Printing management system, printing management method, printing management program, and printing management device

Abstract

To detect operator's suspicious operation on a printer.SOLUTION: A print management system 10 comprises a communication unit which acquires logs from one or more printers 100 respectively, a storage unit in which a suspicious operation list is stored, and a control unit which calculates matching levels between the logs and individual operations included in the suspicious operation list. On the basis of that there is an operation of which a matching level with a log exceeds a predetermined threshold, among the operations included in the suspicious operation list, the control unit determines that a suspicious operation has been performed on a printer 100 from which the log is transmitted.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to a print management system, and more particularly to a technology for detecting suspicious operations on a printing press. [Background technology]

[0002] Printing companies and other similar businesses use numerous printing presses to carry out a huge volume of printing work every day. Printing companies also handle highly confidential information, such as newspapers and magazines that feature scoops, and are therefore often required to take measures to prevent the leakage of confidential information, particularly information leaks by operators operating the printing presses. However, with such a large volume of daily printing work, it is not easy to monitor the operation of all printing presses and operators, and the monitoring costs can be a significant burden for printing companies. Therefore, there is a need for technology that can more efficiently prevent information leaks by operators.

[0003] Regarding the security of printing machines, for example, Japanese Patent Application Laid-Open No. 2006-227833 (Patent Document 1) discloses a server that "if it is determined that a job has security settings, the job is scheduled to a clean device; on the other hand, if it is determined that there is no security setting, the job is scheduled to either a clean device or a non-clean device so that the job volume of the job allocated to the clean device and the non-clean device is balanced based on the delivery date; if the job volume of the job without security settings that has been scheduled to a clean device is equal to or greater than the job volume of the job with security settings, the job without security settings is scheduled to a non-clean device" (see [Abstract]). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2006-227833 Summary of the Invention [Problem to be solved by the invention]

[0005] According to the technology disclosed in Patent Document 1, although it is possible to distribute jobs to each device based on the security settings for each job, it is not possible to detect suspicious operations by operators on a printing press. Therefore, there is a need for a technology to detect suspicious operations by operators on a printing press.

[0006] The present disclosure has been made in light of the above-described background, and an object of one aspect is to provide a technology for detecting suspicious operations by an operator on a printing machine. [Means for solving the problem]

[0007] According to one embodiment, there is provided a print management system. The print management system includes a communication unit that acquires logs from one or more printing machines, a memory unit that stores a suspicious operation list, and a control unit that calculates the degree of match between the log and each operation included in the suspicious operation list. The control unit determines that a suspicious operation has been performed on the printing machine that sent the log, based on the existence of an operation among the operations included in the suspicious operation list whose degree of match with the log exceeds a predetermined threshold.

[0008] In a print management system according to one aspect, the suspicious operation list includes operations that cause unscheduled interrupt processing to occur at a predetermined first frequency or more.

[0009] In a print management system according to one aspect, the suspicious operation list includes an operation of opening and closing a door or a tray at a predetermined second frequency or more in a certain printing press that is executing a printing process.

[0010] In a print management system according to one aspect, the suspicious operation list includes an operation of executing test printing of different pages on a certain printing press at a predetermined third frequency or more.

[0011] In a print management system according to one aspect, the suspicious operation list includes an operation of performing test printing of a black and white image page on a certain printing press at a predetermined fourth frequency or more.

[0012] In one aspect of the print management system, one or more printing machines are equipped with a scanner, and the suspicious operation list includes an operation that changes a setting of a destination of scanned data generated by the scanner at a predetermined frequency of at least a fifth frequency.

[0013] In one aspect, based on determining that a suspicious operation has been performed on the printing machine that sent the log, the control unit sends an instruction to the printing machine that sent the log to restrict the functions that the user can use.

[0014] In one aspect, based on the control unit determining that a suspicious operation was performed on the printing machine that sent the log, the communication unit sends a notification to the administrator's terminal that includes the type of suspicious operation and information about the printing machine that sent the log.

[0015] According to one embodiment, there is provided a printing management method executed by a printing management device, which includes the steps of acquiring a log from each of one or more printing presses, referencing a suspicious operation list stored in a storage unit, calculating the degree of match between the log and each operation included in the suspicious operation list, and determining that a suspicious operation has been performed on the printing press that sent the log based on the presence of an operation among the operations included in the suspicious operation list whose degree of match with the log exceeds a predetermined threshold.

[0016] In a print management method according to one aspect, the suspicious operation list includes operations that cause unscheduled interrupt processing to occur at a predetermined first frequency or more.

[0017] In a printing management method according to one aspect, the suspicious operation list includes an operation of opening and closing a door or a tray at a predetermined second frequency or more in a printing press that is executing a printing process.

