Information processing system, image forming apparatus, and storage medium

Abstract

An information processing system, an image forming apparatus, and a storage medium. The image processing system has: a first processor mounted on a first image processing apparatus; a second processor mounted on a connection server having a virtual private line connection function; a third processor mounted on a second image processing apparatus; and a fourth processor mounted on a management server, the third processor causes the second image processing apparatus to save a job related to image processing, in response to a connection information acquisition request specifying identification information of an organization transmitted from the first image processing apparatus, the fourth processor returns connection server connection information corresponding to the organization specified in the connection information acquisition request, the first processor uses the connection server connection information to connect a virtual private line between the first image processing apparatus and the connection server of the organization, in response to a job acquisition instruction, acquires the job from the second image processing apparatus of the organization via the virtual private line, and causes the first image processing apparatus to execute the acquired job.

Description

Technical Field

[0001] This invention relates to an information processing system, an image forming apparatus, and a storage medium for storing programs. Background Technology

[0002] For example, when connecting computers located within the head office to computers located in branch offices or other locations, or to portable terminals taken outside the company, from a security perspective, it is preferable to establish a Virtual Private Network (VPN) and use it for information transmission and reception. To establish a VPN, each computer making the VPN connection saves the necessary information beforehand and refers to this information when establishing the VPN connection.

[0003] However, in recent years, with the reform of work styles and the popularization of remote work, workplaces used by employees from different companies, freelancers, students, etc., such as co-working spaces and shared offices, are expanding. Workplace managers are setting up all-in-one machines equipped with printing and fax functions in workplaces to provide services to users.

[0004] In workplaces, to prevent information leaks due to theft or other reasons, company-related information and the data to be printed are not stored on the PCs. Furthermore, when using an all-in-one machine in the workplace to perform tasks, the tasks located on the company's internal system are sent to the all-in-one machine for execution. In this case, from a security perspective, it is preferable to establish a VPN connection between the all-in-one machine in the workplace and the company's internal VPN server.

[0005] Prior art literature

[0006] Patent documents

[0007] Patent Document 1: Japanese Patent Application Publication No. 2013-260459

[0008] Patent Document 2: Japanese Patent No. 6047480 Specification Summary of the Invention

[0009] The problem that the invention aims to solve

[0010] Information processing devices located in shared spaces are shared by multiple users from different organizations. For example, to connect an information processing device to a server located within a user's organization via a VPN, the device needs the information required to establish the VPN connection. However, the information required to establish the VPN connection with the organization's server is organization-related information, which can be considered confidential. Furthermore, similarly, the operations performed by the information processing device may also be confidential. Nevertheless, storing organization- and operation-related information in advance on an information processing device shared by users belonging to different organizations could pose security risks.

[0011] The purpose of this disclosure is to enable an image processing device located in a shared space and shared by multiple users who do not belong to the same organization to perform image processing-related tasks stored on the organization side without storing information related to the organization or the task.

[0012] Some aspects of the non-limiting embodiments of this disclosure overcome the aforementioned disadvantages and / or other disadvantages not described above. However, these aspects of the non-limiting embodiments do not need to overcome the aforementioned disadvantages, and aspects of the non-limiting embodiments of this disclosure may not overcome any of the aforementioned disadvantages.

[0013] Methods for solving problems

[0014] [1] According to one aspect of this disclosure, an image processing system is provided, comprising: a first processor mounted on a first image processing device, the first image processing device being disposed in a shared space and shared by multiple users not belonging to the same organization; a second processor mounted on a connection server having a virtual private line (VPN) connection function, the connection server being disposed outside the shared space and connected to a local area network (LAN) of an organization to which at least one of the multiple users belongs; a third processor mounted on a second image processing device, the second image processing device being connected to the LAN of the organization; and a fourth processor mounted on a management server, the management server being disposed outside the shared space and the LAN of the organization, and managing connection server connection information required to establish a VPN with the connection server of the organization and access information required to access the second image processing device of the organization, wherein the third processor... The processor enables the second image processing device to store image processing-related jobs created by users belonging to the organization. In response to a connection information acquisition request sent from the first image processing device that specifies the organization's identification information, the fourth processor returns connection server connection information corresponding to the organization specified in the connection information acquisition request. The first processor uses the connection server connection information corresponding to the organization obtained by sending a connection information acquisition request containing the organization's identification information specified by the user of the first image processing device to the management server to connect a virtual private line between itself and the organization's connection server. In response to a job acquisition instruction containing the organization's identification information specified by the user of the first image processing device, it acquires a job from the organization's second image processing device via the virtual private line, which can access the organization using the organization's access information, and causes the first image processing device to execute the acquired job.

[0015] [2] Alternatively, the image processing system may include: a fifth processor mounted on an authentication server, the authentication server being connected to the local area network of the organization and authenticating users belonging to the organization, wherein, in response to an access information acquisition request sent from the first image processing device specifying the organization's identification information, the fourth processor returns authentication server access information corresponding to the organization specified in the access information acquisition request, the authentication server access information being information stored by the management server required to access the authentication server, the first processor acquiring the identification information of the user specified by the user of the first image processing device, acquiring the authentication server access information corresponding to the organization by sending the acquired access information acquisition request containing the organization's identification information to the management server, and using the acquired authentication server access information and the user's identification information to authenticate the user to the authentication server via the virtual private line.

[0016] [3] Alternatively, the image processing system may have: a sixth processor mounted on an information processing device used by a user of the shared space, wherein the sixth processor registers jobs created by the user in the second image processing device.

[0017] [4] Alternatively, the job may be a print job, and on-demand printing service may be provided by sending the print job stored in the second image processing device to the first image processing device and executing the print job.

[0018] [5] Alternatively, the fourth processor enables the management server to store the access information of the second image processing device, which acts as the host machine when providing on-demand printing services. The first processor uses the access information corresponding to the organization obtained by sending an access information acquisition request containing the identification information of the organization specified by the user of the first image processing device to the management server, and sends a registration request to the second image processing device of the organization to register the first image processing device as a slave machine of the second image processing device. After registration is completed in response to the registration request, the processor acquires a job from the second image processing device via the virtual private line in response to the job acquisition instruction specified by the user.

