Image processing device, control method for image processing device, and program

Abstract

To support setting of values according to setting items of an image processing system such that the values are suited to a utilization environment of the image processing system.SOLUTION: A first setting data group including a plurality of setting items and their setting values are associated to a predetermined utilization environment, and a second setting data group including a plurality of setting items and their setting values different from the plurality of setting items and their setting values included in the first setting data group are associated to the predetermined utilization environment, and the associates are stored. Information indicating a selection result for specifying the utilization environment of the image processing system is accepted, and based on the first setting data group corresponding to the predetermined utilization environment specified by the information, the setting values of the image processing system are changed. Furthermore, based on the second setting data group corresponding to the predetermined utilization environment specified by the information, information indicating results of selecting whether to change the setting values of the image processing system is received, and the results of selecting whether to change the setting values of the image processing system are made different based on the information.SELECTED DRAWING: Figure 7

Description

Technical Field

[0001] The present invention relates to an image processing apparatus that collectively performs settings for a plurality of setting items.

Background Art

[0002] Generally, an image processing apparatus has a setting function for performing various settings based on user operations. For example, settings related to security can be mentioned. In Patent Document 1, a method has been proposed to reduce the operation time of the user required for setting by collectively setting security settings for a plurality of image processing apparatuses.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] By paying attention to the usage environment of the image processing apparatus, it has come to be installed in various environments such as telecommuting and public spaces shared by an unspecified number of people, and the required settings have become complicated. However, in Patent Document 1, performing settings suitable for the usage environment of the image processing apparatus is not considered. Therefore, there is a possibility that the user may not know which setting items should be set for the usage environment of the image processing apparatus. 。

[0005] An object of the present invention is to provide a mechanism for assisting in setting such that the setting values corresponding to the setting items of the image processing apparatus become setting values suitable for the usage environment of the image processing apparatus.

Means for Solving the Problems

[0006] To achieve the above objective, the image processing apparatus of the present invention includes a receiving means for receiving the selection of a usage environment for the image processing apparatus from among a plurality of usage environments, After accepting the aforementioned selection, without any instructions from the user, based on the aforementioned selection A setting means for setting multiple values ​​corresponding to the selected usage environment, and a control means for proposing one or more values ​​corresponding to the selected usage environment, A second setting means for setting one or more values ​​based on instructions from a user to set the proposed value, It has. [Effects of the Invention]

[0007] According to the image processing apparatus of the present invention, it is possible to assist in setting the setting values ​​corresponding to the setting items of the image processing apparatus so that they become setting values ​​suitable for the operating environment of the image processing apparatus. [Brief explanation of the drawing]

[0008] [Figure 1] This figure shows an example of the hardware configuration of the MFP100. [Figure 2] This diagram shows an example of the software configuration for the MFP100. [Figure 3] This is an example of a mandatory security template used in security settings. [Figure 4] This is an example of an optional security template used in security settings. [Figure 5] This figure shows an example of a screen that allows the user to select the operating environment for the MFP100. [Figure 6] This figure shows an example of a confirmation screen that asks the user whether or not to apply optional security settings. [Figure 7] This is a flowchart showing an example of the security setting process in the first and fourth embodiments. [Figure 8] This is an example of an application history used in the second embodiment. [Figure 9] This figure shows an example of a screen that allows the user to select the application to use in the second embodiment. [Figure 10] This is an example of an application management table used in the second embodiment. [Figure 11] It is a flowchart showing an example of the security setting process in the second embodiment. [Figure 12] It is a flowchart showing an example of the security setting process when starting a newly used application in the second embodiment. [Figure 13] It is an example of an optional security template used in the security setting in the third embodiment. [Figure 14] It is a diagram showing an example of a confirmation screen for asking the user whether to apply the optional security setting in the third embodiment. [Figure 15] It is a diagram showing an example of a communication system in the fourth embodiment. [Figure 16] It is a diagram showing the software configuration of the MFP 100 in the fourth embodiment. [Figure 17] It is a diagram showing the hardware configuration of the management cloud system 1501 in the fourth embodiment. [Figure 18] It is a diagram showing the software configuration of the management cloud system 1501 in the fourth embodiment. [Figure 19] It is a flowchart showing an example of the security setting process in the fifth embodiment.

Embodiments for Carrying Out the Invention

[0009] Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings. Note that the following embodiments do not limit the invention according to the claims, and not all combinations of the features described in the embodiments are essential for the solution means of the invention.

[0010] <The First Embodiment> FIG. 1 is a diagram showing the hardware configuration of an MFP 100, which is an example of an image processing apparatus according to the present embodiment. The MFP 100 includes a display unit that displays information to the user and an operation unit 102 that functions as a reception unit that receives user instructions. The MFP 100 also includes a printer unit 103 that outputs electronic data to a paper medium and a scanner unit 104 that reads a paper medium and converts it into electronic data. The operation unit 102, the printer unit 103, and the scanner unit 104 are connected to a control unit 101 and realize functions as a multifunction peripheral according to the control of the control unit 101. In the present embodiment, the MFP 100 having a plurality of functions is exemplified as an example of the image processing apparatus, but the present invention is not limited thereto. For example, a single-function scanner or printer device may be used. Further, a device such as a 3D printer or a 3D scanner may be used.

[0011] The control unit 101 controls the operation of the entire MFP 100. A ROM (Read Only Memory) 112 is used to store programs executed by the CPU 111. The CPU 111 reads out the control programs stored in the ROM 112 and performs various controls of the MFP 100 such as reading control and transmission control. A RAM (Random Access Memory) 113 is used as a temporary storage area such as the main memory and work area of the CPU 111. An HDD (Hard Disk Drive) 114 is a storage device that stores image data, various programs, and various setting information. Note that other storage devices such as an SSD (Solid State Drive) may be provided. As described above, hardware such as the CPU 111, the ROM 112, the RAM 113, and the HDD 114 constitutes a so-called computer.

[0012] An operation unit I / F (interface) 115 connects the operation unit 102 and the control unit 101. The operation unit 102 is provided with a liquid crystal display unit having a touch panel function and various hard keys. The CPU 111 displays information for the user and receives instructions from the user via the operation unit I / F 115.

[0013] The printer interface 116 connects the printer unit 103 and the control unit 101. The MFP 100 performs output processing to paper media based on the print data input via the printer interface 116.

