Printer, method for controlling printer, and program

Abstract

To provide a technique to make difficult reconstruction of data remaining in a memory with a simple method.SOLUTION: A printer comprises: receiving means that receives a file transmitted from an external device; a volatile memory that, when the external device is a predetermined server, stores data included in the file; and overwriting means that, when the sector of the volatile memory storing the data is disabled, rewrites the data stored in the sector into dummy data up to the limit of the capacity of the volatile memory.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present disclosure relates to a printing device, a control method for a printing device, and a program. [Background technology]

[0002] Patent Document 1 discloses a technology that uses RAM as a RAMDISK when managing files. In general, a file system is used when managing files. In a file system, the storage area for data contained in a file is divided into units called "sectors," and files are managed by groups of sectors.

[0003] Recently, a service has been provided in which image data sent from a user's terminal device is not immediately printed out by a printing device, but is printed out only after the user completes login authentication in front of the printing device and inputs a print command. From the perspective of data security, this type of service is called a "secure printing service." In a "secure printing service," a file that includes confidential data (also called "confidential data") may be transferred from a server to a printing device.

[0004] Furthermore, in the "secure print service," when a file is deleted from a printing device, it is desirable to completely delete the data contained in the file so that the data cannot be restored. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2018-124717 A Summary of the Invention [Problem to be solved by the invention]

[0006] However, when deleting a file, even if the file appears to have been deleted from the perspective of file system management, in reality, the data contained in the file may remain in volatile memory.

[0007] Also, when using RAM as a RAMDISK, in order to completely erase data remaining in the RAM, it is necessary to modify the file system driver, which is cumbersome.

[0008] Therefore, an object of the present disclosure is to provide a technique that makes it difficult to restore data remaining in a volatile memory using a method that is simpler than conventional methods. [Means for solving the problem]

[0009] In order to achieve the above-mentioned object, the printing device disclosed herein is characterized by comprising a receiving means for receiving a file transmitted from an external device, a volatile memory for storing data contained in the file when the external device is a specified server, and an overwriting means for rewriting the data stored in the sector to dummy data up to the capacity limit of the volatile memory when the sector of the volatile memory storing the data is disabled. Effect of the Invention

[0010] According to the technology disclosed herein, it is possible to make it difficult to restore data remaining in a volatile memory using a method that is simpler than conventional methods. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 illustrates an example of a configuration of a printing system according to an embodiment. [Diagram 2] FIG. 2 illustrates the flow of data in one embodiment. [Diagram 3] FIG. 2 is a schematic diagram of a first storage area in one embodiment. [Figure 4] FIG. 1 is a flowchart illustrating an embodiment. [Diagram 5] FIG. 1 is a flowchart illustrating an embodiment. [Figure 6] FIG. 1 is a flowchart illustrating an embodiment. [Figure 7] FIG. 2 is a schematic diagram of a first storage area in one embodiment. [Figure 8] FIG. 1 is a flowchart illustrating an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, the embodiments of the present invention will be described with reference to the drawings. Note that the following embodiments do not limit the scope of the present invention, and not all of the combinations of features described in the embodiments are essential to the solution of the present invention. Note that the same components are given the same reference numbers and descriptions are omitted.

[0013] [First embodiment] <Overall system configuration> FIG. 1 is a diagram showing an example of the configuration of a printing system according to the present embodiment.

[0014] 1, the printing system in this embodiment includes a printing device 100, a first server 101, and a second server 102. The printing device 100, the first server 101, and the second server 102 are connected via a network and are capable of transmitting and receiving files including predetermined data to and from each other. The first server 101 and the second server 102 are external devices capable of providing a predetermined service in response to a request from a terminal device (not shown).

[0015] An example of a service provided by the first server 101 is a "secure print service." In other words, the first server 101 is capable of sending and receiving print jobs including image data and confidential data. Examples of confidential data include the ID and password of a user who uses the "secure print service," the configuration of the "secure print service," and the IP address of the first server 101. In the "secure print service," a print job sent by a user's terminal device is first sent to the first server 101. Then, the print job is transferred from the first server 101 to the printing device 100. Then, the user performs login authentication in front of the printing device 100 and then inputs a print instruction, and the print output is performed for the first time.

