not.

  The structure of the address book (hereinafter referred to as “address book 7AD”) of the LDAP server 3 is the same as that of the address book 6AD.

  Returning to FIG. 4, the communication restriction information storage unit 232 stores communication restriction information 6TS indicating restrictions on communication in the image processing apparatus 2. In particular, in the present embodiment, whether to directly specify the identification code (e-mail address or fax number) of the data transmission destination one by one (hereinafter referred to as “direct input”) is permitted or prohibited. Each image processing apparatus 2 is determined. Whether the direct input is permitted or prohibited is indicated in the communication restriction information 6TS of each image processing apparatus 2.

  The screen display control unit 201 causes the display 20h to display a screen that allows the user to perform an operation for data transmission as illustrated in FIG. 7 or FIG. Details of these screens will be described later.

The transmission proxy necessity determination unit 202 performs a process of determining whether or not it is necessary to have another image processing apparatus 2 perform the transmission of data using the G3 fax protocol to the fax terminal designated by the user. In particular,
(Requirement A-1) The image processing apparatus 2 itself has hardware and software necessary for communication using the G3 fax protocol, such as a modem 20n and fax communication software.
(Requirement A-2) These hardware and software operate normally.
It is checked whether the two requirements are satisfied. If both requirements are satisfied, it is determined that the substitution is unnecessary. On the other hand, if the requirements are not met, it is determined that a substitution is necessary.

  Hereinafter, transmission of data using the G3 fax protocol is referred to as “G3 fax transmission”.

  The proxy request destination search unit 203, when the transmission proxy necessity determination unit 202 determines that the G3 fax transmission needs to be proxyed, sets the proxy request destination search destination from other image processing apparatuses 2 For example, as follows.

The proxy request destination search unit 203 inquires of all other image processing apparatuses 2 whether or not the following requirement B-1 and requirement B-2 necessary for proxy of G3 fax transmission are satisfied.
(Requirement B-1) A transmission agent program is provided and can be executed normally.
(Requirement B-2) Both the requirements A-1 and A-2 are satisfied.

  Then, the image processing apparatus 2 that has returned an answer indicating that both the requirement B-1 and the requirement B-2 are satisfied is set as a proxy request destination. In addition, when a plurality of image processing apparatuses 2 return such an answer, an arbitrary one is selected as a request destination. For example, the image processing apparatus 2 having the highest specification is selected. Alternatively, the image processing apparatus 2 that has returned the answer first is selected. Alternatively, the image processing apparatus 2 whose modem 20n is not currently busy is selected.

  The transmission destination suitability determination unit 204 determines whether or not the transmission destination (destination) designated by the user is appropriate as a transmission destination for G3 fax transmission, for example, as follows.

  When a predetermined command is input, the screen display control unit 201 displays a transmission destination designation screen HG1 as shown in FIG. 7 on the display 20h. The transmission destination designation screen HG1 is provided with a transmission destination candidate list in which transmission destination candidates are arranged and a plurality of keys for direct input as an interface for allowing the user to specify a transmission destination. This destination candidate list is generated as follows.

  If it is determined by the transmission proxy necessity determination unit 202 that it is not necessary to have the G3 fax transmission delegated, the address stored in the address book storage unit 231 of the image processing apparatus 2 itself (that is, the local) Of the records in the book 6AD, those whose prohibition flag is “0” are extracted, and the destination candidate list is generated by arranging the name and identification code (e-mail address or fax number) indicated in the record. .

  On the other hand, when it is determined that it is necessary to have a proxy, the request destination searched for by the proxy request destination search unit 203 is requested for the address book of the request destination.

  Then, the address book assigning unit 211 of the request destination in FIG. 5 extracts the records in the address book 6AD stored in the address book storage unit 231 of the request destination that have the prohibition flag “0”. . Then, an address book indicating only the extracted record is transmitted to the request source and given.

  The screen display control unit 201 records the name and identification code indicated in the address book record acquired from the request destination and the record whose prohibition flag is “0” among the records in the address book 6AD of the image processing apparatus 2 itself. The destination candidate list is generated by arranging the names and identification codes shown in FIG.

