Printing device, printing device control method, and program

Abstract

To acquire only a necessary audit log while protecting confidential information in acquiring audit logs by filtering the audit logs according to authority of a user who has issued an acquisition request.SOLUTION: A printing system of the present invention is a printing system comprising one or more multi-functional machines (1000-1002) and a management server (2000) that can communicate with the multi-functional machines via networks (100, 200), and the management server receives instructions for acquiring user identification information and audit logs in which an operation user of the multi-functional machine is designated to be audited. When a group to which a user corresponding to the user identification information belongs and a group to which the operation user to be audited belongs match or correspond to each other, the printing system transmits the instructions to the multi-functional machine. The multi-functional machine stores the audit logs in linkage with the operation user of the multi-functional machine, and transmits the audit log of the operation user designated in the received instructions to the server.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present invention relates to an audit log function of a printing device for the purpose of improving security. [Background technology]

[0002] Information devices and printing devices are known to have a function that records the operation of the device as a log for the purpose of grasping the usage status of the device, auditing, and preventing information leakage, and such a log is called an audit log. When an information leakage or unauthorized access to a device is discovered, it is possible to confirm the unauthorized operation by referring to the audit log.

[0003] In recent years, the locations where information devices and printing devices are installed and the user environments have become more diverse, and not only access within a firewall but also direct access from external networks such as the Internet is increasing. As a result, information leaks and attacks due to unauthorized operation have become problems both inside and outside the company. Due to the spread of such usage of information devices and printing devices, in recent years, the idea of ​​defense has changed from not only perimeter security such as firewalls to the idea of ​​defense based on zero trust security. Zero trust security defense is the idea of ​​strictly defending devices directly connected to the Internet based on the assumption that humans are evil. The function of audit logs is becoming increasingly important from the idea of ​​defense based on zero trust security.

[0004] According to Patent Document 1, a function is disclosed in which a log management server accesses a printing device to acquire audit logs. Acquisition of such audit logs is generally performed by the administrator of the information device or printing device or the security administrator within the organization. The administrator can acquire all audit logs held by the device in one go and view them all.

[0005] However, in recent years, with the spread of work styles both inside and outside the company, such as teleworking, it is becoming increasingly necessary for not only the organization's security administrators, but also the heads of each department in the organization to check whether members of their departments are performing their work correctly.For example, while the head of a department can understand to some extent the situation of their employees if they are in the office, he or she cannot directly monitor the situation of employees in satellite offices or at home, so he or she must use audit logs to determine whether information devices or printing devices are being used improperly. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] JP 2014-146206 A Summary of the Invention [Problem to be solved by the invention]

[0007] However, conventionally, audit logs obtained from information devices and printing devices record the operation history of many users and devices, and therefore individual department heads in an organization could not view the audit logs. This is because audit logs also contain confidential information, and it is undesirable for unauthorized individuals to be able to view audit logs that they should not view.

[0008] Therefore, the audit logs that department heads may view would not be all audit logs that security administrators can view, but would be limited to only those related to their own department.

[0009] The present invention has been made in consideration of the above-mentioned problems, and has as its object to improve security in a device having an audit log function.

[0010] It is yet another object of the present invention to obtain an audit log in accordance with user authority in a printing device having an audit log function. [Means for solving the problem]

[0011] The printing system of the present invention is a printing system comprising one or more printing devices and a server capable of communicating with the printing devices via a network, wherein the server comprises a receiving means for receiving user identification information and an instruction to obtain an audit log specifying an operating user of the printing device as the audit target, and a first transmitting means for transmitting an instruction to the one or more printing devices if a group to which a user corresponding to the user identification information belongs matches or corresponds to a group to which the operating user of the audit target belongs, and the printing device comprises a first storage means for storing the audit log in association with the operating user of the printing device, a first receiving means for receiving the instruction from the server, and a second transmitting means for transmitting the audit log of the operating user specified in the received instruction to the server. Effect of the Invention

[0012] According to one aspect of the present invention, it is possible to improve security in a device having an audit log function.

[0013] In addition, according to another aspect of the present invention, it is possible to obtain the audit log of the operating user to be audited by linking it to the group to which the user belongs, so that the audit log can be obtained according to the user's authority on a printing device having an audit log function. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 is a diagram illustrating an example of a printing system configuration according to an embodiment. [Diagram 2] 1A is an example of a hardware configuration diagram of a multifunction peripheral 1000 in an embodiment, FIG. 1B is an example of a hardware configuration diagram of a management server 2000, and FIG. [Diagram 3] 1A is an example of a software configuration diagram of a multifunction peripheral 1000 in an embodiment, and FIG. 1B is an example of a software configuration diagram of a management server 2000 in an embodiment. [Figure 4]11 is an example of a flowchart showing a flow from an instruction to acquire an audit log to sending the audit log in the embodiment. [Diagram 5] 13 is an example of a flowchart showing a process flow for generating an audit log destination list in the embodiment. [Figure 6] 13 is an example of a setting screen for determining a device from which an audit log is to be acquired in the embodiment. [Figure 7] 13 is an example of an audit log authority setting screen in the embodiment. [Figure 8] 11 is an example of a flowchart showing the flow of an audit log acquisition process in the embodiment. [Figure 9] 11 is a flowchart illustrating a flow of a login process according to an embodiment. [Figure 10] 13 is an example of a flowchart illustrating an audit log acquisition process according to the second embodiment. [Figure 11] 13 is an example of a setting screen for audit log acquisition conditions in the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In this embodiment, a multifunction device (digital multifunction device / MFP / Multi Function Peripheral) with a user authentication function is taken as an example. However, since the user authentication function is generally also used in SFP (Single Function Peripheral), the scope of application is not limited to multifunction devices. EXAMPLES

[0016] Fig. 1 is an example of a network configuration diagram of this embodiment. In this embodiment, a system in which a plurality of multifunction devices communicate with a management server via a network as shown in Fig. 1 is called a printing system.