[0016] On the other hand, the second server 102 is capable of sending print jobs to the printing device 100, but does not provide a "secure printing service." In other words, the possibility that confidential data is included in a file sent from the second server 102 to the printing device 100 is lower than that of the first server 101. Therefore, it can be said that the possibility that a file sent from the first server 101 to the printing device 100 contains confidential data is higher than that of a file sent from the second server 102 to the printing device 100.

[0017] The printing device 100 includes a CPU 103, a ROM 104, a RAM 105, a first non-volatile memory 106, and a printer unit 107. The printing device 100 further includes a second non-volatile memory 108, a controller 109, a display operation unit 110, a network driver 111, and a network I / F 112.

[0018] The CPU 103 has a function of controlling the printing device 100. The printer unit 107 has a function of performing print output. The ROM 104 stores a control execution code (program) of the printing device 100. Furthermore, the ROM 104 stores an application that operates when printing data transmitted from the first server 101, and a file system that is a program used for managing files. In this embodiment, the ROM 104 stores an application for using the RAM 105 as a RAMDISK. The RAM 105 functions as a storage unit that temporarily stores image data used for printing and temporarily stores data related to the control of the printing device 100. The RAM 105 in this embodiment can be used as a RAMDISK. The first non-volatile memory 106 stores various information necessary for the maintenance of the printing device 100. An example of the first non-volatile memory 106 is NVRAM.

[0019] The second non-volatile memory 108 stores image data used for printing by the printer unit 107. In addition to image data, the second non-volatile memory 108 in this embodiment stores various data transmitted from the first server 101 and the second server 102 and related to the services provided by the first server 101 and the second server 102. An example of the second non-volatile memory 108 is a NAND type flash memory.

[0020] The printing device 100 includes a display operation unit 110 having a function as a user interface such as an LCD, an LED, a key, or a touch panel. Using the display operation unit 110, a user performs operations such as execution operations or setting operations of each function of the printing device 100. The controller 109 transfers these operation instructions and controls the display contents between the display operation unit 110 and the CPU 103. The printing device 100 has a network I / F 112 for connecting to an external device. The CPU 103 is connected to the network I / F 112 via a network driver 111. The network I / F 112 transmits and receives a print execution instruction and a file including a print job between the printing device 100 and an external device such as the first server 101 or the second server 102.

[0021] FIG. 2 is a diagram showing the flow of data in this embodiment.

[0022] 2, a secure print application 200 is stored in the ROM 104. The secure print application 200 has a function of transmitting and receiving a file including predetermined data to and from the first server 101 or the second server 102 via the network I / F 112.

[0023] The secure printing application 200 also has a function of performing login authentication, acquiring a print job, acquiring a print request, and the like when the "secure printing service" is provided by transmitting and receiving data to and from the first server 101. A user who uses the "secure printing service" can perform operations such as login authentication and selection of a print job by using a user interface temporarily displayed on the display operation unit 110.

[0024] The RAM 105 also includes a first storage area 201 for temporarily storing data transmitted from the first server 101, and a second storage area 202 for temporarily storing data transmitted from the second server 102. The first storage area 201 and the second storage area 202 can be used as a RAMDISK.

[0025] In the present embodiment, the secure print application 200 operates when the printing device 100 receives a file including predetermined data from the first server 101 or the second server 102. When the secure print application 200 is operating, the CPU 103 assigns processing according to the type of server that transmitted data to the printing device 100. A known technique can be used to determine the type of server. For example, when the IP address included in the received file matches the IP address of the first server 101 stored in advance in the second non-volatile memory 108, the CPU 103 determines that the data was transmitted from the first server 101. When the server that transmitted the file to the printing device 100 is the first server 101, the CPU 103 temporarily stores the data included in the file in the first storage area 201. At this time, data indicating that the file has been temporarily stored in the first storage area 201 is added to the file.

[0026] On the other hand, if the server that sent the file to the printing device 100 is the second server 102, the CPU 103 temporarily stores the data included in the file in the second storage area 202. At this time, data indicating that the file has been temporarily stored in the second storage area 202 is added to the file. Hereinafter, the data indicating the area selected when temporarily storing data in RAM 105 will be referred to as "storage area data."