[0019] [6] Alternatively, the fourth processor may use the connection information of the connection server to connect a virtual private line between itself and the connection server, and by searching the local area network to which the connection server is connected, determine the second image processing device as the host machine, obtain the access information of the determined second image processing device and save it in the management server.

[0020] [7] Alternatively, the third processor may register the management server as a slave machine when providing on-demand printing services in the second image processing device, and the fourth processor may enable the management server to store the access information of the second image processing device as the master machine in the on-demand printing service.

[0021] [8] Alternatively, the fourth processor may associate the second image processing device, which corresponds to the user-specified organization of the first image processing device, with the first image processing device as the slave device of the second image processing device, and relay the information exchange between the first image processing device and the second image processing device.

[0022] [9] Alternatively, if the first image processing device and the management server are connected via a virtual private line, and the management server and the connection server of the organization corresponding to the identification information contained in the job acquisition instruction are both connected via a virtual private line, the first processor acquires the job from the second image processing device via the management server.

[0023]

[10] According to another aspect of this disclosure, an image forming apparatus is provided, comprising a processor and disposed in a shared space shared by multiple users not belonging to the same organization, and included in an information processing system together with: a connection server having a virtual private line (VPN) connection function, disposed outside the shared space and connected to a local area network (LAN) of an organization to which at least one of the multiple users belongs; an image processing apparatus connected to the LAN of the organization; and a management server disposed outside the shared space and the LAN of the organization, and managing connection server connection information required to establish a VPN with the connection server of the organization and access information required to access the image processing apparatus of the organization, wherein the processor uses connection server connection information corresponding to the organization obtained by sending a connection information acquisition request containing identification information of the organization specified by a user of the first image processing apparatus to the management server, connects a VPN between itself and the connection server of the organization, and, in response to a job acquisition instruction containing identification information of the organization specified by the user, acquires a job via the VPN from the image processing apparatus of the organization that can be accessed using the access information of the organization, and executes the acquired job.

[0024]

[11] According to another aspect of this disclosure, a storage medium is provided storing a program for causing a computer forming an image processing system to perform the following functions, wherein the image processing system comprises: a first image processing device located in a shared space and shared by multiple users not belonging to the same organization; a connection server having a virtual private line (VPN) connection function located outside the shared space and connected to a local area network (LAN) of an organization to which at least one of the multiple users belongs; a second image processing device connected to the LAN of the organization; and a management server located outside the shared space and the LAN of the organization, and managing connection server connection information required to establish a VPN with the connection server of the organization and access information required to access the second image processing device of the organization, the program causing the computer forming the second image processing device in the image processing system to perform the following functions: saving data from the network... For image processing-related jobs created by users of the organization, the computer forming the management server performs the following functions: in response to a connection information acquisition request sent from the first image processing device that specifies the organization's identification information, it returns connection server connection information corresponding to the organization specified in the connection information acquisition request; the computer forming the first image processing device performs the following functions: using the connection server connection information corresponding to the organization obtained by sending a connection information acquisition request containing the organization's identification information to the management server, it connects a virtual private line between itself and the organization's connection server; in response to a job acquisition instruction containing the organization's identification information specified by the user of the first image processing device, it acquires a job via the virtual private line from the organization's second image processing device, which can access the organization using the organization's access information; and executes the acquired job.

[0025] Invention Effects

[0026] According to [1], an image processing device located in a shared space and shared by multiple users who do not belong to the same organization can perform image processing-related tasks stored on the organization side without storing information related to the organization and the task.

[0027] According to [2], users of image processing devices can be authenticated.

[0028] According to [3], the first image processing device can execute a job created by a successfully authenticated user.

[0029] According to [4], the first image processing device can cooperate with the second image processing device to provide on-demand printing services.

[0030] According to [5], the first image processing device can directly acquire and execute the job saved by the second image processing device.

[0031] According to [6], the management server can be made to actively run to obtain access information for the second image processing device of the host machine.

[0032] According to [7], the second image processing device can provide on-demand printing services via a management server.

[0033] According to [8], information exchange between the first image processing device and the second image processing device can be performed via a management server.

[0034] According to [9], the first image processing device can obtain the job via the management server.

[0035] According to

[10] , an image processing device located in a shared space and shared by multiple users who do not belong to the same organization can perform image processing-related tasks stored on the organization side without storing information related to the organization and the task.

[0036] According to

[11] , an image processing device located in a shared space and shared by multiple users who do not belong to the same organization can perform image processing-related tasks stored on the organization side without storing information related to the organization and the task. Attached Figure Description

[0037] Exemplary embodiments of this disclosure will be described in detail with reference to the following figures, wherein:

[0038] Figure 1 This is a block diagram showing the structure of the information processing system in Embodiment 1.

[0039] Figure 2 This is a diagram illustrating an example of the data structure of the management server information stored in the management server information storage unit in Embodiment 1.

[0040] Figure 3 This is a diagram illustrating an example of the data structure of company information stored in the company information storage unit in Embodiment 1.

[0041] Figure 4A This is a timing diagram showing the process for the image processing device to perform a printing job in Embodiment 1.

[0042] Figure 4B It continues Figure 4A The timing diagram.

[0043] Figure 5 This is a block diagram showing the structure of the information processing system in Embodiment 2.

[0044] Figure 6 This is a diagram illustrating an example of the data structure of company information stored in the company information storage unit in Embodiment 2.

[0045] Figure 7A This is a timing diagram showing the process of causing the image processing device to perform a printing job in Embodiment 2.