[0014] The scanner interface 117 connects the scanner unit 104 and the control unit 101. The scanner unit 104 reads a document placed on a document glass (not shown) and generates image data.

[0015] A network cable is connected to the network interface 118, allowing it to communicate with external devices on the LAN 120. While this embodiment assumes a wired communication interface, it is not limited to this. For example, it could be a wireless communication interface.

[0016] The fax interface F119 is connected to a telephone network (not shown in the diagram). Fax messages are forwarded to the fax machine's telephone number via the telephone network. This telephone-based fax is just one example; internet fax services could also be used.

[0017] Figure 2 shows the software configuration of the MFP100. Each part shown in Figure 2 is realized by the CPU 111 executing the program according to the present invention stored in the ROM 112.

[0018] The operation control unit 201 displays a user-facing screen on the operation unit 102. It also detects user actions and switches screens or updates the display based on the detection results.

[0019] The data storage unit 202 stores data in the HDD 114 and reads data from the HDD 114 in accordance with requests from other control units. The data storage unit 202 stores setting information for determining the operation of the MFP 100, as well as information related to security settings. In this embodiment, the information related to security settings stored in the data storage unit 202 will be described later with reference to Figures 3 and 4.

[0020] The security settings control unit 203 configures the security settings of the MFP100 in accordance with user instructions detected by the operation control unit 201. In this embodiment, the "essential security template," described later using Figure 3, is applied to the MFP100. Furthermore, based on the "optional security template," described later using Figure 4, the recommended settings of the template are applied to the MFP100 while confirming with the user on the operation unit 102 whether or not to apply it. The specific setting control process in this embodiment will be described later using Figure 7. In this embodiment, the batch setting that applies the "essential security template" is a function that allows the vendor to set the recommended settings for typical security functions in a batch. This differs in nature from a function that applies a security policy edited by the user and prohibits changing the settings for specific security setting items to settings that do not conform to the policy.

[0021] The application control unit 204 controls the applications (hereinafter referred to as "applications") of the MFP100. Applications provide users with various functions. Examples of functions include copy, send, fax, box, and print functions. The application control unit 204 provides these functions to the user via each interface. The specific control is explained below, separated by function.

[0022] To provide the copying function to the user, the application control unit 204 receives a copy command from the user via the operation unit I / F 115. Upon receiving the command, the application control unit 204 reads the original document from the scanner unit 104 via the scanner I / F 117 and receives the image data. The application control unit 204 then performs color conversion processing on the received image data to make it suitable for output. Finally, the application control unit 204 transfers the color-converted image data to the printer unit 103 and outputs it to paper.

[0023] To provide the transmission function to the user, the application control unit 204 receives instructions from the user to execute a transmission via the operation unit I / F 115. At that time, in addition to the instruction to execute the transmission, it also receives instructions regarding the transmission protocol, destination specification, and image format. The transmission protocol is a communication standard for transmitting data. Examples of transmission protocols include FTP (File Transfer Protocol), a standard for file transfer, and SMB (Server Message Block), a standard for file sharing. Specifying a destination means specifying the destination folder, file, etc. For example, the destination may be specified using a notation method called UNC (Universal Naming Convention). Examples of image formats include JPEG (Joint Photographic Experts Group) and PDF (Portable Document Format). When the application control unit 204 receives an instruction from the user to execute a transmission, it reads the document from the scanner unit 104 via the scanner I / F 117 and receives the image data. Then, it performs conversion processing on the received image data to the image format specified by the user. Finally, the application control unit 204 transmits the converted image data to the destination via the network interface 118 using the transmission protocol instructed by the user.

[0024] To provide the fax function to the user, the application control unit 204 receives instructions from the user to execute a fax via the operation unit I / F 115. At the same time, it also receives instructions for the telephone number of the fax to be forwarded. Upon receiving the instructions, the application control unit 204 reads the document from the scanner unit 104 via the scanner I / F 117 and receives the image data. Then, it performs processing on the received image data, such as converting it into an image format for faxing. Finally, the application control unit 204 forwards the fax to the telephone number specified by the user via the fax I / F 119.

[0025] The box function saves scanned image data to the internal storage area of ​​the MFP100 or to memory media connected to the MFP100. To provide the box function to the user, the application control unit 204 receives instructions from the user via the operation unit I / F 115 to scan a document and save the image data to the box. In this instruction, the application control unit 204 receives instructions from the user regarding the save location and image format of the scanned image. In the save location instruction, the user specifies the path to the internal storage area of ​​the MFP100 or to memory media connected to the MFP100. Examples of image formats include JPEG and PDF. Upon receiving the instructions, the application control unit 204 reads the document from the scanner unit 104 via the scanner I / F 117 and receives the image data. Then, it performs conversion processing on the received image data to the image format specified by the user. Finally, the application control unit 204 transfers the converted image data to the save location specified by the user. Furthermore, the box function allows the MFP100 to act as a file server, such as an SMB server, making data stored on the MFP100 accessible to external PCs (not shown) and other MFPs. To provide this function to users, the application control unit 204 receives requests to access the box from external sources via the network interface 118. These requests include the path to the target image file. The application control unit 204 then transfers the image data corresponding to the specified image file path to the requesting source via the network interface 118.

[0026] The print function, for example, when the MFP100 receives print data from an external PC (not shown), does not print immediately, but instead temporarily stores the data in the MFP100 and executes printing upon user instruction. The MFP100 receives the print data received from the external PC via the network interface 118 and saves that print data to the HDD 114. To provide the print function to the user, the application control unit 204 receives a print command from the user via the operation interface 115. At that time, in addition to the print command, user information is also received. The application control unit 204 transfers the print data stored in the HDD 114 that matches the received user information to the printer unit 103 via the printer interface 116 and outputs it to paper.

[0027] Please note that the above features are just examples of the MFP100's capabilities, and other features may also be included.