[0017] The multifunction device 1000 has a printing function and an audit log function. In addition, the multifunction device 1000 can transmit and receive print data, scanned image data, device management information, and the like between other information processing devices via the internal network 100.

[0018] In this embodiment, the audit log refers to a log that indicates who performed what process, when, and where. Specifically, it refers to a job log that records the operation history of users and devices, an operation log of a user interface (UI), a record of image data when scanning or printing is performed, packet information during network communication, etc. The type of audit log is not particularly limited because it depends on what information the administrator wants to audit.

[0019] The multifunction device 1000 can also communicate with the management server 2000 via the internal network 100 and the external network 200. In this embodiment, the internal network 100 is assumed to be an in-house network protected by a firewall or gateway within an office, and the external network 200 is assumed to be a network that can be directly accessed from the Internet, but is not limited thereto. A PC (electronic device) 01 can perform user authentication and refer to and operate the multifunction device 1000 via the network 100.

[0020] The management server 2000 can communicate with multifunction devices, PCs, and mobile terminals via an external network 200. The multifunction devices 1001 and 1002 are multifunction devices directly connected to the external network. In this embodiment, the multifunction device 1001 is installed in a shared space such as a coworking space, and the multifunction device 1002 is installed in a home for telecommuting, but this is not limited thereto. A PC (electronic device) 02 and a mobile terminal 03 can perform user authentication and refer to and operate the multifunction devices 1000 to 2000 via the network 200.

[0021] In this embodiment, the multifunction peripherals 1000 to 1002 not only perform scanning and printing by themselves, but also perform printing and store scanned data via the management server 2000 .

[0022] 1 shows only the illustrated number of MFPs, management servers, PCs, and mobile terminals as an example, but the number of each may be multiple and is not limited to this. Also, the management server 2000 may be connected to another cloud storage via the network 200 and is not limited to this.

[0023] FIG. 2A is a block diagram showing a schematic configuration of a multifunction peripheral 1000 according to this embodiment.

[0024] The CPU 201 executes the software program of the multifunction peripheral 1000 and controls the entire device. The ROM 202 is a read-only memory that stores the boot program and fixed parameters of the multifunction peripheral 1000. The RAM 203 is a random access memory that is used to store programs and temporary data when the CPU 201 controls the multifunction peripheral 100. The HDD 204 is a hard disk drive that stores system software, applications, and various data. The CPU 201 executes the boot program stored in the ROM 202, expands the program stored in the HDD 204 into the RAM 203, and controls the operation of the multifunction peripheral 100 by executing the expanded program. The network I / F control unit 205 controls the transmission and reception of data to and from the network 100. The scanner I / F control unit 206 controls the reading of documents by the scanner 211. The printer I / F control unit 207 controls the printing process by the printer 212, etc. The panel control unit 208 controls a touch panel type operation panel 210, and controls the display of various information and the input of instructions from the user. The USB I / F 213 controls the connection with the USB memory. The bus 209 interconnects the CPU 201, ROM 202, RAM 203, HDD 204, network I / F control unit 205, scanner I / F control unit 206, printer I / F control unit 207, panel control unit 208, and USB I / F 213. Control signals from the CPU 201 and data signals between the devices are transmitted and received via the bus 209.

[0025] The multifunction peripherals 1001 and 1002 in this embodiment have the same configuration as that shown in FIG.

[0026] FIG. 2B is a block diagram showing a schematic configuration of the management server 2000 according to this embodiment. The CPU 221 executes the software program of the management server 2000 and controls the entire device. The ROM 222 is a read-only memory and stores the boot program and fixed parameters of the management server 2000. The RAM 223 is a random access memory and is used to store programs and temporary data when the CPU 221 controls the management server 2000. The HDD 224 is a hard disk drive and stores system software, applications, and various data. The CPU 221 executes the boot program stored in the ROM 222, expands the program stored in the HDD 224 into the RAM 223, and controls the operation of the management server 2000 by executing the expanded program. The network I / F control unit 225 controls the transmission and reception of data to and from the network 200. The operation unit of the management server 2000 can be operated from a PC or a mobile terminal via the network I / F control unit 225. In this embodiment, the operation unit displayed on the PC or mobile terminal is called a remote UI. A bus 229 interconnects the CPU 221, the ROM 222, the RAM 223, the HDD 224, the network I / F control unit 225, and the panel control unit 228. Control signals from the CPU 221 and data signals between the various devices are transmitted and received via the bus 229.

[0027] FIG. 2C is a block diagram showing a schematic configuration of the PC02 according to the present embodiment.

[0028] In the PC02, a CPU 231 generally controls access to various devices connected to a system bus 235 based on a control program stored in a ROM 232 or a hard disk (HDD) 234 of the PC02.

[0029] Reference numeral 232 denotes a ROM which stores control programs executable by the CPU 231 and the like.

[0030] Reference numeral 223 denotes a RAM, which functions mainly as a main memory, a work area, etc. for the CPU 231, and is configured so that the memory capacity can be expanded by an optional RAM connected to an expansion port (not shown).

[0031] 234 is a hard disk drive (HDD) that stores a boot program, various applications, font data, user files, edit files, etc. In this embodiment, the HDD 34 is used, but in addition to the HDD 234, an SD card, a flash memory, etc. may also be used as an external storage device.