[0046] Figure 7B It continues Figure 7A The timing diagram. Detailed Implementation

[0047] Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

[0048] Implementation Method 1

[0049] Figure 1 This is a structural block diagram illustrating one embodiment of the information processing system according to the present invention. Figure 1 The diagram illustrates a structure in which a shared office LAN (Local Area Network) system 100, a company LAN system 200, and a management server 310 located in the cloud 300 are connected via a network 1 consisting of the Internet or the like. The information processing system in this embodiment, as hardware, can be implemented by combining conventional computers, and as described later, the characteristic information processing control of this embodiment is achieved through software running on each computer.

[0050] The information processing system may also include a shared office LAN system 100 with multiple shared offices and a company LAN system 200 with multiple companies, but since each only needs to have the structure described later, therefore... Figure 1 The diagram shows one LAN system 100 and one LAN system 200. Only one management server 310 is configured in the information processing system. In this embodiment, the management server 310 is located in the cloud 300, but it is not necessary to limit its location to the cloud 300 as long as it can be accessed from each LAN system 100 or 200.

[0051] The shared office LAN system 100 is a LAN system installed in a shared office. In this embodiment, "shared space" refers to a space where multiple users from different organizations coexist. In this embodiment, a shared office is used as an example of a shared space for explanation.

[0052] Furthermore, "organization" refers to a group formed to achieve a specific purpose. If a user who does not belong to any organization uses a shared office, then the shared office can be considered a space shared by multiple users who do not belong to the same organization, rather than multiple users who belong to different organizations. In this embodiment, for ease of explanation, it is assumed that the users of the shared office belong to any organization. Furthermore, in the case of a user who does not belong to any organization, it is assumed that there is an organization to which that individual user belongs. In this embodiment, a company is used as an example of an organization. Therefore, in the following description, "organization" and "company" are used synonymously. In addition, educational institutions such as universities also exist as organizations.

[0053] The company LAN system 200 is a LAN system set up within the company, built outside the shared office. The shared office LAN system 100 is used by users belonging to multiple companies, therefore the company LAN system 200 exists for each user's company and is connected to network 1.

[0054] Image processing device 110 is located in a shared office and is used only by users of the shared office. More specifically, image processing device 110 can be used by users belonging to an organization that has signed a contract with the administrator of the shared office. Image processing device 110 is shared by users belonging to each of multiple organizations; in other words, it is shared by multiple users who do not belong to the same organization. In this embodiment, image processing device 110 is configured to be used as a slave device in an on-demand printing service.

[0055] Image processing apparatus 110, also known as image forming apparatus, is an all-in-one machine equipped with various image processing-related functions such as printing, copying, and scanning, functioning as a first image processing apparatus with a built-in computer. Image processing apparatus 110 includes: a CPU as a first processor, ROM, RAM, HDD, a scanner as an image reading device for reading images on media such as paper, a print engine as an image forming device for forming images on media, an operation panel for receiving instructions from the user and displaying information, and a network interface for connecting communication lines such as Network 1 and LAN 120. Furthermore, the image processing apparatus 110 in this embodiment includes a card reader. It may also include an external media interface for connecting external storage devices such as USB memory and flash memory, and a wireless communication unit for short-range wireless communication with a user PC 130.

[0056] The image processing apparatus 110 includes an image processing unit 111, a VPN connection processing unit 112, an authentication processing unit 113, and a management server information storage unit 114. The image processing unit 111 performs image processing based on requests from users. In this embodiment, the image processing apparatus 110 operates as a client machine upon registration when providing on-demand printing services, performing image processing-related printing jobs. The image processing unit 111 provides various image processing functions according to the hardware and software provided by the image processing apparatus 110. However, each user permitted to use the shared office may not be able to use all the functions provided by the image processing apparatus 110, but can use the functions within the scope specified in the contract information related to the use of the shared office.

[0057] In response to a request from a user, the VPN connection processing unit 112 establishes a VPN connection with the VPN server 210 of the company LAN system 200 to which the user belongs. In this embodiment, the communicative connection between the two, for example, shared office LAN system 100 and company LAN system 200 via VPN, is referred to as a "VPN connection." Furthermore, the VPN connection processing unit 112 disconnects the VPN connection in response to a termination request. The authentication processing unit 113 authenticates whether the user of the image processing device 110 belongs to the destination company of the VPN connection.

[0058] Figure 2 This diagram illustrates an example of the data structure of the management server information stored in the management server information storage unit 114 of this embodiment. The management server information is the information required to access the management server 310. Within the management server information, a set of company authentication information and a URL (Uniform Resource Locator) are set for each company to which each user of the shared office belongs. The company authentication information is the authentication information required to obtain information about that company, including the company's identification information (hereinafter referred to as "Company ID") and a password. The URL is the storage destination information that determines the location where information related to that company is stored. The management server information is pre-set in the management server information storage unit 114 according to the contract between the company or the shared office manager and the company / shared office.

[0059] Each component 111 to 113 in the image processing apparatus 110 is implemented through coordinated operation between the computer mounted on the image processing apparatus 110 and the program running in the CPU, which is the first processor mounted on the computer. Furthermore, the management server information storage unit 114 is implemented using an HDD mounted on the image processing apparatus 110. Alternatively, RAM or other computers included in the shared office LAN system 100 can be used via LAN 120.

[0060] In addition, user PC 130 is a portable PC brought into the shared office by employees of various companies. Users can also bring their own desk PC 240 into the shared office and use it as user PC 130.

[0061] The company LAN system 200 is built outside the shared office LAN system 100. The company LAN system 200 is configured to connect to the VPN server 210, the authentication server 220, the image processing device 230, and its own workstation PC 240 via LAN 250.

[0062] VPN server 210 has functions such as VPN server function or VPN router function, for connecting to a VPN in response to VPN connection requests from external devices. It establishes a VPN connection in response to requests from external network systems; in this embodiment, it establishes a VPN connection in response to a request from the image processing device 110 of the shared office LAN system 100. Furthermore, in this embodiment, VPN server 210 relays data exchanged between the VPN-connected image processing device 110 and computers such as authentication server 220 connected to the LAN 250 of the company LAN system 200.

