Image forming apparatus, control method, program

Abstract

To provide an image formation device that can sufficiently determine whether the result of processing shown in a debug log is due to a false input of data.SOLUTION: A program for a control system of an image formation device includes a log processing code. The log processing code converts such personal data as a user name or a mail address by a hash function (2200). The conversion of the personal data by the hash function is a one-to-one mapping of a plain sentence and a code word and is a conversion of one-direction only in which the word code cannot be returned to the plain sentence.SELECTED DRAWING: Figure 8

Description

Technical Field

[0001] The present disclosure relates to an image forming apparatus, a control method, and a program, and particularly to an improvement for smoothly performing bug verification of a program.

Background Art

[0002] An image forming apparatus forms an image by an electrophotographic method or an inkjet method. For example, image formation by the electrophotographic method includes a series of steps such as exposure of a photoreceptor, development of an electrostatic latent image obtained by the exposure, transfer of the toner image obtained by the development to a sheet, and fixing of the transferred toner image. The computer of the image forming apparatus executes an operating system and an application for ensuring basic functions as an information device, in addition to firmware for controlling such image forming steps. Since it is necessary to develop and maintain the quality of these firmware and applications, the burden on software development in manufacturers developing image forming apparatuses has been increasing year by year.

[0003] In order to smoothly perform malfunction analysis and debugging of a program, debug logs have been conventionally used. A debug log is a log indicating what processing has been performed inside each program and what the input values and output values were, and the debug log can be output by inserting a dedicated debug log output code into the program. By tracing a series of debug logs, the operation of the program can be followed, and the cause of a malfunction in firmware or an application can be efficiently identified and debugging can be performed.

[0004] Incidentally, debug logs may contain data that could be subject to legal regulations. A prime example of such data is personal information. Personal information includes various types such as the names, identification numbers, location data, email addresses, and online identifiers of natural persons. The processing and transfer of this personal information outside the EEA (European Economic Area) are regulated by the General Data Protection Regulation (GDPR), which has become a topic of discussion in the industry.

[0005] One information processing device that can generate debug logs while protecting information unsuitable for public release is described in Patent Document 1. This information processing device analyzes the argument string notified by the program to be debugged, performs masking, and generates a debug log that includes the masked argument string. Masking here means replacing some of the characters that make up the argument string with the asterisk character "*". For example, "0 The argument string "3-4567-8901" is masked, and "Telephone It outputs a debug log that reads "Number: ***4***-***1". In this example, The number of consecutive characters to mask is set to 3, and the number of consecutive characters not to mask is set to 1. Both the number of consecutive characters to mask and the number of consecutive characters not to mask can be changed. [Prior art documents] [Patent Documents]

[0006] [Patent Document 1] Japanese Patent Publication No. 2010-147942 [Overview of the Initiative] [Problems that the invention aims to solve]

[0007] However, with the conventional techniques described above, if the number of consecutive characters to be masked is small, the original argument string may be inferred, and therefore personal information cannot be adequately protected.

[0008] However, increasing the number of consecutive characters to mask leads to the following problems.

[0009] For example, the debug log of a login processing program may include the login name and password. In such cases, if the number of consecutive characters to mask is increased, both correctly entered and incorrectly entered login names may be converted into the same string by the masking process. This could make it impossible to distinguish from the debug log content whether the login failure was due to an incorrect login name or a bug in the login processing program.

[0010] If the login name is simply entered incorrectly, there is no need to debug the login process program. However, if there is a bug in the login process program, countermeasures are necessary. Debug logs are used to analyze the operation of the program being debugged, including determining whether debugging is necessary. Therefore, it is essential to balance the original purpose of debug logs with the protection of personal information.

[0011] Such requests also apply to programs other than login processing programs, and to the protection of personal information other than login names. Furthermore, even data that is not personal information may be required to be protected by legal regulations.

[0012] The purpose of this disclosure is to provide an image forming apparatus that can protect data that may be subject to legal regulations without impairing the ability to analyze program operation using debug logs. [Means for solving the problem]

[0013] The above issues are, The control unit and the inputs that the user has entered into the control unit It may be subject to legal regulations The first data And each of the first data and the second data having the same attributes, which are stored in the device beforehandconversion means for performing one-way one-to-one conversion, and By the aforementioned conversion means the Each of the first and second data sets conversion result data obtained by the one-to-one conversion is together debug log as solved by an image forming apparatus comprising log output means for outputting.

[0014] The one-way one-to-one conversion may be a conversion using a hash function.

[0015] It may be provided with a constant storage unit for storing operation constants used in the operation of the hash function.

[0017] The [[ID=二十一]] Second [[ID=二十二]]non-volatile memory in which data is written, and the [[ID=二十三]] The second [[ID=二十四]]data written in the non-volatile memory are provided with backup means for backing up to a backup medium, and in conjunction with this backup, the [[ID=二十五]] Record change [[ID=二十六]]conversion means obtains the [[ID=二十七]] Transformation result obtained by the one-to-one transformation for the second data [[ID=二十八]]data, and the [[ID=二十九]] log [[ID=三十]]output means outputs the [[ID=三十一]] Conversion result [[ID=三十二]]data. It may be so. [[ID=三十三]] [[ID=三十四]]

[0018] [[ID=三十五]] [[ID=三十六]]In conjunction with the backup, the [[ID=三十七]] Record change [[ID=三十八]]conversion means obtains the [[ID=三十九]] The second [[ID=四十]]data from the [[ID=四十一]] Conversion result [[ID=四十二]]data backed up to the backup medium It may be so. [[ID=四十三]] [[ID=四十四]]

[0019] [[ID=四十五]] [[ID=四十六]]The backup means may perform the backup periodically. [[ID=四十七]] [[ID=四十八]]

[0020] [[ID=四十九]] [[ID=五十]]In the non-volatile memory, [[ID=五十一]] The second [[ID=五十二]]a plurality of data are written, and the plurality of [[ID=五十三]] Second [[ID=五十四]]data are data indicating a plurality of registered users registered in advance, and the [[ID=五十五]] First [[ID=五十六]]data may be data input by panel operation or data input by card reading. [[ID=五十七]] [[ID=五十八]]

[0021] [[ID=五十九]] [[ID=六十]]In the non-volatile memory [[ID=六十一]] , the secondMultiple data entries are written, Second The data is data indicating multiple pre-registered destinations, and the above First The data may indicate a destination selected from a group of pre-registered destinations.

[0022] The aforementioned one-way one-to-one conversion may include a shortening conversion in which the hash value obtained by the conversion using the hash function is replaced with a shortened word of shorter length.

[0023] The aforementioned First The system includes a receiving means for receiving whether or not data conversion is necessary, and if conversion is necessary, the conversion means performs the conversion, and the log output means outputs the output, and if conversion is not necessary, the First It would also be acceptable to output a debug log that includes the data as is.