[0028] Figures 3 and 4 show the configuration data related to security settings stored in the data storage unit 202 in this embodiment. 301 in Figure 3 represents the usage environment of the MFP100. In this embodiment, the environments in which the MFP100 is used are divided into six categories: company intranet environment, direct internet connection environment, internet-restricted environment, home environment, public space environment, and high-confidentiality information management environment. Figure 3 shows the required configuration items 303 and configuration values ​​304 that should be set in each usage environment. Function 302 indicates which function of the application each required configuration item corresponds to. In the company intranet environment, direct internet connection environment, and high-confidentiality information management environment, configuration values ​​corresponding to all configuration items listed in Figure 3 should be set. Furthermore, in the internet-restricted environment, the configuration values ​​listed in Figure 3 should be set for all configuration items except for "accept encrypted secure jobs only" indicated by the diagonal lines. Similarly, for the home environment and public space environment, configuration values ​​should be set for all configuration items except those indicated by the diagonal lines. In this embodiment, a collection of data on setting items and values ​​that should be configured for each usage environment is called a security template. Multiple setting items and their setting values ​​are associated with predetermined usage environments such as a company intranet environment, a home environment, or a public space environment, and stored as a template in the data storage unit 202. The template shown in Figure 3 is called the "essential security template." In this embodiment, when a user selects one usage environment from the six available environments, the essential security template corresponding to that environment is applied. Specifically, the setting values ​​304 are applied collectively to the setting items 303 included in the essential security template corresponding to that usage environment.

[0029] The following explains setting item 303. The "Confirmation when recalling frequently used settings" setting in the fax and transmission functions displays a confirmation screen before actually sending to recipients registered as frequently used settings for one-touch transmission. The "Confirmation when entering fax number" setting in the fax function displays a confirmation screen after manually entering the fax number. Additionally, the "Confirmation when including fax destination" setting displays a confirmation screen when the destination includes a fax destination. These settings, when enabled, are related to preventing accidental transmissions, aiming to minimize the chance of sending to the wrong recipient when using the fax and transmission functions.

[0030] The "S / MIME settings" in the sending function are for encrypting emails. The "Encrypted PDF settings" in the sending and inbox functions allow you to set the encryption strength for encrypted PDFs. Additionally, "Always add device signature when sending" is an item that ensures a device signature is always added when sending PDFs or XPS files. These settings, when enabled, enhance the security of documents sent or saved using the sending and inbox functions, and are related to document security.

[0031] This section explains the "Fax Reception Report," "Fax Box Reception Report," "Fax Transmission Result Report," and "Fax Communication Management Report" in the fax function. These settings determine whether or not to print fax-related results, such as fax reception / transmission results and fax history, as reports. Similarly, the "Transmission Result Report" and "Communication Management Report" in the transmission function determine whether or not to print the transmitted content and transmission history as reports. By setting these settings to "Do not print," information leakage due to printed papers being left unattended is prevented; these are settings related to preventing unattended printouts. The "Forced Retention" setting in the print function determines whether or not to forcibly retain print data when printing from an external PC via the driver. This setting also relates to preventing unattended printouts.

[0032] The "Accept only encrypted secure jobs" setting in the print function determines whether to accept only encrypted, highly secure jobs. Enabling this setting restricts accidental operation and is a configuration item related to operation restrictions.

[0033] Figure 4 shows the optional setting items 403 and setting values ​​404 that are recommended to be set in each usage environment. These settings are the same as in Figure 3 for usage environment 301 and function 302. In the company intranet environment, direct internet connection environment, and high confidential information management environment, it is recommended to set the setting values ​​corresponding to all the setting items listed in Figure 4. In addition, in the internet-restricted environment, home environment, and public space environment, it is recommended to set the setting values ​​corresponding to the setting items other than those indicated by diagonal lines. In this embodiment, the template shown in Figure 4 is called the "optional security template". In this embodiment, when a user selects one of the six usage environments, a confirmation screen is displayed for each setting item included in the optional security template corresponding to that usage environment, asking whether to apply the template's setting values. The user sets each setting item by selecting whether to apply it on the confirmation screen.

[0034] The following explains setting item 403. The "Restrict broadcast transmission including fax destinations" setting in the fax function is related to broadcast transmission, which sends faxes to multiple destinations simultaneously. Setting "Restrict broadcast transmission including fax destinations" to "Enabled" disables broadcast transmission. The "Allow sending by users without registered email addresses" setting in the fax function, when using personal authentication management as the login service, determines whether to allow email sending to users without registered email addresses. Setting it to "Disabled" allows only users with registered email addresses to send emails. The "Restrict new destinations" setting in the sending function prevents accidental entry of recipients by restricting sending to only pre-registered destinations and preventing new entries. "Restrict email sending to 'Send to Myself'" prevents sending images via email to email addresses other than those pre-assigned to the user. Similarly, "Restrict file sending to 'My Folder'" prevents sending images to folders on external file servers other than those pre-assigned to the user. These settings are related to preventing accidental transmissions.

[0035] The "Certificate Verification for WebDAV Transmission" setting in the transmission function is for configuring whether or not to verify the legitimacy of the certificate when communicating using the WebDAV protocol. The same applies to the "Certificate Verification for FTPS Transmission," "Certificate Verification for SMTP Transmission," and "Certificate Verification for POP Reception" settings in the transmission function, as well as the "Certificate Verification for Network Access" setting in the box function. These settings configure whether or not to verify the legitimacy of the certificate when communicating using each respective protocol. All of the above settings relate to certificate verification, which verifies the legitimacy of the communication destination by checking the certificate during transmission and reception.

[0036] In the fax function, "Use fax memory reception" and "Use I-fax memory reception" are settings for recording received faxes and I-faxes in memory instead of printing them on paper. In the print function, "Use automatic printing at login" is a setting that determines whether or not to allow the automatic printing of forced hold print jobs when a user logs in. Also, "Automatically print My Jobs at Login" is a setting that determines whether or not each user logged in via personal authentication management will print automatically when "Use automatic printing at login" is enabled. By disabling these two items in the print function, even if there is print data held for the logged-in user when they log in, it will not be printed automatically. The above fax and print function settings are settings related to preventing unattended print jobs.

[0037] In the fax function, "Allow sending from fax driver" is an item that sets whether or not to allow fax transmission from a computer using the fax driver. In the box function, "External access settings" is an item that sets whether or not to expose the MFP's internal storage to the outside. Also, "Use memory media function" is an item related to the memory media function. The memory media function is a function that allows you to save scanned image data to memory media or print files on memory media by connecting memory media to the USB port. By setting this item to "Disabled", you can set it so that the use of memory media is not allowed. The above items are settings related to operation restrictions.

[0038] In this embodiment, the set of configuration data stored in the data storage unit 202 is a set of security configuration data related to the MFP100 application, as shown in Figures 3 and 4. However, these are just examples of a set of configuration data and are not limited to data related to applications. For example, a set of security configuration data related to the system in general, such as the network, may be stored in the data storage unit 202. Then, in the configuration flow described later using Figure 7, security settings related to the system in general, such as the network, may be performed instead of security settings related to applications.