[0027] Here, the capacity of the second storage area 202 is preferably larger than the capacity of the first storage area 201. In other words, the capacity of the first storage area 201 is preferably smaller than the capacity of the second storage area 202. In this embodiment, a process (hereinafter referred to as "overwriting process") of rewriting data included in a file transmitted from the first server 101 with dummy data unrelated to the data is executed in the first storage area 201. The time required to execute the "overwriting process" is proportional to the remaining capacity of the storage area.

[0028] Therefore, it is desirable that the capacity of the first storage area 201 is the minimum necessary size, with the limit being the size at which the "overwrite process" can be executed. With this configuration, the load imposed by the "overwrite process" can be reduced compared to when the capacity of the first storage area 201 and the capacity of the second storage area 202 are equal.

[0029] Finally, regardless of the type of server that transmitted the file, the CPU 103 stores the data contained in the file in the second non-volatile memory 108 before power is no longer supplied to the RAM 105. In other words, regardless of whether the data contained in the file was temporarily stored in the first storage area 201 or the second storage area 202, the data is stored in the second non-volatile memory 108. For example, the data contained in the file is stored in the second non-volatile memory 108 before the power of the printing device 100 is shut down. The data contained in the file received by the printing device 100 may be stored in the first non-volatile memory 106.

[0030] Furthermore, when the printing device 100 is started, the data stored in the second non-volatile memory 108 is copied to the RAM 105 and temporarily stored therein. At this time, whether the data is temporarily stored in the first storage area 201 or the second storage area 202 is determined based on the "storage area data" added to the file received by the printing device 100. If the "storage area data" indicates that the data has been temporarily stored in the first storage area 201, the data stored in the second non-volatile memory 108 is copied to the first storage area 201 and temporarily stored therein. On the other hand, if the "storage area data" indicates that the data has been temporarily stored in the second storage area 202, the data stored in the second non-volatile memory 108 is copied to the second storage area 202 and temporarily stored therein.

[0031] <Overwrite process> Generally, data temporarily stored in a volatile memory is completely erased when power is no longer supplied to the volatile memory. In view of this, it is extremely rare for a typical printing device to have a function for completely erasing (also called "secure erasure") data temporarily stored in a volatile memory. In addition, to completely erase data temporarily stored in a volatile memory, it is necessary to make modifications to the file system, which is cumbersome.

[0032] Therefore, when deleting a file, the printing device 100 in this embodiment rewrites the data remaining in the sectors of the first storage area 201 provided in the RAM 105 to dummy data that is not related to the data. This ensures data security even when it is difficult to completely delete the data remaining in the sectors.

[0033] A sector is a unit by which a file system divides and manages a storage medium (for example, RAM 105). A sector is generally set to a fixed value such as 512 bytes. A file system uses a group of sectors consisting of a plurality of sectors to configure files and directories. Header data is added to each sector. The header data added to the sectors includes data for determining which file is managed in the group of sectors, or whether the sectors included in the group of sectors are in use.

[0034] Data indicating the sector in which the data contained in the file is stored is managed by the file system. When the file system determines which area on the physical disk the file is to be stored in, it determines the area in which the file is to be stored, then determines the sector on the disk, and stores the data contained in the file consecutively from the sector. If there is a sector already used in the middle of the consecutive sectors, the sector may be skipped and the data may be stored in another discontinuous sector. In this embodiment, when a file is temporarily stored in RAM 105, a sector group that manages the file is determined in the memory, and the data contained in the file is temporarily stored consecutively from the first sector of the sector group. These files may be temporarily stored at an address that indicates the location of the sector that manages the file.

[0035] 3 is a schematic diagram of the first storage area 201 in this embodiment. In Fig. 3(a) to Fig. 3(e), valid (i.e., active) sectors are shown in white. On the other hand, invalid (i.e., inactive) sectors are shown in gray.

[0036] 3(a) is a diagram showing a state in which a file is temporarily stored in the first storage area 201 when the file is deleted. As shown in FIG. 3(a), the first storage area 201 includes a first sector group 301, a second sector group 302, a third sector group 303, a fourth sector group 304, and a fifth sector group 305. In the illustrated example, a file including data to be deleted is copied to the second sector group 302. On the other hand, a file including data not to be deleted is copied to the fourth sector group 304.