[0018] In a printing management method according to one aspect, the suspicious operation list includes an operation of executing test printing of different pages in a certain printing machine at a predetermined third frequency or more.

[0019] In a printing management method according to one aspect, the suspicious operation list includes an operation of performing test printing of a black and white image page on a printing machine at a predetermined fourth frequency or more.

[0020] In a print management method according to one aspect, the suspicious operation list includes an operation of changing the setting of a destination of scan data generated by a scanner at a predetermined fifth frequency or more.

[0021] In one aspect, the method further includes a step of sending an instruction to the printing machine that sent the log to restrict the functions that the user can use, based on determining that a suspicious operation has occurred on the printing machine that sent the log.

[0022] In one aspect, the method further includes a step of sending a notification to the administrator's terminal, based on determining that a suspicious operation was performed on the printing machine that sent the log, the notification including the type of suspicious operation and information about the printing machine that sent the log.

[0023] According to another embodiment, there is provided a print management program for causing a printing device to execute the above method.

[0024] Furthermore, according to another embodiment, there is provided a print management device including a storage unit that stores the above-mentioned program, and a control unit that executes the program. [Effects of the Invention]

[0025] According to one embodiment, it is possible to detect suspicious operator manipulation of a printing press.

[0026] The above and other objects, features, aspects and advantages of the present disclosure will become apparent from the following detailed description of the disclosure taken in conjunction with the accompanying drawings. [Brief explanation of the drawings]

[0027] [Figure 1] 1 shows an example of a configuration of a print management system 10 according to an embodiment. [Figure 2] 1 is a diagram showing an example of the appearance of a printing machine 100 according to an embodiment. [Figure 3] FIG. 1 shows an example of a configuration of an image forming apparatus 200 according to an embodiment. [Figure 4] FIG. 2 illustrates an example of a hardware configuration of a server 110. [Figure 5] 10 is a diagram showing an example of a procedure for detecting a suspicious operation in the server 110. FIG. DETAILED DESCRIPTION OF THE INVENTION

[0028] Hereinafter, embodiments of the technical concept according to the present disclosure will be described with reference to the drawings. In the following description, the same components are denoted by the same reference numerals. The names and functions of the components are also the same. Therefore, detailed descriptions thereof will not be repeated.

[0029] 1 is a diagram showing an example of the configuration of a print management system 10 according to the present embodiment. The print management system 10 includes a server (print management device) 110, an administrator PC (Personal Computer) 120, and one or more printing presses 100. These are also connected to each other via a network 130. The print management system 10 collects and analyzes logs from each printing press 100 to estimate whether an operator at each printing press 100 has performed a suspicious operation related to information leakage or the like.

[0030] In this specification, the term "suspicious operation" refers to an operation on the printing machine 100 that may cause harm to the company that owns the printing machine 100 or the owner of the print data. As an example, suspicious operations may include operations such as opening and closing a tray or the like of the printing machine 100 during printing to intentionally cause the printing process to fail in order to illegally obtain printing paper or print data, operations such as unnecessarily repeating test printing, operations such as sending scanned data to a destination different from usual, and operations such as frequently executing unscheduled interrupt processing. Furthermore, in this specification, the term "system" encompasses a configuration consisting of one or more devices that provide a suspicious operation detection function, as well as services, virtual machines, instances, containers, etc. built on a cloud environment.

[0031] In one aspect, the print management system 10 may include the server 110 and the administrator PC 120, but may not include the printing press 100. In this case, the server 110 may collect logs from existing printing presses.

[0032] In another aspect, the print management system 10 may include the server 110, but may not include the administrator PC 120 or the printing press 100. In this case, the print management system 10 may also be said to be a print management device. The server 110 may also collect logs from existing printing presses, and provide the administrator PC 120 with a suspicious operation notification service, a remote control service for the printing press 100, a UI (User Interface) using a web application, and the like.

[0033] The printing machine 100 prints print data input as a job onto paper, posters, etc. The printing machine 100 also records a log during operation of the printing machine 100 and transmits the log to the server 110. In this specification, the term "log" encompasses logs of various settings on the printing machine 100, logs of various operations on the printing machine 100 (printing, scanning, data transmission operations, etc.), physical operations on the printing machine 100 detected by various sensors on the printing machine 100 (opening and closing of a paper feed tray, opening and closing of any cover (door) of an ink cartridge or toner cartridge, etc.), and logs of operations of the printing machine 100 (printing, scanning, sending and receiving data, etc.).