[0039] Next, the screens displayed on the operation unit 102 in this embodiment will be explained using Figures 5 and 6. Figure 5 shows a screen 500 for selecting the usage environment of the MFP 100. In this embodiment, one environment is selected from six environments, 501 to 506, as the usage environment for the MFP 100. The usage environment options displayed on screen 500 correspond to the usage environments of the security templates stored in the data storage unit 202. The essential security templates corresponding to the environment selected by the user on screen 500 are applied to the MFP 100 all at once. In addition, for the optional security templates corresponding to the environment selected by the user on screen 500, a screen 600 is displayed to confirm whether or not to apply the recommended settings for each setting item included in the template.

[0040] Here, we will explain the options for the usage environment of the MFP100 in this embodiment. 501 is "internal infrastructure," which is an environment where the internet connection is made via a firewall within the office. 502 is "direct internet connection," which is an environment where the MFP100 is directly connected to the internet without going through a firewall. 503 is "internet prohibited," which is an environment where the MFP100 is not connected to the internet. 504 is "work from home," which is an environment where the MFP100 is connected to an external network or wireless access point function. 505 is "public space," which is an environment where an unspecified number of people use the MFP100, such as a shared office. 506 is "high confidential information management," which is an environment where the security of the MFP100 is the top priority. It goes without saying that the above environments are for the purpose of explaining this embodiment, and other environments may also exist.

[0041] Figure 6 shows the screen 600 described above. Label 601 is a label that displays a message asking whether to apply the recommended setting value for each setting item, based on the optional security template corresponding to the environment selected by the user on screen 500. For example, in Figure 6, a message is displayed asking the user whether to enable the setting value for the setting item "Certificate verification when sending WebDAV". Button 602 is the "Set" button, which is used by the user to instruct the user to apply the setting displayed on label 601. Button 603 is the "Do not set" button, which is used by the user to instruct the user not to apply the setting displayed on label 601. Screen 600 is displayed for each setting item included in the optional security template, so the wording of label 601 is changed and the number of screens is displayed equal to the number of setting items included in the template. Alternatively, a "Details" button (not shown) may be provided, and when this button is pressed, an explanation of the setting item displayed on label 601 and the purpose of changing the setting to the recommended value may be displayed.

[0042] The process of applying a security template will be explained using Figure 7. Each operation (step) shown in the flowchart of Figure 7 is realized by the CPU 111 calling a program stored in the ROM 112 or HDD 114 to implement each control unit from the RAM 113 and executing it. When the operation control unit 201 detects that the user has pressed a button to display screen 500 on a menu screen (not shown) displayed on the operation unit 102, the process shown in Figure 7 begins.

[0043] In S701, the operation control unit 201 displays screen 500 on the operation unit 102 and proceeds to S702. In S702, if the operation control unit 201 detects that the user has selected an environment on screen 500, it proceeds to S703; otherwise, it repeats S702. In S703, the security setting control unit 203 retrieves a template from the required security templates stored in the data storage unit 202 that corresponds to the environment selected by the user in S702. Proceeding to S704, the security setting control unit 203 applies the template retrieved in S703 to the MFP 100.

[0044] Next, in S705, the security setting control unit 203 retrieves a template from the optional security templates stored in the data storage unit 202 that corresponds to the environment selected by the user in S702. In S706-S710, the security setting control unit 203 executes a loop process for each setting item included in the template retrieved in S705. In S706, the security setting control unit 203 selects one unprocessed item from the setting items included in the template retrieved in S705. In S707, the operation control unit 201 displays screen 600 on the operation unit 102. At this time, label 601 shows the setting item selected in S706 and its corresponding recommended setting value. In S708, if the user selects the "Set" button on screen 600, the process proceeds to S709; if the "Do not set" button is selected, the process proceeds to S710. In S709, the security setting control unit 203 applies the setting value of the setting item shown on label 601 to the MFP100. In S710, if there are no unprocessed configuration items among the configuration items included in the template obtained in S705, the loop process is terminated.

[0045] Through the above process, users can easily configure the necessary security settings simply by selecting their operating environment. Furthermore, for security settings that are recommended and that users should decide whether or not to configure after reviewing them, users can easily configure them by selecting whether or not to configure them on a confirmation screen.

[0046] <Second Embodiment> In the first embodiment, first, using the mandatory security template shown in Figure 3, all settings included in the template corresponding to the environment selected by the user were applied to the MFP100 in one go. Subsequently, using the optional security template shown in Figure 4, screen 600 was displayed for all settings included in the template corresponding to the environment selected by the user, and the settings were configured.

[0047] In the second embodiment, a configuration is described in which the application history is referenced and a template is applied to the application being used. In this way, by not configuring applications that are not being used, the number of loops in S706 to S710 in the first embodiment can be reduced. This allows the verification content to be narrowed down, thereby reducing the burden on the user.

[0048] Furthermore, this embodiment can also be designed to include a configuration that allows the user to select the functions they wish to use and then applies a template to the app that provides those functions. This makes it possible to apply templates to apps that have not yet been used and are not recorded in the app history, but which the user plans to use in the future.

[0049] Furthermore, it is possible to design the system to include a configuration that applies a template to apps that have not been set as "apps not used" when they are launched. Using apps without proper security settings can cause user confusion and expose users to security risks. This embodiment can also reduce such possibilities.

[0050] The hardware configuration of the MFP100 is the same as that shown in Figure 1 in the first embodiment. The software configuration of the MFP100 is also the same as that shown in Figure 2 in the first embodiment, but in this embodiment, the application control unit 204 stores the history of used applications in the data storage unit 202. An example of the application history is shown in Figure 8. 801 is the date and time the application was used. 802 is the name of the application. For example, 803 indicates that the sending application was used at 10:15 on October 12, 2021. In Figure 8, for simplicity, only the date and time of use and the application used are recorded in the application history, but the user who executed it and the actions performed by the application may also be recorded. For example, for a sending application, the destination server address may be recorded, and for a fax function, the destination telephone number and error information may be recorded. Based on the application history shown in Figure 8, the security setting control unit 203 distinguishes between applications that are being used and applications that are not being used. The specific method of distinction will be described later in S1101 of Figure 11. Then, a security template is applied to the applications that are determined to be being used. The specific process will be described later using Figure 11.