[0032] The network I / F control unit 235 controls the transmission and reception of data to and from the network 200 .

[0033] The display control unit 236 controls the display of the display I / F 237 .

[0034] An operation control unit 238 controls operation signals of a keyboard 239 and a mouse 240. The keyboard I / F 239 controls key input. The mouse I / F controls input from a pointing device (not shown).

[0035] In this embodiment, the operation unit of the management server 2000 is displayed by a UI on a Web browser displayed by a display I / F 237 of PC02 via a network I / F control unit 225. Furthermore, operations on the management server 2000 are performed on the UI on the Web browser by a keyboard I / F 239 and a mouse I / F 240 of PC02. In this embodiment, the UI via the network via the Web browser is called a remote UI.

[0036] The bus 239 interconnects the CPU 231, the ROM 232, the RAM 233, the HDD 234, the network I / F control unit 235, the display control unit 236, and the operation control unit 238. Control signals from the CPU 231 and data signals between the respective devices are transmitted and received via the bus 239.

[0037] 3A is a block diagram for explaining software modules included in the multifunction peripheral 1000 according to the first embodiment. The software modules shown in FIG. 3 are realized by the CPU 201 executing a program loaded in the RAM 203.

[0038] A network driver 301 controls a network I / F control device 205 connected to the network 100 to transmit and receive data to and from the outside via the network 100. A network control unit 302 controls communication below the transport layer in a network communication protocol such as TCP / IP to transmit and receive data. A communication control unit 303 is a module for controlling a plurality of communication protocols supported by the multifunction device 100. Encrypted communication such as TLS supported by the multifunction device 100 is also executed by the communication control unit 303.

[0039] The encryption processing unit 304 is a module for executing various cryptographic processes such as data encryption and decryption, generation and verification of digital signatures, generation of hash values, etc. In the encrypted communication process such as TLS executed by the communication control unit 303, the encryption process is also performed by the encryption processing unit 304.

[0040] The device control unit 305 is a module that generates control commands and control data for the multifunction device 1000 and comprehensively controls the multifunction device 100. User authentication instructed via the operation panel 210, panel control unit 208, or network I / F control unit 205 is executed by the device control unit 305. The device control unit 305 records the operation history of the multifunction device 1000 in the HDD 204 as an audit log.

[0041] A print / read processing unit 306 is a module for executing functions such as printing by the printer 212 and reading of an original by the scanner 211. In this embodiment, a scan or print instruction to the multifunction peripheral 1000 can also be executed by a user's instruction via the operation panel 210. The control of the operation panel 210 and the panel control unit 208 is executed by a UI control unit 307.

[0042] The control unit consisting of the software configuration of the multifunction device 1000 shown in Fig. 3(A) above will hereinafter be referred to as the control unit 1. In this specification, the control unit 1 consists of the CPU 201, ROM 202, RAM 203, HDD 204, etc. of the multifunction device 1000. Note that in the following sequences and flowcharts, the parts processed by the multifunction device 1000 are stored in any one of the storage means, ROM 202, RAM 203, or HDD 204, of the control unit 1 and are executed by the CPU 201.

[0043] Fig. 3B is a block diagram for explaining software modules included in the management server 2000 according to the first embodiment. The software modules shown in Fig. 3 are realized by the CPU 221 executing a program loaded in the RAM 223.

[0044] The network driver 321 controls the network I / F control unit 225 connected to the network 100 to transmit and receive data to and from the outside via the network 100. The network control unit 322 controls communication below the transport layer in a network communication protocol such as TCP / IP to transmit and receive data. The communication control unit 323 is a module for controlling a plurality of communication protocols supported by the management server 2000. Encrypted communication such as TLS supported by the management server 2000 is also executed by the communication control unit 323.

[0045] The encryption processing unit 324 is a module for executing various cryptographic processes such as data encryption and decryption, generation and verification of digital signatures, generation of hash values, etc. In the encrypted communication process such as TLS executed by the communication control unit 323, the encryption process is also performed by the encryption processing unit 324.

[0046] The device control unit 325 is a module for generating control commands and control data for the management server 2000 and for centrally controlling the management server 2000. The device control unit 325 records the operation history of the multifunction peripheral 1000 in the HDD 224 as an audit log.

[0047] In this embodiment, the management server 2000 is operated by a remote UI that can be operated from a PC or a mobile terminal via a network I / F control unit 225. The control of this remote UI is executed by a UI control unit 327.

[0048] The control unit consisting of the software configuration of the management server 2000 shown in Fig. 3(B) above is hereinafter referred to as the control unit 2. In this specification, the control unit 2 consists of the CPU 221, ROM 222, RAM 223, HDD 224, etc. of the management server 2000. Note that in the following sequences and flowcharts, the parts processed by the management server 2000 are stored in any one of the storage means of the ROM 222, RAM 223, and HDD 224 of the control unit 2 and are executed by the CPU 221.

[0049] FIG. 4 is a sequence diagram illustrating the overall process flow until the management server acquires the audit log from the multifunction peripheral having the audit log function in the system according to the embodiment.

[0050] In this embodiment, a printing system is configured in which the MFPs 1000, 1001, 1002 through MFP XXXX, the management server 2000, and PC02 communicate with each other via a network. The MFPs 1000-1002 perform user authentication, accept print instructions from the operation unit, and perform print control. The management server 2000 acquires audit logs from the MFPs. PC02 shares the audit log acquisition from a remote UI, which is a UI for performing operations on the management server 2000. Note that the management server 2000 is a separate device from the MFPs 1000-1002, but the functions of the management server 2000 may be included in the MFPs 1000-1002, and there is no particular limitation thereto.