[0037] FIG. 3B is a diagram showing a state in which a flag indicating that a file has been deleted is set for each sector of the second sector group 302 from the state of FIG. 3A. For example, when a file is deleted using the secure print application 200, the file system sets a flag indicating that the file has been deleted for the sector of the sector group to which the file is copied. Then, the sector group including the sector to which the flag is set becomes invalid (i.e., inactive). In the illustrated example, each sector of the second sector group 302 changes from an active state to an inactive state. However, although each sector of the second sector group 302 is invalid here, the data to be deleted still remains in each sector of the second sector group 302. In other words, at this point in time, in terms of management of the file system, it appears that data has been deleted from each sector of the second sector group 302, but in reality, the data to be deleted remains. Therefore, in this embodiment, an "overwrite process" is executed to rewrite the data remaining in the sector to dummy data that is not related to the data.

[0038] Fig. 3(c) is a diagram showing a state where the inactive sectors in Fig. 3(b) are changed to an active state. As shown in the diagram, at this point, all sectors in the first storage area 201 are valid.

[0039] FIG. 3(d) is a diagram showing a state in which a dummy file is created, copied to an unprotected sector group, and dummy data is written to the dummy file. In the illustrated example, the dummy file is copied to sector groups other than the fourth sector group 304, and dummy data is written to each sector other than the fourth sector group 304. An example of dummy data is the number "0". As illustrated, each sector of the fourth sector group 304 is protected, and "overwrite processing" is not performed on each sector of the fourth sector group 304. Note that a known technique may be used to protect sectors storing data that is not to be erased. The dummy data used in the "overwrite processing" is written to the first storage area 201 until the capacity of the first storage area 201 is reached. After the dummy data is written to the dummy file until the capacity of the first storage area 201 is reached, the dummy file is closed by the file system. The dummy file is then erased by the file system. Then, a flag indicating that the dummy file has been erased is added by the file system to the sector of the group of sectors that manages the dummy file.

[0040] Figure 3(e) is a diagram showing a state in which a flag indicating that the dummy file has been deleted has been added to the sector of the sector group managing the dummy file from the state of Figure 3(d). As shown in the figure, at this point, each sector of the sector group other than the fourth sector group 304 is invalid. In other words, at this point, in terms of file system management, the dummy file appears to have been deleted, but in reality, dummy data remains in each sector of the sector group other than the fourth sector group 304.

[0041] According to such a configuration, even if the RAM 105 is analyzed, the data to be erased is overwritten with dummy data. Therefore, it is difficult to restore the original data to be erased. That is, according to the configuration of this embodiment, data security is ensured by overwriting the data to be erased with dummy data instead of erasing it.

[0042] <When saving a new file> Fig. 4 is a flowchart showing the processing performed by the printing device 100 from when it receives a new file including new data until when it saves the data in the second non-volatile memory 108. The series of processing steps shown in the flowchart in Fig. 4 are performed by the CPU 103 expanding the secure printing application 200 stored in the ROM 104 or the like into the RAM 105 and executing it. The symbol "S" in the explanation of each process indicates a step in the flowchart. The same applies to other flowcharts besides Fig. 4.

[0043] In S401, CPU 103 receives a new file including new data from a server. In S402, CPU 103 assigns processing depending on the type of server that sent the new file to printing device 100. If the server that sent the new file to printing device 100 is the first server 101, CPU 103 executes processing of S403. On the other hand, if the server that sent the new file to printing device 100 is not the first server 101, CPU 103 executes processing of S405.

[0044] In S403, CPU 103 temporarily stores the data included in the new file in first storage area 201. After temporarily storing the data included in the new file in first storage area 201, CPU 103 executes the process of S404. In S404, CPU 103 adds to the new file storage area data indicating that the data included in the new file has been temporarily stored in first storage area 201. After adding the above storage area data to the new file, CPU 103 executes the process of S407.

[0045] In S405, CPU 103 temporarily stores the data included in the new file in second storage area 202. In this case, the new file is transmitted from a server other than first server 101, and the overwrite process in this embodiment is not necessary. After temporarily storing the data included in the new file in second storage area 202, CPU 103 executes the process of S406. In S406, CPU 103 adds to the new file storage area data indicating that the data included in the new file has been temporarily stored in second storage area 202. After adding the above storage area data to the new file, CPU 103 executes the process of S407.