[0051] The screens 500 and 600 displayed on the operation unit 102 are the same as in the first embodiment. Figure 9 shows, in addition to the first embodiment, screen 900 displayed on the operation unit 102 in this embodiment. Screen 900 is a screen for allowing the user to select the function to use. The function to use refers to a function that is not currently being used but is planned to be used in the future. The function currently being used is identified based on the application history described above, and the function to be used in the future is selected by the user on this screen 900. In this embodiment, the user can select one or more functions from functions 901 to 905. In Figure 9, the copy function 901 and the send function 902 have been selected by the user. The selection of the copy function 901 and the send function 902 is confirmed when the user presses the confirm button 911. The process of identifying the function being used based on the application history shown in Figure 8 will be described later, but the buttons for the functions being used identified by this process may be displayed on screen 900 in a pre-selected state. The security template is also applied to the application that provides the function selected and confirmed on screen 900. The specific process will be described later using Figure 11.

[0052] Figure 10 shows an example of the application management table for the MFP100. This table is used to apply a template to an application when it is launched that has not been set as an "application not used". The specific process will be described later using Figure 12. In Figure 10, 1001 is the name of the application, 1002 is whether the application is usable or not, and 1003 is the reason if the application is unusable. For example, in Figure 10(a), the Send application, Box application, Copy application, and Print application B are usable. The Fax application is unusable because the fax board necessary to operate the Fax application is not installed in the MFP100. Print application A is also unusable because the license to enable Print application A has not been installed. Figure 10(b) shows an example of how the application management table in Figure 10(a) changes when the environment is selected and configured on screen 500 while the Box application is not being used on the MFP100. The status 1002 of the Box application has changed from usable to unused, and the reason is indicated as unused. If, based on the app history shown in Figure 8, it is determined that the Box app is not being used, and the functions provided by the Box app (Box functions) are not selected on screen 900 shown in Figure 9, the app management table changes as shown in Figures 10(a) to (b). At this time, the security settings control unit 203 does not apply the security template to the app that provides the Box functions. The specific process will be described later using Figure 11. As mentioned above, it is also possible to determine which apps to apply the template to and change the app management table based solely on the determination based on the app history shown in Figure 8, without displaying screen 900.

[0053] Using Figure 11, the process of applying a security template in the second embodiment will be explained. Each operation (step) shown in the flowchart of Figure 11 is realized by the CPU 111 calling a program for realizing each control unit stored in the ROM 112 or HDD 114 from the RAM 113 and executing it. Steps S701 to S703 are the same as in the first embodiment. In Figure 11, the explanation will start from the next step after S703.

[0054] In S1101, the security settings control unit 203 identifies the application being used based on the application history shown in Figure 8. Specifically, the security settings control unit 203 checks the application name 802 in the application history stored on the HDD 114. At this time, it may identify the application being used by checking all history, or it may identify the application being used by checking the history for a specific period, such as the past year. In addition, to avoid having to check the application history every time, the last check date and the application being used at that time are recorded in the data storage unit 202. Then, when a check is needed, only the application history from the last check date onward is checked, and newly used applications are added to the applications being used.

[0055] Next, the process proceeds to S1102, where the operation control unit 201 displays screen 900 on the operation unit 102 and proceeds to S1103. In S1103, if the operation control unit 201 detects that the user has pressed the OK button 911 on screen 900, the process proceeds to S1104; otherwise, S1103 is repeated.

[0056] In S1104, the security settings control unit 203 rewrites the application management table based on the application being used identified in S1101 and the function selected by the user in S1102 to S1103. Specifically, among the applications whose status 1002 in the application management table is "Available," the status 1002 of applications that are neither being used nor providing the function being used is rewritten to "Unused." In addition, the cause 1003 of the function is set to "Unused."

[0057] In S1105, the security settings control unit 203 extracts the essential security templates related to the functions provided by the apps that are marked as "Available" in the app management table. Specifically, it extracts the setting items and setting values ​​related to the relevant functions from the essential security templates obtained in S703. Then, in S1106, the security settings control unit 203 applies the templates extracted in S1105 to the MFP100.

[0058] In S1107, the security settings control unit 203 obtains an optional security template corresponding to the environment selected in S702. Subsequently, in S1108, the security settings control unit 203 extracts optional security templates related to the functions provided by apps that are marked as "Available" in the app management table. Specifically, it extracts the setting items and setting values ​​related to the relevant functions from the optional security templates obtained in S1107. Then, in S1109 to S1111, the security settings control unit 203 executes a loop process for each setting item included in the template extracted in S1108. In S1109, the security settings control unit 203 selects one unprocessed item from the setting items included in the template extracted in S1108. S707 to S709 are the same processes as in the first embodiment. In S1110, if there are no unprocessed setting items among the setting items included in the template extracted in S1108, the loop process is terminated.

[0059] In S1111, the environment selected by the user in S702 is saved to HDD114. Through this process, the security template is applied to MFP100.

[0060] Next, using Figure 12, we will explain the process that is executed when an application is launched after the environment selection has been made in S702 as described above. In particular, this process allows a template to be applied to an application that is not to be used if it is launched. Each operation (step) shown in the flowchart of Figure 12 is realized by the CPU 111 calling a program for realizing each control unit stored in ROM 112 or HDD 114 from RAM 113 and executing it. In S702, when the operation control unit 201 detects the user's environment selection operation on the operation unit 102, the program that executes the flowchart shown in Figure 12 becomes active.

[0061] In S1201, the application control unit 204 launches the application. In S1202, the security settings control unit 203 determines whether the status of the application launched in S1201 is "unused" or "unavailable". Specifically, this determination is made using the application management table shown in Figure 10. First, the application name of the application launched in S1201 is searched for in the application name 1001 of the application management table. Then, the status 1003 of the corresponding application name is obtained and it is determined whether it is "unused" or "unavailable". If the security settings control unit 203 determines that the application is "unused" or "unavailable", it proceeds to S1204. If it determines otherwise, that is, if it determines that the application is "available", the security settings control unit 203 terminates this flow.