[0051] This sequence is started in response to the receipt of an instruction to the management server 2000 to acquire an audit log.

[0052] First, in S0401, the control unit 2 of the management server 2000 receives an instruction to acquire user identification information and an audit log from a user via a remote UI presented on the PC 02. In this embodiment, the content of the instruction is an instruction that designates the operating user as an audit target.

[0053] Next, in S0402, PC02 instructs the management server 2000 to request acquisition of an audit log together with user identification information.

[0054] Next, in S0403, the control unit 2 performs processing for generating a list of audit log acquisition destinations based on the received user identification information and audit log acquisition request. In this embodiment, the audit log acquisition destinations are destinations to which the management server 2000 sends an instruction to acquire the audit log.

[0055] Fig. 5 is a flowchart explaining the process for generating an audit log acquisition destination list, which is started after the process of S0403 in Fig. 4. This process is achieved by the CPU 221 of the control unit 2 executing a program loaded in the RAM 223.

[0056] In step S0501, the control unit 2 accepts an audit log acquisition request together with user identification information (user ID). The audit log acquisition request in this embodiment includes a condition for acquiring an audit log. An example of a condition for acquiring an audit log in this embodiment is shown in FIG. 11. FIG. 11 shows a screen 110 for setting a condition for acquiring an audit log, which is displayed by a remote UI via the network I / F control unit 225 of the management server 2000. In the screen 110, it is possible to specify conditions for an audit log to be acquired, such as whether to acquire all audit logs, whether to acquire audit logs of a specific department, whether to acquire only audit logs of an operating user of a specific multifunction machine, and the period during which audit logs were recorded. In this embodiment, the screen 110 is composed of a user name (user ID) entry field 111, a password entry field 112, acquisition range designation icons 112, 113, an acquisition target entry field 114, and acquisition period designation fields 115, 116, 117, 118, 119, 120, 121, 122, 123, and 124. Screen 110 is merely an example and is not limited to this. In this embodiment, the user name and password are collectively referred to as user identification information, but the user identification information may be any information that can identify the user for whom an audit log is to be obtained.

[0057] A user who wishes to acquire an audit log enters a user name and a password required for login authentication to the management server in a user name (user ID) entry field 111 and a password entry field 112, respectively. In addition, a button 112 for "acquire all audit logs" as the acquisition range or a button 113 for "acquire specified audit logs" is selected. If the button 112 is selected, the acquisition range and acquisition period are not input. In this embodiment, "acquire specified audit logs" is selected, and it is necessary to input the acquisition range and acquisition period. In the acquisition target entry field 114, the "belonging group name" or the "operation user ID" for which the audit log is to be acquired is input. The name to be entered in the entry field 114 corresponds to the user ID 602 ​​or the belonging group 603 shown in FIG. 6. The acquisition target entry field 114 has a search function, and may be configured to present candidates for related user IDs and belonging group names from the words entered by the user. In the acquisition period entry field, the period for acquiring the audit log is specified by inputting the start and end dates and times. The start date and time are specified in a year specification field 115, a month specification field 116, a date specification field 117, and a time specification field (hour 118 and minute 119). The end date and time are specified in a year specification field 120, a month specification field 121, a date specification field 122, and a time specification field (hour 123 and minute 124).

[0058] In step S 0502 , the control unit 2 checks the conditions for acquiring the audit log specified on the screen 110 , and stores the conditions in the RAM 223 .

[0059] Next, in step S0503, the control unit 2 acquires from the HDD 224 a setting for determining a device from which an audit log is to be acquired.

[0060] 6A shows a setting screen (management table A) 601 for determining a device for which an audit log is to be acquired in this embodiment. This screen is displayed by a remote UI on the display I / F 237 of the PC02 via the network I / F control unit 225 of the management server 2000.

[0061] The screen 601 in this embodiment is configured by a user ID setting 602, a group setting 603, a device setting 604, a decision button 605, and a cancel button 606. The screen 601 is a setting for determining the group to which each operating user belongs and from which multifunction device the audit log is to be acquired when an instruction is given to acquire an audit log for the operating user (operating user ID) who operated the multifunction device or the group to which the operating user belongs. Taking the screen in FIG. 6A as an example, when an audit log acquisition is requested for user001 who is the operating user of the multifunction devices 1000 to 1002, the acquisition target device is only the multifunction device 1000, and for user002, the acquisition target device is the multifunction device 1000 and 1001. Also, when an audit log for the AA department, section 01 is requested, the multifunction devices 1000, 1001, and 1002 linked to the user ID belonging to the AA department, section 01 are the devices from which the audit log is to be acquired. In this embodiment, the settings on the screen 601 are set in advance from the remote UI by the administrator of the management server or the multifunction device. When the decision button 605 is pressed, the control unit 2 stores the setting value in the HDD 224 .

[0062] After the process of step S0503, the process proceeds to step S0504.

[0063] In step S0504, the control unit 2 acquires the audit log authority setting from the HDD 224.

[0064] FIG. 7A shows a screen (management table B) 701 for setting audit log authority in this embodiment, which is displayed by a remote UI via the network I / F control unit 225 of the management server 2000.