[0024] The aforementioned first data includes personal data, The system includes communication means for performing a communication requesting permission from the provider or administrator of the personal data to use the personal data for debugging, and the conversion means may switch whether or not to perform the one-to-one conversion depending on whether permission has been obtained from the provider or administrator of the personal data to use the personal data for debugging. Furthermore, the first data and the second data may be usernames or email addresses, and the conversion means may perform a one-way, one-to-one conversion between the username or email address entered by the user and the username or email address stored in the device beforehand.

[0025] Furthermore, the above issues are, A control method performed in an image forming apparatus, wherein the user inputs information to the operation unit of the image forming apparatus. It may be subject to legal regulations First data And each of the first data and the second data having the same attributes, which are stored in the image forming apparatus beforehand A transformation step that applies a one-way, one-to-one transformation, The conversion step Obtained through one-to-one conversion Each of the first and second data sets The converted data together Debug Log as This is solved by a control method characterized by including a log output step.

[0026] Furthermore, the above issues are, A program to be executed by the computer of an image forming apparatus, which is entered by the user into the control unit of the image forming apparatus. It may be subject to legal regulations First data And each of the first data and the second data having the same attributes, which are stored in the image forming apparatus beforehand A transformation step that applies a one-way, one-to-one transformation, The conversion step Obtained through one-to-one conversion Each of the first and second data sets The converted data together Debug Log as This problem is solved by a program that causes a computer to execute the log output step. [Effects of the Invention]

[0027] In this way, unlike the conventional masking technique described above, where there is a many-to-one relationship between the argument string before processing and the argument string after processing, this method uses a one-to-one transformation. Therefore, even if the target candidate data before transformation are different, the transformed result data will not be identical, allowing them to be distinguished, and thus avoiding a decrease in the analyzability of the debug log.

[0028] Furthermore, because a one-way transformation is used, it is difficult to obtain the original target candidate data from the transformed result data, thus protecting the target candidate data that could be subject to legal regulations. [Brief explanation of the drawing]

[0029] [Figure 1] This is a diagram showing a program debugging system. [Figure 2] The hardware configuration of the image forming apparatus 1 is shown. [Figure 3] This shows the programs installed on HDD23. [Figure 4] This shows the usernames (NAKATA, NISIDA, KAWATA) stored in NVRAM24, and the email addresses registered by those users (nakata@abc.jp, nisida@abc.jp, kawata@abc.jp). [Figure 5] This indicates that the Panel application 101, Login application 102, Send application 103, Backup application 104, and Authdevice application 105 are loaded into RAM 22 and are available for use in a multitasking execution environment. [Figure 6]Figure 6(a) shows an example of template file 106. Figure 6(b) shows an example of a variable area. [Figure 7] This flowchart shows the processing steps that should be performed by the log processing code. [Figure 8] Figure 8(a) shows the login screen, Figure 8(b) shows the debug log 2100 generated upon successful login, Figure 8(c) shows the login screen with an incorrect username, and Figure 8(d) shows the debug log 2200 generated upon login failure. Figure 8(e) shows an example of the correspondence between a username and a hash value. [Figure 9] Figure 9(a) shows an example of an operation on the email address screen where an email address is entered, Figure 9(b) shows a debug log generated when an email is sent successfully, Figure 9(c) shows an example of an operation on the email address screen where an email address is entered, and Figure 9(d) shows an example of a debug log generated when an email is sent unsuccessfully. [Figure 10] An example of hash value table 3000 is shown. [Figure 11] A flowchart showing the processing procedure to be performed in the second embodiment is shown. [Figure 12] Figure 12(a) shows debug logs 2710-2740 using DATA001-DATA003, and Figure 12(b) shows debug logs 2810-2840 using DATA001-DATA003. [Figure 13] Figure 13(a) shows the debug log generated when login is successful, and Figure 13(b) shows the debug log generated when login fails. [Modes for carrying out the invention]

[0030] Hereinafter, embodiments of the image forming apparatus according to this disclosure will be described with reference to the drawings. (First Embodiment) [1] Appearance of the image forming apparatus 1 The image forming apparatus described herein is used in the program debugging system shown in Figure 1. The program debugging system consists of an image forming apparatus 1, a personal computer (PC) 2, a server 3 for the program development department, and a program provision server 4.

[0031] The image forming apparatus 1 is a tandem-type color MFP (Multifunction Peripheral) that performs image formation using an electrophotographic method, and consists of a document transport unit 11, a scanner unit 12, a printer unit 13, a paper feed unit 14, and an operation unit 15. The document transport unit 11 feeds documents placed on a tray at the top of the device one by one to the scanner unit 12, and the scanner unit 12 optically reads characters and other information recorded on the documents. The printer unit 13 forms images on the paper supplied from the paper feed unit 14 and outputs the printed paper from the output port 19. The operation unit 15 includes a display unit 16, a touch panel 17, and a key unit 18.

[0032] The display unit 16 is a liquid crystal display or the like, and is located on the front side of the image forming apparatus. It displays job-related information and other information to the user.

[0033] The touch panel 17 covers the surface of the display unit 16 and outputs the coordinates of the position on the display unit 16 that is touched by the user.

[0034] The key section 18 includes keys for accepting start and stop operations, keys for accepting job selection, and a keyboard for accepting alphabet input from A to Z, and accepts instructions to start a job, instructions to stop a job, and character input of a username or email address.

[0035] If a problem occurs with the image forming apparatus 1, a service technician who visits in response to a service call from the user will use PC2 to retrieve the debug log created by the image forming apparatus 1. Methods for retrieving the debug log include connecting the image forming apparatus 1 and PC2 with a serial cable 2C and capturing the debug log output from the terminal by the image forming apparatus 1; connecting PC2 to the image forming apparatus 1 via the USB connector (not shown) of the image forming apparatus 1 and transferring the debug log file from the image forming apparatus 1 to PC2; or copying the debug log file generated in the memory of the image forming apparatus 1 to a recording medium such as a USB memory stick and transferring the debug log file from the recording medium to PC2 via the recording medium.

[0036] The service technician transfers the debug logs collected by PC2 to the program development department's server 3, where they are stored in the server 3's storage 3S. The debugging staff in the development department examines the debug logs and the source code of the image forming apparatus 1's program to verify whether the malfunction that caused the service call was due to a program bug. If the malfunction was caused by a bug, they create a bug-corrected version of the program and supply it to the program supply server 4. The image forming apparatus 1 downloads the bug-corrected version of program 4P provided by the debugging staff from the program supply server 4, replaces the program installed on its machine with the bug-corrected version, and completes the version upgrade.