[0063] In the VPN server 210, information related to the image processing device 110, which is the target of the VPN connection, can also be pre-configured. Specifically, the identification information or authentication information of the image processing device 110 can be pre-configured. The image processing device 110, as the target of configuration, can be identified by signing a contract with the shared office and obtaining the necessary information. Alternatively, instead of the identification information of the image processing device 110, a user ID belonging to a company user or license information (e.g., a certificate or password) issued by the VPN server 210 to the image processing device 110 can be used.

[0064] VPN server 210 achieves the processing functions described later through coordinated actions between the computer that forms VPN server 210 and the program running in the CPU, which is mounted on the computer as a second processor.

[0065] In response to a request from the image processing device 110, the authentication server 220 performs user authentication for users of the company located in the shared office. The authentication server 220 performs the processing functions described later through coordinated operation between the computer forming the authentication server 220 and the program running in the CPU, which is the fifth processor mounted on the computer.

[0066] Image processing device 230, also known as image forming device, is an all-in-one machine equipped with various image processing-related functions such as printing, copying, and scanning, functioning as a second image processing device with a built-in computer. Image processing device 230 includes: a CPU (acting as a third processor), ROM, RAM, HDD, a scanner (acting as an image reading device for reading images from media such as paper), a print engine (acting as an image forming device for forming images on media), an operation panel for receiving user instructions and displaying information, and a network interface for connecting communication lines such as Network 1 and LAN 250. Additionally, the image processing device 230 in this embodiment may also have an external media interface for connecting external storage devices such as USB memory and flash memory.

[0067] In this embodiment, the image processing apparatus 230 is configured as a master unit in the on-demand printing service. The on-demand printing service refers to a function where multiple image processing apparatuses form a group, enabling the printing data stored in the image processing apparatuses of the group to be printed from any one of the image processing apparatuses in the group. Here, the group of image processing apparatuses providing the on-demand printing service is described as being configured with one image processing apparatus as the master unit and the remaining image processing apparatuses as slave units. However, it is also possible to form a group where the master and slave units are not distinguished, and each image processing apparatus in the group possesses equivalent functions.

[0068] The image processing apparatus 230 includes an ODP (On Demand Print) function processing control unit 231 and a slave device information storage unit 232. Furthermore, components not used in the description of this embodiment are omitted from the figures. The ODP function processing control unit 231 enables the image processing apparatus 230 to perform the on-demand printing function. That is, the ODP function processing control unit 231 cooperates with devices registered as slave devices, such as the image processing apparatus 110, to provide on-demand printing services. The slave device information storage unit 232 stores slave device information related to the slave devices of the image processing apparatus 230, which operates as the host in the on-demand printing service. The slave device information includes the address information (e.g., IP address) of the device operating as a slave device. The ODP function processing control unit 231 is implemented through the coordinated operation of a computer mounted on the image processing apparatus 230 and a program running in the CPU, which is a third processor mounted on the computer. The slave device information storage unit 232 is implemented through an HDD mounted on the image processing apparatus 230. Alternatively, RAM or other computers included in the company's LAN system 200 can be used via LAN 250.

[0069] Multiple PCs used by employees are connected to LAN 250. The individual workstation PC 240 is an information processing device used within the company by employees using the shared office space. The individual workstation PC 240 stores user-created data awaiting printing. The processing performed on the individual workstation PC 240 is achieved through coordinated actions between the computer forming the individual workstation PC 240 and the programs running on the CPU, which is the sixth processor mounted on the computer.

[0070] VPN server 210, authentication server 220, image processing device 230 and their own PC 240 can all be implemented using conventional general-purpose computers, each having storage units such as CPU, ROM, RAM, HDD, user interface, and network interface for connecting network 1 and LAN 250, etc.

[0071] The management server 310 is located outside each LAN system 100, 200. As described above, the management server 310 is located in the cloud 300 in a manner that allows access from the image processing device 110 and the VPN server 210.

[0072] The management server 310 has an information management department 311 and a company information storage department 312. The information management department 311 manages company information and sets and provides company information in response to requests from external parties.

[0073] Figure 3 This diagram illustrates an example of the data structure of the company information stored in the company information storage unit 312 in this embodiment. The company information is pre-set for each company to which the users of the shared office belong. The company information includes the information required when the image processing device 110 begins accessing each company's VPN server 210 and authentication server 220. The company information includes company authentication information, VPN server connection information, authentication server connection information, and host connection information. The company authentication information is the authentication information required to access the company's information, and it contains the same content as the company authentication information stored in the image processing device 110.

[0074] The VPN server connection information contains the information required for the image processing device 110 to establish a VPN connection with the company's VPN server 210. In the VPN server connection information, the server address is set to determine the address of the VPN server 210 as the access destination. Essentially, an IP address is set. The port number is the port number used to connect to the VPN server 210. The authentication information is the information required for the image processing device 110 to be authenticated by the VPN server 210 at the connection destination, including an ID, password, a certificate issued by the VPN server 210, and VPN settings such as encryption methods or protocols associated with communication via the VPN.

[0075] The authentication server connection information includes the information required for the image processing device 110 to access the company's authentication server 220. In the authentication server connection information, the server address is set to determine the address of the authentication server 220 as the destination. Essentially, an IP address is set. The port number is the port number used to connect to the authentication server 220. The authentication information is the information required for the image processing device 110 to be authenticated by the authentication server 220 at the destination, including ID, password, certificate, etc.

[0076] The host connection information contains the information required for the image processing device 110 to access the company's image processing device 230, which operates as a host, when providing on-demand printing services. In the host connection information, the IP address is essentially set to determine the address information of the image processing device 230 as the destination. The port number is the port number used to connect to the image processing device 230. The authentication information is the information required for the image processing device 110 to be authenticated by the connected destination image processing device 230, including ID, password, certificate, etc.

[0077] The information management unit 311 in the management server 310 is implemented through the coordinated operation of the computer that forms the management server 310 and the program running in the CPU, which is the fourth processor mounted on the computer. Additionally, the company information storage unit 312 is implemented through an HDD mounted on the management server 310. Alternatively, RAM or storage units from other computers in the cloud 300 may be used.

