Information processing device and its control method, information processing system, program, storage medium

Abstract

To increase an effect to prevent information leakage related to scan data.SOLUTION: Scan data acquired through scanning a document is stored on a condition that censorship keywords are not included in an extracted character string. In executing a job that requires BOX output, the character string is extracted with respect to the stored scan data. When the censorship keywords are determined to be included in the extracted character string, the stored scan data is not output, and when the censorship keywords are determined not to be included in the extracted character string, the stored scan data is output (transmitted or printed).SELECTED DRAWING: Figure 6

Description

Technical Field

[0001] The present invention relates to an information processing apparatus, a control method thereof, an information processing system, a program, and a storage medium.

Background Art

[0002] In recent years, information leakage and attacks due to unauthorized operations have become problems both inside and outside companies. In such a situation, the security model has changed from a boundary model where it is safe within the protection of a firewall to a zero-trust model based on the theory of evil that distrusts everything.

[0003] An information processing apparatus, such as an image forming apparatus, has various functions, including a function of transmitting scan data, a FAX function, a function of transmitting stored documents, etc., and has a data transmission and communication function to an external storage. In the zero-trust security model, since everything needs to be doubted, it is important to always verify that the data exchanged does not lead to information leakage and that no unauthorized operations are being performed.

[0004] As a method for verifying scan data and preventing unauthorized operations from being performed, a technique has been proposed to perform character string extraction (OCR) on a scanned document and check (review) whether the extracted text matches a pre-registered character string or position (Patent Document 1). This makes it possible to verify data with a smaller memory amount compared to conventional image-based comparisons and prevent unauthorized copying of valuable securities. <>

[0005] Also, a method is known to prevent information leakage by periodically checking whether personal information is included in the image data stored inside an image forming apparatus and displaying a warning if there is a problem (Patent Document 2). According to this method, the user is notified if personal information is included in the text data obtained from the stored image data.

Prior Art Documents

Patent Documents

[0006] [Patent Document 1] Japanese Patent Application Publication No. 8-194412 [Patent Document 2] Japanese Patent Publication No. 2007-48053 [Overview of the Initiative] [Problems that the invention aims to solve]

[0007] However, in the device described in Patent Document 1, censorship is performed only when outputting, such as printing or copying, and not when saving scanned data. Furthermore, in the device described in Patent Document 2, censorship is performed at predetermined timings, but not necessarily when outputting the saved data, such as by sending it. Scanned data can be tampered with by malicious users between the time it is saved and the time it is output. Moreover, the strings subject to censorship may be updated between the time it is saved and the time it is output. Therefore, there was room for improvement in enhancing the effectiveness of preventing information leakage regarding scanned data. [Means for solving the problem]

[0008] To achieve the above objective, the present invention provides an extraction means for extracting a string from scan data obtained by scanning a document, and the string extracted from the acquired scan data by the extraction means prescribed A storage means for storing the acquired scan data in a storage unit, provided that it does not contain any strings, A setting means for setting a string to be added to the predetermined string, Execute a job to output the scan data stored in the aforementioned storage unit. In some cases , the string extracted by the extraction means to the stored scan data Includes the string set above The aforementioned prescribed A determination means that performs a determination process to determine whether or not a string is included, before The determination means determines the extracted string Includes the string set above The aforementioned prescribedIf it is determined that the string is present, the stored scan data will not be output, and the determination means will determine the extracted string. Includes the string set above The aforementioned prescribed The system is characterized by having a control means that controls the output of the saved scan data if it is determined that the string is not included. [Effects of the Invention]

[0009] According to the present invention, the effectiveness of preventing information leakage related to scanned data can be enhanced. [Brief explanation of the drawing]