[0037] A problem that arises during the debugging process described above is the inclusion of data that may be subject to legal regulations in the debug log retrieval process. Legal regulations refer to domestic laws, enforcement regulations of domestic laws, ordinances, treaties, international agreements, and rules that impose some form of restriction on the external leakage of information. These include various types such as GDPR, Japan's Personal Information Protection Act, the Act on Access to Information Held by Administrative Agencies (Information Disclosure Act), legal systems prohibiting insider trading, legal systems protecting patients, and laws protecting business information. If the debug logs accumulated on server 3 of the development department contain data that may be subject to legal regulations, the manufacturer of image forming apparatus 1 may be held legally liable for violating these regulations. Data that may be subject to legal regulations in this manner is called target data. Target data includes both data that is clearly subject to legal regulations (regulated data) and data that is similar to regulated data but differs in some respects from regulated data.

[0038] Therefore, when outputting a debug log, the image forming apparatus 1 applies a one-way transformation to the target candidate data (including regulated data) so that the original data cannot be identified from the debug log. Furthermore, explaining all legal regulations would be complicated, so the following explanation will focus on the GDPR as a representative legal system. Specifically, the target candidate data includes data that constitutes personal information (personal data) and data similar to such personal data. Also, the regulated data is defined as personal data.

[0039] [2] Hardware configuration of the image forming apparatus 1 Figure 2 shows the hardware configuration of the image forming apparatus 1. As shown in this figure, the image forming apparatus 1 is equipped with a CPU 20, Flash ROM 21, RAM 22, HDD 23, NVRAM 24, communication interface 25, and serial device 26, and is connected to the card authentication device 31.

[0040] When the image forming apparatus 1 is powered on, the CPU 20 reads programs installed in the Flash ROM 21 and HDD 23 into the RAM 22 and executes them to realize the basic functions of the image forming apparatus 1. These basic functions include document transport by the document transport unit 11, document reading by the scanner unit 12, paper feeding by the paper feed unit 14, image formation by the printer unit 13, operation input from the operation unit 15, and screen output to the display unit 16. The programs installed in the Flash ROM 21 are multiple control programs that constitute the firmware, and they enable the document transport unit 11, scanner unit 12, printer unit 13, paper feed unit 14, operation unit 15, and display unit 16 to realize the above basic functions. The CPU 20 has an execution mode for executing these programs and an output mode for debugging. The execution mode and the output mode for debugging can be switched by setting the dual switch when a service technician visits.

[0041] There are two types of communication methods: a communication interface 25 and a serial device 26. The communication interface 25 consists of a NIC, modem, TA, and wireless LAN card for sending and receiving data to be printed and data read by the scanner unit 12. The serial device 26 is a communication method for connecting to an external PC 2 via a serial cable 2C when the CPU 20 is switched to debug mode and performs debug terminal output, and debug logs can be output externally via the serial device 26.

[0042] [3] Programs installed on HDD23 Figure 3 shows the programs installed on HDD23. As shown in this figure, HDD23 has the operating system 110 and its applications installed, and the corresponding template files are stored there. The applications include Panel application 101, Login application 102, Send application 103, Backup application 104, and Authdevice application 105. Along with these applications, a debug log template file 106 is pre-stored. As will be explained in more detail later, template file 106 enables the creation of debug logs by Panel application 101, Login application 102, etc.

[0043] The operating system 110 includes a version control module 111 and a kernel 112.

[0044] The version control module 111 accesses the program provision server 4 to check whether the latest version of the firmware and application is available. If the latest version is available, it downloads the latest version of the firmware and application and updates the firmware installed on the FlashROM 21.

[0045] Kernel 112 manages individual applications and control programs loaded into RAM 22 as tasks, controlling the operation of multiple applications under a multitasking environment.

[0046] (3-1) Information necessary for implementing basic functions The information necessary for realizing the basic functions is registered in NVRAM24. NVRAM24 is a ferroelectric random access memory, and has an advantage over FlashROM21 in that it allows for high-speed writing. Various regulated data is stored in NVRAM24. As shown in Figure 4, regulated data includes usernames of users who can log in to and operate the image forming apparatus 1 (NAKATA NISIDA KAWATA) and email addresses registered by those users (nakata@abc.jp, nisida@abc.jp, kawata@abc.jp). In addition, calculation constants (9823256) assigned to the image forming apparatus 1 are stored there. Calculation constants are numerical values ​​assigned to each image forming apparatus when an image forming apparatus manufacturer produces thousands or tens of thousands of units. In this embodiment, when the manufacturer of the image forming apparatus ships each of the multiple image forming apparatuses it has manufactured, it generates random numbers, assigns each random number value to an image forming apparatus, and writes them to the NVRAM24 as apparatus-specific calculation constants.

[0047] The restricted data (usernames, email addresses) and device-specific constants, which are stored in the NVRAM24, are important data. Therefore, periodic backups are performed by the Backup application 104 described above, and the same usernames and email addresses are written to the FlashROM21. By periodically copying the restricted data such as usernames and email addresses stored in the NVRAM24 to the FlashROM21 and backing up the usernames and email addresses in the FlashROM21, even if an abnormality occurs in the NVRAM24, recovery becomes possible by copying the restricted data such as usernames and email addresses from the FlashROM21 to the NVRAM24.

[0048] (3-2) Configuring tasks corresponding to the application Figure 5 shows the state in which the Panel application 101, Login application 102, Send application 103, Backup application 104, and Authdevice application 105 are loaded into RAM 22 and provided for use in a multitasking execution environment.

[0049] The tasks corresponding to the Panel application 101 (PanelTask201), the Login application 102 (LoginTask202), the Send application 103 (SendTask203), the Backup application 104 (BackupTask204), and the Authdevice application 105 (AuthdeviceTask205) are located in the respective sub-regions 210, 220, 230, 240, and 250 of RAM22. These tasks share a common configuration, consisting of variable regions 211, 221, 231, 241, and 251 for each task, instruction codes 213, 223, 233, 243, and 253 that perform task-specific processing, and log processing codes 214, 224, 234, 244, and 254. These tasks are triggered by the issuance of interrupt signals to the CPU20.

[0050] Log processing codes 214, 224, 234, 244, and 254 output debug logs 301, 302, 303, 304, and 305, respectively, which represent the processing content and results of the tasks performed by each task. By setting the output destination of the debug logs to a file, the debug logs output by the log processing codes can be stored in a single file 300 and handed over to the service technician's PC2. When creating an application using a high-level programming language such as C, debug output can be written using output functions such as the fprintf function.

[0051] (3-3) Structure of template file 106 The debug logs generated by log processing codes 214, 224, 234, 244, and 254 are performed using the template file 106 shown in Figure 3. Template file 106 is a standard text that shows the typical processing content performed by each task using various variables.

[0052] The log processing codes 214, 224, 234, 244, and 254 included in each application select a template corresponding to the processing performed by that application and represent the processing performed by the application by substituting specific strings into the template's variables. Figure 6(a) shows an example of a template file 106 that represents processing using personal data storage variables. Personal data storage variables are variables used to store regulated data or candidate data. The contents of the debug log templates representing the processing of PanelTask201 to AuthdeviceTask205 are described below.