[0034] In addition, in this specification, the term "operation" includes any action performed on the printing press 100, such as operating a button or touch panel on the printing press 100, sending a command from a terminal to the printing press 100 via the network 130, opening and closing a tray, opening and closing a door (or cover) for maintenance or toner replacement, etc. Opening and closing a tray and a door can also be considered mechanical operations on the printing press 100.

[0035] Printing machine 100 may receive print data (jobs) via network 130 or via any storage medium such as a Secure Digital (SD) card or flash memory. Printing machine 100 may also be equipped with a scanner (not shown). In this case, printing machine 100 may print scanned images (jobs to print scanned images may be input to the printing machine).

[0036] In one aspect, printing machine 100 may be an inkjet printer equipped with inkjet nozzles, or a laser printer equipped with a toner cartridge and a photoconductor. In this embodiment, printing machine 100 is described as a large commercial printing machine owned by a printing company and operated by an operator, but application of the present invention is not limited to large commercial printing machines. In another aspect, printing machine 100 may be an office printing machine or a home printing machine.

[0037] The server 110 collects logs from one or more printing presses 100 and analyzes the logs to determine whether any suspicious operations have been performed by an operator on each printing press 100. More specifically, the server 110 stores a suspicious operation list 400 in the secondary storage device 3 (see FIG. 4). The server 110 calculates the degree of match between the suspicious operation list 400 and the log (actual operation) for each printing press 100. The server 110 determines that a suspicious operation has actually been performed based on the presence of an operation in the suspicious operation list 400 that matches the log to a predetermined standard or higher. The server 110 can also be considered a printing management device that monitors whether each printing press 100 is being used normally (whether any suspicious operations have been performed on each printing press 100).

[0038] The suspicious operation list 400 includes multiple operations. Furthermore, each operation included in the suspicious operation list 400 does not have to be a single operation, but may include one or more types of specific operations being repeatedly performed a predetermined number of times or more (a series of operations) in a single printing press 100 within a predetermined period (any period, such as one hour, one day, or one week). For example, a suspicious operation (A) included in the suspicious operation list 400 may indicate a series of operations in a single printing press 100, such as opening and closing the paper feed tray of the printing press 100 (a specific operation) ten or more times (a predetermined number of times or more) during the printing operation of the printing press 100 within one hour (a predetermined period). Hereinafter, "performing a suspicious operation a predetermined number of times or more within a predetermined period" may also be expressed as "performing a suspicious operation at a predetermined frequency or more."

[0039] In one aspect, the server 110 may determine that a suspicious operation has actually been performed based on the presence of an operation in the suspicious operation list 400 that completely matches a series of operations included in the log. In other words, the server 110 may determine that a suspicious operation has actually been performed based on the degree of match between the operations in the suspicious operation list 400 and the operations included in the log being 100%.

[0040] As an example, the suspicious operation list 400 may include operations that cause unscheduled interrupt processing to occur at a predetermined frequency or more. In operations using commercial inkjet printers (printing posters, newspapers, etc.), the printing machine 100 typically executes pre-scheduled jobs. Frequent occurrence of unscheduled interrupt processing indicates a high possibility that the printing machine 100 is being used for purposes not planned for the business. For this reason, the printing management system 10 provides a function for monitoring such interrupt operations that occur at a frequency or more.

[0041] As another example, the suspicious operation list 400 may include an operation of opening and closing the door or tray of a printing press 100 at a predetermined second frequency or more while the printing process is in progress. Opening and closing the door or tray of the printing press 100 during printing may cause printing to fail. This could be exploited by a malicious operator to intentionally cause the printing process to fail and then steal the paper for which printing failed. For this reason, the print management system 10 provides a function to monitor opening and closing operations of the door (cover) or tray of the printing press 100 at a frequency greater than a certain frequency.

[0042] As another example, the suspicious operation list 400 may include an operation of performing test printing of different pages on a certain printing press 100 at a predetermined third frequency or more. "Test printing" refers to, for example, printing some pages to check the color development of color inks. If a certain printing press 100 performs test printing operations more frequently than usual, there is a possibility that the operations are not for the intended purpose but are intended to steal pages on which confidential information is printed. For this reason, the printing management system 10 provides a function for monitoring such test printing operations of the printing press 100 at a frequency greater than a certain frequency.

[0043] As another example, the suspicious operation list 400 may include an operation of performing test printing of black-and-white image pages on a certain printing machine 100 at a predetermined fourth frequency or more. When printing black-and-white images, there may be cases where it is not necessary to check the color development, as is the case with printing with color ink. Nevertheless, if the operation of test printing black-and-white images is frequently performed on a certain printing machine 100, there is a possibility that the operation is intended to steal pages on which confidential information is printed. Therefore, the printing management system 10 provides a function to monitor such operations of test printing black-and-white images on a printing machine 100 at a frequency greater than a certain frequency.