[0010] [Figure 1] This is a block diagram showing the overall structure of the information processing system. [Figure 2] This diagram shows an overview of the censorship process. [Figure 3] This is a functional block diagram of the main controller. [Figure 4] This flowchart shows the scanning process and data censorship process. [Figure 5] This figure shows an example of an error screen. [Figure 6] This is a flowchart showing the BOX output process. [Figure 7] This is a flowchart showing the dictionary registration process. [Figure 8] This is a diagram showing the censorship keyword input screen. [Figure 9] This is a flowchart showing the data censorship process. [Figure 10] This diagram shows the correspondence between the destination of scanned data and whether or not censorship processing is required. [Figure 11] This is a block diagram showing the software configuration of the server device. [Figure 12] This flowchart shows data censorship processing and server-side censorship processing. [Figure 13] This is a flowchart showing the data censorship process. [Figure 14]This is a diagram showing an example of a transmission file setting screen. [Figure 15] This is a flowchart showing the scanning process.

Embodiments for Carrying Out the Invention

[0011] Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[0012] (First Embodiment) FIG. 1 is a block diagram showing the overall configuration of an information processing system including an information processing apparatus according to a first embodiment of the present invention. As this information processing apparatus, an image forming apparatus 100 is exemplified, but it is not limited to an image forming apparatus. The image forming apparatus 100 is, for example, an MFP (Multifunction Peripheral). In FIG. 1, a block diagram showing hardware with respect to the image forming apparatus 100 is shown.

[0013] The information processing system is configured such that the image forming apparatus 100 is communicably connected to the server apparatus 180 and the PC 190 via the LAN 160. The image forming apparatus 100 has a main controller 110, an operation unit 130, a printer unit 140, and a scanner unit 150.

[0014] In the main controller 110, the CPU 111 reads out and executes a program for the main controller 110 stored in the ROM 112 or the flash memory 114 into the RAM 113. The ROM 112 is a read-only memory and stores the boot program, BIOS, fixed parameters, etc. of the main controller 110. The RAM 113 is a random access memory and is used for storing programs and temporary data when the CPU 111 controls the main controller 110. The flash memory 114 stores a loader, a kernel, and an application. In addition to the execution program, license information for enabling the functions of the image forming apparatus 100, a signature, and a public key used for detecting program tampering are stored in the flash memory 114.

[0015] HDD115 is a hard disk drive that stores some applications, various data, and print data received from PC190 via network I / F120. The program read from flash memory 114 and executed by CPU 111 includes a print application program. This print application program converts the print data stored in HDD115 into image data that can be printed by the printer unit 140, and this image data is also stored in HDD115.

[0016] Furthermore, the firmware read from the flash memory 114 and executed by the CPU 111 includes a scanning application program. This scanning application program allows the scanner unit 150 to read image data, and the read image data is transferred to the HDD 115. The read image data is then stored in the HDD 115.

[0017] The control panel interface 116 is an interface for transmitting instructions input by the user of the image forming apparatus 100 via the control panel unit 130 to the CPU 111. The control panel interface 116 also receives processing information from the CPU 111 for switching the content displayed on the control panel unit 130 and transmits it to the control panel unit 130. The control panel unit 130 is equipped with a liquid crystal display with touch panel functionality and a keyboard, and displays the status and operation menu of the image forming apparatus 100 and accepts instructions from the user.

[0018] The printer interface 117 is an interface for connecting the main controller 110 and the printer unit 140. Here, the printer unit 140 prints onto the recording medium based on image data transferred from the HDD 115 via the printer interface 117.

[0019] The scanner I / F 118 is an interface for connecting the main controller 110 and the scanner unit 150. Here, the scanner unit 150 (scanner section) reads the image on the document as image data using a line sensor composed of a CCD (ChargeCoupled Device) or the like. The scanner unit 150 transfers the read image data to the HDD 115 via the scanner I / F 118. The stored image data can be printed by the printer unit 140. By printing the image data read by the scanner unit 150 with the printer unit 140, copying becomes possible.

