JP2008310774A - Information processing apparatus, control method therefor, and computer program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information processing apparatus capable of further improving security management of image data, a control method therefor, and a program.
A pseudo security policy associated with a security policy that is added to image data attached information of the image data before the image data is converted into a format capable of giving a security policy to the image data is managed. . Get the pseudo security policy for the input image data. The acquired pseudo security policy is added to the image data attached information of the input image data. The image data attached information to which the pseudo security policy is added and the corresponding image data are stored.
[Selection] Figure 2

Description

  The present invention relates to an information processing apparatus that performs security management of input image data, a control method thereof, and a computer program.

In recent years, the market interest in document security has increased and the needs have expanded. Under such circumstances, there exists a configuration in which image data and security data for ensuring the security thereof are managed by a server, and image data is managed in an information processing apparatus (for example, Patent Document 1). In this configuration, the information processing apparatus performs data collation and tracking management of image data in cooperation with the server. And in performing this data collation and tracking management, an information processing apparatus transmits image data and a security tag to a server, and performs a process as needed.
JP 2003-122616 A

  In an information processing apparatus, there is a method of assigning a security policy in order to perform security management of image data.

  Therefore, conventionally, it has been necessary to convert the format of the image data into a specific format to which a security policy can be assigned.

  For example, the format of the image data is once converted into a PDF format, and a policy server that manages the security policy is accessed to acquire the security policy and apply it to the image data. Therefore, it cannot be said that sufficient security management is performed until image data is converted into a specific format to which a security policy can be assigned.

  SUMMARY An advantage of some aspects of the invention is that it provides an information processing apparatus, a control method thereof, and a program that can further improve security management of image data.

In order to achieve the above object, an information processing apparatus according to the present invention comprises the following arrangement. That is,
An information processing apparatus that performs security management of input image data,
Management means for managing a pseudo security policy associated with the security policy, which is added to the image data attached information of the image data before the image data is converted into a format capable of giving the security policy to the image data; ,
First acquisition means for acquiring a pseudo security policy for input image data from the management means;
Adding means for adding the pseudo security policy acquired by the first acquisition means to the image data attached information of the input image data;
Storage means for storing image data attached information to which the pseudo security policy is added by the adding means and corresponding image data.

Preferably, the management means manages the pseudo security policy for each type of image data input method,
The first acquisition unit acquires a pseudo security policy for the image data from the management unit according to the type of input method of the input image data.

Preferably, conversion means for converting the format of the image data stored in the storage means into a format capable of giving the security policy;
Second acquisition means for acquiring a security policy associated with a pseudo security policy added to the image data attached information corresponding to the image data from a management device that manages the security policy;
And an adding unit that adds the security policy acquired by the second acquiring unit to the image data converted by the converting unit.

  Preferably, the input method includes at least one of scanner input, facsimile reception input, and electronic mail reception input.

  Preferably, the security policy is information for restricting the function for each function realized by the information processing apparatus.

In order to achieve the above object, a method for controlling an information processing apparatus according to the present invention comprises the following arrangement. That is,
A method of controlling an information processing apparatus that performs security management of input image data,
The management means stores a pseudo security policy associated with the security policy, which is added to the image data attached information of the image data before the image data is converted into a format in which the security policy can be assigned to the image data. A management process for managing the medium;
An acquisition step in which an acquisition unit acquires a pseudo security policy for the input image data from the storage medium;
An adding unit adds the pseudo security policy acquired in the acquisition step to the image data attached information of the input image data; and
The storage means includes a storage step of storing the image data attached information to which the pseudo security policy is added in the addition step and the corresponding image data in a storage medium.

In order to achieve the above object, a computer program according to the present invention comprises the following arrangement. That is,
A computer program for causing a computer to execute control of an information processing apparatus that performs security management of input image data,
Managing a pseudo security policy associated with the security policy added to the image data attached information of the image data before converting the image data into a format capable of giving the security policy to the image data in a storage medium Management process;
An acquisition step of acquiring a pseudo security policy for the input image data from the storage medium;
An additional step of adding the pseudo security policy acquired in the acquisition step to the image data attached information of the input image data;
The computer is caused to execute a storage step of storing the image data attached information to which the pseudo security policy is added in the addition step and the corresponding image data in a storage medium.