[0044] As another example, the suspicious operation list 400 may include an operation that changes the settings of the destination of scanned data generated by the scanner of the printing machine 100 at a predetermined frequency or more. For example, if an operator frequently performs an operation to send scanned data to a destination that is not registered in the printing machine 100, the operation may be intended to steal information. Therefore, the printing management system 10 provides a function to monitor such operations that change the settings of the destination of scanned images in the printing machine 100 at a frequency or more.

[0045] In one aspect, the server 110 may, upon detecting a suspicious operation, send a command to the printing machine 100 that accepted the suspicious operation to restrict the functions available to the user. The printing machine 100 that received the command may, for example, suspend the current printing process and lock various functions to prevent operation by anyone other than the administrator. In another aspect, upon detecting a suspicious operation, the server 110 may send a notification to the administrator PC 120 that includes information about the type of suspicious operation and the printing machine 100 that accepted the suspicious operation (that sent the log). Furthermore, in another aspect, the server 110 may execute both of the above two processes upon detecting a suspicious operation. Furthermore, in another aspect, the server 110 may determine the action to take when a suspicious operation is detected based on settings pre-registered in the server 110.

[0046] The administrator PC 120 is a terminal used by the administrator, and may have the functions of communicating with the server 110, registering various settings in the server 110, and receiving various information from the server 110 and displaying it on a display. As an example, the administrator PC 120 may have the function of adding a suspicious operation list 400 to the server 110, and the function of changing and deleting the suspicious operation list 400 on the server 110. The administrator PC 120 may also have the function of setting the server 110 to operate when the server 110 detects a suspicious operation in any of the printing machines 100.

[0047] In one aspect, administrator PC 120 may be any information processing terminal such as a smartphone, a tablet, smart glasses, or a wearable computer. In another aspect, administrator PC 120 may have an application installed thereon for communicating with server 110. In another aspect, administrator PC 120 may communicate with server 110 using a browser function. In this case, server 110 includes a web application that provides services to administrator PC 120.

[0048] The network 130 may be a wired network, a wireless network, or a network including both a wired network and a wireless network. The network 130 may also be a local area network (LAN) within a company, or may include a public network such as the Internet.

[0049] By having the above configuration, the print management system 10 can prevent information leakage in various environments such as mass printing operations at a printing company, office operations, and remote work operations.

[0050] In the case of a printing company's high-volume printing business, the printing company performs the printing business using a large number of commercial printing presses 100. Each printing press 100 is typically operated by a single operator. Therefore, even if an operator performs an unusual operation on a printing press 100 in an attempt to steal information, there is a possibility that no one will notice. In contrast, a print management system 10 according to an embodiment can detect whether or not a suspicious operation has been performed on each printing press 100 without assigning a supervisor by analyzing logs received from each printing press 100. Therefore, even if an operator performs a suspicious operation on a printing press 100 without being observed by anyone, the print management system 10 can detect the suspicious operation.

[0051] In the case of office work, it is conceivable that an employee may print out information that is prohibited from being taken out, such as customer information, and take it outside the company. Even in such a case, the printing management system 10 can detect suspicious operations (such as printing prohibited information, scanning and sending prohibited information, etc.) by, for example, comparing the suspicious operation list 400 linked to each employee or position with the operations received by the printing device 100.

[0052] In recent years, remote work has become a common business practice. In such an environment, it is conceivable that employees print company documents (confidential information) on a printer at home. Even in such a case, the printing management system 10 can detect suspicious operations (such as printing confidential information outside the company) by, for example, accepting registration of each employee or each employee's printer information and comparing the operations accepted by each employee's printer with a suspicious operation list 400 linked to each employee or each employee's printer information. The server 110 may also acquire logs of operations performed on the printer from the employee's printer at home or from notification software installed on the employee's PC at home. In this case, the server 110 may provide the employee with a download service for software to be installed on the printer or notification software to be installed on the PC.

[0053] 2 is a diagram showing an example of the appearance of printing press 100 according to the present embodiment. Printing press 100 includes image forming device 200, paper feeder 210, and finishing device 220. In one aspect, printing press 100 may include only image forming device 200. In another aspect, printing press 100 may include image forming device 200 and either paper feeder 210 or finishing device 220.