[0020] The USB-HostI / F119 is an interface for connecting the main controller 110 to an external USB device 170. An example of an external USB device 170 is a fax unit. In the case of a fax unit, the external USB device 170 transmits faxes based on image data transferred from the HDD 115 via the USB-HostI / F119. The external USB device 170 also generates image data based on received data and transfers it to the HDD 115 via the USB-HostI / F119. The image data stored in the HDD 115 is then printed onto a recording medium by the printer unit 140, as described above. Other examples of external USB devices 170 include USB memory sticks and USB keyboards. Update files necessary for firmware updates can also be transferred from a USB memory stick.

[0021] The network interface 120 connects the main controller 110 to the LAN 160 and communicates with the PC 190 on the LAN. The PC 190 is connected to the image forming apparatus 100 via the LAN 160 and can send print data to the image forming apparatus 100, operate the device via a web browser, and transfer firmware files. Furthermore, the image forming apparatus 100 is connected to the server device 180 via the LAN 160 and can be configured as the destination for sending scan data and various logs. The transmission method here is not limited to SMTP (Simple Mail Transfer Protocol) or FTP (File Transfer Protocol).

[0022] Furthermore, the image forming apparatus 100 can use the server device 180 as a storage location for necessary settings and data. However, depending on the installation environment of the image forming apparatus 100, it may not be necessary to connect to the server device 180. Alternatively, a cloud service or similar may be used instead of the server device 180.

[0023] Next, we will describe the data censorship function performed by the CPU 111 of the main controller 110 to carry out the censorship process of scanned data.

[0024] Figure 2 shows an overview of the censorship process implemented by the software that provides the data censorship function. The software program that implements the data censorship function is stored in ROM 112, flash memory 114, or HDD 115.

[0025] When a job requiring scanning, such as copying, scanning and sending, faxing, or saving to a box, is submitted to the image forming apparatus 100, it performs a censorship process to check the content of the scanned data. Here, a box saving job is a job that scans a document and saves the scanned data to the box 200 (storage unit) of the image forming apparatus 100. The box 200 here is implemented, for example, by an HDD 115. Note that the box 200 is not necessarily built inside the image forming apparatus 100, and may be built in a location accessible via communication.

[0026] Subsequent processing is only executed if the censorship process determines that the scanned data does not contain any censorship keywords (strings to be censored) that have been pre-registered by the administrator or user. For example, in the case of a copy job, the scanned data is printed. In the case of a scan transmission job, the scanned data is sent via email or FTP, and in the case of a fax transmission job, the fax transmission process is performed on the scanned data. In the case of a BOX save job, an ID is assigned to the scanned data and it is saved to BOX200.

[0027] Hereafter, when referring to scanned data (documents) saved in BOX200, specifically distinguishing it from scanned data before saving, it may be referred to as "saved scanned data." Furthermore, the process of reading saved scanned data from BOX200 and using it for output (transmission / printing) will be referred to as "BOX output."

[0028] In BOX output, saved scan data is read from BOX 200 according to user instructions, and printing or transmission is performed. Scan data may change between the time it is saved in BOX 200 and the time it is read and used for output (transmission / printing). For example, saved scan data may be tampered with through unauthorized operations. Therefore, the image forming apparatus 100 performs a re-censorship process before transmission / printing when outputting to BOX. In addition, the censorship keywords may differ between when the scan data was saved and when it is output to BOX. In this respect as well, there is an advantage to performing a re-censorship process when outputting to BOX.

[0029] Figure 3 is a functional block diagram of the main controller 110. Using Figure 3, the configuration of the software executed by the CPU 111 of the main controller 110 will be explained. The program shown in Figure 3 is stored in the flash memory 114 (Figure 1). Each functional unit shown in Figure 3 is primarily realized through the cooperation of the CPU 111, flash memory 114, and RAM 113.