[0078] Furthermore, the program used in this embodiment can be provided via a communication unit, or it can be stored on a computer-readable recording medium such as a CD-ROM or USB memory. The program provided from the communication unit or the recording medium is installed on the computer, and the computer's CPU executes the program sequentially to perform various processes.

[0079] Next, the actions in this embodiment will be explained.

[0080] In this embodiment, we will describe an example where a user who typically uses the image processing device 230 to print within a company uses the on-demand printing service in a shared office to have the image processing device 110 print.

[0081] When a company considers using user PCs 130 in a shared office, sometimes, for the purpose of preventing information leakage, the user PCs 130 do not save data files to be used by the image processing device 110. In this case, the user PCs 130 cannot directly send data to the image processing device 110 for printing. Therefore, the user sends a print job to the image processing device 230 from their own seat PC 240, etc., which actually stores the data to be printed, to instruct printing. However, at this time, the image processing device 230 does not execute the print job but only registers it. That is, the image processing device 230 temporarily stores the print job.

[0082] Then, after the user moves to the shared office, the user moves the print job stored in the image processing device 230 to the image processing device 110 and prints it. In this case, from a security point of view, the image processing device 110 is connected to the company's internal VPN server 210 via VPN, and then the data to be printed is sent.

[0083] However, if the information required for VPN connections, i.e. the company's inherent information, is stored and managed in a shared office LAN system 100 that includes the image processing device 110, information leakage may occur.

[0084] Therefore, in this embodiment, the company's inherent information, namely Figure 3 The company information shown is not stored in the image processing device 110 but in the management server 310 on the cloud 300, and is retrieved by the image processing device 110 when necessary. Furthermore, the print job itself is not stored in the image processing device 110 on the shared office side before it is executed.

[0085] The following uses Figure 4A , Figure 4B The sequence diagram shown illustrates the process by which a user of a shared office prints a print job created within the company by having the image processing device 110 execute the print job. Furthermore, as mentioned above, prior to performing this process, a contract between the company and the shared office needs to be established. Figure 2 The management server information is shown. Additionally... Figure 3 The company authentication information, VPN server connection information, and authentication server connection information shown are set by the company administrator through VPN server 210 or by the administrator registering the information with the company information storage unit 312 of management server 310 using a PC (not shown). Alternatively, information can be sent to the administrator of management server 310 for registration. Furthermore, there are two methods for setting the host connection information.

[0086] One method is to manually configure settings similar to those for VPN server connection information. The other method is to configure settings actively through the management server 310. Specifically, the configuration is performed as follows.

[0087] That is, the management server 310 establishes a VPN connection with the VPN server 210 by referring to the VPN server connection information set in the company information. Thus, the management server 310 virtually connects to the LAN 250, and therefore detects the image processing device 230 that can be set as the host by searching for devices connected to the LAN 250. Then, the management server 310 obtains the information required to connect to the image processing device 230 and registers it as host connection information in the company information storage unit 312.

[0088] As described above, with the required information set, the user, while inside the company, instructs the image processing device 230 to print from their own seat PC 240 (step 110). At this time, the print job to be executed by the image processing device 110 is sent to the image processing device 230, but the print job is only stored and not executed.

[0089] A user moving to the shared office issues a print job retrieval instruction to the image processing device 110 (step 120). For example, the user holds a portable IC card on a card reader (not shown) of the image processing device 110. The IC card, provided by the shared office or company, records the user's identification information (hereinafter referred to as "User ID") and company ID. When the User ID and company ID are retrieved from the IC card, the image processing device 110 performs VPN connection processing as follows (step 130). More specifically, the VPN connection processing unit 112 retrieves management server information based on the obtained company ID, thereby obtaining management server information corresponding to that company. Then, the VPN connection processing unit 112 specifies the URL contained in the obtained management server information and sends a request to the management server 310 to obtain VPN server connection information containing company authentication information (step 131).

[0090] When a request is received from the image processing device 110, the information management unit 311 in the management server 310 authenticates the company based on the company authentication information contained in the request, and then returns the company's VPN server connection information (step 132).

[0091] When VPN server connection information is obtained from management server 310, VPN connection processing unit 112 sends a VPN connection request containing authentication information to the server address and port number contained in the VPN server connection information (step 133).

[0092] When a VPN connection request is received from the image processing device 110, the VPN server 210 authenticates the image processing device 110 based on the authentication information contained in the request, and then returns a connection permission (step 134).

[0093] As described above, the VPN connection processing unit 112 establishes a VPN connection between the image processing device 110 and the VPN server 210 owned by the company to which the user holding the IC card belongs (step 135). After the VPN connection is established, the image processing device 110 then performs user authentication processing (step 140). More specifically, the authentication processing unit 113 specifies the URL included in the management server information obtained in step 131 and sends a request to the management server 310 to obtain authentication server connection information containing company authentication information (step 141).

[0094] When the information management unit 311 in the management server 310 receives a request from the image processing device 110, it authenticates the company based on the company authentication information contained in the request, and then returns the company's authentication server connection information (step 142).

[0095] When the authentication server connection information is obtained from the management server 310, the authentication processing unit 113 sends a user authentication request containing authentication information and the user ID obtained from the IC card to the server address and port number contained in the authentication server connection information via VPN, thereby requesting authentication of the user (step 143).

[0096] Upon receiving a user authentication request from the image processing device 110, the authentication server 220 authenticates the image processing device 110 based on the authentication information contained in the request, and then performs user authentication based on the user ID contained in the user authentication request (step 144). Here, we will continue the explanation assuming that the user authentication is successful.

[0097] Next, the image processing unit 111 in the image processing apparatus 110 specifies the URL contained in the management server information obtained in step 131 and sends a request to the management server 310 to obtain host connection information containing company authentication information (step 150).

[0098] Upon receiving an acquisition request from the image processing device 110, the information management unit 311 in the management server 310 authenticates the company based on the company authentication information included in the request, and then returns the host connection information of the company (step 160).