  ADVANTAGE OF THE INVENTION According to this invention, the information processing apparatus which can improve the security management of image data, its control method, and a program can be provided.

  The present invention provides a configuration in which a security policy is assigned to image data in a unique format in the information processing apparatus, and the same security policy as before conversion is maintained even after the format of the image data is converted to a general format. For the purpose. Thereby, it is possible to improve the safety of the image data.

  Hereinafter, embodiments of the present invention for realizing this object will be described in detail with reference to the drawings.

  FIG. 1 is a configuration diagram illustrating an example of an information processing apparatus according to an embodiment of this invention.

  An example of the information processing apparatus 100 is a multifunction peripheral. The multifunction machine has a scanner function, a printer function, a copy function, and a fax function, and can communicate with other clients 15 and the policy server 16 via the network 13. Further, the multi-function device can communicate with other communication devices via the public line network 14.

  Note that the information processing apparatus 100 is not limited to a multifunction peripheral, and may be a digital copying machine, a printer with a copy function, a facsimile, a printer, or a printing apparatus such as a printer, or a scanner apparatus if the configuration can implement the present invention. .

  The information processing apparatus 100 mainly includes a scanner unit 1, a printer unit 2, and a control unit 3.

  The scanner unit 1 is connected to the printer unit 2 and the control unit 3 to read an image of a document and generate image data of the read image. Further, the scanner unit 1 transmits the image data to the printer unit 2 or the control unit 3. The printer unit 2 prints an image on a recording sheet based on the image data received from the scanner unit 1 or the control unit 3.

  The control unit 3 is connected to an external network 13 or a public line network 14 and inputs / outputs image data via the network 13 or the public line network 14. The control unit 3 also performs information management such as accumulation of usage when the user uses the multifunction machine.

  The control unit 3 includes a facsimile unit 4, a file unit 5, a storage device 6, a network interface unit 7, a formatter unit 8, an image memory 9, and a core unit 10.

  The facsimile unit 4 is connected to the core unit 10 and the public line network 14, expands the compressed image data received from the public line network 14, and transmits the expanded image data to the core unit 10. In addition, the facsimile unit 4 compresses the image data transmitted from the core unit 10 and transmits the compressed image data to other devices via the public line network 14. The image data compression / decompression process performed by the facsimile unit 4 is, for example, a process according to the facsimile communication standard (G3, G4, etc.). Further, the compression / decompression process is not essential.

  The file unit 5 is connected to the core unit 10 and the storage device 6, compresses the image data transmitted from the core unit 10, and stores both the compressed image data and a keyword for searching for the compressed image data in the storage device 6. Remember. The storage device 6 is realized by, for example, a hard disk drive, but is not limited to this. The file unit 5 searches the compressed image data stored in the storage device 6 based on the keyword transmitted from the core unit 10. Then, the file unit 5 reads and decompresses the searched compressed image data, and transmits the decompressed image data to the core unit 10.

  The formatter unit 8 is connected to the core unit 10 and develops data described in, for example, PDL (Page Description Language) into image data that can be processed by the printer unit 2.

  The image memory 9 temporarily stores information from the scanner unit 1 and information transmitted through the network interface unit 7. The image memory 9 is realized by, for example, a RAM or a ROM.

  The core unit 10 executes data transmission / reception control among the scanner unit 1, the facsimile unit 4, the file unit 5, the network interface unit 7, and the formatter unit 8. In addition, the core unit 10 analyzes job control data for executing the function of the information processing apparatus 100 and executes processing according to the analysis result. Further, the core unit 10 generates usage information such as the number of copies, the number of prints, the number of scans, and the like to manage the usage status for each user and stores the usage information in the storage device 6.