[0030] The startup control unit 311 is a program that controls the startup process of the image forming apparatus 100, starting the OS (operating system) of the main controller 110 and setting up the basic system for running various programs. The operation unit control unit 312 is a program for controlling the operation unit 130 via the operation unit I / F 116. The printer control unit 313 is a program for controlling the printer unit 140 via the printer I / F 117. The scanner control unit 314 is a program for controlling the scanner unit 150 via the scanner I / F 118.

[0031] The image processing unit 315 performs image processing on the scanned data received via the scanner control unit 314, and also extracts character information from the scanned data. The character information is extracted from the scanned data by OCR (Optical Character Recognition), but it may be extracted by other methods. The character information extraction performed by the image processing unit 315 may be performed not only for censorship processing, but also to create data with character information attached to the scanned data.

[0032] The USB control unit 316 is a program for controlling the external USB device 170 via the USB-Host I / F 119. The communication control unit 317 communicates with the server device 180 and PC 190 via the network I / F 120. This communication takes place via LAN 160, and includes the transmission of scan data and the transfer of configuration data necessary for data censorship. The transferred files are saved to the HDD 115.

[0033] The censorship setting management unit 318 manages the setting value (ON / OFF of censorship mode) of whether or not censorship should be performed during scanning. The censorship setting management unit 318 also receives the settings necessary for censorship from the user and saves them to the HDD 115. The setting screen for receiving the settings necessary for censorship may be displayed on the operation unit 130 via the operation unit control unit 312, or it may be provided by a web server function so that the user can operate it using a web browser installed on the PC 190. The censorship setting management unit 318 saves the settings received in this way to the HDD 115 and provides the settings to the data censorship processing unit 319 when it performs censorship.

[0034] When a scan is performed by the scanner control unit 314, the data censorship processing unit 319 reads the character information extracted from the scan data by the image processing unit 315. The data censorship processing unit 319 then checks (censors) whether the read character information contains censorship keywords managed by the censorship setting management unit 318.

[0035] The error notification control unit 320, when it determines through data censorship processing (described later in Figure 4(b)) that the content of the scanned data contains censorship keywords that are prohibited from transmission, performs a notification process, such as issuing an error notification. This error notification is sent, for example, to the operation unit 130 or to external devices connected to the LAN 160.

[0036] The user data management unit 321 manages data for each individual user. The data managed here includes address lists used for faxing, scanned data stored in BOX 200, and various setting values. The authentication control unit 322 manages the authentication information of each user and accepts authentication operations when using the image forming apparatus 100. Based on the authentication information performed by the authentication control unit 322, it becomes possible to read data linked to permissions from the user data management unit 321.

[0037] Next, we will explain the scanning of the original document and the censorship of the scanned data using Figures 4 and 5.

[0038] Figure 4(a) is a flowchart of the scanning process. This process is achieved by the CPU 111 loading the program stored in the flash memory 114 into the RAM 113 and executing it. This process starts when a job requiring scanning is submitted. Examples of jobs requiring scanning include copy jobs, scan and send jobs, fax transmission jobs, and BOX save jobs.

[0039] In step S401, the scanner control unit 314 scans one document using the scanner unit 150, and the image processing unit 315 digitizes the reading result. In step S402, the scanner control unit 314 determines whether there are any unscanned documents. If there are no unscanned documents, it terminates the process shown in Figure 4(a). On the other hand, if there are unscanned documents, the scanner control unit 314 determines in step S403 whether the stop flag is set to ON. The stop flag is set to ON in step S421 of Figure 4(b), which will be described later. If the stop flag is not set to ON (set to OFF), the scanner control unit 314 returns to step S401 and proceeds to scan the next document. If the stop flag is set to ON, it terminates the process shown in Figure 4(a).

[0040] Figure 4(b) is a flowchart of the data censorship process. This process is implemented by the CPU 111 loading a program stored in the flash memory 114 into the RAM 113 and executing it. This process starts after the start of the scanning process (Figure 4(a)) and is executed asynchronously with that process. For example, the data censorship process may start when the first scanned data is generated during the scanning process, or it may start after all documents have been scanned.