[0065] In this embodiment, 701 is composed of a group setting 702, an authority setting 703 for whether the audit log can be referenced, an authority setting 704 for whether the audit log can be operated, a decision button 705, and a cancel button 706. This audit log authority setting is a setting for determining whether a user who is trying to obtain an audit log can refer to the audit log and can perform operations such as deletion and movement. Taking the screen of FIG. 7(A) as an example, the audit log linked to a user belonging to the group AA department 01 section can be referenced by the security administrator, the AA department manager, and the AA department 01 section manager as user roles, and the security administrator is even allowed to perform operations such as deletion and movement. In this embodiment, the security administrator can move and delete the data of the audit log, but the manager and section manager can only refer to the data of users linked to their own department, but the setting is free depending on the user's usage environment and is not particularly limited. In FIG. 7, it is assumed that a user who obtains an audit log has authority for the group to which the user belongs, but the scope of authority is not limited to this. In this embodiment, the audit log authority is set in advance from the remote UI by the administrator of the management server or the multifunction device. When the OK button 705 is pressed, the control unit 2 saves the setting value in the HDD 224. Note that while the screen 701 in Fig. 7(A) is configured to link the user role with the authority to the group to which the user belongs, it is also possible to link and set the group to which the audit log can be referenced and the group to which the audit log can be operated to the user role as shown in the screen (management table b) 721 in Fig. 7(B), and this is not limited thereto.

[0066] After the process of step S0504, the process proceeds to step S0505.

[0067] In step S0505, the control unit 2 compares the conditions for acquiring the audit log acquired in steps S0502 to S0504, the settings for determining the device from which the audit log is to be acquired, and the settings of the audit log authority. Next, in S0506, the control unit 2 determines whether or not an audit log acquisition destination that matches the conditions is present as a result of the comparison in S0505.

[0068] If the control unit 2 determines in S0506 that an audit log acquisition destination that meets the conditions is present, the process proceeds to S0507, where the control unit 2 generates an audit log acquisition destination list and saves it in the RAM 223. Then, the process of Fig. 5 ends, and the process proceeds to S0404 in Fig. 4. This audit log acquisition destination list is data containing information regarding which multifunction device the management server 2000 will acquire audit logs from after the process of S0404 in Fig. 4.

[0069] If the control unit 2 determines in S0506 that there is no audit log acquisition destination that meets the conditions, the process proceeds to S0508, where the control unit 2 displays an audit log acquisition error on the remote UI. Then, the process of Fig. 5 is terminated, and the process proceeds to S0417 in Fig. 4, where the result is displayed on the remote UI. Then, the process of Fig. 4 is terminated.

[0070] An example of the branching of the processing from S0506 to S0508 according to the conditions of the audit log acquisition request will be described with reference to Fig. 6(A) and Fig. 7(A). An example will be taken of a case where the control unit 2 accepts an audit log acquisition request for user001 (operation user) from the AA department 01 section manager (user corresponding to the user identification information) in S0501. In this case, as shown in Fig. 6(A), user001 belongs to the AA department 01 section, and as shown in Fig. 7(A), the AA department 01 section manager has the authority to access the audit log of the AA department 01 section. Since the user corresponding to the user identification information who issued the audit log acquisition request and the group to which the operating user who is the target of the audit log acquisition belong match, the process proceeds to S0507. Also, an example will be taken of a case where an audit log acquisition request is accepted for user001 (operation user) from the AA department manager (user corresponding to the user identification information). In this case, as shown in FIG. 6(A), user001 belongs to AA department, section 01, and as shown in FIG. 7(B), the AA department manager has the authority to access the audit log of the AA department. The AA department and the AA department section 01 do not belong to the same group, but the AA department includes the AA department section 01, and the group to which the user corresponding to the user identification information belongs includes the group to which the operating user belongs, so they are in a corresponding relationship. Then, the process proceeds to S0507. Next, the control unit 2 takes as an example a case in which the control unit 2 receives an audit log acquisition request for user006 (operating user) from the AA department manager (user corresponding to the user identification information) in S0501. In this case, as shown in FIG. 6(A), user006 belongs to BB department, section 01, and as shown in FIG. 7(A), the AA department manager does not have the authority to access the audit log of BB department, section 01, so the conditions do not match or correspond to the audit log acquisition request, and the process proceeds to S0508.

[0071] After the process in FIG. 5, the process proceeds to S0404 in FIG.

[0072] Step S0404 and subsequent steps are described below in relation to the process performed when the audit log destination list is generated in step S0507 of Fig. 5. The process performed in step S0404 and subsequent steps is described below in relation to the process performed when the audit log destination list includes multifunction peripherals 1000, 1001, 1002, . . . XXXX.

[0073] In step S0404, the control unit 2 of the management server 2000 transmits a request to the multifunction peripheral 1000 to obtain an audit log.

[0074] Next, in step S0405, the control unit 1 of the multifunction peripheral 1000 performs an audit log acquisition process.

[0075] Fig. 8 is a flowchart explaining the process of acquiring the audit log which is started after the process of S0405 in Fig. 4. This process is achieved by the CPU 201 of the control unit 1 executing a program loaded in the RAM 203.

[0076] In step S0801, the control unit 1 of the multifunction device 1000 receives an audit log acquisition request from the management server 2000. This audit log acquisition request includes information on the conditions for acquiring the audit log handled in S0402 of FIG. 4 or S0502 of FIG.

[0077] In step S0802, the control unit 1 extracts and acquires, by filtering, audit logs that match the conditions for acquiring the audit logs from the HDD 204. For example, in the case of a request to acquire an audit log associated with User001, the control unit 1 filters and acquires, from the HDD 204, the audit log of when User001 operated the multifunction peripheral 1000.

[0078] Next, in step S0803, the control unit 1 judges whether an audit log that matches the condition for acquiring the audit log has been acquired.