[0053] PanelTask201 displays a login screen and an email address selection screen, and retrieves the string entered using the key type in key section 18 when the login screen is displayed, and the email address selected on the email address selection screen. Since different processing is performed when the login screen is displayed and when the email address selection screen is displayed, PanelTask201 is associated with templates 2011 and 2012, as shown in Figure 6(a). The first template 2011 is UserName:[username variable] was sent to[task name variable]., indicating that the value of the first variable, the username variable, is passed to the task specified by the second variable, the task name variable. The second template 2012 is get[email address variable] from NVRAM, indicating that the email address is retrieved from NVRAM24. The username variable in template 2011 is a variable for storing target candidate data, and due to incorrect input, data similar to restricted data may be stored. The email address variable in template 2012 is a variable for storing restricted data.

[0054] LoginTask202 is a task that retrieves a string representing the username from PanelTask ​​and AuthdeviceTask and matches it against multiple usernames registered in NVRAM24. Two templates, 2021 and 2022, are associated with this task. The first template, 2021, is NVRAM: [username variable] verifying [username variable], indicating that the entered username was authenticated by a username stored in NVRAM24. The second template, 2022, is NVRAM: No matching, verifying [username variable], indicating that the entered username was not authenticated by any of the usernames stored in NVRAM24. The username variable in templates 2021 and 2022 is a variable for storing target candidate data, and due to incorrect input, data similar to restricted data may be stored.

[0055] SendTask203 is a task that sends an email with image data read by the scanner unit 12 attached to the email address selected by the user on the email address screen, and two templates are associated with it. The first template 2031 is "send to Email Address:[email address variable] Send OK", indicating that the email was sent to the recipient specified in the email address variable and that the email reached the recipient. The second template 2032 is "send to Email Address:[email address variable] Send NG", indicating that the email was sent to the recipient specified in the email address variable and that the email did not reach the recipient. The email address variable in templates 2031 and 2032 is a variable for storing regulated data.

[0056] BackupTask204 is a task that periodically writes usernames and email addresses stored in NVRAM24 to FlashROM21, and is associated with two templates, 2041 and 2042. The first template, 2041, is FlashROM[username variable], indicating that the username in the username variable section has been written to FlashROM21 and backed up. The second template, 2042, is FlashROM[email address variable], indicating that the email address in the username variable section has been written to FlashROM21 and backed up. The email address variable in templates 2041 and 2042 is a variable for storing regulated data.

[0057] The interval at which usernames and email addresses are written to FlashROM21 is determined by the administrator's prior settings.

[0058] AuthdeviceTask205 is a task that retrieves the username read by the card authentication device 31 from the personal card 32, and is associated with a single template 2031, namely [username variable] was sent to [task name variable]. This template indicates that the username was retrieved from the card authentication device 31 and passed to the task specified by the task name variable. The username variable in template 2051 is a variable for storing target candidate data.

[0059] The template in Figure 6(a) merely shows template file 106, which represents processing content using usernames and email addresses. Some of the processing content performed by PanelTask201 to AuthdeviceTask205 does not use usernames or email addresses, and the templates for these processing contents that do not use usernames or email addresses use variables that are not personal data storage variables to indicate the processing content. Please note that templates that show processing content using variables that are not personal data storage variables are not the subject of this application and are therefore not shown in the figures.

[0060] (3-4) Obtaining the string to be applied to the template In templates 2011, 2012, 2121, 2022, 2031, and 2032, the string to be assigned to the username variable when representing the processing content of each task is obtained from the variable area of ​​each task. An example of the variable area is shown in Figure 6(b). As shown in this figure, the variable area includes a key input memory device variable 261 for receiving strings entered on the keyboard of the key unit 18, and an inter-task communication variable 262 for input / output with other tasks.

[0061] [4] Processing to be performed by log processing codes 214-254 The processing steps to be performed by the log processing code are shown in Figure 7.

[0062] The system determines whether multiple templates are compatible with the task containing the log processing code (step S100). If multiple templates are not compatible (No in step S100), it selects a compatible template (step S101). If multiple templates are compatible (Yes in step S100), it selects one of the templates according to the processing result (step S102).

[0063] A random number, which is a device-specific constant, is obtained from FlashROM21 (step S103). Random numbers are recorded in both FlashROM21 and NVRAM24, but here the random number is obtained from FlashROM21 because it is more stable.

[0064] In the process described above, the templates selected in steps S101 and S102 represent the processing performed in the corresponding task. The variables used in the templates selected in steps S101 and S102 include, as mentioned above, variables for storing personal data and variables for other purposes.

[0065] In step S104, it is determined whether the variables used in the template selected in step S102 are variables for storing personal data, thereby determining whether or not personal data subject to regulation under the GDPR Act has been processed in the corresponding task.

[0066] If the variables used in the selected template are not variables for storing personal data, step S104 becomes No and the process proceeds to step S112, where a backlog representing the processing details of the corresponding task is generated and output without using hash values ​​(step S112).

[0067] If the variables used in the selected template are personal data storage variables, step S104 becomes Yes and the process proceeds to step S105. In step S105, it is determined whether the personal data storage variable in the template is a username variable or an email address variable.

[0068] If the variable used in the template is a username variable (user variable in step S105), the username string to be assigned to the username variable is obtained from the key input memory device variable 261 (step S106), and a hash value is obtained by executing a hash function on the obtained random number and the string (step S107). A hash function is a function that maps a key value x to some range of values, such as an array index set, and the value returned by the hash function is called a hash value. In this embodiment, a hexadecimal number representing a username or email address is used as the key value. The hash value is obtained by multiplying the key value by a coefficient specific to the device and applying it to MD5 (message digest algorithm 5), a typical hash algorithm. Hash algorithms have the property that the output hash value changes significantly if the hexadecimal number used as the key is different by even one bit, and are used for tamper detection.

[0069] The debug log is obtained and output by replacing the username variable in the template with the hash value obtained in this way (step S108).

[0070] If the variable used in the template is an email address variable (email address variable in step S105), the string of the email address to be assigned to the email address variable is obtained from NVRAM24 (step S109), and a hash value is obtained by performing a hash function on the obtained random number and the string (step S110). Then, the debug log is obtained and output by replacing the email address variable in the template with the hash value (step S111).

[0071] Device-specific constants such as random numbers, usernames, and email addresses are stored in both NVRAM24 and FlashROM21. However, for generating debug logs, it is preferable to retrieve them from FlashROM21 because FlashROM21 is a more stable storage device.