  Here, when the user selectively specifies a transmission destination from among the identification codes shown in the transmission destination candidate list, the transmission destination appropriateness determination unit 204 determines that the specified transmission destination is appropriate. To do.

  On the other hand, when the user designates a transmission destination by direct input, the following determination is made. If the communication restriction information 6TS of its own communication restriction information storage unit 232 indicates that direct input is prohibited, it is determined that the designated transmission destination is inappropriate. Also, the request destination is inquired as to whether direct input is prohibited at the request destination.

  If direct input is prohibited by either the request source or the request destination, it is determined that the transmission destination is inappropriate.

If direct input is permitted at both the request source and the request destination, whether or not the transmission destination is suitable as a transmission destination is determined based on the local address book 6AD and the address book 7AD of the LDAP server 3. That is,
(Requirement C-1) If a record relating to the transmission destination is registered in the local address book 6AD, the prohibition flag of the record is “1”.
(Requirement C-2) If a record related to the transmission destination is registered in the LDAP server 3, the prohibition flag of the record is “1”.
If neither of the requirements is satisfied, it is determined that the transmission destination is appropriate. If any one of them is applicable, it is determined that it is inappropriate.

  For example, information as shown in FIG. 6 is stored in the local address book 6AD, and when a fax number “03-2222-xxxx” is directly input, whether or not the requirement C-1 is satisfied is determined. The fax number is determined based on the prohibition flag of the record indicated by “identification code”, that is, the third record from the top. Whether or not the requirement C-2 is satisfied is similarly determined by referring to the address book 7AD of the LDAP server 3.

  Alternatively, in the same case, whether or not the requirement C-1 is satisfied may be determined as follows. Identify the user of the device with that fax number. In this example, “ΔΔ Corporation” is specified from FIG. Not only the prohibition flag of the record of the fax number but also the prohibition flag of the record indicating the identification code for transmission to the specified user by another protocol is checked. In this example, in addition to the third record from the top, the prohibition flags of the fourth and fifth records from the top are also checked. Then, if “1” is indicated in any of the prohibition flags, it is determined that the requirement C-1 is satisfied. If all are “0”, it is determined that they are not satisfied.

  The user of the image processing apparatus 2 inputs a destination candidate that matches his / her desired condition from the address book 7AD of the LDAP server 3 to the LDAP search screen HG2 shown in FIG. The LDAP server 3 can be searched. Since the search method itself is known, the description thereof is omitted. However, those whose prohibition flag is “1” may be excluded from search targets.

  The configuration of the screen showing the retrieved candidate list is the same as the configuration of the transmission destination designation screen HG1 described with reference to FIG.

  The appropriate destination list generation unit 205 arranges a list of destinations that can be specified when the request destination searched by the proxy request destination search unit 203 substitutes G3 fax transmission, that is, an appropriate destination (hereinafter, “ For example, a procedure shown in FIG. 9.

  The appropriate destination list generation unit 205 has a protocol of “G3-FAX” and a prohibition flag of “0” from the address book 6AD (see FIG. 6) stored in the local address book storage unit 231. A record is read (# 171). That is, the address book for G3 fax protocol is read.

  If it can be read (Yes in # 172), the protocol is “G3-FAX” in the address book record downloaded from the request destination (that is, the record in the address book 6AD of the request destination). And a record whose prohibition flag is “0”) (# 179). Thereby, the appropriate transmission destination list 6LT is generated.

  If it could not be read (No in # 172), whether or not the fax number of each member (organization or individual) registered in the local address book 6AD is registered in the address book 7AD of the LDAP server 3 Check.

  That is, the name of each record registered in the local address book 6AD is read (# 173), and the LDAP server 3 is requested to search for a record indicating any of those names (# 173). 174).

  Then, the LDAP server 3 searches for such a record from the address book 7AD according to the request, and notifies the record that has been searched.