[0046] In S407, CPU 103 saves the new file to which the storage area data has been added in second non-volatile memory 108. That is, the new file is newly added to second non-volatile memory 108. After saving the new file in second non-volatile memory 108, CPU 103 ends a series of processes in this flowchart. Note that the new file may be saved in first non-volatile memory 106.

[0047] The above is the overall control content from when the printer 100 receives a new file from the server to when it stores the file in non-volatile memory. Note that when a new file is added to the printer 100, the "overwrite process" is not executed.

[0048] <To delete saved data> 5 is a flowchart showing the process from when a file is received to when an overwrite process is executed in this embodiment. Here, an example in which the printing device 100 receives a print job is described, but the type of file that the printing device 100 receives is not limited to a print job as long as it can be deleted using a file system.

[0049] In S501, the CPU 103 receives a print job including predetermined data from the server. In S502, the CPU 103 stores the print job in the second non-volatile memory 108. Note that the print job may be stored in the first non-volatile memory 106.

[0050] In S503, CPU 103 allocates processing depending on whether or not a print instruction has been input by the user. If a print instruction has been input by the user, CPU 103 executes processing of S504. On the other hand, if a print instruction has not been input by the user, CPU 103 waits for a print instruction from the user. In S504, CPU 103 executes print output of the print job for which a print instruction has been input by the user.

[0051] In S505, CPU 103 allocates processing depending on the type of server that sent the print job to printing device 100. If the server that sent the print job to printing device 100 is the first server 101, CPU 103 executes processing of S506. On the other hand, if the server that sent the print job to printing device 100 is not the first server 101, CPU 103 executes processing of S508.

[0052] In S506, CPU 103 temporarily stores the print job stored in second non-volatile memory 108 in first storage area 201. That is, in this step, the print job for which a print instruction has been input by the user is copied to first storage area 201 in RAM 105. When copying the print job to first storage area 201, storage area data included in the print job is referenced. If the storage area data indicates that the print job has been temporarily stored in first storage area 201, CPU 103 copies the print job to first storage area 201. After temporarily storing the print job in first storage area 201, CPU 103 executes the process of S507.

[0053] In S507, the CPU 103 invalidates each sector of the sector group that manages the print job that has been printed out in the first storage area 201. After completing the process of this step, the CPU 103 executes the process of S510.

[0054] In S508, the CPU 103 stores the print job in the second storage area 202. In S509, the CPU 103 invalidates the sector group that manages the print job in the second storage area 202. After completing the process of this step, the CPU 103 executes the process of S510.

[0055] In S510, the CPU 103 executes "overwriting processing." Details of this step will be described later with reference to Fig. 6. When the CPU 103 has finished executing the "overwriting processing," it ends the series of processes in this flowchart.

[0056] The above is the overall control content from when the printing device 100 receives a print job until when it executes the "overwrite process."

[0057] <Overwrite process details> Next, a description will be given of the subroutines executed in the process of the flowchart in Fig. 5. Details of the "overwrite process" executed in S510 will be described with reference to the flowchart in Fig. 6.

[0058] FIG. 6 is a flowchart showing the "overwrite process" in this embodiment.

[0059] In S601, the CPU 103 creates a dummy file and temporarily stores the dummy file in a group of unprotected sectors in the first storage area 201. In S602, the CPU 103 writes dummy data defined as an erasure pattern to the dummy file. That is, in this step, dummy data is written to each sector of all the groups of unprotected sectors.

[0060] In S603, CPU 103 determines whether dummy data has been written to the dummy file up to the capacity limit of first storage area 201. For example, if an error "ENOSPC" occurs in the standard C library, it is determined that dummy data has been written to the dummy file up to the capacity limit of first storage area 201. If CPU 103 determines that dummy data has been written to the dummy file up to the capacity limit of first storage area 201, CPU 103 executes the process of S604. On the other hand, if CPU 103 determines that dummy data has not been written to the dummy file up to the capacity limit of first storage area 201, CPU 103 executes the process of S602 again.

[0061] In S604, CPU 103 stops writing dummy data to the dummy file and closes the dummy file. After CPU 103 closes the dummy file, CPU 103 executes the process of S605. In S605, CPU 103 invalidates each sector of the sector group that manages the dummy file. After CPU 103 invalidates each sector of the sector group that manages the dummy file, the series of processes in this flowchart ends.