[0041] In step S411, the censorship setting management unit 318 determines whether the censorship mode to be managed is set to ON. If the censorship mode is set to ON, the censorship setting management unit 318 proceeds to step S412. If the censorship mode is set to OFF, the censorship process is not performed, and the unit proceeds to step S416.

[0042] In steps S412 to S414, the CPU 111, acting as a determination means, performs determination processing on the scan data acquired in step S401. First, in step S412, the image processing unit 315, acting as an extraction means, performs OCR on the scan data acquired in step S401 to extract strings (text data) from the scan data. In step S413, the data censorship processing unit 319 performs data censorship. That is, the data censorship processing unit 319 compares the extracted strings with the censorship dictionary to check whether the extracted strings contain censorship keywords. Here, at least one censorship keyword is registered in the censorship dictionary through dictionary registration (described later in Figure 7). The censorship dictionary is managed by the censorship setting management unit 318.

[0043] In step S414, the data censorship processing unit 319 determines whether or not there are any strings in the extracted strings that match the censorship keyword (i.e., the extracted strings do not contain the censorship keyword) as a result of the data censorship in step S413. If, as a result of this determination, there are no strings in the extracted strings that match the censorship keyword, the data censorship processing unit 319 proceeds to step S415.

[0044] In step S415, the data censorship processing unit 319 determines whether there are any strings that have not yet been compared with the censorship dictionary, i.e., whether there is any uncensored data. If there is uncensored data, the data censorship processing unit 319 returns to step S412. If there is no uncensored data, the unit proceeds to step S416, as data censorship has been completed for all data.

[0045] In step S416, the data censorship processing unit 319 determines whether the job submitted (the one that triggered the start of processing in Figure 4(a)) is a BOX save job. If the job submitted is a BOX save job, the data censorship processing unit 319 proceeds to step S417. In step S417, the user data management unit 321, acting as a storage means, assigns an ID to the censored scan data and saves it to BOX 200. The data saved in BOX 200 becomes saved scan data from this point onward. Note that the scan data saved in step S417 may be saved together with the text data extracted in step S412, and the manner of saving is not limited.

[0046] If the submitted job is not a BOX save job, the data censorship processing unit 319 proceeds to step S418 to determine whether the submitted job is a transmission job (scan transmission job or fax transmission job). If the submitted job is a transmission job, the data censorship processing unit 319 proceeds to step S419. In step S419, the communication control unit 317 sends the scanned data to the destination specified by the user in the transmission format specified (email transmission, FTP transmission, or fax transmission).

[0047] Here, the scanned data may be sent together with the text data extracted in step S412. In this case, for example, the scanned data may be sent in the form of a text-attached file such as SearchablePDF, or the text data may be sent as the email title or body.

[0048] If the job submitted this time is not a transmission job, then the printer control unit 313 proceeds to step S420 and prints the scanned data using the printer unit 140, since the job submitted this time is a copy job.

[0049] Based on the results of the determination in step S414, if the extracted string contains a string that matches the censorship keyword, the censored data in this case requires a high level of information leakage prevention, and the process proceeds to step S421. Therefore, the censored data is not printed, transmitted, or saved. In step S421, the data censorship processing unit 319 turns on the stop flag managed by the scanner control unit 314. This is because, since the scanned data requires a high level of information leakage prevention, it is appropriate to stop any ongoing scan processes.

[0050] In step S422, the error notification control unit 320 performs notification processing. In this notification processing, as shown in Figure 5(a), the error notification control unit 320 uses the operation unit control unit 312 to display the error screen 500 on the operation unit 130.

[0051] Figure 5(a) shows an example of error screen 500. Error screen 500 displays an error message, informing the user that the censored data could not be output due to the high level of information leakage prevention requirements. In addition to displaying a message, the notification process may also include displaying a mark or providing audio notification.