  If the notification of the retrieved record is obtained (Yes in # 175), the appropriate transmission destination list generation unit 205 has a record indicating “G3-FAX” as the protocol (Yes in # 176). ) And the record is extracted (# 177).

  Then, the extracted record is merged with the address book record downloaded from the request destination (# 179). Thereby, the appropriate transmission destination list 6LT is generated.

  If the LDAP server 3 cannot search such a record, or if all the records notified from the LDAP server 3 are for protocols other than G3 (No in # 175 or No in # 176), it is downloaded from the request destination. By arranging the records in the address book, an appropriate destination list 6LT is generated (# 180).

  Then, the screen display control unit 201 causes the display 20h to display a screen on which the appropriate transmission destination list 6LT generated by any one of the above methods is arranged (# 181).

Returning to FIG. 4, the transmission proxy requesting unit 206 requests another image processing apparatus 2 to perform the G3 fax transmission for the destination (transmission destination) designated by the user. However, the following requirement D-1, requirement D-2, and requirement D-3 must all be satisfied.
(Requirement D-1) The transmission proxy necessity determination unit 202 determines that it is necessary to have G3 fax transmission be performed on behalf.
(Requirement D-2) That another image processing apparatus 2 as a request destination has been found by the proxy request destination search unit 203.
(Requirement D-3) The transmission destination suitability determination unit 204 determines that the transmission destination specified by the user is appropriate.

  The transmission agent request unit 206 causes the scanner 20e to read a document sheet on which an image to be transmitted is written when requesting the request destination. Then, the image data obtained thereby is transferred to the request destination. The conversion of the image data into the format for G3 fax transmission may be performed by the image processing apparatus 2 itself or may be performed at the request destination.

  In FIG. 5, as described above, the address book assigning unit 211 extracts the address book 6AD stored in its own address book storage unit 231 with the prohibition flag being “0”, and extracts it as another It is given by transmitting to the image processing apparatus 2.

  The direct input permission / rejection response unit 212 performs direct input based on the communication restriction information 6TS stored in its own communication restriction information storage unit 232 when an inquiry about whether direct input is possible is received from another image processing apparatus 2. Answer whether or not.

  The transmission proxy control unit 213 controls the (local) modem 20n of the image processing apparatus 2 itself so that the G3 fax transmission requested by the other image processing apparatus 2 to execute the proxy is executed. However, if the record related to the designated transmission destination is stored in the local address book 6AD and the prohibition flag of the record is “1”, the proxy is stopped. When the proxy is cancelled, the job data (image data or processing condition data, etc.) related to the G3 fax transmission is discarded.

  10 and 11 are flowcharts for explaining an example of the overall processing flow of the image processing apparatus 2 when the transmission proxy request program is executed. FIG. 12 is an overall diagram of the image processing apparatus 2 when the transmission proxy program is executed. It is a flowchart explaining the example of the flow of a process.

  Next, the flow of processing of the image processing apparatus 2 that requests substitution of G3 fax transmission and the requested image processing apparatus 2 will be described with reference to the flowcharts of FIGS. 10, 11, and 12. Here, the case where the image processing apparatus 2A not provided with the modem 20n requests either the image processing apparatus 2B or image processing apparatus 2C provided with the modem 20n will be described as an example. However, it is assumed that a problem has occurred in the modem 20n of the image processing apparatus 2C.

  When the G3 fax transmission mode is selected (Yes in # 101 in FIG. 10), the image processing apparatus 2A has the G3 fax transmission function and is currently effective. That is, it is checked whether both requirement A-1 and requirement A-2 are satisfied (# 103). If the condition is satisfied (No in # 103), the image processing apparatus 2A itself performs the G3 fax transmission process as usual without requesting substitution (# 102).

  However, as described above, since the image processing apparatus 2A does not include the modem 20n, it is determined that the requirement is not satisfied (Yes in # 103), and the processing for the proxy request after step # 104 is executed. To do.

  When a mode other than G3 fax transmission is selected (No in # 101), processing corresponding to that mode is appropriately executed (# 102).