[0072] Furthermore, in steps S108 and S111, when a hash function conversion is performed on the username and email address, it is desirable to write the hash value obtained from the conversion to NVRAM24 and FlashROM21, associating it with the username and email address, and to store the conversion result of the hash function as associated with the username and email address. In this way, when performing the conversion for the same username and email address, it is desirable to read the hash value previously stored in NVRAM24 and FlashROM21 instead of processing in steps S105 to S111, and to omit the conversion using the hash function.

[0073] [5] The process of generating debug logs using the debug log generation code for each task (5-1) Debug logs generated when entering keys on the login screen The process by which debug logs are generated by log processing codes 214 to 254 is explained below. Assume that, as shown in Figure 8(a), the user opens the login screen and enters "NAKATA," one of several usernames stored in NVRAM 24. In this case, the string entered by the key type of the key unit 18 is stored in the key input memory device variable 261. PanelTask ​​201 then copies the address of the key input memory device variable 261 to the inter-task communication variable 262, thereby passing the string obtained by the key type of the key unit 18 to LoginTask 202.

[0074] The string NAKATA entered from the key unit 18 is the username, so the log processing code 214 included in PanelTask201 selects the first template 2011, namely UserName:[username variable] was sent to[task name variable]. (step S102), and retrieves the string NAKATA from the key input memory device variable 261 as the string to be substituted for the [username variable] part (step S106).

[0075] Furthermore, since PanelTask201 displays the login screen shown in Figure 8(a), the default task name for the [Task Name Variable] is set to LoginTask. By calculating a hash value from the string obtained in this way and a random number, and replacing the username variable in template 2011 with the hash value ereawfaw3234arwa, we obtain debug log 2110 in Figure 8(b), namely (PanelTask) UserName: ereawfaw3234arwa was sent to LoginTask.

[0076] The string NAKATA entered from the key unit 18 is one of the usernames stored in NVRAM 24. Since the username has been authenticated, the log processing code 224 included in LoginTask 202 selects the first template 2021, i.e., NVRAM: [username variable] verifying [username variable] (step S102). To fill in the [username variable] part of this template, it retrieves the string NAKATA from the key input memory device variable 261 (step S106). A hash value is calculated from the retrieved string and a random number, and the hash value ereawfaw3234arwa is applied to the username variable in the template. This results in the debug logs 2120 and 2130 in Figure 8(b), i.e., (LoginTask) NVRAM: ereawfaw3234arwa, verifying UserName: ereawfaw3234arwa, (LoginTask) Login OK.

[0077] In BackupTask204, since username authentication was performed, the log processing code 244 included in BackupTask204 selects the first template 2041, i.e., FlashROM[username variable] (step S102), and obtains the strings NAKATA, NISIDA, and KIMURA to be placed in the [username variable] part (step S106). A hash value is calculated from the obtained strings and a random number, and the hash values ​​ereawfaw3234arwa, abcawfaw5444arwa, and 89ewae42qsafaeae are applied to the username variable of the template. This results in the debug log 2140 in Figure 8(d), i.e., (Backup) FlashROM: ereawfaw3234arwa, abcawfaw5444arwa, 89ewae42qsafaeae.

[0078] Next, we will explain the case shown in Figure 8(c) where the user attempted to enter NAKATA, one of several usernames stored in NVRAM24, but mistakenly entered NAKKTA. Since the string NAKKTA entered from the key section 18 is a username, the log processing code included in PanelTask201 selects the first template 2011, namely UserName:[username variable] was sent to[task name variable]. (step S102), and obtains the string NAKKTA from the key input memory device variable 261 as the string to be applied to the [username variable] part (step S106). The hash value 34arwawfereaaw32 is calculated from the obtained string and a random number, and by applying the hash value to the username variable in the template, the debug log 2210 shown in Figure 8(d), namely (PanelTask) UserName: 34arwawfereaaw32 was sent to LoginTask. is obtained.

[0079] The string NAKKTA entered from the key unit 18 does not match any of the usernames stored in NVRAM 24, and therefore username authentication failed. As a result, the log processing code included in LoginTask202 selects the second template 2022, namely NVRAM: No matching, verifying [username variable] (step S102), and retrieves the string NAKKTA from the key input memory device variable 261 as the string to be applied to the [username variable] part of this template (step S106). The hash value 34arwawfereaaw32 is calculated from the retrieved string and a random number, and the hash value is applied to the username variable in the template. This results in the debug log 2220 in Figure 8(d), namely NVRAM: No matching, verifying UserName: 34arwawfereaaw32.

[0080] The processing of BackupTask204 is the same as in Figure 8(b). Through the above processing, in the case of successful login in Figure 8(a), debug logs 2110, 2120, 2130, and 2140 in Figure 8(b) are obtained, and in the case of failed login in Figure 8(c), debug logs 2210, 2220, 2230, and 2240 are obtained. In the above process, the strings NAKATA, NISIDA, and KAWATA are replaced with the strings ereawfaw3234arwa, abcawfaw5444arwa, and 89ewae42qsafaeae, respectively, as shown in Figure 8(e). The string NAKKTA, which was entered incorrectly, is replaced with a different string from NAKATA, namely 34arwawfereaaw32. As a result, in the debug log in Figure 8(d), the incorrect input string "NAKKTA" is represented by a hash value different from that of NAKATA, NISIDA, or KAWATA. Therefore, it can be concluded that the (LoginTask) NVRAM: No matching, verifying and Login NG in debug logs 2230 and 2240 are caused by incorrect input from the operation unit 15, and that there are no problems with the Panel application 101 or Login application 102 themselves.

[0081] (5-2) Debug log generated when the personal card 32 is read by the card authentication device 31 Figures 8(a) and 8(c) show that the username was entered using the key type on the key unit 18, but it is also possible to authenticate the username by reading the personal card 32 with the card authentication device 31. The card authentication device 31 is connected to the main body of the image forming apparatus 1 via a USB connector, and when user authentication is performed using input from the card authentication device 31, AuthdeviceTask 205 passes the username to LoginTask 202 instead of PanelTask ​​201. When the card authentication device 31 accepts input of a user ID, AuthdeviceTask 205 uses template 2051 (see Figure 6(a)) which has the same content as PanelTask ​​201 to output a debug log indicating the username that was passed to LoginTask 202. If the username transmitted from the card authentication device 31 is corrupted due to noise or other reasons, the corrupted username is converted to a hash value that is different from any of the usernames backed up in the FlashROM 21, as shown in the debug log 2210 in Figure 8(d). Therefore, it can be clearly understood that the corruption occurred when the username was entered from the card authentication device 31.

[0082] (5-3) Debug log indicating email transmission Figures 8(a) and 8(c) show the input of a username using the key type on the key unit 18, while Figures 9(a) and 9(c) show the case where an email address is entered by operating on the email address screen displayed on the display unit 16. The email address screen in Figure 9(a) displays a list of email addresses stored in the NVRAM 24, namely nakata@abc.jp, nisida@abc.jp, and kimura@abc.jp, and accepts the selection of one of these email addresses.