  The finisher unit 11 discharges the recording paper on which the image is printed by the printer unit 2. The operation display unit 12 displays an operation screen for operating the information processing apparatus 100, an input screen for inputting information, or an error message indicating an error that has occurred in the information processing apparatus 100. The operation display unit 12 includes keys and buttons for operating the information processing apparatus 100, and inputs an operation instruction from the user. A keyword for searching for the compressed image data described above can be input via the operation display unit 12.

  Note that the compression / decompression process executed in the information processing apparatus 100 is not essential, and it is of course possible to omit the compression / decompression process depending on the processing capability of the information processing apparatus and the type of image data.

  Next, the configuration of software for controlling the core unit 10 will be described with reference to FIG.

  FIG. 2 is a block diagram showing an example of a software configuration for controlling the core unit of the embodiment of the present invention.

  In addition, the information processing method demonstrated below is implement | achieved when the program corresponding to each of the various components (201-209) shown in FIG.

  The image data input service group 201 is a software service group that imports image data into the information processing apparatus 100, and receives image data and image data attached information (eg, document name and input method information) to the document management service 204 through the API 203. hand over.

  The document management service 204 determines an image data input method (eg, facsimile reception input, scanner input, etc.) from the received image data attached information. Then, based on the determination result, the document management service 204 (first acquisition unit) inquires and acquires a pseudo security policy to be assigned to the security policy service 208 (e.g., edit of fax similly received data is not possible). .

  Further, the document management service 204 adds the acquired pseudo security policy to the image data attached information, and stores the image data in the image data / database 205 and the image data attached information in the image data attached information / database 206.

  The image data use service group 202 is a software service group that uses image data, and acquires image data and image data attached information from the document management service 204 through the API 203. The image data utilization service group 202 can also convert the format of the image data by using the format conversion service 207.

  The format conversion service 207 has a function of converting the format of image data. The format conversion service 207 (second acquisition unit) can communicate with the security policy service 208 to acquire a pseudo security policy and a security policy defined by the external policy server 210. Here, the external policy server 210 functions as a management device that manages the security policy.

  The security policy service 208 manages the pseudo security policy assigned to the image data in the information processing apparatus 100 in the pseudo policy data database 209. In particular, in the present embodiment, a pseudo security policy is managed for each image data input method (input source) information (a pseudo security policy is managed for each type of image data input method). This input method information indicates a method for receiving image data received (input) by the information processing apparatus 100. In the case of the configuration of FIG. 1, the input method information includes scanner input, facsimile reception input, e-mail reception input, and the like.

  The pseudo security policy is a security policy dedicated to image data in the information processing apparatus 100 created from the security policy defined by the external policy server 210. The security content is equivalent to the security policy defined by the external policy server 210. The security content includes at least one of use restrictions (use restrictions for each function) for various functions of the information processing apparatus 100 with respect to image data to be processed. Usage restrictions include editing, deleting, transferring, and saving. Here, the various functions include, for example, copying, printing, scanning, facsimile transmission / reception, Internet facsimile transmission / reception, electronic mail transmission / reception function, and the like.

  Next, a processing method for assigning a security policy according to an image data input method will be described with reference to FIG.

  FIG. 3 is a sequence diagram illustrating a processing method for assigning a security policy according to an image data input method according to the embodiment of this invention.

  In step S31, the image data input service group 201 transmits image data and image data attached information to the document management service 204.

  When the document management service 204 receives the image data and the image data attached information, the document management service 204 acquires image data input method information (for example, facsimile reception input) from the image data attached information. In step S 32, the document management service 204 transmits image data input method information to the security policy service 208.

  In step S <b> 33, the security policy service 208 transmits pseudo security policy information corresponding to the received image data input method information to the document management service 204.

  In step S34, the document management service 204 adds the received pseudo security policy information to the image data attached information. In step S35, the document management service 204 transmits the image data and the image data attached information to the image data / database 205 / image data attached information / database 206. In step S36, the image data / database 205 / image data attached information / database 206 stores the received data.