  The other image processing apparatus 2 (2B, 2C,...) Is inquired as to whether or not the G3 fax transmission can be performed (# 104). That is, the image processing apparatus 2 that satisfies both the requirements B-1 and B-2 is searched.

  Then, the image processing apparatuses 2 (2B, 2C,...) That received the inquiry check their own specifications and operating conditions, and return an answer to the inquiry to the image processing apparatus 2A.

  If no image processing apparatus 2 capable of performing G3 fax transmission is found (No in # 105), a message indicating that G3 fax transmission cannot be performed is displayed to the user (# 106), and G3 fax transmission processing is performed. Discontinue.

  As described above, since the image processing apparatus 2C does not include the modem 20n, the image processing apparatus 2C obtains a reply that substitution is impossible. It is assumed that a reply that substitution is possible is obtained from the image processing apparatus 2B.

  Therefore (Yes in # 105), the image processing apparatus 2A determines the image processing apparatus 2B as a request destination, and requests and downloads the address book of the image processing apparatus 2B from the request destination, that is, the image processing apparatus 2B (#). 107).

  The image processing apparatus 2B selected as the request destination executes the processing for substitution in the procedure shown in FIG.

  When the image processing apparatus 2B requests an address book from the request source, that is, the image processing apparatus 2A (Yes in # 131 in FIG. 12), it extracts a record whose prohibition flag is “0” in its address book 6AD. Then, it is transmitted to the image processing apparatus 2A as the address book of the image processing apparatus 2B (# 132).

  When the image processing apparatus 2A can download the address book of the image processing apparatus 2B (Yes in # 108), the prohibition flag in the address book 6AD of the image processing apparatus 2A itself is “0” as shown in FIG. The destination candidate list in which the name and identification code indicated in the record “and the name and identification code indicated in the downloaded address book record are arranged is displayed (# 109).

  When the user designates a transmission destination by direct input (No in # 110), the image processing apparatus 2A displays that direct input is not possible if direct input is prohibited (No in # 111). (# 112). If the image processing apparatus 2B itself permits direct input (Yes in # 111), the request destination, that is, the image processing apparatus 2B is inquired whether the image processing apparatus 2B prohibits direct input (# in FIG. 11). 115).

  When the image processing apparatus 2B receives the inquiry (Yes in # 133 in FIG. 12), the image processing apparatus 2B returns a reply indicating whether direct input is permitted (# 134).

  When the image processing apparatus 2A receives an answer indicating that direct input is prohibited (No in # 116 in FIG. 11), it displays that direct input is not possible (# 112 in FIG. 10).

  Furthermore, the image processing apparatus 2A generates and displays the appropriate transmission destination list 6LT by the procedure described with reference to FIG. 9 (# 113). If the user selects and designates a transmission destination from the appropriate transmission destination list 6LT (Yes in # 114), the user determines that the transmission destination is appropriate, scans the image of the document (# 123), and The image data is transferred to the processing device 2B and a substitute for G3 fax transmission is requested (# 124).

  When both of the image processing apparatuses 2A and 2B permit direct input and the user designates a transmission destination by direct input (No in # 110, Yes in # 111, Yes in # 116), or the user has a transmission destination candidate list If the transmission destination is selected and designated from the above (Yes in # 110), if the prohibition flag of the record related to the transmission destination is “1” (Yes in # 117), a message indicating that transmission is prohibited is displayed ( # 118) The G3 fax transmission process is stopped. In this case as well, the G3 fax transmission may not be stopped immediately, but the appropriate transmission destination list 6LT may be displayed, and the user may selectively designate the transmission destination from the list.

  If there is no record relating to the transmission destination or the prohibition flag of the record is “0” (No in # 117), it immediately determines that the transmission destination is appropriate, and scans the image of the document (# 123), the image data is transferred to the image processing apparatus 2B and a substitute for G3 fax transmission is requested (# 124). However, the suitability of the transmission destination may be determined as follows by referring to the address book 7AD of the LDAP server 3 as well.

