JP2006127260A - Image processing system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To ensure user security and efficiently perform user management.
An image processing system connects an image processing device 20 that performs input / output processing of image data and an information processing device 30 via a network 10, and the image processing device 20 responds to a request from the information processing device 30. Input or output image data. A predetermined security system is set between the information processing apparatus 30 and the user management server. The information processing device 30 authenticates the user based on the security system and transmits a user information processing request packet using the security session, and the user management server refers to the user management library in response to the request packet. Thus, the user registration, deletion, and update of the secret key are performed by the step of transmitting the reply packet to the information processing device 30 and the step of creating the user information library by the information processing device 30 based on the received reply packet information.
[Selection] Figure 1

Description

  The present invention relates to an image processing system in which an information processing apparatus and an image processing apparatus such as a printer and a facsimile are connected by a network.

  A system in which an image processing apparatus and an information processing apparatus are connected via a network has been developed and is actually operating. For example, in Patent Document 1, image data captured by an image input / output processing device by a scanner or the like is transferred to a management server together with setting information, and the management server transfers to the other most suitable image input / output processing device based on the setting information. A system for proper processing is described.

  On the other hand, in recent office environments, information processing devices that support a predetermined protocol such as SNMP (Simple Network Management Protocol) are increasing for security enhancement. However, such information processing equipment has two major problems.

One of them is the premise of having user account information of the protocol in order to perform management from the protocol manager, and the issue is how to obtain such information automatically. The other is the issue of integrated user management. In other words, a device administrator account, a network administrator account, etc. are provided to manage image input / output devices such as printers and copiers, and in that way, how to efficiently manage user specific to the protocol. It is a point of whether to perform integrated user management of information processing devices by integrating them.
JP 2002-149518 A

  SUMMARY OF THE INVENTION An object of the present invention is to solve the above-described two problems and to provide an image processing system capable of ensuring security and performing user management efficiently.

  According to a first aspect of the present invention, there is provided an image processing system in which an image processing apparatus that performs input / output processing of image data and an information processing apparatus are connected via a network, and the image processing apparatus receives a request from the information processing apparatus. In an image processing system that performs input or output processing of image data, a predetermined security system is set between the information processing apparatus and a user management server, and the information processing apparatus authenticates a user based on the security system. And transmitting a request packet for user information processing using a security session, and transmitting a reply packet to the information processing apparatus by referring to the user management library in response to the request packet by the user management server; And the information processing apparatus performs user information labeling based on the received reply packet information. The user of registered by the steps of creating a library, delete, and wherein the updating of the secret key.

  The invention according to claim 2 is the image processing system according to claim 1, wherein authentication management of the user is performed by the security system before the user registration, deletion, and secret key update. To do.

  A third aspect of the present invention is the image processing system according to the first aspect, wherein the user management server is provided in an image processing apparatus or an information processing apparatus.

  A fourth aspect of the present invention is the image processing system according to the first or second aspect, wherein the security system is SSL.

  According to the present invention, the information processing apparatus authenticates a user based on a predetermined security system and transmits a user information processing request packet using a security session, and the user management server responds to the request packet by the user management server. To refer to the management library, send a reply packet to the information processing apparatus, and the information processing apparatus creates a user information library based on the received reply packet information, thereby registering, deleting, and updating the private key User account information can be acquired automatically and safely, and user management can be performed efficiently.

  An image processing system of the present invention connects an image processing apparatus that performs input / output processing of image data and an information processing apparatus via a network, and the image processing apparatus inputs or outputs image data in response to a request from the information processing apparatus. This is a system that performs processing. In this system, a predetermined security system is set between the information processing apparatus and the user management server. When registering, deleting, or updating a secret key based on this security system, the information processing apparatus authenticates the user based on the security system and uses the security session to send a request packet for user information processing. A step of sending, a step of sending a reply packet to the information processing device by referring to the user management library in response to the request packet, and a step of sending the reply information to the information processing device by the information processing device based on the received reply packet information. Creating a library.

  As shown in FIG. 1, the system according to the present embodiment may have a form in which a single image processing apparatus 20 is connected in one network 10, and a plurality of systems in one network as shown in FIG. The image processing apparatus 20 may be connected, or a combination of these forms may be used. 1 and 2, an image processing apparatus 20 and an information processing apparatus 30 are connected to one network 10. One network 10 is connected to each other by a router 40.