[0054] Image forming apparatus 200 includes a scanning unit, a printing unit, and the like, and scans documents and executes print jobs. Image forming apparatus 200 also includes a panel operation unit 302 (see FIG. 3 ) for receiving operations from an operator. Image forming apparatus 200 stores operations received via panel operation unit 302, or operations such as opening and closing a paper feed tray and an ink replacement cover (door), as logs in nonvolatile memory 310 (see FIG. 3 ). Image forming apparatus 200 also periodically transmits the logs to server 110. In one aspect, image forming apparatus 200 may use any sensor to detect opening and closing of a paper feed tray and an ink replacement cover (door). In another aspect, image forming apparatus 200 may be an inkjet printer or a laser printer.

[0055] The paper feed device 210 includes one or more paper feed trays. The paper feed device 210 is connected to the image forming apparatus 200 and transports sheets in the paper feed trays to the image forming apparatus 200. A plurality of paper feed devices 210 may be connected to the image forming apparatus 200.

[0056] The finishing device 220 performs various processes on the paper sheets on which the images are printed. For example, the finishing device 220 may have a stapler function or a bookbinding function. Furthermore, multiple finishing devices 220 of different types may be connected to the image forming apparatus 200.

[0057] FIG. 3 is a diagram showing an example of the configuration of image forming apparatus 200 according to the present embodiment. In one aspect, each of the components shown in FIG. 3 may be realized entirely as hardware. In another aspect, some of the components shown in FIG. 3 may be realized as software. In this case, CPU (Central Processing Unit) 301 realizes each component by executing software deployed on RAM (Random Access Memory) 311. Furthermore, in another aspect, each component realized as hardware may be configured by at least one CPU, at least one FPGA (Field Programmable Gate Array), ASIC (Application Specific Integrated Circuit), or a combination thereof.

[0058] The image forming device 200 comprises a CPU 301, a panel operation unit 302, an image forming unit 303, an image processing unit 304, an image output unit 305, a network connection unit 306, a setting management unit 307, a printing press information transmission unit 308, a log / operation history management unit 309, a non-volatile memory 310, a RAM 311, and a ROM 312.

[0059] The CPU 301 executes programs for implementing various functions of the image forming apparatus 200. As an example, the CPU 301 executes programs read from the ROM 312 or the nonvolatile memory 310 to the RAM 311, and refers to data read from the ROM 312 or the nonvolatile memory 310 to the RAM 311.

[0060] The panel operation unit 302 is installed in the image forming apparatus 200 and includes a touch panel and a button operation unit. The touch panel includes a liquid crystal monitor, an organic EL (Electro-Luminescence) monitor, etc. The liquid crystal monitor, organic EL monitor, etc. include a touch sensor, and can display an operation menu and accept input by touch from a user (or operator). The button operation unit includes multiple buttons, and can accept input from a user in the same way as a touch panel.

[0061] Image forming unit 303 generates a print image from scan data and job data. Image processing unit 304 performs all data processing related to printing. As an example, image processing unit 304 performs encryption and decryption of the print image. Image output unit 305 prints the print image on paper. If image forming apparatus 200 is an inkjet printer, image output unit 305 may control inkjet nozzles, paper transport, etc. If image forming apparatus 200 is a laser printer, image output unit 305 may control toner transfer, toner fixation, paper transport, etc. In some aspects, some or all of image forming unit 303, image processing unit 304, and image output unit 305 may be configured as the same unit or as separate units.

[0062] Network connection unit 306 communicates with other devices via network 130. Network connection unit 306 receives jobs from other devices. In one aspect, network connection unit 306 may transmit a log input from printing press information transmission unit 308 to server 110. In another aspect, network connection unit 306 may be implemented by a wired LAN port, a Wi-Fi (registered trademark) (Wireless Fidelity) module, or the like. In another aspect, network connection unit 306 may transmit and receive data using a communication protocol such as TCP / IP (Transmission Control Protocol / Internet Protocol) or UDP (User Datagram Protocol).

[0063] The setting management unit 307 manages various settings (print settings, etc.) for the image forming apparatus 200. The setting management unit 307 reads out settings stored in the non-volatile memory 310 and displays them on the panel operation unit 302, and stores settings received via the panel operation unit 302 or the network connection unit 306 in the non-volatile memory 310.

[0064] Printing press information transmission unit 308 transmits logs (such as operation logs and logs of image forming apparatus 200 settings) stored in non-volatile memory 310 or RAM 311 to server 110. In one aspect, printing press information transmission unit 308 may include a network interface separate from network connection unit 306. In another aspect, printing press information transmission unit 308 may transmit the logs to server 110 via network connection unit 306.