[0099] After obtaining the host connection information from the management server 310, the image processing unit 111 sends a slave registration request via VPN to the server address and port number contained in the host connection information. The request includes the authentication information of the image processing device 230 as the host and the identification information of its own device (hereinafter referred to as "device ID", such as IP address). The slave device is requested to be registered as a slave device (step 170).

[0100] When a slave device registration request is received, the ODP function processing control unit 231 in the image processing apparatus 230 authenticates the image processing apparatus 110 based on the authentication information contained in the request, and then registers the image processing apparatus 110 corresponding to the device ID contained in the slave device registration request as a slave device in the slave device information storage unit 232. Then, the ODP function processing control unit 231 returns a registration completion notification to the image processing apparatus 110 that sent the request via VPN (step 180).

[0101] As described above, when the image processing device 110 is registered as a slave device of the image processing device 230, the image processing unit 111 sends a job list retrieval request to the image processing device 230 via VPN. The job list retrieval request includes the user ID of the user who issued the print job retrieval instruction in step 120 (step 190).

[0102] In response to a job list retrieval request sent from image processing device 110, image processing device 230 reads the identification information of the print jobs of the user corresponding to the user ID included in the job list retrieval request from the stored print jobs, such as job ID, job name, etc. (hereinafter collectively referred to as "job ID"), to create a job list. Then, image processing device 230 returns the created job list to image processing device 110, the requesting source, via VPN (step 200).

[0103] Next, the image processing unit 111 displays the returned job list on the operation panel (step 210). The user viewing the operation panel display selects the job ID of the job that the image processing device 110 wants to execute from the job list (step 220). When the job ID selected by the user is obtained, the image processing unit 111 sends a job sending request to the image processing device 230 via VPN. The job sending request includes the obtained job ID and the user ID of the user who selected the job ID (step 230).

[0104] In response to a job sending request sent from the image processing device 110, the image processing device 230 extracts the print job corresponding to the job ID contained in the job sending request and returns it to the image processing device 110, the requesting source, via VPN (step 240).

[0105] After obtaining the print job as described above, the image processing unit 111 performs printing by executing the print job (step 250).

[0106] Subsequently, the image processing device 110 may also disconnect the VPN after printing is completed (step 260). When the VPN is disconnected, if the image processing device 110 subsequently stores information obtained from the user or management server 310 internally, it discards the information by deleting it from the image processing device 110 (step 270). By discarding the information, users belonging to other companies are prevented from obtaining information from the image processing device 110. That is, information leakage is prevented.

[0107] According to this embodiment, as described above, when providing on-demand printing services, the image processing device 110 located in the shared office can be used as a slave device of the image processing device 230 for printing. Thus, even without carrying a user PC 130 containing the data to be printed or the printed material containing that data, the user can obtain printed materials in the shared office. Furthermore, as described above, the group of image processing devices providing on-demand printing services is described in a manner where the image processing device 230 is the host and other image processing devices including the image processing device 110 located in the shared office are slave devices, but this disclosure is not limited to this. Each image processing device may also have the same functions as the image processing device 230, and store device information (IP addresses, etc.) of the other image processing devices forming the group, thus forming a group with equal status. In this case, the image processing device 110 located in the shared office becomes a participant in the group, obtains information about one of the image processing devices forming the group (equivalent to host connection information) from the management server 310, and submits a registration request for its own device via the management server 310, thereby enabling it to join the group.

[0108] Implementation Method 2

[0109] Figure 5 This is a structural block diagram illustrating the information processing system of this embodiment. Furthermore, the same reference numerals are used for the same components as in Embodiment 1, and descriptions are omitted. In this embodiment, an intermediary unit 313 is provided in the management server 310 of the structure shown in Embodiment 1. The intermediary unit 313 has the function of mediating information exchanged between the shared office LAN system 100 and the company LAN system 200. The intermediary unit 313 is implemented through the coordinated operation of the computer forming the management server 310 and the program running in the CPU, which is a fourth processor mounted on the computer.

[0110] Figure 6This diagram illustrates an example of the data structure for company information stored in the company information storage unit 312 of this embodiment. In the company information of this embodiment, connection sub-machine information is added to the data structure shown in Embodiment 1 for each company. The connection sub-machine information includes information about the image processing device 110 that is identified as a sub-machine of the image processing device 230 of that company. For example, the information identifying the image processing device 110 is its IP address. Furthermore, multiple image processing devices 110 may exist, with the image processing device 230 serving as the host.

[0111] The system architecture described above differs from that of Embodiment 1. Next, the operation in this embodiment will be described, which is essentially the same as in Embodiment 1. However, in this embodiment, the intermediary unit 313 in the management server 310 mediates the exchange between the image processing device 110 (as a slave device) and the image processing device 230 (as a master device), which differs from Embodiment 1. Hereinafter, using... Figure 7A , Figure 7B The timing diagram shown illustrates the process by which users of a shared office print print jobs created within the company by having the image processing device 110 execute the print job. Furthermore, for those using... Figure 4A , Figure 4B The same process as Implementation Method 1 is described, with the same step numbers marked and descriptions omitted as appropriate.

[0112] When the user is inside the company, they issue a print instruction to the image processing device 230 from their own seat PC 240, causing the image processing device 230 to store the print job (step 110). Then, after moving to a shared office, the user issues a print job retrieval instruction to the image processing device 110 by holding their IC card on the card reader of the image processing device 110 (step 120).

[0113] Through this operation, the image processing device 110 establishes a VPN connection with the VPN server (step 130). Details of this process have been described in Embodiment 1 and are therefore omitted. Afterward, the image processing device 110 performs user authentication (step 140). Details of this process have also been described in Embodiment 1 and are therefore omitted.

[0114] Next, the image processing unit 111 in the image processing apparatus 110 sends a job list retrieval request containing its own device ID, the user ID of the user who issued the print job retrieval instruction in step 120, and the company authentication information of the user's company to the management server 310 (step 310).