[0062] In S1204, the security settings control unit 203 displays an unillustrated confirmation screen on the operation unit 102 to ask whether to apply the security template to the "unused" or "unavailable" app, and receives the user's input. In S1205, if the security settings control unit 203 receives "Apply" as the user's selection result, it proceeds to S1206. If it receives "Do not apply", this flow terminates. At this time, the app may be forcibly terminated as shown in S1208. This prevents general users from using the app without applying the app security template. Note that the app may not be forcibly terminated depending on the permissions. For example, if an administrator is logged in, the app may not be forcibly terminated except in step S1208.

[0063] In S1206, the security settings control unit 203 applies a security template to the application. Specifically, first, the security settings control unit 203 retrieves the required security template and optional security template corresponding to the environment saved in S1111 from the data storage unit 202. Next, the security settings control unit 203 extracts the setting items and setting values ​​related to the functions provided by the application from each template. The security settings control unit 203 applies the extracted required security template to the MFP100. Then, for the extracted optional security template, it performs the processing shown in S1109, S707 to S709, and S1110 in Figure 11.

[0064] Finally, in S1207, the security settings control unit 203 sets the status 1002 for the app in the app management table to "Available" and leaves the cause 1003 blank.

[0065] Through the above process, users can easily configure security settings appropriate for their environment simply by selecting their environment. Furthermore, by selecting apps they plan to use in the future, users can easily configure appropriate security settings for those apps as well. In addition, if an app was not configured at that time, the appropriate security settings can be easily configured for that app when it is launched.

[0066] <Third Embodiment> In the third embodiment, the configuration items included in the optional security template are divided into several categories. Then, instead of a screen 600 for the user to confirm the application of settings for each configuration item, a configuration is described in which a screen 1400 for the user to confirm the application of settings for each category is displayed. The hardware and software configuration of the MFP100 is the same as in the first embodiment, so the description is omitted.

[0067] The essential security template shown in Figure 3 is stored in the data storage unit 202, as in the first embodiment. Regarding the optional security template shown in Figure 4, the template shown in Figure 13 is stored in the data storage unit 202 instead. Specifically, it differs from the first embodiment in that it includes "type" information.

[0068] As in the first embodiment, the screen 500 shown in Figure 5 is displayed on the operation unit 102 by the operation control unit 201 in the third embodiment as well, and accepts the user's environment selection. When setting the optional security template, the confirmation screen displayed on the operation unit 102 by the operation control unit 201 is, as mentioned above, screen 1400 shown in Figure 14 instead of screen 600 shown in Figure 6. Label 1401 is a label that displays a message asking the user whether or not to apply the template settings to the optional setting items corresponding to the "certificate verification" type. Button 1402 is the "Set" button, and button 1403 is the "Do not set" button. When button 1402 is selected by the user, the setting items corresponding to the "certificate verification" type among the optional security templates corresponding to the environment selected on screen 500 are set to the recommended settings all at once. Button 1404 is the "Details" button. When button 1404 is selected, the individual setting screens for the setting items that are set all at once on screen 1400 are displayed on the operation unit 102. In other words, the operation unit 102 displays a screen where the user can configure each setting item corresponding to the "certificate verification" type among the optional security templates that correspond to the environment selected on screen 500. This configuration makes it possible to set individual settings as desired, rather than configuring them all at once by type.

[0069] The process of applying the security template is almost the same as that shown in Figure 7 in the first embodiment. In steps S706 to S710, the first embodiment performs loop processing for each setting item, whereas in this embodiment, loop processing is performed for each type, which is the difference from the first embodiment.

[0070] Through the above process, users can easily configure security settings that are recommended and that they should decide whether or not to configure after reviewing them, by selecting whether or not to configure them on a confirmation screen. In this case, compared to the first embodiment where each setting item is reviewed individually, this embodiment allows for the review of several setting items at once, thereby reducing the burden on the user.

[0071] <Fourth Embodiment> The first to third embodiments described a configuration in which control is performed by the MFP100. In this embodiment, a configuration in which control is performed by an information processing device such as a cloud system will be described. Whether control is performed by a cloud system or by an edge device depends on the appropriate configuration for each solution, taking into account the balance between the component costs related to the computing resources of the edge device and the required response speed.

[0072] Figure 15 shows an example of a communication system in this embodiment. The MFP100 and the management cloud system 1501 are connected via LAN120, gateway 1502, and the internet 1503. The management cloud system 1501 is a server that collects information from the MFP100 and remotely monitors the status of the MFP100. The gateway 1502 is a network router that relays communication from the MFP100 to the internet 1503. The MFP100 and PC1504 are connected via LAN120.

[0073] The hardware configuration of the MFP100 is the same as that shown in Figure 1 in the first embodiment. Figure 16 shows the software configuration of the MFP100, and in addition to the parts shown in Figure 2 in the first embodiment, it includes a management system communication unit 1601. The management system communication unit 1601 exchanges information between the management cloud system 1501 and the MFP100. Specifically, when a setting change is made in the MFP100, it notifies the management cloud system 1501 of this. This process allows the management cloud system 1501 to identify what settings the MFP100 is operating under. Furthermore, when an instruction to change the settings is given in the management cloud system 1501, the management system communication unit 1601 of the MFP100 receives the notification and has the function to process the setting change. In this way, in this embodiment, by synchronizing the information of the MFP100 bidirectionally, it is possible to check and change the information of the MFP100 in the management cloud system 1501 as needed.

[0074] Next, the hardware configuration of the management cloud system 1501 will be explained using Figure 17. The control unit 1701, which includes the CPU 1711, controls the entire management cloud system 1501. The ROM 1712 is used to store programs executed by the CPU 1711. The RAM 1713 is used to temporarily store data used by the CPU 1711. The HDD 1714 stores various programs and various setting information. In this way, the hardware such as the CPU 1711, ROM 1712, RAM 1713, and HDD 1714 constitute a so-called computer. The operation unit I / F 1715 connects the operation unit 1702 and the control unit 1701. The network I / F 1716 is connected to the internet 1503.

[0075] The software configuration of the management cloud system 1501 will be explained using Figure 18. Each part shown in Figure 18 is realized by the CPU 1711 executing the program according to the present invention stored in the ROM 1712.

[0076] The web browser communication unit 1801 displays a user-facing screen in response to a request from a web browser running on PC 1504. It also detects user actions and switches screens or updates the display based on the detection results.