[0065] Log and operation history management unit 309 stores, as logs, operations received via panel operation unit 302 or network connection unit 306, and operations such as opening and closing of trays or doors (covers) detected by various sensors, in non-volatile memory 310 or RAM 311. In one aspect, log and operation history management unit 309 may periodically output a log transmission request to printing press information transmission unit 308. In another aspect, log and operation history management unit 309 and printing press information transmission unit 308 may operate independently.

[0066] The non-volatile memory 310 stores various programs, setting data, image data imported into the image forming apparatus 200, and logs (operation logs, logs of settings for the image forming apparatus 200, etc.).

[0067] RAM 311 temporarily stores programs executed by CPU 301 and data referenced by CPU 301. In one aspect, RAM 311 may store logs generated within image forming apparatus 200.

[0068] ROM 312 can store programs, various settings, and the like for image forming apparatus 200. ROM 312 can be used to store programs or setting information that is not normally updated or is updated very infrequently. In one aspect, ROM 312 may be realized by flash memory or the like.

[0069] Fig. 4 is a diagram illustrating an example of the hardware configuration of server 110. In one aspect, server 110 may execute the server 110 processing described with reference to Fig. 1 as a program on the hardware illustrated in Fig. 4. In one aspect, the hardware illustrated in Fig. 4 may be used as administrator PC 120.

[0070] The server 110 includes a CPU 1, a primary storage device 2, a secondary storage device 3, an external device interface 4, an input interface 5, an output interface 6, and a communication interface .

[0071] The CPU 1 can execute programs for implementing various functions of the server 110. The CPU 1 is configured, for example, by at least one integrated circuit. The integrated circuit may be configured, for example, by at least one CPU, at least one FPGA, or a combination thereof.

[0072] The primary storage device 2 stores programs executed by the CPU 1 and data referenced by the CPU 1. In one aspect, the primary storage device 2 may be realized by a dynamic random access memory (DRAM) or a static random access memory (SRAM), etc.

[0073] The secondary storage device 3 is a non-volatile memory and may store programs executed by the CPU 1 and data referenced by the CPU 1. In this case, the CPU 1 executes programs read from the secondary storage device 3 to the primary storage device 2 and references data read from the secondary storage device 3 to the primary storage device 2. The secondary storage device 3 also stores the suspicious operation list 400. In one aspect, the secondary storage device 3 may be realized by a hard disk drive (HDD), a solid state drive (SSD), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory, or the like.

[0074] External device interface 4 can be connected to any external device such as a printer, a scanner, an external HDD, etc. In one aspect, external device interface 4 may be realized by a USB (Universal Serial Bus) terminal or the like.

[0075] The input interface 5 can be connected to any input device such as a keyboard, a mouse, a touchpad, or a gamepad. In one aspect, the input interface 5 can be realized by a USB terminal, a PS / 2 terminal, a Bluetooth (registered trademark) module, or the like.

[0076] Output interface 6 can be connected to any output device such as a cathode ray tube display, a liquid crystal display, an organic electroluminescence (EL) display, etc. In one aspect, output interface 6 may be realized by a USB terminal, a D-sub terminal, a DVI (Digital Visual Interface) terminal, an HDMI (registered trademark) (High-Definition Multimedia Interface) terminal, etc.

[0077] The communication interface 7 is connected to a wired or wireless network device. In one aspect, the communication interface 7 may be realized by a wired LAN port, a Wi-Fi module, or the like. In another aspect, the communication interface 7 may send and receive data using a communication protocol such as TCP / IP or UDP.

[0078] 5 is a diagram showing an example of a procedure for detecting a suspicious operation in server 110. In one aspect, server 110 may load a program for performing the processing of FIG. 5 from secondary storage device 3 to primary storage device 2 and execute the program. In another aspect, some or all of the processing may be realized as a combination of circuit elements configured to perform the processing.

[0079] In step S510, the server 110 acquires the machine setting log (operation history, job history, settings for the printing press, etc.) from the printing press 100.

[0080] In step S520, server 110 analyzes the log and checks whether there is an operation in suspicious operation list 400 that matches the operation included in the log. In one aspect, server 110 may check whether the degree of match between the operation included in the log and any operation included in suspicious operation list 400 is equal to or greater than a predetermined standard. In another aspect, server 110 may check whether the operation included in the log completely matches any operation included in suspicious operation list 400 (i.e., whether the degree of match between the operation included in the log and any operation included in suspicious operation list 400 is 100%).

[0081] In step S530, the server 110 determines whether or not there is an operation in the suspicious operation list 400 that closely matches an operation included in the log. An operation that closely matches an operation included in the log means an operation whose degree of match with the operation included in the log is equal to or exceeds a predetermined standard. If the server 110 determines that there is an operation in the suspicious operation list 400 that closely matches an operation included in the log (YES in step S530), the server 110 transfers control to step S540. If not, the server 110 ends the process.