[0115] After receiving a job list retrieval request from the image processing device 110, the information management unit 311 in the management server 310 authenticates the company based on the company authentication information contained in the request, and then registers the device ID in the connection sub-machine information of the company information (step 320). Next, the intermediary unit 313 sends a job list retrieval request to the image processing device 230 through the server address and port number contained in the host connection information of the company from the company information. The job list retrieval request includes the authentication information of the image processing device 230 as the host, its own device identification information (hereinafter referred to as "management server ID", such as IP address), and the user ID of the user who issued the print job retrieval instruction to the image processing device 110 (step 330). The job list retrieval request also serves as the sub-machine registration request described in Embodiment 1.

[0116] When a job list retrieval request is sent, the ODP function processing control unit 231 in the image processing apparatus 230 authenticates the management server 310 based on the authentication information included in the request, and then registers the management server 310 corresponding to the management server ID included in the job list retrieval request as a slave machine in the slave machine information storage unit 232 (step 340). Next, in response to the job list retrieval request, the image processing apparatus 230 reads the identification information of the print job of the user corresponding to the user ID included in the job list retrieval request from the stored print jobs, such as the job ID, and creates a job list. Then, the image processing apparatus 230 returns the created job list to the slave machine that sent the request, i.e., the management server 310 (step 350).

[0117] The intermediary unit 313 in the management server 310 returns the job list returned by the image processing device 230 to the image processing device 110, the source of the job list acquisition request (step 360). The destination can also be determined by referring to the company's connection sub-machine information.

[0118] Subsequent processing can be the same as in Implementation Method 1, therefore the description is omitted.

[0119] In this embodiment, the image processing device 110 obtains the job list via the management server 310. That is, the management server 310 has an intermediary unit 313, so that in the on-demand printing service, it is a virtual master machine for the image processing device 110, which is a slave machine, and a virtual slave machine for the image processing device 230, which is a master machine.

[0120] Furthermore, in this embodiment, the image processing device 110 sends the print job request directly to the host machine, i.e., the image processing device 230, similar to the case in Embodiment 1. However, it can also send it via the management server 310, similar to the case of a job list retrieval request. In this case, for security reasons, it is preferable to connect VPNs between the image processing device 110 and the management server 310, and between the management server 310 and the VPN server 210, respectively, and exchange print jobs via the VPNs.

[0121] However, print jobs differ from retrieval requests in that they involve relatively large amounts of data. Therefore, when a single management server 310 mediates print jobs between multiple shared office LAN systems 100 and company LAN systems 200, the load on the management server 310 increases. Therefore, in this embodiment, to avoid overloading the management server 310, for print jobs with relatively large amounts of information data compared to requests or instructions such as job list retrieval requests, the image processing unit 230 (the host) and the image processing unit 110 (the slave) directly exchange print jobs in the on-demand printing service.

[0122] Furthermore, the management server 310 needs to remove the IP address of the image processing device 110 whose VPN has been disconnected from the company's information on connected sub-machines. VPN disconnection can also be achieved, for example, by notifying the image processing device 110.

[0123] Furthermore, in the above embodiments, the processor refers to a processor in a broad sense, including general-purpose processors (e.g., CPU: Central Processing Unit, etc.) and special-purpose processors (e.g., GPU: Graphics Processing Unit, ASIC: Application Specific Integrated Circuit, FPGA: Field Programmable Gate Array, programmable logic device, etc.).

[0124] Furthermore, the actions of the processor in the above embodiments can be performed not only by a single processor, but also by multiple processors located in physically separate positions working together. Additionally, the order of the processor's actions is not limited to the order described in the above embodiments and can be appropriately modified.

Claims

1. An image processing system, comprising: A first processor is mounted on a first image processing device, the first image processing device being located in a shared space and shared by multiple users who do not belong to the same organization; A second processor is mounted on a connection server with virtual private line connection capability, the connection server being located outside the shared space and connected to the local area network of the organization to which at least one of the plurality of users belongs; A third processor is mounted on a second image processing device, the second image processing device being connected to the local area network of the organization; as well as A fourth processor is mounted on a management server located outside the shared space and the organization's local area network. This management server stores and manages connection server connection information required to establish a virtual private line with the organization's connection server, and access information required to access the organization's second image processing device. This access information is for the second image processing device, which acts as the host machine when providing on-demand printing services. The on-demand printing service is provided by sending and executing print jobs stored by the second image processing device to the first image processing device. in, The third processor enables the second image processing device to save print jobs created by users belonging to the organization. In response to a connection information acquisition request sent from the first image processing device, specifying identification information of an organization, the fourth processor returns connection server connection information corresponding to the organization specified in the connection information acquisition request. The first processor Using the connection information corresponding to the organization obtained by sending a connection information retrieval request containing the identification information of the organization specified by the user of the first image processing device to the management server, a virtual private line is connected between the first image processing device and the organization's connection server. Using the access information corresponding to the organization obtained by sending an access information retrieval request containing the identification information of the organization specified by the user of the first image processing device to the management server, a registration request is sent to the organization's second image processing device to register the first image processing device as a slave device of the second image processing device. In response to a registration request being registered, and in response to a print job acquisition instruction containing identification information of an organization specified by the user of the first image processing device, a print job is acquired via the VPN from a second image processing device of that organization that can access the organization using its access information. The first image processing device executes the acquired print job.

2. The image processing system according to claim 1, comprising: A fifth processor is mounted on the authentication server, which is connected to the organization's local area network and authenticates users belonging to the organization. In response to an access information retrieval request sent from the first image processing device, specifying the identification information of an organization, the fourth processor returns authentication server access information corresponding to the organization specified in the access information retrieval request. This authentication server access information is stored by the management server and contains information required to access the authentication server. The first processor Obtain the user identification information specified by the user of the first image processing device. By sending an access information retrieval request containing the organization's identification information to the management server, access information for the authentication server corresponding to that organization can be obtained. Using the obtained authentication server access information and user identification information, the user is authenticated by the authentication server via the virtual private line.