  In FIG. 1, user integrated management of the image processing apparatus 20 is performed in each network 10. A user management server for that purpose is installed in each image processing apparatus 20 in each network 10, and a predetermined protocol manager such as SMNP that manages the image processing apparatus 20 is installed in the information processing apparatus 30. Note that the image processing apparatus 20 and the protocol manager that manages the image processing apparatus 20 may exist in the same network, or may exist in different networks.

  In FIG. 2, user management of a plurality of image processing apparatuses 20 is integrated and performed by the information processing apparatus 30 in which the user management server is installed.

  FIG. 3 shows a connection state applied to the configuration of FIG. 1, in which the image processing apparatus 20 in which the user management server is installed and the information processing apparatus 30 in which the protocol manager is installed are connected by the network 10. The image processing apparatus 20 is provided with a database 200 that is a collection of user information managed by the user management server. The information processing apparatus 30 is provided with a database 100 that stores a library of user information used when the protocol manager performs the protocol communication. The library of user information in the database 100 is information acquired from the database 200 of the image processing apparatus 20 via the set security system.

  FIG. 4 shows a connection state applied to the configuration of FIG. 2, and the user information managed by the user management server is stored in the database 200 of one information processing apparatus 30. The database 100 of the other information processing apparatus 30 stores a library of user information used when the protocol manager performs protocol communication. This library of user information is information acquired from the database 200 of the information processing apparatus 30 via the set security system. As the above security system, SSL (Security Sockets Layer) is used. In addition, an SNMP manager is used as the protocol manager.

  FIG. 5 shows a user information management library in the SNMP manager, which includes a user name 101, a group name 102, an authentication level 103, an authentication algorithm 104, an authentication password 105, a privacy password 106, and a context name 107. FIG. 6 shows a protocol (SNMPv3) permission library on the user management server side, which includes a user ID 201, a group ID 202, an SNMPv3 operation permission mode 203, and other items 204.

  FIG. 7 shows a protocol (SNMPv3) user library on the user management server side, which is composed of a user ID 231, a user name 232, an authentication level 233, an authentication algorithm 234, an authentication password 235, a privacy password 236, and a context name 237. Has been. FIG. 8 shows a protocol (SNMPv3) group library on the user management server side, and is composed of a group ID 251, a group name 252, and other items 253.

  6 to 8, user information must first be registered in these libraries. The user ID is an ID for identifying a user, the group ID is an ID for identifying a group, and the SNMPv3 operation permission mode is a flag indicating whether or not to give an SNMPv3 operation right to this user. As a group classification method, for example, a document management group such as a network management group, a device management group, and a document management group can be performed by not giving a protocol (SNMPv3) operation right.

  In FIG. 7, SNMPv3 communication cannot be performed without an SNMPv3 user account. Therefore, the manager of SNMPv3 needs to acquire a user account before performing SNMPv3 communication. Communication between the SNMPv3 manager and the user management server is via SSL.

  FIG. 9 shows a data format for user registration transmitted from the protocol (SNMP) manager side. The user name 301, the operation code 302, the clone user name 303, the authentication password 304, the privacy password 305, and the new authentication password 306 are shown. , The new password 307 for privacy.

  FIG. 10 shows a data format for reply from the user management server. Result code 321, user name 322, authentication level 323, authentication algorithm 324, authentication password 325, privacy password 326, context name 327, group name 328.

  FIG. 11 shows a data format for updating the user key transmitted from the SNMP manager side. The user name 341, the operation code 324, the update flag 343, the old authentication password 344, the new authentication password 345, the old privacy password 346, It consists of a new privacy password 347.

  FIG. 12 shows a data format for user deletion transmitted from the SNMP manager side, which includes a user name 361, an operation code 362, an authentication password 364, and a privacy password 364.

  FIG. 13 shows a flowchart of communication via SSL, in which transmission data 401 is encrypted by SSL (step 402), and is transmitted as data 404 with a TCP header added to the encrypted transmission data 403. Yes. Since SSL has an authentication mechanism, communication with the user management server cannot enter the data communication phase unless it passes through the authentication phase.