[0082] In step S540, the server 110 determines whether the setting for when a suspicious operation is detected is notification. More specifically, the server 110 checks the setting for the response process to be performed when a suspicious operation is detected, which is pre-registered in the server 110. The response process to be performed when a suspicious operation is detected includes, for example, a process for notifying an administrator, a process for restricting the functions of the printing press 100 in which a suspicious operation is detected, and the like. If the server 110 determines that the setting for when a suspicious operation is detected is notification (YES in step S540), the server 110 transfers control to step S550. If not (NO in step S540), the server 110 transfers control to step S560.

[0083] In step S550, the server 110 notifies the administrator (administrator PC 120) of the log analysis results and suggestions for changing job allocation to operators, etc. The notification sent to the administrator PC 120 may include the type of suspicious operation, information about the printing machine 100 that accepted the suspicious operation, information about the operator who performed the suspicious operation, etc.

[0084] In step S560, the server 110 changes the settings of the printing press, such as imposing functional restrictions on the operator (user). More specifically, the server 110 sends a command to the printing press 100 that sent the log to restrict the functions available to the user. The printing press 100 that receives the command restricts the functions of its own device that the operator (user) can use. In some cases, the server 110 may execute both steps S540 and S550 based on the detection of a suspicious operation.

[0085] As described above, the print management system 10 and print management device (server 110) according to this embodiment collect and analyze logs from one or more printing presses 100 and determine whether there is an operation in the pre-registered suspicious operation list 400 that matches (or closely matches) an operation included in the log. This allows the print management system 10 and print management device (server 110) to detect suspicious operations by operators based on the logs without installing surveillance cameras or the like. As a result, the print management system 10 and print management device (server 110) can prevent the occurrence of information leaks, etc.

[0086] The embodiments disclosed herein should be considered to be illustrative in all respects and not restrictive. The scope of the present disclosure is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope equivalent to the claims. Furthermore, the disclosures described in the embodiments and each modification are intended to be implemented, as far as possible, either alone or in combination. [Explanation of symbols]

[0087] 1,301 CPU, 2 Primary storage device, 3 Secondary storage device, 4 External device interface, 5 Input interface, 6 Output interface, 7 Communication interface, 10 Printing management system, 100 Printing machine, 110 Server, 120 Administrator PC, 130 Network, 200 Image forming device, 210 Paper feeder, 220 Finishing device, 302 Panel operation unit, 303 Image forming unit, 304 Image processing unit, 305 Image output unit, 306 Network connection unit, 307 Setting management unit, 308 Printing machine information transmission unit, 309 Operation history management unit, 310 Non-volatile memory, 311 RAM, 312 ROM, 400 Suspicious operation list.

Claims

1. a communication unit that acquires logs from each of the one or more printing presses; a storage unit for storing a suspicious operation list; a control unit that calculates a degree of coincidence between the log and each operation included in the suspicious operation list, The control unit determines that a suspicious operation has been performed in the printing machine that transmitted the log based on the presence of an operation among the operations included in the suspicious operation list whose degree of match with the log exceeds a predetermined threshold, A print management system, wherein the suspicious operation list includes operations that cause unscheduled interrupt processing to occur at a predetermined first frequency or more.

2. A communication unit that acquires logs from each of one or more printing machines; a storage unit for storing a suspicious operation list; a control unit that calculates a degree of coincidence between the log and each operation included in the suspicious operation list, The control unit determines that a suspicious operation has been performed in the printing machine that transmitted the log based on the presence of an operation among the operations included in the suspicious operation list whose degree of match with the log exceeds a predetermined threshold, A printing management system, wherein the suspicious operation list includes operations of opening and closing a door or tray at a predetermined second frequency or more in a printing press that is executing a printing process.

3. A communication unit that acquires logs from each of one or more printing machines; a storage unit for storing a suspicious operation list; a control unit that calculates a degree of coincidence between the log and each operation included in the suspicious operation list, The control unit determines that a suspicious operation has been performed in the printing machine that transmitted the log based on the presence of an operation among the operations included in the suspicious operation list whose degree of match with the log exceeds a predetermined threshold, A print management system, wherein the suspicious operation list includes an operation of executing test printing of different pages on a certain printing machine at a predetermined third frequency or more.

4. A communication unit that acquires logs from each of one or more printing machines; a storage unit for storing a suspicious operation list; a control unit that calculates a degree of coincidence between the log and each operation included in the suspicious operation list, The control unit determines that a suspicious operation has been performed in the printing machine that transmitted the log based on the presence of an operation among the operations included in the suspicious operation list whose degree of match with the log exceeds a predetermined threshold, A print management system in which the suspicious operation list includes an operation of performing test printing of a black and white image page on a certain printing machine at a predetermined fourth frequency or more.