  By this processing, the pseudo security policy equivalent to the security policy that can be assigned to the image data after format conversion can be made to function in the image data before format conversion in the information processing apparatus 100 according to the image data input method. . When performing processing (editing processing or the like) on the image data before format conversion, the information processing apparatus 100 performs processing on the image data in accordance with the content of the pseudo security policy added to the corresponding image data attached information. To control. For example, when the content of the pseudo security policy is not editable and viewable, the user of the information processing apparatus 100 can only view the image data to be processed.

  Next, a processing method for maintaining the same security policy after conversion of the image data format as before conversion will be described with reference to FIG.

  FIG. 4 is a sequence diagram showing a processing method for maintaining a security policy before and after converting the format of image data according to the embodiment of the present invention.

  In step S <b> 41, the image data utilization service group 202 acquires image data and image data attached information from the document management service 204. In step S <b> 42, the image data utilization service group 202 transmits the image data and the image data attached information to the format conversion service 207.

  In step S43, the format conversion service 207 converts the format of the received image data. Here, PDF conversion is performed as an example of format conversion. Thereafter, in step S44, the format conversion service 207 transmits the ID, which is the identification information of the image data converted into PDF, and the pseudo security policy assigned to the original image data to the security policy service 208.

  In step S45, the security policy service 208 transmits the received pseudo security policy as a key to the pseudo security policy data database 209. Thereafter, in step S46, the security policy service 208 acquires security policy information associated with the pseudo security policy from the pseudo security policy data database 209. In step S47, the security policy service 208 transmits the ID that is the identification information of the image data converted to PDF and the security policy information to the external policy server 210.

  Based on the received ID and security policy information, the external policy server 210 generates a unique UID and security policy (for example, an encryption key) for image data to which a security policy is assigned. In step S48, the external policy server 210 transmits the generated security policy to the security policy service 208.

  In step S49, the security policy service 208 transmits the received UID and security policy to the format conversion service 207.

  In step S50, the format conversion service 207 uses the received UID and security policy to assign (encrypt) the security policy to the image data converted to PDF in step S43. Thereafter, in step S51, the format conversion service 207 transmits the image data converted to PDF with the security policy to the image data utilization service group 202.

  As described above, according to the present embodiment, the pseudo security policy associated with the security policy to be assigned after the conversion is assigned before the format conversion of the management target (processing target) image data. Thereby, even before the conversion of the image data format, security management equivalent to the security policy assigned after the conversion can be performed.

  Although the embodiment has been described in detail above, the present invention can take an embodiment as a system, apparatus, method, program, storage medium, or the like. Specifically, the present invention may be applied to a system composed of a plurality of devices, or may be applied to an apparatus composed of a single device.

  In the present invention, a software program (in the embodiment, a program corresponding to the flowchart shown in the drawing) that realizes the functions of the above-described embodiments is directly or remotely supplied to a system or apparatus. In addition, this includes a case where the system or the computer of the apparatus is also achieved by reading and executing the supplied program code.

  Accordingly, since the functions of the present invention are implemented by computer, the program code installed in the computer also implements the present invention. In other words, the present invention includes a computer program itself for realizing the functional processing of the present invention.

  In that case, as long as it has the function of a program, it may be in the form of object code, a program executed by an interpreter, script data supplied to the OS, or the like.

  Examples of the recording medium for supplying the program include a floppy (registered trademark) disk, a hard disk, and an optical disk. Further, as a recording medium, magneto-optical disk, MO, CD-ROM, CD-R, CD-RW, magnetic tape, nonvolatile memory card, ROM, DVD (DVD-ROM, DVD-R), etc. is there.

  As another program supply method, a browser on a client computer is used to connect to an Internet home page. Then, the computer program itself of the present invention or a compressed file including an automatic installation function can be downloaded from a homepage of the connection destination to a recording medium such as a hard disk. It can also be realized by dividing the program code constituting the program of the present invention into a plurality of files and downloading each file from a different homepage. That is, a WWW server that allows a plurality of users to download a program file for realizing the functional processing of the present invention on a computer is also included in the present invention.

  In addition, the program of the present invention is encrypted, stored in a storage medium such as a CD-ROM, distributed to users, and key information for decryption is downloaded from a homepage via the Internet to users who have cleared predetermined conditions. Let It is also possible to execute the encrypted program by using the key information and install the program on a computer.