[0052] In addition, the notification process may include notifying the user of the error details 510 via email, as shown in another example in Figure 5(b). In this case, the error notification control unit 320 confirms with the authentication control unit 322 who the current user is and obtains the user's email address from the user data management unit 321. The user is notified that the scanned data is unprintable by sending an email through the communication control unit 317. After steps S417, S419, S420, and S422, the process shown in Figure 4(b) is terminated.

[0053] Furthermore, notification via screen display and notification via email may be used in combination. That is, the operation unit 130 may display an error screen 500 until the user logs off, and after logging off, if it is determined that the user is no longer in front of the image forming apparatus 100, the system may notify the user via email. Even in this case, scan data will not be transmitted.

[0054] Note that other job options besides copy jobs, scan / send jobs, fax / send jobs, and box save jobs may also be available. If other jobs are submitted, the corresponding processing will be executed.

[0055] Next, the BOX output process, which reads and outputs saved scanned data from BOX 200, will be described. Figure 6 is a flowchart of the BOX output process. This process is realized by the CPU 111 loading the program stored in flash memory 114 into RAM 113 and executing it. This process starts when a job requiring BOX output (BOX transmission job or BOX printing job) is submitted. In this process, the data censorship processing unit 319 or the CPU 111 perform the function of control means in the present invention.

[0056] In step S601, the user data management unit 321 reads the saved scan data corresponding to the submitted job from BOX 200. In step S602, the censorship setting management unit 318 performs the same processing as in step S411. Then, if the censorship mode is set to ON, the censorship setting management unit 318 proceeds to step S603, and if the censorship mode is set to OFF, it proceeds to step S606.

[0057] In steps S603 to S605, the CPU 111, acting as a determination means, performs a determination process on the read and saved scanned data. This is because scanned data may be tampered with or censorship keywords may be updated between the time it is saved and output, so it is appropriate to perform data censorship again when outputting to BOX.

[0058] First, in step S603, the image processing unit 315 extracts strings (text) from the scanned data by performing OCR on the saved scanned data read in step S601. If text information is attached to the saved scanned data, the process in step S603 may be skipped and the process proceeds to step S604. In that case, the attached text information is treated as equivalent to the extracted strings (text). In steps S604 and S605, the data censorship processing unit 319 performs the same process as in steps S413 and S414 in Figure 4(b). If, as a result of the determination in step S605, the data censorship processing unit 319 finds that there are no strings in the extracted strings that match the censorship keyword, the process proceeds to step S606.

[0059] In step S606, the data censorship processing unit 319 determines whether the submitted job is a BOX transmission job. If the submitted job is a BOX transmission job, the data censorship processing unit 319 proceeds to step S607. In step S607, the communication control unit 317 sends the scanned data, which was censored in step S604, to the destination specified by the user, using the transmission method specified (email, FTP, or fax).

[0060] If the submitted job is not a transmission job, the data censorship processing unit 319 determines that the submitted job is a box print job, and the printer control unit 313 proceeds to step S608. In step S608, the data censorship processing unit 319 uses the printer unit 140 to print the scanned data that was censored in step S604.

[0061] Based on the results of the determination in step S605, if the extracted string contains a string that matches the censorship keyword, the censored data in this case requires a high level of information leakage prevention, and the process proceeds to step S609. Therefore, the censored data is not printed or transmitted. In steps S609 and S610, the data censorship processing unit 319 performs the same processing as in steps S421 and S422 in Figure 4. After steps S607, S608, and S610, the process shown in Figure 6 is completed.

[0062] Figure 7 is a flowchart of the dictionary registration process. This process is performed by the CPU 111 loading the program stored in the flash memory 114 into the RAM 113 and executing it. This process starts when a command to execute dictionary registration is input from the user via the operation unit 130.

[0063] First, when the instruction to register a dictionary is entered, the settings screen is displayed. The settings screen is displayed on the operation unit 130, or it is displayed on the web browser of the PC 190 via the web server function.