5. A communication unit that acquires logs from each of one or more printing machines equipped with a scanner; a storage unit for storing a suspicious operation list; a control unit that calculates a degree of coincidence between the log and each operation included in the suspicious operation list, The control unit determines that a suspicious operation has been performed in the printing machine that transmitted the log based on the presence of an operation among the operations included in the suspicious operation list whose degree of match with the log exceeds a predetermined threshold, A printing management system, wherein the suspicious operation list includes an operation of changing the settings of the destination of scanned data generated by the scanner at a predetermined fifth frequency or more.

6. A printing management system as described in any one of claims 1 to 5, wherein the control unit sends an instruction to the printing machine that sent the log to restrict the functions that the user can use based on determining that a suspicious operation has been performed on the printing machine that sent the log.

7. A printing management system as described in any one of claims 1 to 6, wherein the communication unit sends a notification to an administrator's terminal including the type of suspicious operation and information about the printing machine that sent the log based on the control unit determining that a suspicious operation was performed on the printing machine that sent the log.

8. A print management method executed by a print management device, obtaining a log from each of one or more printing presses; A step of referring to a suspicious operation list stored in a storage unit; calculating a degree of coincidence between the log and each operation included in the suspicious operation list; and determining that a suspicious operation has been performed in the printing machine that transmitted the log based on the presence of an operation whose degree of match with the log exceeds a predetermined threshold among the operations included in the suspicious operation list, A printing management method, wherein the suspicious operation list includes operations that cause unscheduled interrupt processing to occur at a predetermined first frequency or more.

9. A print management method executed by a print management device, comprising: obtaining a log from each of one or more printing presses; A step of referring to a suspicious operation list stored in a storage unit; calculating a degree of coincidence between the log and each operation included in the suspicious operation list; and determining that a suspicious operation has been performed in the printing machine that transmitted the log based on the presence of an operation whose degree of match with the log exceeds a predetermined threshold among the operations included in the suspicious operation list, A printing management method, wherein the suspicious operation list includes an operation of opening and closing a door or tray at a predetermined second frequency or more in a printing machine that is executing a printing process.

10. A print management method executed by a print management device, comprising: obtaining a log from each of one or more printing presses; A step of referring to a suspicious operation list stored in a storage unit; calculating a degree of coincidence between the log and each operation included in the suspicious operation list; and determining that a suspicious operation has been performed in the printing machine that transmitted the log based on the presence of an operation whose degree of match with the log exceeds a predetermined threshold among the operations included in the suspicious operation list, A printing management method, wherein the suspicious operation list includes an operation of performing test printing of different pages on a certain printing machine at a predetermined third frequency or more.

11. A print management method executed by a print management device, comprising: obtaining a log from each of one or more printing presses; A step of referring to a suspicious operation list stored in a storage unit; calculating a degree of coincidence between the log and each operation included in the suspicious operation list; and determining that a suspicious operation has been performed in the printing machine that transmitted the log based on the presence of an operation whose degree of match with the log exceeds a predetermined threshold among the operations included in the suspicious operation list, A printing management method, wherein the suspicious operation list includes an operation of performing test printing of a black and white image page on a printing machine at a predetermined fourth frequency or more.

12. A print management method executed by a print management device, comprising: obtaining a log from each of one or more printing presses; A step of referring to a suspicious operation list stored in a storage unit; calculating a degree of coincidence between the log and each operation included in the suspicious operation list; and determining that a suspicious operation has been performed in the printing machine that transmitted the log based on the presence of an operation whose degree of match with the log exceeds a predetermined threshold among the operations included in the suspicious operation list, A printing management method, wherein the suspicious operation list includes an operation of changing the settings of a destination of scanned data generated by a scanner at a predetermined fifth frequency or more.

13. A printing management method described in any one of claims 8 to 12, further comprising a step of sending an instruction to the printing machine that sent the log to restrict the functions that the user can use, based on determining that a suspicious operation has been performed on the printing machine that sent the log.

14. A printing management method described in any of claims 8 to 13, further comprising a step of sending a notification to an administrator's terminal based on a determination that a suspicious operation has been performed on the printing machine that sent the log, the notification including the type of the suspicious operation and information about the printing machine that sent the log.

15. A print management program for causing a print management device to execute the print management method according to any one of claims 8 to 14.

16. a storage unit that stores the print management program according to claim 15; a control unit for executing the print management program.

Images