[0062] The above is the content of the overwrite process in this embodiment. As described above, in this embodiment, dummy data is overwritten by performing general file operations (open, write, close, erase) on the RAM 105 used as a RAMDISK.

[0063] With the configuration of this embodiment, as an alternative process to secure erasure, the data to be erased remaining in the volatile memory can be overwritten with dummy data that is not related to the data. Therefore, it becomes difficult to correctly read the data to be erased remaining in the volatile memory, and data security can be ensured. Therefore, according to the technology disclosed herein, it is possible to make it difficult to restore the data remaining in the volatile memory by a method that is simpler than the conventional method.

[0064] It is assumed that data may remain in RAM 105 when a file is erased by the file system. That is, when data stored in the second non-volatile memory 108 is erased or updated, the data may remain in RAM 105. For this reason, in this embodiment, when a new file is added to the second non-volatile memory 108, overwriting processing is not performed. That is, in this embodiment, control is performed so that receiving a new file from the first server 101 does not trigger the "overwriting processing."

[0065] [Second embodiment] In this embodiment, an object is to make it difficult to restore confidential data by using a method that is simpler than the conventional method, even when the data is updated.

[0066] In the following description, the same reference numerals are used for configurations similar to or corresponding to the first embodiment, and the description is omitted, and the differences are mainly described. The following description assumes that the first server 101 transmits an instruction to update data stored in the second non-volatile memory 108 to the printing device 100. Here, the description assumes that the user sets a new password and updates the old password to the new password.

[0067] <When updating data> FIG. 7 is a schematic diagram of the first storage area 201 in this embodiment.

[0068] 7A is a schematic diagram showing a state in which a file stored in the second non-volatile memory 108 has been copied to the first storage area 201. Here, data already stored in the second non-volatile memory 108 at the time when the printing device 100 receives an update instruction is called "old data." In the illustrated example, a file including the copied "old data" is managed in the second sector group 302 in the first storage area 201. An example of "old data" is an old password that a user has previously used.

[0069] Fig. 7(b) is a diagram showing a state in which the sector group managing the file including the old data has become invalid from the state of Fig. 7(a). In the illustrated example, the second sector group 302 managing the file including the old data has become invalid.

[0070] Figure 7(c) shows the state in which the sector group that manages the file including the data sent with the update instruction has become valid, following the state shown in Figure 7(b). Here, the data sent with the update instruction is called "new data." An example of "new data" is a new password that the user has newly set.

[0071] FIG. 7D is a diagram showing a state in which all sectors in the first storage area 201 have become valid, following the state shown in FIG. 7C.

[0072] Figure 7(e) shows the state in which "dummy data" has been written to the dummy file managed in the unprotected sector group at the time shown in Figure 7(d). The fourth sector group 304, which manages the file including the "new data", is protected. Therefore, the "overwrite process" is not performed in the fourth sector group 304.

[0073] FIG. 7(f) is a diagram showing a state in which a flag indicating that the dummy file has been deleted has been set for the group of sectors managing the dummy file, following the state shown in FIG. 7(e). Therefore, according to the configuration of this embodiment, as an alternative process to secure erasure, dummy data can be overwritten on each sector that stores the old data to be updated. For example, an old password that a user has been using can be overwritten with dummy data. Therefore, the old data remaining in the sector is rewritten with dummy data, making it difficult to correctly read the old data. This ensures the data security of the data remaining in the sector.

[0074] FIG. 8 is a flowchart showing the process performed by the printing device 100 from when it receives a data update instruction to when it executes an overwrite process.

[0075] In S801, the CPU 103 receives from the server an instruction to update old data stored in the second non-volatile memory 108, and an update file including new data including the update contents. In S802, the CPU 103 assigns processing according to the type of server that transmitted the update instruction and the update file to the printing device 100. If the server that transmitted the update instruction and the update file to the printing device 100 is the first server 101, the CPU 103 executes the processing of S803. On the other hand, if the server that transmitted the update instruction and the update file to the printing device 100 is not the first server 101, the CPU 103 executes the processing of S808.