[0064] In step S701, the censorship setting management unit 318 waits for the user to access the settings screen. Once the user accesses the settings screen, in step S702, the censorship setting management unit 318 displays the censorship keyword input screen 800 shown in Figure 8 on the operation unit 130. The censorship keyword input screen 800 shown in Figure 8 displays a keyword list display unit 801, a keyword input reception unit 802, an OK button 803, and a Cancel button 804. In addition, settings for actions to be taken when the scan data censorship result is unsuccessful, and censored strings, may also be configured on a user or group basis.

[0065] In step S703, the censorship setting management unit 318 accepts censorship keywords from the user on the censorship keyword input screen 800. In step 704, the censorship setting management unit 318 saves the entered censorship keywords to the HDD 115 and terminates the process shown in Figure 7. When registered censorship keywords exist, the process shown in Figure 7 is executed, and the registered censorship keywords can be updated. The censorship in the judgment process described above is performed using the latest censorship keywords.

[0066] According to this embodiment, first, when attempting to save or output scan data acquired by scanning a document, a judgment process is performed on the acquired scan data (S412~S414). The acquired scan data is saved to the HDD115 (storage unit) on the condition that the string extracted from the acquired scan data does not contain a censorship keyword (a string subject to censorship) (S414~S417). When executing a job that requires BOX output, a judgment process is performed on the saved scan data (S603~S605). That is, a string is extracted from the saved scan data, and it is determined whether or not the extracted string contains a censorship keyword. If it is determined that the extracted string contains a censorship keyword, the saved scan data is not output (S605→S609). If it is determined that the extracted string does not contain a censorship keyword, the saved scan data is output (sent or printed) (S605→S606→S607, S608).

[0067] This means that scanned data is censored not only when it is saved but also when it is output, thus addressing data tampering and updates to censorship keywords after saving. Therefore, the effectiveness of preventing information leaks related to scanned data is enhanced. In particular, although censorship keywords can be updated, censorship at the time of output is performed based on the latest censorship keywords. Consequently, censorship is performed under conditions appropriate to the situation at the time of output, resulting in a high level of information leak prevention.

[0068] Furthermore, if any extracted strings match censorship keywords, the stop flag is turned ON, and if there are any unscanned documents, their scanning is canceled (S421, S403). This prevents the generation of scan data that could potentially lead to information leakage.

[0069] Furthermore, if any of the extracted strings match a censorship keyword, an error will be reported (S422), allowing the user to be informed that the scanned data cannot be output from the perspective of preventing information leakage.

[0070] Furthermore, the necessity of censorship can be set by turning censorship mode ON or OFF, and the judgment process is executed only if censorship mode is set to be necessary. This allows for smooth processing of data storage and output that does not pose a risk of information leakage.

[0071] (Second Embodiment) In the first embodiment, censorship was uniformly performed when a job requiring scanning was submitted. However, if censorship is mandatory, the processing load increases, and the waiting time until processing is completed increases. Therefore, in the second embodiment of the present invention, the image forming apparatus 100 performs judgment processing on the scanned data only for jobs that require censorship. In this embodiment, the data censorship process differs from that of the first embodiment, but the other configurations are the same.

[0072] Figure 9 is a flowchart of the data censorship process. The entity executing this process and the execution / start conditions are the same as those shown in Figure 4(b). The data censorship process shown in Figure 9 differs from the process shown in Figure 4(b) in that step S901 is added, but the other steps are the same and are as explained in Figure 4(b).

[0073] Based on the determination in step S411, the censorship setting management unit 318 proceeds to step S901 if the censorship mode is set to ON, and to step S416 if the censorship mode is set to OFF.

[0074] Figure 10(a) shows the correspondence between the destination of scanned data and whether or not censorship processing is required. This correspondence information is stored, for example, in flash memory 114 and can be updated by the user at any time.