[0083] Suppose the user selects the email address nakata@abc.jp from among these email addresses. In this case, PanelTask201 obtains the coordinates of nakata@abc.jp on the email address screen and retrieves nakata@abc.jp from NVRAM24 as the email address corresponding to those coordinates. PanelTask201 then copies the address of the area in NVRAM24 that stores nakata@abc.jp to the inter-task communication variable 262, thereby passing nakata@abc.jp to SendTask203.

[0084] Since PanelTask201 retrieves the email address from NVRAM24, the log processing code 214 included in PanelTask201 selects the second template, template 2012 (step S102).

[0085] The log processing code 214 included in PanelTask201 retrieves the email address nakata@abc.jp from NVRAM24 as the string to be applied to the [email address variable] part of template 2012 (step S109). A hash value is calculated from the retrieved string and a random number, and the hash value is applied to the username variable in the template (step S110). This yields the debug log 2510 in Figure 9(b), which is get Email Address: wwwwwfaw3234arwaA from NVRAM.

[0086] SendTask203 creates an email addressed to the acquired email address, attaches the image data obtained by scanning with the scanner unit 12, and sends it, assuming it has reached the recipient. The log processing code included in SendTask203 selects template 2031, i.e., send to Email Address:[email address variable] Send OK, from the two templates corresponding to SendTask (step S102), and obtains the email address nakata@abc.jp from NVRAM24 as the string to be applied to the [email address variable] part of template 2031 (step S109). A hash value is calculated from the obtained string and a random number, and the hash value is applied to the email address variable in template 2031 (step S110). This yields debug logs 2520 and 2530 in Figure 9(d), i.e., send to Email Address: wwwwwfaw3234arwaA, Send OK.

[0087] Since the previous task performed email sending, BackupTask204 writes the three email addresses registered in NVRAM24, nakata@abc.jp, nisida@abc.jp, and kisida@abc.jp, to FlashROM21. Since the email addresses have been written to FlashROM21, BackupTask204 selects template 2042, and applies the hash values ​​obtained by converting the three email addresses to the email address variable of this template 2042, obtaining debug log 2540 in Figure 9(b), namely FlashROM: wwwwwfaw3234arwaA, pppppfaw5444arwaB, qqqqqe42qsafaeae.

[0088] Figure 9(c) shows the case where the user selects the email address nisida@abc.jp on the email address screen. In this case, PanelTask201 obtains the coordinates of nisida@abc.jp on the email address screen and retrieves the string nisida@abc.jp from NVRAM24 as the email address corresponding to those coordinates. The log processing code 214 included in PanelTask201 selects template 2012 as described above and outputs debug log 2610, which is "get Email Address: pppppfaw5444arwaB A from NVRAM.", by substituting the hash value of nisida@abc.jp into the email address variable of template 2012.

[0089] On the other hand, SendTask203 creates an email addressed to the acquired email address, attaches the image data obtained by scanning with the scanner unit 12, and sends it, but the email fails to be delivered. In this case, the log processing code included in SendTask203 selects template 2032, one of the two templates 2031 and 2032 that correspond to SendTask203, namely send to Email Address:[email address variable] Send NG (step S102). The log processing code 234 included in Send application 103 obtains the email address nisida@abc.jp from NVRAM24 as the string to be applied to the [email address name variable] part of template 2032 (step S109). The hash value ppppfaw5444arwaB is calculated from the obtained string and a random number (step S110), and the hash value is applied to the email address variable in template 2012 (step S111). This yields debug logs 2620 and 2630 in Figure 9(d), namely send to Email Address: pppppfaw5444arwaB and Send NG. BackupTask204 is the same as in Figure 9(b).

[0090] Comparing debug log 2520, which is output when sending is successful, with debug log 2620, which is output when sending fails, we can see that the hash value output by SendTask203 when sending fails is the same as one of the hash values ​​written to NVRAM24 by BackupTask204. Therefore, we can understand that the failure to send email by SendTask203 was caused by an incorrect email address registered in NVRAM24.

[0091] [6] Summary As described above, according to this embodiment, the conversion of personal data using a hash function has the property of converting multiple plaintexts of the same number of characters into separate codewords, so it is possible to distinguish whether the hash values ​​contained in each of the multiple debug logs represent the same subject. It is possible to clearly distinguish whether the negative processing result shown in the debug log is due to a key typing error or a card reading error, so even if the debug log shows a negative processing result, if it is found to be due to a typing error, the processing result can be excluded from analysis as it does not indicate the cause of a bug. This makes it possible to efficiently debug programs incorporated into image forming apparatuses and improve the quality of image forming apparatuses.

[0092] [7] Second embodiment In the first embodiment, personal data in the debug log was replaced with hash values ​​and output. However, hash values ​​have a long word length, and when stored in RAM22 and output, they occupy a large area. Therefore, in this embodiment, each hash value obtained by replacing personal data is replaced with a shorter string (abbreviated string).

[0093] (7-1) Replacing shortened strings using a table This abbreviated string is a combination of a reserved word indicating that it corresponds to personal data and a number of a predetermined number of digits, and is assigned to each of the multiple hash values ​​generated in steps S107 and S110 of Figure 7. For this assignment, a hash value table 3000 as shown in Figure 10 is generated in RAM 22.

[0094] The hash value table 3000 consists of records 3100, 3200, 3300, etc., corresponding to each of the multiple hash values, as shown in Figure 10. Each record stores the hash value 3010 generated in step S104 and its corresponding abbreviated string 3020.

[0095] (7-2) Procedure for replacing with abbreviated strings In order to shorten the hash value using the hash value table 3000, in the second embodiment, after steps S107 and S110 in Figure 7, steps S201 to S207 of the flowchart shown in Figure 11 are executed instead of steps S108 and S111.

[0096] First, the hash value obtained in step S104 is used to search the hash value table 3000 (step S201), and it is determined whether there is a matching record (step S202). If no record matches the hash value (No in step S202), a shortened string [DATA + counter value i] is generated (step S203), and a record containing the hash value and the shortened string [DATA + counter value i] is added to the hash value table 3000 (step S204), and the variable i is incremented (step S205). If a matching hash value exists in the hash value table 3000 (Yes in step S202), the abbreviated string 3020, which is [DATA + counter value i], stored in the record containing the matching hash value is read (step S206).

[0097] If a shortened string corresponding to the hash value in the debug log is obtained in either step S204 or S206, the hash value portion of the debug log is replaced with the shortened string and output (step S207).

[0098] (7-3) Hash value replacement in debug logs indicating email transmission Similar to Figure 9(a), we assume that a user enters one of the email addresses registered in NVRAM24 into the operation unit 15. When the Panel application 101 outputs a debug log and replaces the email address nakata@abc.jp included in the debug log with wwwwwfaw3234arwaA, the hash value table 3000 does not have a registered hash value (No in step S202), and the hash value wwwwwfaw3234arwaA is considered completely new, so a shortened string [DATA + counter value i] is assigned to the hash value. The counter value i is 3 digits, and i=1, so the shortened string DATA001 is generated as the shortened string corresponding to the hash value wwwwwfaw3234arwaA (step S203).