[0077] The data storage unit 1802 stores data in distributed resources on the cloud and reads data from those distributed resources in accordance with requests from other control units. For example, if a user wants to change some device settings, the user first sends the changes to the web browser communication unit 1801. Then, the data storage unit 1802 stores the sent content as settings in distributed resources on the cloud in accordance with a request from the web browser communication unit 1801. Furthermore, the data storage unit 1802 also stores security templates as shown in Figures 3 and 4.

[0078] The security settings control unit 1803 controls the instructions regarding security settings to be sent to the MFP 100 according to user operations on the web browser detected by the web browser communication unit 1801.

[0079] The MFP communication unit 1804 controls communication with the MFP 100. When it receives a setting value from the MFP 100, it stores it in the data storage unit 1802. Also, when a setting change instruction is given by the management cloud system 1501, it sends a setting change instruction to the MFP 100.

[0080] In the first embodiment, it was explained that screens 500 and 600 are displayed on the operation unit 102 of the MFP 100. In this embodiment, screens 500 and 600 are displayed on the PC 1504. The process of displaying the screen on the PC 1504 and applying security settings according to user instructions will be described. The flow is the same as in Figure 7, so it will be explained using Figure 7. Each process is executed by the management cloud system 1501 on behalf of the MFP 100. In the fourth embodiment, each operation (step) shown in the flowchart of Figure 7 is realized by the CPU 1711 calling a program for realizing each control unit stored in the ROM 1712 or HDD 1714 from the RAM 1713 and executing it.

[0081] When the Web browser communication unit 1801 receives a request from the Web browser running on PC 1504 to acquire screen 500, the process shown in Figure 7 begins. For example, a user presses a button to display screen 500 on a menu screen (not shown) displayed in the Web browser running on PC 1504. The Web browser, detecting this operation, sends a request to acquire screen 500 to the Web browser communication unit 1801.

[0082] In S701, the Web browser communication unit 1801 provides screen 500 to the Web browser running on PC1504. As a result, screen 500, as shown in Figure 5, is displayed in the Web browser running on PC1504.

[0083] In S702, when the user selects the MFP100 usage environment on screen 500, the web browser, having detected this operation, sends the selection result to the web browser communication unit 1801. This flow illustrates a scenario where the user selects the MFP100 environment, but this is not limited to cases where the MFP100 usage environment can be identified. For example, the environment can be identified by estimating it from the circumstances in which the MFP100 is installed. When the web browser communication unit 1801 receives the user's selection result, the process proceeds to S703. If it does not receive the result, S702 is repeated.

[0084] In S703, the security setting control unit 1803 retrieves a template from the essential security templates stored in the data storage unit 1802 that corresponds to the environment selected by the user in S702.

[0085] In S704, the MFP communication unit 1804 sends an instruction to the MFP 100 to apply the template acquired by the security setting control unit 1803 in S703 to the MFP 100. At this time, the management system communication unit 1601 of the MFP 100 receives an instruction to apply the settings from the management cloud system 1501 via the network I / F 118. The security setting control unit 203 of the MFP 100 changes the settings of the MFP 100 based on the setting data received by the management system communication unit 1601. For simplicity, this flowchart omits this step, but the MFP 100 may also determine whether the settings were applied correctly, and if not, it may retry the process or perform error handling.

[0086] In S705, the security setting control unit 1803 retrieves a security template from the optional security templates stored in the data storage unit 1802 that corresponds to the environment selected by the user in S702.

[0087] In S706, the security setting control unit 1803 executes a loop process for each setting item included in the option template acquired in S705. In S706, the security setting control unit 1803 selects one unprocessed item from the setting items acquired in S705. In S707, the web browser communication unit 1801 sends screen 600, which shows the setting item selected in S706 and its corresponding recommended setting value, to the web browser running on PC 1504. As a result, screen 600 shown in Figure 6 is displayed on the web browser.

[0088] In S708, when the user selects either the "Set" button or the "Do not set" button on screen 600, the web browser, having detected this operation, sends the selection result to the web browser communication unit 1801. If the web browser communication unit 1801 receives the result of the user selecting the "Set" button, the process proceeds to S709. If the web browser communication unit 1801 receives the result of the user selecting the "Do not set" button, the process proceeds to S710.

[0089] In S709, the MFP communication unit 1804 sends an instruction to the MFP100 to apply the recommended setting value to the setting item selected in S706. At this time, the management system communication unit 1601 of the MFP100 receives the setting application instruction from the management cloud system 1501 via the network I / F 118. The security setting control unit 203 of the MFP100 then changes the settings of the MFP100 based on the setting item and setting value received by the management system communication unit 1601. In S710, if there are no unprocessed setting items among the setting items acquired in S705, the loop process is terminated.

[0090] Through the above process, it becomes possible to perform the setting control in the first embodiment using a cloud system instead of the MFP100.

[0091] <Fifth Embodiment> In this embodiment, we will first describe a configuration in which the system security template is applied, followed by the application security template. The hardware and software configurations of the MFP100 are the same as in the first embodiment, so we will omit their description.

[0092] In this embodiment, the application security template refers to the two templates described with reference to Figures 3 and 4 in the first embodiment. The system security template (not shown) is for collectively configuring general system settings, such as network settings, according to the usage environment of the MFP100. The system security template is a group of configuration data that combines multiple configuration items and values, corresponding to the same usage environment 301 as the application security template. Examples of configuration items include authentication settings and firewall settings. Furthermore, a portion of the system security template may include configuration items related to any of the installable applications. This system security template and the two application security templates mentioned above are stored in the data storage unit 202.

[0093] The screens displayed on the operation unit 102 are the same as in the first embodiment: screen 500 shown in Figure 5 and screen 600 shown in Figure 6.

[0094] The configuration process will be explained using the flowchart shown in Figure 19 instead of Figure 7. Each operation (step) shown in the flowchart of Figure 19 is realized by the CPU 111 calling a program stored in the ROM 112 or HDD 114 to implement each control unit from the RAM 113 and executing it. Note that the flowchart shown in Figure 19 is the same as the flowchart shown in Figure 7, but with S1901 and S1902 added between S702 and S703. In S702, when the operation control unit 201 detects that the user has selected an environment on the screen 500, the process proceeds to S1901. In S1901, the security setting control unit 203 obtains a template from the system security templates stored in the data storage unit 202 that corresponds to the environment selected by the user in S702. The process proceeds to S1902, and the security setting control unit 203 applies the template obtained in S1901 to the MFP 100. Then, the process proceeds to S703. From there onward, the process is the same as in the first embodiment.