  Further, the functions of the above-described embodiments are realized by the computer executing the read program. Further, based on the instructions of the program, an OS or the like running on the computer performs part or all of the actual processing, and the functions of the above-described embodiments can be realized by the processing.

  Further, the program read from the recording medium is written in a memory provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer. Thereafter, the CPU of the function expansion board or function expansion unit performs part or all of the actual processing based on the instructions of the program, and the functions of the above-described embodiments are realized by the processing.

It is a block diagram which shows an example of the information processing apparatus of embodiment of this invention. It is a block diagram which shows an example of the structure of the software for controlling the core part of embodiment of this invention. It is a sequence diagram which shows the processing method which provides a security policy according to the input method of the image data of embodiment of this invention. It is a sequence diagram which shows the processing method which maintains a security policy before and after conversion of the format of the image data of embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Information processing apparatus 1 Scanner part 2 Printer part 3 Control part 4 Fax part 5 File part 6 Storage device 7 Network interface part 8 Formatter part 9 Image memory 10 Core part 11 Finisher part 12 Operation display part 13 Network 14 Public line 15 Client 16 Policy server 201 Image data input service group 202 Image data use service group 203 API
204 Document Management Service 205 Image Data / Database 206 Image Data Attached Information / Database 207 Format Conversion Service 208 Security Policy Service 209 Pseudo Policy Data Database 210 External Policy Server

Claims (7)

An information processing apparatus that performs security management of input image data,
Management means for managing a pseudo security policy associated with the security policy, which is added to the image data attached information of the image data before the image data is converted into a format capable of giving the security policy to the image data; ,
First acquisition means for acquiring a pseudo security policy for input image data from the management means;
Adding means for adding the pseudo security policy acquired by the first acquisition means to the image data attached information of the input image data;
An information processing apparatus comprising: storage means for storing image data auxiliary information to which a pseudo security policy is added by the adding means and corresponding image data. The management means manages the pseudo security policy for each type of image data input method,
The information processing apparatus according to claim 1, wherein the first acquisition unit acquires a pseudo security policy for the image data from the management unit according to a type of an input method of the input image data. Conversion means for converting the format of the image data stored in the storage means into a format capable of giving the security policy;
Second acquisition means for acquiring a security policy associated with a pseudo security policy added to the image data attached information corresponding to the image data from a management device that manages the security policy;
The information processing apparatus according to claim 1, further comprising: an adding unit that adds the security policy acquired by the second acquiring unit to the image data converted by the converting unit. The information processing apparatus according to claim 2, wherein the input method includes at least one of scanner input, facsimile reception input, and electronic mail reception input. The information processing apparatus according to claim 1, wherein the security policy is information for restricting the function for each function realized by the information processing apparatus. A method of controlling an information processing apparatus that performs security management of input image data,
The management means stores a pseudo security policy associated with the security policy, which is added to the image data attached information of the image data before the image data is converted into a format in which the security policy can be assigned to the image data. A management process for managing the medium;
An acquisition step in which an acquisition unit acquires a pseudo security policy for the input image data from the storage medium;
An adding unit adds the pseudo security policy acquired in the acquisition step to the image data attached information of the input image data; and
A method for controlling an information processing apparatus, comprising: a storage step of storing in a storage medium the image data attached information to which the pseudo security policy is added in the adding step and the corresponding image data. A computer program for causing a computer to execute control of an information processing apparatus that performs security management of input image data,
Managing a pseudo security policy associated with the security policy added to the image data attached information of the image data before converting the image data into a format capable of giving the security policy to the image data in a storage medium Management process;
An acquisition step of acquiring a pseudo security policy for the input image data from the storage medium;
An additional step of adding the pseudo security policy acquired in the acquisition step to the image data attached information of the input image data;
A computer program for causing a computer to execute the image data attached information to which the pseudo security policy is added in the adding step and the storing step of storing the corresponding image data in a storage medium.

Images