  FIG. 14 shows the processing flow of the main process on the user management server side. The main process of the user management server accepts an SSL connection request (step 501), and if there is a request in step 502, generates a child process (step 503), and then returns to the monitoring state. At this time, the processing of the SSL session is left to the child process.

  FIG. 15 shows the processing flow of the child process of the user management server. First, an SSL session is established (step 601), and request data from the SNMP manager is awaited (step 602). When the requested data comes, the requested data is analyzed (step 605), and registration, deletion, and key update of the library are performed according to the request (steps 606, 612, 607, 611, 609, 610). Then, after processing of the library of the user management server, reply data is created according to the request data and transmitted via SSL (step 613).

  FIG. 16 shows the SSL client processing flow on the SNMP manager side. In FIG. 16, the SNMPv3 manager transmits a connection request for the SSL session to the user management server, and after passing the authentication, enters the next data communication phase. Then, user registration (steps 706 and 703), deletion (steps 707 and 704), key update processing (steps 708 and 705), and end processing (step 709) can be selected by operation input (step 702).

  FIG. 17 shows a process flow of user registration, deletion, and key update on the SNMP manager side. In step 750 of FIG. 17, input items differ depending on the selected operation. That is, in the case of user registration, it is necessary to input items shown in FIG. In the case of key update, the items shown in FIG. 11 are necessary. In the case of user deletion, input of items shown in FIG. 12 is necessary. Request data is created based on these input items (step 751) and transmitted via SSL (step 752).

  When a reply packet is transmitted from the user management server (step 753), the reply data is first analyzed (step 755). If the processing result is negative, return to the operation input. If the result is affirmative, it is reflected in the SMMNMPv3 user information database, and SNMPv3 user registration, deletion, and key update processing are performed (step 757). The SNMPv3 user registration, deletion, and key update processes are processes conforming to the SNMPv3 protocol and are not related to SSL. When the SNMPv3 process is completed, the process returns to the operation input.

  In such an embodiment, user account information can be safely and automatically acquired, and user management can be performed efficiently.

It is a network block diagram of the integrated user management by a single image processing apparatus. It is a network block diagram of the integrated user management by the information processing apparatus in the environment of a multiple image processing apparatus. It is a conceptual diagram on the SNMP manager side and the user management server side in integrated user management by a single image processing apparatus. It is a conceptual diagram of the SNMP manager side and the user management server in the integrated user management by the information processing apparatus in the environment of the multiple image processing apparatus. It is a user information management library on the SNMP manager side. This is an SNMPv3 operation permission library on the user management server side. It is a library for SNMPv3 users on the user management server side. FIG. 8 shows an SNMPv3 group library on the user management server side. This is a data format for user registration transmitted from the SNMP manager side. This is a data format for response from the user management server. This is a data format for updating a user key transmitted from the SNMP manager side. It is a data format for user deletion transmitted from the SNMP manager side. It is a conceptual diagram of the packet structure via SSL. It is a processing flow of the main process on the user management server side. It is a processing flow of the child process on the user management server side. It is a SSL client processing flow on the SNMP manager side. It is a processing flow of user registration, deletion, and key update on the SNMP manager side.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Network 20 Image processing apparatus 30 Information processing apparatus

Claims (4)

An image processing system in which an image processing apparatus that performs input / output processing of image data and an information processing apparatus are connected via a network, and the image processing apparatus performs input or output processing of image data in response to a request from the information processing apparatus In
A predetermined security system is set between the information processing apparatus and the user management server,
The information processing apparatus authenticates a user based on the security system and transmits a user information processing request packet using a security session, and the user management server loads a user management library in response to the request packet. The process of registering, deleting, and updating the secret key is performed by referring to transmitting a reply packet to the information processing apparatus, and creating a user information library based on the received reply packet information. An image processing system characterized by that.   The image processing system according to claim 1, wherein user authentication management is performed by the security system before the user registration, deletion, and secret key update.   The image processing system according to claim 1, wherein the user management server is provided in the image processing apparatus or the information processing apparatus. The image processing system according to claim 1, wherein the security system is SSL.

Images