[0076] In S803, the CPU 103 temporarily stores the file stored in the second non-volatile memory 108 in the first storage area 201. Specifically, the old data stored in the second non-volatile memory 108 is copied to each sector of the sector group in the first storage area 201 that manages the file including the old data. In S804, the CPU 103 invalidates each sector of the sector group in the first storage area 201 that manages the file including the old data. In S805, the CPU 103 validates each sector of the sector group in the first storage area 201 that manages the update file. In S806, the CPU 103 validates all sectors of the first storage area 201. In S807, the CPU 103 executes "overwrite processing". The contents of this step are the same as the example shown in FIG. 6. When the CPU 103 finishes executing the "overwrite processing", it executes the processing of S811.

[0077] In S808, CPU 103 temporarily stores the file stored in second non-volatile memory 108 in second storage area 202. Specifically, old data stored in second non-volatile memory 108 is copied to each sector of the group of sectors in second storage area 202 that manages the file including the old data. In S809, CPU 103 invalidates each sector of the group of sectors in second storage area 202 that manages the file including the old data. In S810, CPU 103 validates each sector of the group of sectors in second storage area 202 that manages the update file, and temporarily stores new data in each of the sectors.

[0078] In S811, the CPU 103 saves an update file including the new data in the second non-volatile memory .

[0079] The above is the overall control content from when the printing device 100 receives a data update instruction to when it saves the update file. According to the printing device 100 of this embodiment, even when updating data, it is possible to make it difficult to restore confidential data by using a method that is simpler than in the past.

[0080] [Other embodiments] The disclosure of this embodiment includes the following configuration.

[0081] [Configuration 1] A receiving means for receiving a file transmitted from an external device; a volatile memory for storing data included in the file when the external device is a predetermined server; and an overwriting means for overwriting the data stored in the sector of the volatile memory with dummy data up to a capacity limit of the volatile memory when the sector of the volatile memory storing the data is invalid. A printing device comprising:

[0082] [Configuration 2] The predetermined server is a server that provides a secure printing service. 2. The printing device according to claim 1.

[0083] [Configuration 3] The volatile memory is a RAM and can be used as a RAMDISK. 3. The printing device according to configuration 1 or 2.

[0084] [Configuration 4] the RAM including a first storage area and a second storage area having a capacity larger than that of the first storage area; the overwriting means for overwriting the data remaining in the first storage area with the dummy data; 4. The printing device according to configuration 3.

[0085] [Configuration 5] the overwriting means for overwriting the data with the dummy data when the receiving means receives the file a number of times greater than a predetermined number, 5. A printing device according to any one of configurations 1 to 4.

[0086] [Configuration 6] the overwriting means not rewriting the data stored in the volatile memory to the dummy data when it is scheduled that power supply to the volatile memory will be stopped; 6. A printing device according to any one of configurations 1 to 5.

[0087] [Configuration 7] The overwriting means is configured to overwrite the data with random data if the data is compressed by a run-length algorithm. 7. A printing device according to any one of configurations 1 to 6.

[0088] [Configuration 8] new data and an update instruction for updating the data stored in the non-volatile storage means; The receiving means for receiving the the volatile memory for temporarily storing the data and the update data at the same time; and an overwriting means for overwriting the data with the dummy data when updating the data with the update data. 8. A printing device according to any one of configurations 1 to 7.

[0089] [Configuration 9] A receiving step of receiving a file transmitted from an external device; a storing step of storing data included in the file in a volatile memory when the external device is a predetermined server; and if the sector of the volatile memory storing the data is invalid, overwriting the data stored in the sector with dummy data. A method for controlling a printing device.

[0090] [Configuration 10] A program for causing a computer to function as the printing device according to any one of configurations 1 to 8.

[0091] 5, an example in which a print job is transmitted has been described, but the file transmitted from the server is not limited to a print job. The file transmitted from the server may be a general document file as long as it may include confidential data.

[0092] It is generally known that repeated rewriting of data in a memory accumulates damage to the memory, shortening the lifespan of the memory. Therefore, the overwrite process may not be executed every time a print job or an update instruction is received. This makes it possible to suppress the number of times the memory is rewritten. For example, the CPU 103 may execute the overwrite process when a print job is received more than a predetermined number of times. With this configuration, the number of times the memory is rewritten can be reduced compared to when the overwrite process is executed every time a print job is received. Therefore, for example, the processing load on the RAM 105 can be reduced. In other words, the lifespan of the RAM 105 can be extended compared to when the overwrite process is executed every time a print job is received.