[0079] If the control unit 1 determines in step S0803 that the audit log has been acquired, the process proceeds to step S0804, where the control unit 1 generates audit log data to be sent to the management server 2000. The audit log data here refers to the audit log extracted based on the conditions for acquiring the audit log. Then, the process in FIG. 8 ends.

[0080] If the control unit 1 determines in step S0803 that the audit log could not be acquired, the process proceeds to step S0805, where the control unit 1 returns an error notification result to the management server 2000. Then, the process in FIG. 8 ends.

[0081] 8 ends, the process proceeds to step S0406 in Fig. 4, where the control unit 1 returns the result to the management server 2000. In the process of S0406, the content to be sent is the audit log data of S0804 or an error notification of S0805.

[0082] By performing the above-mentioned processes S0501 to S0507 in Fig. 5 and S0802 to 0804 in Fig. 8, when acquiring audit logs, it is possible to extract (filter) audit logs according to the authority of the user who issued the acquisition request. This makes it possible to allow specific users to acquire only the audit logs they need while protecting confidential information.

[0083] Next, we return to the explanation of Figure 4.

[0084] After the process of S0406, if there is another multifunction device as the acquisition destination of the audit log, the same process as S0404 to S0406 is performed for the other multifunction device. FIG. 4 shows an example of performing the same process for the multifunction devices 1001, 1002, . . . XXX, and the processes of S0407 to 0409, S0410 to S0412, and S0413 to S0415 are the same as the process of S0404 to 0406. It is also possible that the acquisition destination multifunction device is turned off or the network is disconnected, and there is no response from the multifunction device, and the control unit 2 of the management server 2000 cannot acquire the audit log. In such a case, in this embodiment, the control unit 2 waits a certain time and then instructs the multifunction device to acquire the audit log again. However, when the control unit 2 returns the result to the PC02, the control unit 2 may perform a process of adding information about the multifunction device that could not be acquired, and this is not limited.

[0085] When the acquisition of the audit log for the multifunction device that is the target of the audit log acquisition is completed, the control unit 2 of the management server 2000 proceeds to the process of step S0416.

[0086] In step S0416, the control unit 2 combines the acquired audit logs.

[0087] Then, in step S0417, the control unit 2 returns the audit log data to the PC02.

[0088] The above is an explanation of the control for acquiring audit logs according to user authority in a printing device with an audit log function. In this way, by acquiring audit logs according to user authority, it is possible to acquire necessary audit logs while protecting the audit logs, which contain confidential information. Furthermore, since the user can extract and acquire only the information he or she wants, it also has the effect of improving the visibility of the audit logs. EXAMPLES

[0089] In the first embodiment, the management server 2000 acquires the audit log for each multifunction device in response to an instruction from the user via the PC02. The audit log acquired at this time is the audit log extracted by the multifunction device 1000 based on an instruction from the PC02. However, in a different configuration, all audit logs stored in the HDD 204 of the multifunction device may be acquired in response to an instruction from the PC02, and the management server may extract from all the acquired audit logs. In this case, a flowchart for explaining the process of acquiring the audit log, which starts after the process of S0405 in FIG. 4, is shown in FIG. 10. This process is achieved by the CPU 201 of the control unit 1 executing a program expanded in the RAM 203.

[0090] In step S1001, the control unit 2 issues an audit log acquisition request to the multifunction device. This audit log acquisition request includes information on the conditions for acquiring the audit log, which were handled in S0402 in FIG. 4 and S0502 in FIG.

[0091] Step S1002 corresponds to S0801.

[0092] In step S1003, the control unit 1 transmits all the audit logs stored in the HDD 204 to the management server.

[0093] In step S1004, all the logs of the multifunction devices acquired by the control unit 2 are stored in the HDD 224. Here, steps S1004 to S1006 may be performed for each multifunction device, or may be performed collectively after acquiring the audit logs of multiple multifunction devices that are the acquisition destinations of the audit log acquisition destination list.

[0094] Step S1005 corresponds to step S0802. For example, in the case of a request to acquire an audit log associated with User001, the control unit 2 filters and acquires from the HDD 224 the audit log when User001 operated the multifunction device.

[0095] Next, in step S1006, the control unit 2 determines whether an audit log that matches the condition for acquiring the audit log has been acquired.

[0096] If the control unit 2 determines in step S1006 that the audit log has been acquired, the process proceeds to step S1007, where the process of FIG. 10 ends.

[0097] If the control unit 2 determines in step S1006 that the audit log could not be acquired, the process proceeds to step S1008, where the control unit 2 returns an error notification result, and the process in FIG. 10 is then terminated.

[0098] After the process in FIG. 10 is completed, the process proceeds to step S0416 in FIG.

[0099] 5 and 10, the management server starts acquiring the audit log by receiving an audit log acquisition request from the user via PC02. However, the management server 2000 may acquire the audit log of the multifunction device periodically in advance and store it in the HDD 224 of the management server 2000 without waiting for the audit log acquisition request. In other words, the management server 2000 may acquire the audit log based on the instruction of PC02 from the audit log retrieved in advance from the multifunction device and stored in the HDD 224, and this is not limited thereto.

[0100] When the audit log is retrieved from the multifunction device in advance, the multifunction device may transmit the audit log every time a predetermined time has elapsed since the last transmission, or the management server may receive the audit log every time a predetermined time has elapsed since the last reception. Also, the multifunction device may transmit the audit log every time a predetermined amount of data is reached, instead of every time a predetermined amount of time has elapsed, and this is not limited to this method.