[0099] When the Send application 103 outputs a debug log and replaces the email address nakata@abc.jp contained in the debug log with wwwwwfaw3234arwaA, the same hash value is registered in the hash value table 3000 (Yes in step S202), so the hash value wwwwwfaw3234arwaA contained in the debug log is replaced with the abbreviated string DATA001 and output (step S207).

[0100] Backup application 104 outputs a debug log and determines whether the hash values ​​wwwwwfaw3234arwaA, pppfaw5444arwaB, and qqqqqe42qsafaeaeC included in the debug log are registered in hash value table 3000. Since the same hash value for wwwwwfaw3234arwaA is registered in hash value table 3000 (Yes in step S202), the hash value wwwwwfaw3234arwaA included in the debug log is replaced with the abbreviated string DATA001 and output. Since pppfaw5444arwaB and qqqqqe42qsafaeaeC are not registered in the table, abbreviated strings in the form of [DATA + counter value i] (DATA002, DATA003) are generated as abbreviated strings corresponding to these hash values ​​(step S203).

[0101] As a result, debug logs 2710-2740 and 2810-2830, which show the exchange of personal data using DATA001 and 003, are generated as shown in Figures 12(a) and (b).

[0102] (7-4) Summary In a typical business with several dozen employees, the number of personal data entries appearing in the debug log is at most a few hundred, and in many cases, it is thought to be less than a thousand. Each of these fewer than a thousand personal data entries is converted into a hash value at a one-to-one ratio, and the converted hash values ​​are then converted into shorter strings. Therefore, in the second embodiment, the hash values ​​in the debug log file can be converted into short strings, while ensuring that there is no overlap. By converting to these shorter strings, the area occupied by the debug log file in NVRAM24 is reduced, and the distinction between which entries correspond to which becomes clearer, allowing for more efficient debugging in subsequent stages.

[0103] [8] Comparison with replacement according to Patent Document 1 For reference, we will compare the debug log obtained by performing string replacement according to Patent Document 1 with the debug log output by the image forming apparatus 1 of the first embodiment. If the number of characters not masked is increased, the risk of the original string being identified increases, so the ratio of consecutive strings to be masked to consecutive strings not to be masked must be set to about 9:1, otherwise the risk of the username being identified increases. Since NAKATA NISIDA KAWATA has 6 characters, 90% of this means that the 5-character portion needs to be masked.

[0104] In this case, as shown in Figure 13(a), if the third character from the beginning, i.e., the K, S, and W parts, are left unmasked, they become **K***, **S***, and **W***, allowing these usernames to be distinguished. This makes it possible to trace the data exchange regarding **K*** between the Panel application 101 and the Login application 102. However, as shown in Figure 8(c), if NAKATA is mistakenly entered as NAKKTA, even if the names of the three users can be distinguished by the masks **K***, **S***, and **W***, as shown in Figure 13(b), both NAKATA and NAKKTA become **K***, and the key input error does not appear in the debug log. Thus, in Patent Document 1, it is difficult to specify a mask that can distinguish usernames of the same number of characters, and even if they can be distinguished, it is not possible to indicate the presence or absence of a key input error in the debug log. If a debug log entry such as "Login NG" exists, it is impossible to distinguish whether it is a bug in the Panel application 101 or Login application 102, a malfunction in the operation unit 15 or NVRAM 24, or a user input error, resulting in unnecessary analysis time during debugging. In contrast, the image forming apparatus 1 according to this embodiment replaces NAKATA, NAKKTA, NISIDA, and KAWATA with different hash values, so that usernames with the same string can each be represented using different hash values, and the occurrence of key input errors can be indicated in the debug log.

[0105] [9] Variant Although the present invention has been described above based on embodiments, it goes without saying that the present invention is not limited to the embodiments described above, and the following modifications are possible.

[0106] (1) In the above embodiment, it is desirable to use a perfect hash function as a function that is a one-to-one mapping and has the property of being one-way. The perfect hash function may be a minimal perfect hash function such as the Knuth multiplicative hash. However, an imperfect hash function may be used as long as it does not impede practicality.

[0107] While MD5 was used as the hash algorithm, it is not limited to this. Other hash algorithms may also be used. Specifically, personal data transformation may be performed using a hash algorithm that modifies part of the MD5 calculation process shown below.

[0108] The program takes personal data and arithmetic constants as input, processes them, and outputs a fixed-length 128-bit value. Padding is applied so that the input message is a multiple of 512 bits (16 x 32-bit words).

[0109] The main part of MD5 repeats the following processes 1), 2), and 3) for 32-bit words A, B, C, and D. 1) Of A[i], B[i], C[i], and D[i], the first A[i] is subjected to a series of operations including transformation by a nonlinear function F, addition modulo 232, and bit rotation to the left, resulting in A'[i].

[0110] 2) Let D[i], A'[i], B[i], and C[i] be in that order, and let A[i+1]=D[i], B[i+1]=A'[i], C[i+1]=B[i], and D[i+1]=C[i].

[0111] 3) Replace A[i], B[i], C[i], D[i] with A[i], B[i], C[i], D[i], and return to 1). Any operation other than a hash function may be used, as long as it is a one-to-one mapping and has the property of being unidirectional.

[0112] (2) While usernames and email addresses are listed as data to be replaced with hash values, the data is not limited to these. If other data falls under the category of personal data under the GDPR, it must be converted into hash values. For example, the names of natural persons, identification numbers, location data, online identifiers (IP addresses, cookie identifiers), and data indicating factors relating to physical, physiological, genetic, mental, economic, cultural, and social uniqueness must be converted into hash values.

[0113] Data that is processed as personal data under the GDPR, such as customer contact information, customer names, data that may be subject to employee performance evaluations by supervisors, and the names and job titles of all employees, must be converted into hash values.

[0114] Furthermore, in image forming apparatuses, in addition to the processes exemplified in the above embodiments, data relating to the issuers of various jobs, including print jobs, scan jobs, copy jobs, facsimile transmission jobs, and facsimile reception jobs, may also fall under the category of regulated data or candidate data. When such data relating to the issuers of various jobs falls under the category of regulated data or candidate data, it is desirable to convert it into a hash value.

[0115] (3) In the second embodiment, when personal data is converted to a hash value, the hash value is further converted to a shortened string, but this is not the only way. The shortened string may be used when a debug log file is generated and handed over to the service technician's PC2. In addition, the shortened string is a reserved word + a 3-digit number, but this 3-digit number may be changed according to the number of personnel employed by the business. Alternatively, a dictionary of shortened strings may be kept in advance, and the conversion may be performed by replacing the hash value in the debug log file with a shortened string from this dictionary. It is desirable that the shortened strings prepared for this purpose be names that are easy for humans to understand, such as TARO, HANAKO, etc.