  That is, the image processing apparatus 2A searches whether a record indicating an identification code for another protocol of a person (organization or individual) to whom the transmission destination is given is registered in the address book 7AD. And requests the LDAP server 3 (# 119).

  If no such record is found (No in # 120), the image processing apparatus 2A determines that the transmission destination is appropriate, and requests scanning and substitution (# 123, # 124).

  If such records are found (Yes in # 120), these records are read (# 121), and the prohibition flag is checked (# 122). If the prohibition flag of any record is “1” (Yes in # 122), it is determined that the transmission destination designated by the user is inappropriate, and a message indicating that transmission is prohibited is displayed (# 118). Here, the appropriate transmission destination list 6LT may be displayed together with the prohibition of transmission, and the user may selectively designate the transmission destination from the list.

  If the prohibition flag of all records is “0” (No in # 122), it is determined that the transmission destination is appropriate, and scanning and proxy requests are made (# 123, # 124).

  According to the present embodiment, for example, whether or not the image processing apparatus 2A may substitute the image processing apparatus 2B for G3 fax transmission performed by a device external to the intranet 1 is determined more accurately than in the past. Can do. In other words, since the determination can be made according to the security policy of each of the image processing apparatuses 2A and 2B, the proxy of communication can be performed more accurately than in the past in terms of security.

  Further, according to the present embodiment, the transmission destination candidate list or the appropriate transmission destination list 6LT of FIG. 7 is presented to the user. Therefore, a communicable partner can be found more easily than before, and the operability for the user can be improved.

  In the present embodiment, the case of proxying communication using the G3 fax protocol has been described as an example. In this case, it is also applicable.

  In this embodiment, the case where the process of transmitting data from the image processing apparatus 2 in the intranet 1 to an external apparatus is taken as an example, but the case where the process of receiving data from an external apparatus is taken as an example. Also, the present invention can be applied.

  In this case, as in the case of transmitting data to an external device, the image processing device 2 that is the proxy request source determines whether or not the data from the external device may be received. The determination is made based on (the prohibition flag and communication restriction information 6TS of the address book 6AD) and the security rule (the prohibition flag and communication restriction information 6TS of the address book 6AD) of the requested image processing apparatus 2. That is, when it is possible to determine from both rules that communication with the apparatus may be performed, a request is made to the request destination. If it cannot be determined, the requester refuses to receive data from the device.

  Alternatively, the request destination may determine whether or not data reception is permitted. Alternatively, the determination may be made based on the security rule of the LDAP server 3 (the prohibition flag of the address book 7AD).

  The same fax number or e-mail address may be indicated in two or more of the request source address book 6AD, the request destination address book 6AD, and the address book 7AD of the LDAP server 3. In this case, if at least one of the prohibition flags is “1” for the fax number or e-mail address, the fax number or e-mail address is excluded from the destination candidate list or the appropriate destination list 6LT in FIG. May be. Alternatively, when the LDAP server 3 is not provided in the intranet 1, the prohibition flag of the fax number or the e-mail address is set in one or both of the request source address book 6AD and the request destination address book 6AD. If “1” is indicated, it may be excluded from the transmission destination candidate list or the appropriate transmission destination list 6LT.

  In addition, the configuration of the entire intranet 1, image processing device 2, and LDAP server 3 or each unit, processing content, processing order, list configuration, screen configuration, and the like can be appropriately changed in accordance with the spirit of the present invention.

It is a figure which shows the example of the whole structure of an intranet. It is a figure which shows the example of the external appearance of an image processing apparatus. It is a figure which shows the example of the hardware constitutions of an image processing apparatus. It is a figure which shows the example of a functional structure of the image processing apparatus which has a transmission proxy request program. It is a figure which shows the example of a functional structure of the image processing apparatus which has a transmission agency program. It is a figure which shows the example of an address book. It is a figure which shows the example of a transmission destination designation | designated screen. It is a figure which shows the example of an LDAP search screen. It is a flowchart explaining the example of the flow of a transmission destination address book presentation process. 12 is a flowchart illustrating an example of the overall processing flow of the image processing apparatus when a transmission proxy request program is executed. 12 is a flowchart illustrating an example of the overall processing flow of the image processing apparatus when a transmission proxy request program is executed. 12 is a flowchart for explaining an example of the overall processing flow of the image processing apparatus when a transmission proxy program is executed.