[0101] In the case of the first embodiment, in which the management server 2000 acquires the audit logs from each multifunction device every time an instruction is received from PC02, it is possible to always acquire the latest audit logs. However, in the case of the second embodiment, in which the audit logs are accumulated in the management server 2000 in advance, it is possible to transmit the audit logs immediately upon receiving an instruction from PC02. This depends on the wishes of the user who checks the audit logs, and either configuration is possible. EXAMPLES

[0102] Next, a third embodiment of the present invention will be described.

[0103] In the first and second embodiments, the administrator sets in advance which multifunction device the user is using on the screen 601 in Fig. 6A, and then acquires the audit log associated with the user from the target multifunction device. However, the multifunction device used may change due to a change in the user or the addition of a new multifunction device, and it is time-consuming for the administrator to set up by linking the user and the multifunction device each time.

[0104] In the third embodiment, a control for automatically registering a multifunction device used by a user in a multifunction device having an audit log function will be described.

[0105] In this embodiment, the parts that are not explained, such as the network configuration diagram, the hardware configuration of the information processing device, the multifunction device 1000 and the management server 2000, the software configuration, the process for generating the audit log acquisition destination list, and the audit log acquisition process, are the same as those in the first and second embodiments.

[0106] 9 is a flowchart for explaining the login process of the multifunction peripheral 1000. This process is achieved by the CPU 201 of the control unit 1 executing a program loaded in the RAM 203.

[0107] The login process begins at step S0901 in FIG.

[0108] In step S0901, the control unit 1 displays a login screen on the operation panel 210. Next, the process proceeds to step S0902.

[0109] In step S0902, the operation panel 210 accepts input of user information and a password from the user. The input user information and password are held in the RAM 203 via the operation unit interface 209. In this embodiment, the RAM 203 is used to temporarily store the user information and password, but this may be another device capable of storing the information, such as the HDD 204, and is not limited thereto. The same is true for the embodiments described below. In this embodiment, the multifunction peripheral 1000 stores in the HDD 204 a password linked to user information managed by user authentication, but this may also be stored on a management server or IDaaS (Identity as a Service), and is not limited thereto.

[0110] In step S0903, the control unit 1 obtains the password associated with the input user information from the HDD 204, compares it with the input password, and verifies whether the password is correct. Then, the process proceeds to step S0904.

[0111] In step S0904, if the control unit 1 determines that the entered password is incorrect, the control unit 1 displays an error on the operation panel 210 and proceeds to step S0902. In step S0904, if the control unit 1 determines that the entered password is correct, the control unit 1 proceeds to step S0905 and permits login to the multifunction device 1000.

[0112] Next, in step S0906, the control unit 1 stores the logged-in user information in the RAM 203.

[0113] Next, in step S0907, the control unit 1 generates usage history information for the multifunction device based on the user information stored in the RAM 203 and the device information of the logged-in multifunction device. The usage history information for the multifunction device in this embodiment is information on which user used which multifunction device and when.

[0114] Next, in step S0908, the control unit 1 transmits the usage history information of the multifunction peripheral to the management server 2000. Then, the process of FIG.

[0115] By the process of step S0908, the control unit 2 of the management server 2000 updates the screen 601 of Fig. 6 stored in the HDD 224. For example, when the screen 601 of Fig. 6(A) is in the state, if the user001 newly logs in to the multifunction device 1001, the multifunction device 1001 is added to the acquisition target device setting 604, and the screen becomes 601 of the management table a of Fig. 6(B). Note that the process of S0908 may transmit the usage history information of the multifunction device to the management server 2000 each time the user operates a new multifunction device, or may collectively store the information for a certain period of time and transmit it periodically. Also, the management server 2000 may obtain the information from the multifunction device, and there is no particular limitation.

[0116] The above-mentioned processing of S0907 and S0908 makes it possible to add settings for automatically determining the device from which audit logs are to be acquired according to the user's login process, without the administrator having to set in advance which multifunction device the user is using. This makes it possible to reduce the administrator's effort in adding settings.

[0117] In this embodiment, a setting has been added to determine the device for which the audit log is to be obtained when the user logs in, but the setting can also be triggered by another operation, such as when a function such as copying is used for the first time on a multifunction device, and is not particularly limited.

[0118] (Other Examples) The object of the present invention can also be achieved by executing the following process: A storage medium on which program code of software that realizes the functions of the above-mentioned embodiments is supplied to a system or device, and a computer (or a CPU, MPU, etc.) of the system or device reads out the program code stored in the storage medium. In this case, the program code read out from the storage medium itself realizes the functions of the above-mentioned embodiments, and the program code and the storage medium on which the program code is stored constitute the present invention. [Explanation of symbols]

[0119] 1000 multifunction devices 100 Internal Network 200 External Network 2000 Management Server 301 Network driver for Multifunction Printer 1000 305 Device control unit of the multifunction device 1100 321 Management Server 2000 network driver 325 Device control unit of management server 2000

Claims

1. A printing system including one or more printing devices and a server capable of communicating with the printing devices via a network, The server, a receiving unit for receiving user identification information and an instruction to acquire an audit log specifying an operating user of the printing device as an audit target; a first sending means for sending an instruction to the one or more printing devices when a group to which a user corresponding to the user identification information belongs matches or corresponds to a group to which an operating user to be audited belongs; Equipped with The printing device includes: a first storage means for storing the audit log in association with an operating user of the printing device; a first receiving means for receiving the instruction from the server; a second transmission means for transmitting the audit log of the operating user designated by the received instruction to the server; A printing system comprising:

2. the server includes a second storage means for storing at least a first management table linking the user with a group to which the user belongs, and a second management table linking the operating user with a group to which the operating user belongs, and the printing device used by the operating user; A determination means for determining the user and the group to which the user belongs, and the operating user and the group to which the operating user belongs; Equipped with The printing system according to claim 1 , wherein the determination means determines the group to which the user belongs by using at least the first management table, and determines the group to which the operating user belongs by using at least the second management table.