[0116] (4) In the first and second embodiments, personal data was uniformly replaced with hash values, but this is not limited to this. If consent is obtained from the person who registered the personal data regarding the use of personal data for debugging purposes, a debug log file containing the personal data may be output without converting the hash value. To obtain such consent, an email with the debug log file containing the personal data attached is sent to the provider of the registered personal data or the administrator of the image forming apparatus. If a reply is received to the email indicating consent to the use for debugging, the debug log is output without converting to a hash value.

[0117] (5) Target candidate data and regulated data may include supplementary data stored in NVRAM24 along with personal data. Supplementary data stored in NVRAM24 along with personal data includes count value data and personal setting data. Count value data indicates the number of times a job has been executed by the user for each job. Personal setting data indicates the paper settings, duplex settings, document scanning settings, print settings, scan and fax destination settings that the user has made to the operation unit 15. This supplementary data may be transformed using a hash function.

[0118] (6) The random numbers, which are calculation constants, are said to be stored in NVRAM24 along with the regulated data, but are not limited to this. They may also be stored in a non-volatile medium other than NVRAM24. For example, they may be written to a secure recording medium such as a tamper-resistant module and supplied to the image forming apparatus 1. Furthermore, the periodic backup by BackupTask204 is said to be performed by writing to FlashROM21, but is not limited to this. Backups may also be performed by writing to HDD23, or by writing to the storage of a network-connected server.

[0119] (7) In the above embodiment, the image forming apparatus is an MFP, but it is not limited to this. It may be installed in a production printing machine. It may also be a single-function copier or a single-function peripheral device (printer) for a personal computer. In addition, it may be a label printer, postcard printer, or ticket machine. It may be a color image forming apparatus by providing exposure and developing units for Y, M, C, and K colors, or a monochrome type by providing an exposure and developing unit for K color. It may also be a two-color or three-color image forming apparatus by providing exposure and developing units for two or three of the Y, M, C, and K colors. Furthermore, it is not limited to an electrophotographic method, but may also be an inkjet method. [Industrial applicability]

[0120] This disclosure allows for the representation of processing details performed by embedded programs in a debug log, while still meeting legal and regulatory requirements. This significantly improves the efficiency of debugging for program developers, making it potentially useful in a wide range of industries, including office automation equipment and information technology, as well as retail, rental, real estate, advertising, transportation, and publishing. [Explanation of Symbols]

[0121] 1. Image forming apparatus 2 PC 2C serial cable 3 servers 4. Program Delivery Server 11. Manuscript transport section 12 Scanner section 13 Printer Section 14 Paper feed section 15 Control section 16 Display section 17 Touch panel 18 Key section 19 Outlet 20 CPU 21 FlashROM 22 RAM 23 HDD 24 NVRAM 25 Communication Interfaces 26 Serial Devices 31 Card Authentication Device 101 Panel Application 102 Login Application 103 Send Application 104 Backup applications 105 Authdevice application 106 Template files 110 Operating Systems 111 Version Control Module 112 kernel 201 PanelTask 202 LoginTask 203 SendTask 204 BackupTask 205 AuthdeviceTask 214~254 Log processing code 261 Key Input Memory Device Variables 262 Variables for inter-task communication

Claims

1. An operating unit, A conversion means that performs a one-way one-to-one conversion between first data that may be subject to legal regulations, input by the user to the control unit, and second data having the same attributes as the first data, which is pre-stored in the device. A log output means outputs both the first data and the second data obtained by the one-to-one conversion by the conversion means as debug logs. An image forming apparatus characterized by comprising:

2. The aforementioned one-way, one-to-one transformation is a transformation using a hash function. The image forming apparatus according to claim 1.

3. The system includes a constant storage unit that stores arithmetic constants used in the calculation of the hash function. The image forming apparatus according to feature 2.

4. The non-volatile memory on which the second data is written, The system includes backup means for backing up the second data written to the non-volatile memory to a backup medium, In conjunction with the backup, the conversion means obtains the conversion result data obtained by the one-to-one conversion of the second data, and the log output means outputs the conversion result data. The image forming apparatus according to feature 1.

5. In conjunction with the backup, the conversion means obtains the conversion result data from the second data backed up on the backup medium. The image forming apparatus according to feature 4.

6. The backup means performs the backup periodically. The image forming apparatus according to feature 4 or 5.

7. Multiple instances of the second data are written to the non-volatile memory, and these multiple instances of the second data represent data indicating multiple registered users who have been pre-registered. The first data is data entered via panel operation or data entered via card reading. The image forming apparatus according to any one of claims 4 to 6.

8. Multiple instances of the second data are written to the non-volatile memory, and these multiple instances of the second data are data indicating multiple pre-registered destinations. The first data mentioned above indicates a destination selected from a group of pre-registered destinations. The image forming apparatus according to any one of claims 4 to 6.

9. The aforementioned one-way one-to-one conversion includes a shortening conversion in which the hash value obtained by the conversion using the hash function is replaced with a shortened word. The image forming apparatus according to claim 2 or 3.

10. The system includes a receiving means for receiving whether or not the first data needs to be converted, If the conversion is necessary, the conversion means performs the conversion, and the log output means outputs the output. If the above conversion is unnecessary, output a debug log containing the first data as is. The image forming apparatus according to any one of features 1 to 9.

11. The first data includes personal data, and the device comprises communication means for performing a communication requesting permission from the provider or administrator of the personal data to use the personal data for debugging, The conversion means switches whether to perform the one-to-one conversion depending on whether permission has been obtained from the provider or administrator of the personal data to use the personal data for debugging. The image forming apparatus according to feature 10.

12. The first data and the second data are a username or email address, The conversion means performs a one-way, one-to-one conversion between a username or email address entered by the user and a username or email address pre-stored in the device. The image forming apparatus according to feature 1.

13. A control method performed in an image forming apparatus, A conversion step in which a one-way one-to-one conversion is performed on a first data that may be subject to legal regulations, input by the user to the operating unit of the image forming apparatus, and a second data having the same attributes as the first data, which is pre-stored in the image forming apparatus. A log output step that outputs both the first data and the second data obtained by the one-to-one conversion in the conversion step as debug logs. A control method characterized by including

14. A program to be executed by a computer of an image forming apparatus, A conversion step in which a one-way one-to-one conversion is performed on a first data that may be subject to legal regulations, input by the user to the operating unit of the image forming apparatus, and a second data having the same attributes as the first data, which is pre-stored in the image forming apparatus. A log output step that outputs both the first data and the second data obtained by the one-to-one conversion in the conversion step as debug logs. A program characterized by causing a computer to execute something.

Images