Explanation of symbols

1 Intranet (network system)
2 Image processing device (communication device)
2A Image processing device (communication device)
2B image processing device (communication device, second communication device)
201 Screen display control unit (list display means)
204 Destination appropriateness determination unit (external communication availability inquiry means, external communication permission determination means)
206 Transmission agency request section (communication agency request means)
213 Transmission proxy control unit (communication proxy means)
231 Address book storage unit (external communication restriction information storage means, device information storage means)
232 Communication restriction information storage unit (external communication restriction information storage means)
6AD address book (external communication restriction information, first device information, second device information)
6TS communication restriction information (external communication restriction information)

Claims (8)

A communication device provided in a predetermined network system,
External communication restriction information storage means for storing external communication restriction information indicating restrictions on communication with the outside of the network system;
The designation method of prohibiting designation of a device as an external counterpart device that is a communication partner of the communication device and a device outside the network system by inputting identification information of the device one by one is prohibited. Despite being indicated in the external communication restriction information, when the user makes the designation by the designation method, the apparatus is outside the network system and allowed to communicate with the communication apparatus A list display means for displaying a list of
An inquiry about whether or not it is possible to communicate with the device selected by the user as the external counterpart device from the list is provided in the network system, and communication with the selected device is performed. External communication availability inquiry means for the second communication device having a function to perform;
The external communication restriction information and the inquiry stored in the external communication restriction information storage means determine whether or not the user may communicate with the device selected as the external partner device from the list. External communication permission / rejection determination means, which is performed based on the response from the second communication device;
When the user from the list is determined by the external party with the selected device as a device and communication may be performed wherein the external communication permission determination unit, the communication with the selected device instead of the communication device A communication proxy requesting means for making a request to the second communication device;
A communication apparatus comprising: A communication device provided in a predetermined network system,
External communication restriction information storage means for storing external communication restriction information indicating restrictions on communication with the outside of the network system;
Device information storage means for storing first device information indicating a device outside the network system and authorized to communicate with the communication device;
From the second communication device provided in the network system, having a function of communicating with an external partner device that is a communication partner of the communication device and is external to the network system, Device information acquisition means for acquiring second device information indicating a device outside the network system and authorized to communicate with the second communication device;
In spite of the fact that the external communication restriction information indicates that the designation method for designating the device as the external counterpart device by prohibiting the designation method by inputting the identification information of the device one by one is specified by the user. In accordance with the designation method, based on the first device information stored in the device information storage unit and the second device information acquired by the device information acquisition unit, the network system Displaying a list of devices that are external and authorized to communicate with the communication device and devices that are external to the network system and authorized to communicate with the second communication device; List display means;
An external communication availability inquiry means for making an inquiry to the second communication device whether or not it is possible to communicate with the device selected by the user as the external counterpart device from the list. ,
The external communication restriction information and the inquiry stored in the external communication restriction information storage means determine whether or not the user may communicate with the device selected as the external partner device from the list. External communication permission / rejection determination means, which is performed based on the response from the second communication device;
When the user from the list is determined by the external party with the selected device as a device and communication may be performed wherein the external communication permission determination unit, the communication with the selected device instead of the communication device A communication proxy requesting means for making a request to the second communication device;
A communication apparatus comprising: A network system configured by a first communication device and a second communication device connectable to each other,
In the first communication device,
First external communication restriction information storage means for storing first external communication restriction information indicating restrictions on communication with the outside of the network system;
A designation method in which designation of a device as an external counterpart device that is a communication partner of the first communication device and is outside the network system is prohibited by inputting identification information of the device one character at a time. Although the fact is indicated in the first external communication restriction information, when the user performs the designation by the designation method, the user is outside the network system and communicates with the first communication device. A list display means for displaying a list of devices authorized to perform the operation;
An external communication availability inquiry means for making an inquiry to the second communication device whether or not it is possible to communicate with the device selected by the user as the external counterpart device from the list. ,