3. The image processing system according to claim 2, comprising: A sixth processor is mounted on an information processing device used by a user of the shared space, wherein... The sixth processor registers the print job created by the user in the second image processing device.

4. The image processing system according to claim 1, wherein, The fourth processor Use the connection server connection information to establish a virtual private line between itself and the connection server. The second image processing device, acting as the host machine, is identified by searching the local area network to which the connection server is connected. The access information of the determined second image processing device is obtained and stored in the management server.

5. The image processing system according to claim 1, wherein, The third processor registers the management server in the second image processing device as a slave machine when providing on-demand printing services.

6. The image processing system according to claim 5, wherein, The fourth processor The second image processing device, corresponding to the user-specified organization of the first image processing device, is designated as the master device, and the first image processing device is designated as the slave device of the second image processing device. The information exchange between the first image processing device and the second image processing device is relayed.

7. The image processing system according to claim 6, wherein, When the first image processing device and the management server are connected via virtual private lines, as are the connection servers of the organizations corresponding to the identification information contained in the print job acquisition instruction, the first processor acquires a print job from the second image processing device via the management server.

8. An image forming apparatus comprising a processor, provided in a common space, shared by a plurality of users not belonging to the same organization, and included in an information processing system together with: a connection server having a virtual private line connection function, provided outside the common space, and connected to a local area network possessed by an organization to which at least one of the plurality of users belongs. An image processing device connected to the local area network of the organization; And a management server, located outside the shared space and the organization's local area network, which stores and manages connection server connection information required to establish a virtual private line with the organization's connection server and access information required to access the organization's image processing device. This access information is the access information of the image processing device, which acts as the host when providing on-demand printing services by sending and executing print jobs stored by the image forming apparatus. Wherein, the processor Using the connection information of the connection server corresponding to the organization obtained by sending a connection information acquisition request containing the identification information of the organization specified by the user of the image forming apparatus to the management server, a virtual private line is connected between the image forming apparatus and the connection server of the organization. Using the access information corresponding to the organization obtained by sending an access information acquisition request containing the identification information of the organization specified by the user of the image forming apparatus to the management server, a registration request is sent to the image processing apparatus of that organization to register the image forming apparatus as a slave device of the image processing apparatus. In response to a registration request being registered and a print job acquisition instruction containing identification information of an organization specified by the user, a print job is acquired via the VPN from the image processing device of the organization that can access the network using the organization's access information. Execute the obtained print job.

9. A storage medium storing a program for enabling a computer forming an image processing system to perform the following functions, wherein... The image processing system has: a first image processing device, which is located in a shared space and shared by multiple users who do not belong to the same organization; A connection server with virtual private line connection capability is located outside the shared space and is connected to the local area network of the organization to which at least one of the users belongs. A second image processing device, which is connected to the local area network of the organization; as well as A management server, located outside the shared space and the organization's local area network, stores and manages connection server connection information required to establish a virtual private line with the organization's connection server and access information required to access the organization's second image processing device. This access information is the access information of the second image processing device, which acts as the host when providing on-demand printing services by sending and executing print jobs stored by the second image processing device to the first image processing device. The program enables the computer forming the second image processing device in the image processing system to perform the following function: save print jobs created by users belonging to the organization. The computer forming the management server shall perform the following functions: in response to a connection information acquisition request sent from the first image processing device, which specifies the identification information of an organization, it shall return connection server connection information corresponding to the organization specified in the connection information acquisition request. The computer that forms the first image processing apparatus shall perform the following functions: Using the connection information of the connection server corresponding to the organization obtained by sending a connection information acquisition request containing the identification information of the organization specified by the user of the first image processing device to the management server, a virtual private line is connected between the connection server of the first image processing device and the connection server of the organization. Using the access information corresponding to the organization obtained by sending an access information retrieval request to the management server, which includes the identification information of the organization specified by the user of the first image processing device, a registration request is sent to the second image processing device of that organization to register the first image processing device as a sub-machine of the second image processing device. In response to a registration request being registered, and in response to a print job acquisition instruction containing identification information of an organization specified by the user of the first image processing device, a print job is acquired via the virtual private line from the second image processing device of that organization, which is capable of accessing the organization using its access information. Execute the obtained print job.

10. A computer program product comprising programs for causing a computer forming an image processing system to perform the following functions, wherein... The image processing system has: a first image processing device, which is located in a shared space and shared by multiple users who do not belong to the same organization; A connection server with virtual private line connection capability is located outside the shared space and is connected to the local area network of the organization to which at least one of the users belongs. A second image processing device, which is connected to the local area network of the organization; as well as A management server, located outside the shared space and the organization's local area network, stores and manages connection server connection information required to establish a virtual private line with the organization's connection server and access information required to access the organization's second image processing device. This access information is the access information of the second image processing device, which acts as the host when providing on-demand printing services by sending and executing print jobs stored by the second image processing device to the first image processing device. The program enables the computer forming the second image processing device in the image processing system to perform the following function: save print jobs created by users belonging to the organization. The computer forming the management server shall perform the following functions: in response to a connection information acquisition request sent from the first image processing device, which specifies the identification information of an organization, it shall return connection server connection information corresponding to the organization specified in the connection information acquisition request. The computer that forms the first image processing apparatus shall perform the following functions: Using the connection information of the connection server corresponding to the organization obtained by sending a connection information acquisition request containing the identification information of the organization specified by the user of the first image processing device to the management server, a virtual private line is connected between the connection server of the first image processing device and the connection server of the organization. Using the access information corresponding to the organization obtained by sending an access information retrieval request to the management server, which includes the identification information of the organization specified by the user of the first image processing device, a registration request is sent to the second image processing device of that organization to register the first image processing device as a sub-machine of the second image processing device. In response to a registration request being registered, and in response to a print job acquisition instruction containing identification information of an organization specified by the user of the first image processing device, a print job is acquired via the virtual private line from the second image processing device of that organization, which is capable of accessing the organization using its access information. Execute the obtained print job.

Images