[0093] Also, if it is planned that power supply to the RAM 105 will be cut off, data temporarily stored in the RAM 105 may be prevented from being rewritten with dummy data. For example, if it is planned that the printing device 100 will be shut down, the overwrite process may be prevented from being executed. This is because, when the printing device 100 is shut down, the data temporarily stored in the RAM 105 will be completely erased without the need for overwrite processing. This makes it possible to extend the life of the RAM 105, compared to a case in which the overwrite process is executed on the RAM 105 even when the printing device 100 is scheduled to be shut down.

[0094] Specifically, a tool that receives a firmware update job for the printing device 100 as a job may be installed in the printing device 100 in advance. In a network connection environment in this case, the tool automatically receives the latest firmware. When the printing device 100 receives a firmware update job, the action of "perform firmware update and restart" is confirmed after all jobs that have been queued up until that point are completed. In this case, the printing device 100 automatically shuts down in order to restart. In this way, when the printing device 100 receives a firmware update job, the overwrite process may not be executed.

[0095] In the first embodiment, zero data is used as the dummy data. As another example of the dummy data, random data may be used when the data temporarily stored in the first storage area 201 is compressed by a run-length algorithm. For example, the data temporarily stored in the first storage area 201 may become zero data as a result of being compressed by a run-length algorithm. In such a case, it may become impossible to distinguish whether the stored data has become zero data due to an overwrite process or has become zero data as a result of being compressed by a run-length algorithm.

[0096] However, by overwriting the data temporarily stored in the first storage area 201 with random data, it is possible to prevent the data from becoming difficult to distinguish. Furthermore, when data is compressed using a run-length algorithm, the compressed data has a relatively simple arrangement of numbers, etc., and there is a risk that the data may be analyzed. In contrast, when random data is used, the arrangement of numbers, etc. is more complex than when zero data is used, making it difficult to analyze the data. In other words, by overwriting the data temporarily stored in the first storage area 201 with random data, it is also possible to prevent the data from being analyzed.

[0097] The present invention can also be realized by a process in which a program for implementing one or more of the functions of the above-described embodiments is supplied to a system or device via a network or a storage medium, and one or more processors in a computer of the system or device read and execute the program. The present invention can also be realized by a circuit (e.g., ASIC) that implements one or more of the functions.

Claims

1. 1. A printing device, comprising: a receiving means for receiving a file transmitted from an external device; a storage unit for storing data included in the file in a volatile memory when the external device is a server that provides a secure printing service; Equipped with The volatile memory is a RAM and can be used as a RAM disk; the RAM includes a first storage area and a second storage area having a larger capacity than the first storage area; the printing device further comprises an overwriting means for overwriting the data remaining in the sector of the first storage area included in the volatile memory with dummy data until the capacity of the first storage area included in the volatile memory reaches its limit when the sector of the first storage area that stores the data is invalid; A printing device characterized by:

2. the overwriting means overwrites the data with the dummy data when the receiving means receives the file more than a predetermined number of times; The printing device of claim 1 .

3. the overwriting means does not rewrite the data stored in the volatile memory with the dummy data when the supply of power to the volatile memory is scheduled to be terminated; 3. The printing device according to claim 1 or 2.

4. the overwriting means overwrites the data with run-length data when the data is compressed using a run-length algorithm; 3. The printing device according to claim 1 or 2.

5. the receiving means receives new data and an update instruction for updating the data stored in the non-volatile storage means; the volatile memory temporarily stores the data and the new data simultaneously; the overwriting means rewrites the data to the dummy data when the data is updated to the new data; 3. The printing device according to claim 1 or 2.

6. A method for controlling a printing device, comprising: a receiving step of receiving a file transmitted from an external device; a storing step of storing data included in the file in a volatile memory when the external device is a server that provides a secure printing service; Equipped with The volatile memory is a RAM and can be used as a RAM disk; the RAM includes a first storage area and a second storage area having a larger capacity than the first storage area; The control method includes an overwriting step of, when a sector of the first storage area included in the volatile memory storing the data is invalid, rewriting the data remaining in the sector of the first storage area with dummy data until the capacity of the first storage area included in the volatile memory reaches its limit. A control method comprising:

7. A program for causing a computer to function as the printing device according to claim 1 or 2.

Images