Is provided,
In the second communication device,
Second external communication restriction information storage means for storing second external communication restriction information indicating restrictions on communication with the outside of the network system;
An answering means for making an answer to the inquiry based on the second external communication restriction information;
Is provided,
The first communication device further includes:
Based on the first external communication restriction information and the answer from the second communication device, it is determined whether or not the user may communicate with the device selected as the external counterpart device from the list. External communication permission / rejection determining means,
When it is determined by the external communication permission determination means that communication with the external counterpart device may be performed, a request that communication with the external counterpart device should be performed instead of the first communication device, A communication proxy requesting means for the second communication device;
Is provided,
The second communication device further includes
Communication proxy means for proxying communication with the external counterpart device based on the request from the first communication device ;
It is provided,
A network system characterized by this. A network system configured by a first communication device and a second communication device connectable to each other,
In the first communication device,
First external communication restriction information storage means for storing first external communication restriction information indicating restrictions on communication with the outside of the network system;
First device information storage means for storing first device information indicating a device outside the network system and authorized to communicate with the first communication device;
Is provided,
In the second communication device,
Second device information storage means for storing second device information indicating a device outside the network system and authorized to communicate with the second communication device;
Is provided,
The first communication device further includes:
Device information acquisition means for acquiring the second device information from the second communication device;
A designation method in which designation of a device as an external counterpart device that is a communication partner of the first communication device and is outside the network system is prohibited by inputting identification information of the device one character at a time. Although the fact is indicated in the first external communication restriction information, when the user makes the designation by the designation method, the first device information storage means stores the first A device that is external to the network system and is allowed to communicate with the first communication device based on the device information and the second device information acquired by the device information acquisition means, and the device A list display means for displaying a list of devices that are external to the network system and are allowed to communicate with the second communication device;
An external communication availability inquiry means for making an inquiry to the second communication device whether or not it is possible to communicate with the device selected by the user as the external counterpart device from the list. ,
Is provided,
The second communication device further includes
Second external communication restriction information storage means for storing second external communication restriction information indicating restrictions on communication with the outside of the network system;
An answering means for making an answer to the inquiry based on the second external communication restriction information;
Is provided,
The first communication device further includes:
The first external communication stored in the first external communication restriction information storage means for determining whether the user may communicate with the device selected as the external counterpart device from the list External communication permission / rejection determining means, which is performed based on the restriction information and the answer from the second communication device,
When the external communication permission determination means determines that the user may communicate with the device selected as the external counterpart device from the list, the communication with the selected device is the first communication device. Communication proxy requesting means for making a request to be made instead of the second communication device;
Is provided,
The second communication device further includes
Communication proxy means for proxying communication with the external counterpart device based on the request from the first communication device;
Is provided,
A network system characterized by this. A method for controlling a communication device provided in a predetermined network system,
External communication restriction information indicating restrictions on communication with the outside of the network system is stored in the external communication restriction information storage means,
In the communication device,
The designation method of prohibiting designation of a device as an external counterpart device that is a communication partner of the communication device and a device outside the network system by inputting identification information of the device one by one is prohibited. Despite being indicated in the external communication restriction information, when the user makes the designation by the designation method, the apparatus is outside the network system and allowed to communicate with the communication apparatus Process to display the list of
An inquiry about whether or not it is possible to communicate with the device selected by the user as the external counterpart device from the list is provided in the network system, and communication with the selected device is performed. Causing the second communication device having a function to be executed to execute the process ,
The external communication restriction information stored in the external communication restriction information storage means and the inquiry about whether the user may communicate with the device selected as the external partner device from the list. to execute the process of determining based on answers from the second communication device,
When the user from the list is determined to be in communication with the selected device as the external counterpart device, a communication with the selected device to do so before Symbol second place of the communication device Cause the communication device to execute the requested process ,
A method for controlling a communication apparatus, comprising: A method for controlling a communication device provided in a predetermined network system,