[0095] Through the above process, users can configure the MFP100 using a total of three templates: a system security template and two required and optional application security templates.

[0096] Here, it is also possible to add S1903 between S1902 and S703 in Figure 19, and display an unillustrated screen on the operation unit 102 to confirm with the user whether or not to apply the required and optional application security templates. If the user selects "Apply" on this screen and the operation control unit 201 detects this, the process proceeds to S703 and the subsequent processing is carried out as described above. On the other hand, if the user selects "Do not apply" on the same screen and the operation control unit 201 detects this, the subsequent processing is not carried out and this flow is terminated.

[0097] This configuration allows users to select an environment on the S702 and apply the system security template but not the application security template. If users take responsibility for security, this configuration allows them to use applications more conveniently by not applying the application template.

[0098] Furthermore, in this embodiment, it is also possible to configure the system to perform the processes S1101 to S1111 shown in Figure 11 after the processes S1902, S1903, and S703 have been completed. This allows the application security template to be applied only to applications whose usage history has been recorded or to applications that provide the function selected on screen 900, similar to the second embodiment. The configuration for this is the same as in the second embodiment.

[0099] In this way, by not configuring apps that are not used, the number of loops in S706 to S710 in the first embodiment can be reduced. This allows the verification items to be narrowed down, thereby reducing the burden on the user.

[0100] Furthermore, similar to the second embodiment, the processing shown in Figure 12 can also be performed. Using the app without proper security settings can cause user confusion and expose users to security risks. This embodiment can also reduce such possibilities.

[0101] In this embodiment, a step S1203 can be added between S1202 and S1204, which determines whether or not an application security template has been applied. In S1203, the security setting control unit 203 determines whether an application security template appropriate to the environment has been applied to the MFP100. Specifically, it checks whether the environment information saved in S1111 in Figure 11 is recorded in the data storage unit 202. If the environment information is recorded, it is determined that the application security template has been applied, and the process proceeds to S1204 and subsequent processing. If it is not recorded, it is determined that the application security template has not been applied, and this flow is terminated.

[0102] This eliminates the need for users to re-confirm whether or not to apply the required and optional application security templates in S1903, as shown in Figure 12, thereby reducing the burden on users.

[0103] <Other Embodiments> The present invention can also be realized by supplying a program that implements one or more of the functions of each of the embodiments described above to a system or device via a network or storage medium, and by having one or more processors in the computer of that system or device read and execute the program. It can also be realized by a circuit (e.g., an ASIC or FPGA) that implements one or more functions. [Explanation of symbols]

[0104] 100 MFP 201 Operation Control Unit 202 Data Storage Unit 203 Security Settings Control Unit

Claims

1. A reception means for accepting the selection of an image processing device usage environment from among multiple usage environments, A first setting means that, after receiving the selection, sets a plurality of values ​​corresponding to the selected usage environment based on the selection, without any instructions from the user, A control means that proposes one or more values ​​corresponding to the selected usage environment, A second setting means for setting one or more values ​​based on instructions from a user to set one or more values, An image processing device having

2. The control means displays the one or more values ​​and one or more items corresponding to those one or more values ​​in order to propose the one or more values. The image processing apparatus according to feature 1.

3. The control means is If a first usage environment is selected from the aforementioned multiple usage environments, one or more first values ​​corresponding to that first usage environment will be proposed. If a second usage environment different from the first usage environment is selected from the aforementioned multiple usage environments, then one or more second values ​​different from the one or more first values ​​corresponding to the second usage environment will be proposed. The image processing apparatus according to claim 1 or 2.

4. A reception means for accepting the selection of an image processing device usage environment from among multiple usage environments, A setting means that, after receiving the selection, sets a plurality of values ​​corresponding to the selected usage environment based on the selection, without any instructions from the user, A control means for inquiring with the user whether or not to set one or more values ​​corresponding to the selected usage environment, A second setting means for setting one or more values ​​based on instructions from a user to set one or more values, An image processing device having

5. The control means displays the value of one or more and one or more items corresponding to that value in order to ask the user whether or not to set one or more values. The image processing apparatus according to feature 4.

6. The control means is If a first usage environment is selected from the aforementioned multiple usage environments, the user is asked whether or not to set one or more first values ​​corresponding to the first usage environment. If a second usage environment different from the first usage environment is selected from among the aforementioned multiple usage environments, the user is asked whether or not to set one or more second values ​​different from the one or more first values ​​corresponding to the second usage environment. The image processing apparatus according to claim 4 or 5.

7. The image processing apparatus according to any one of claims 1 to 6, characterized in that the above value of 1 or more is not included in the plurality of values ​​set corresponding to the selected usage environment.

8. The image processing apparatus according to any one of claims 1 to 7, characterized in that the value of 1 or more is determined based on one or more history of the use of the functions of the image processing apparatus.

9. A reception process that accepts the selection of the operating environment for the image processing device from among multiple operating environments, A setting step in which, after accepting the selection, a set of multiple values ​​corresponding to the selected usage environment are set based on the selection, without any instructions from the user, A control step that proposes one or more values ​​corresponding to the selected usage environment, A second setting means for setting one or more values ​​based on instructions from a user to set one or more values, A control method having

10. A reception process that accepts the selection of the operating environment for the image processing device from among multiple operating environments, A setting step in which, after accepting the selection, a set of multiple values ​​corresponding to the selected usage environment are set based on the selection, without any instructions from the user, A control step that asks the user whether or not to set one or more values ​​corresponding to the selected usage environment, A second setting means for setting one or more values ​​based on instructions from a user to set one or more values, A control method having

11. Computers, A reception means for accepting the selection of an image processing device usage environment from among multiple usage environments, A setting means that, after receiving the selection, sets a plurality of values ​​corresponding to the selected usage environment based on the selection, without any instructions from the user, Control means that proposes one or more values ​​corresponding to the selected usage environment, A second setting means for setting one or more values ​​based on instructions from a user to set one or more values, A program designed to function as such.

12. Computers, A reception means for accepting the selection of an image processing device usage environment from among multiple usage environments, A setting means that, after receiving the selection, sets a plurality of values ​​corresponding to the selected usage environment based on the selection, without any instructions from the user, Control means for inquiring with the user whether or not to set one or more values ​​corresponding to the selected usage environment, A second setting means for setting one or more values ​​based on instructions from a user to set one or more values, A program designed to function as such.

Images