3. If the group to which the user belongs does not match or correspond to the group to which the operating user belongs, an error is displayed. A printing system according to claim 1 or 2, characterized in that

4. the one or more printing devices as destinations to which the instruction is to be transmitted by the first transmission means; One or more printing devices used by the operating user that are linked in the second management table A printing system according to claim 2 .

5. the server includes a second receiving means for receiving the audit log of the operating user designated by the received instruction; A display means for displaying the received audit log; Equipped with The display means combines and displays the audit logs received from the one or more printing devices. A printing system according to any one of claims 1 to 4, characterized in that

6. The printing device includes an authentication unit that authenticates the operating user who uses the printing device; a third transmission means for transmitting a usage history of an operating user who has used the printing device to the server; Equipped with The server updates the printing device used by the operating user in the second management table using the usage history. A printing system according to claim 2 .

7. The network includes at least one network that is not protected by a firewall. A printing system according to any one of claims 1 to 6, characterized in that

8. A server capable of communicating with one or more printing devices via a network, the server storing audit logs in association with operating users, a receiving unit for receiving user identification information and an instruction to acquire an audit log specifying an operating user of the printing device as an audit target; a sending means for sending an instruction to the one or more printing devices when a group to which a user corresponding to the user identification information belongs matches or corresponds to a group to which an operating user to be audited belongs; a receiving means for receiving from the printing device the audit log of the operating user designated by the instruction; A server comprising:

9. a storage means for recording at least a first management table linking the user with a group to which the user belongs, and a second management table linking the operating user with a group to which the operating user belongs, and the printing device used by the operating user; A determination means for determining the user and the group to which the user belongs, and the operating user and the group to which the operating user belongs; Equipped with The determining means determines a group to which the user belongs by using at least the first management table, and determines a group to which the operating user belongs by using at least the second management table. A server according to claim 8, characterized in that

10. If the group to which the user belongs does not match or correspond to the group to which the operating user belongs, an error is displayed. A server according to claim 8 or 9, characterized in that

11. The printing device as a destination to which the instruction is transmitted by the transmitting means, One or more printing devices used by the operating user that are linked in the second management table A server according to claim 9, characterized in that

12. A display means for displaying the audit log received by the receiving means; Equipped with The display means combines and displays the audit logs received from the one or more printing devices. A server according to any one of claims 8 to 11, characterized in that

13. The network includes at least one network that is not protected by a firewall. A server according to any one of claims 8 to 12, characterized in that

14. A server capable of communicating with one or more printing devices via a network, the server storing audit logs in association with operating users, a receiving means for receiving an audit log from the one or more printing devices; a receiving unit for receiving user identification information and an instruction to acquire an audit log specifying an operating user of the printing device as an audit target; A server having the characteristic of extracting the audit log of the operating user specified in the instruction from the received audit log when the group to which the user corresponding to the user identification information belongs matches or corresponds to the group to which the operating user to be audited belongs.

15. a storage means for recording at least a first management table linking the user with a group to which the user belongs, and a second management table linking the operating user with a group to which the operating user belongs, and the printing device used by the operating user; A determination means for determining the user and the group to which the user belongs, and the operating user and the group to which the operating user belongs; Equipped with The determining means determines a group to which the user belongs by using at least the first management table, and determines a group to which the operating user belongs by using at least the second management table. A server according to claim 14, characterized in that

16. If the group to which the user belongs does not match or correspond to the group to which the operating user belongs, an error is displayed. A server according to claim 14 or 15, characterized in that

17. The receiving means receives an audit log transmitted from the printing device when the accepting means accepts the instruction. A server according to any one of claims 14 to 16, characterized in that

18. The receiving means receives an audit log transmitted from the printing device when a predetermined time has elapsed since the previous transmission. A server according to any one of claims 14 to 16, characterized in that

19. The network includes at least one network that is not protected by a firewall. A server according to any one of claims 14 to 18, characterized in that

20. A method for controlling a printing system including one or more printing devices that store audit logs in association with operating users, and a server that can communicate with the printing devices via a network, comprising: a receiving step of receiving, by the server, user identification information and an instruction for acquiring an audit log of an operation user to be audited; a first transmission step of transmitting an instruction from the server to the printing device when a group to which a user corresponding to the user identification information belongs matches or corresponds to a group to which an operating user to be audited belongs; a second transmission step of transmitting, from the printing device to the server, the audit log of the operating user designated in the instruction received by the printing device from the server; A method for controlling a printing system comprising:

21. A method for controlling a server capable of communicating with one or more printing devices via a network, the method comprising the steps of: a receiving step of receiving user identification information and an instruction to acquire an audit log of an operation user to be audited; a sending step of sending an instruction to the printing device when a group to which a user corresponding to the user identification information belongs matches or corresponds to a group to which the operating user to be audited belongs; a receiving step of receiving from the printing device an audit log of the operating user designated by the instruction; A method for controlling a server comprising:

22. A method for controlling a server capable of communicating with one or more printing devices via a network, the method comprising the steps of: receiving an audit log from the one or more printing devices; a receiving step of receiving user identification information and an instruction to acquire an audit log of an operation user to be audited; Equipped with A server control method having the feature of extracting the audit log of the operating user specified in the instruction from the received audit log when the group to which the user corresponding to the user identification information belongs matches or corresponds to the group to which the operating user to be audited belongs.

Images