External communication restriction information indicating restrictions on communication with the outside of the network system is stored in the external communication restriction information storage means,
First device information indicating a device outside the network system and authorized to communicate with the communication device is stored in the device information storage unit,
In the communication device,
From the second communication device provided in the network system, having a function of communicating with an external partner device that is a communication partner of the communication device and is external to the network system, Executing a process of acquiring second device information indicating a device outside the network system and authorized to communicate with the second communication device;
In spite of the fact that the external communication restriction information indicates that the designation method for designating the device as the external counterpart device by prohibiting the designation method by inputting the identification information of the device one by one is specified by the user. In accordance with the designation method, based on the first device information stored in the device information storage means and the acquired second device information, and outside the network system and the communication device And a process of displaying a list of devices that are allowed to communicate with the device and devices outside the network system and authorized to communicate with the second communication device,
Inquiring whether or not it is possible to communicate with the device selected by the user as the external counterpart device from the list, to perform processing for the second communication device,
The external communication restriction information stored in the external communication restriction information storage means and the inquiry about whether the user may communicate with the device selected as the external partner device from the list. A process for determining based on an answer from the second communication device;
When it is determined that the user may communicate with the device selected as the external counterpart device from the list, the second communication is performed so that communication with the selected device is performed instead of the communication device. Execute the requested process for the device.
A method for controlling a communication apparatus, comprising: A computer program for controlling a communication device provided in a predetermined network system and having external communication restriction information storage means for storing external communication restriction information indicating restrictions on communication with the outside of the network system ,
In the communication device,
The designation method of prohibiting designation of a device as an external counterpart device that is a communication partner of the communication device and a device outside the network system by inputting identification information of the device one by one is prohibited. Despite being indicated in the external communication restriction information, when the user makes the designation by the designation method, the apparatus is outside the network system and allowed to communicate with the communication apparatus Process to display the list of
An inquiry about whether or not it is possible to communicate with the device selected by the user as the external counterpart device from the list is provided in the network system, and communication with the selected device is performed. process is the execution to be performed on the second communication device having a function of,
The external communication restriction information stored in the external communication restriction information storage means and the inquiry about whether the user may communicate with the device selected as the external partner device from the list. to execute the processing you determined based on the answers from the second communication device,
When it is determined that the user may communicate with the device selected as the external counterpart device from the list, the second communication is performed so that communication with the selected device is performed instead of the communication device. to perform the processing you request with respect to the apparatus,
A computer program characterized by the above. An external communication restriction information storage unit that is provided in a predetermined network system and stores external communication restriction information indicating restrictions on communication with the outside of the network system, and is external to the network system and communicates with the communication device A computer program for controlling a communication device having device information storage means for storing first device information indicating a device authorized to perform
In the communication device,
From the second communication device provided in the network system, having a function of communicating with an external partner device that is a communication partner of the communication device and is external to the network system, Executing a process of acquiring second device information indicating a device outside the network system and authorized to communicate with the second communication device;
In spite of the fact that the external communication restriction information indicates that the designation method for designating the device as the external counterpart device by prohibiting the designation method by inputting the identification information of the device one by one is specified by the user. In accordance with the designation method, based on the first device information stored in the device information storage means and the acquired second device information, and outside the network system and the communication device And a process of displaying a list of devices that are allowed to communicate with the device and devices outside the network system and authorized to communicate with the second communication device,
Inquiring whether or not it is possible to communicate with the device selected by the user as the external counterpart device from the list, to perform processing for the second communication device,
The external communication restriction information stored in the external communication restriction information storage means and the inquiry about whether the user may communicate with the device selected as the external partner device from the list. A process for determining based on an answer from the second communication device;
When it is determined that the user may communicate with the device selected as the external counterpart device from the list, the second communication is performed so that communication with the selected device is performed instead of the communication device. Execute the requested process for the device.
A computer program characterized by the above.

Images