[0075] In step S901, the censorship setting management unit 318 refers to the information shown in Figure 10(a) to determine whether the submitted job requires censorship processing. For example, based on the information of the destination of the scanned data specified in the submitted job, the censorship setting management unit 318 determines whether censorship processing is necessary.

[0076] Specifically, the censorship setting management unit 318 compares the destination information of the scanned data with table 1000. The censorship setting management unit 318 then determines whether the destination is associated with "censor" as an instruction to execute censorship processing, or with "do not censor" as an instruction not to execute censorship processing. If "censor" is associated with the destination of the scanned data, the scanned data is determined to require censorship. If "do not censor" is associated with the destination of the scanned data, the scanned data is determined to not require censorship.

[0077] For example, as shown in the example in Figure 10(a), if the recipient is an internal storage server, it is determined that no censorship is necessary because there is no risk of information leakage to the outside. If the recipient is a cloud service or an email address, it is determined that censorship is necessary because there is a risk of information leakage to the outside. If multiple recipients are selected, censorship is determined to be necessary if even one of the recipients requires censorship.

[0078] If the censorship setting management unit 318 determines, based on the results of the determination in step S901, that the submitted job does not require censorship, it proceeds to step S416. If the censorship setting management unit 318 determines that the submitted job does require censorship, it proceeds to step S412. Therefore, the determination process for the acquired scan data is executed only when censorship is required.

[0079] According to this embodiment, the same effects as in the first embodiment can be achieved in terms of enhancing the effect of preventing information leakage regarding scanned data. Furthermore, since censorship is performed only for jobs that require censorship, the processing load of the image forming apparatus 100 can be reduced.

[0080] Note that in Figure 10(a), as an example, the destinations after scanning are divided into an internal storage server, the cloud, and a mail server, and the system switches between censoring and not censoring them. However, this is not limited to this. For example, as shown in Figure 10(b), the system may be configured to register whether or not to censor email addresses and telephone numbers. For example, the email addresses 1002 and telephone numbers 1004 of company executives, where the exchange of documents containing confidential information is expected to occur frequently, are pre-registered as email addresses and telephone numbers that do not require censorship. Domains 1003 that contain the string "@mail" in their email addresses are registered as domains that require censorship. If the recipient's email address is not registered as email address 1002, the system is controlled to censor it.

[0081] Conventionally, for example, in Japanese Patent Publication No. 2005-184743, censorship was always performed on acquired scanned data. Therefore, even when sending to a destination where censorship was not necessary, the censorship process was performed, resulting in a time-consuming censorship process. In contrast, as shown in Figures 10(a) and (b), by switching whether or not to perform censorship depending on the destination after scanning, it is possible to reduce the time required for censorship.

[0082] Furthermore, the necessity of censorship may be determined not only by the recipient, but also by the type of communication channel, the authority of the sending user, the authority of the receiving user, etc.

[0083] (Third embodiment) In the first and second embodiments, the image forming apparatus 100 consistently performed the judgment process, including censorship. However, the resources of the CPU 111 and HDD 115 are limited, and performing high-load processing may cause processing delays. Therefore, in the third embodiment of the present invention, the image forming apparatus 100 performs censorship processing in cooperation with a server device or cloud service.

[0084] Figure 11 is a block diagram showing the software configuration of the server device 180. Note that a cloud server with a similar configuration may be used instead of the server device 180. The server device 180 includes a data viewing service 1100. Each functional unit included in the data viewing service 1100 shown in Figure 11 is primarily realized through the cooperation of the CPU, ROM, and RAM (none of which are shown) of the server device 180.

[0085] In the data viewing service 1100, the authentication control unit 1101 manages the authentication information of each user and provides functions according to the user's authority. The data censorship processing unit 1102 performs data censorship processing based on the strings written in the scanned data transmitted from the image forming apparatus 100. The censorship setting management unit 1103 holds a censorship dictionary that includes censorship keywords (strings to be censored) necessary for data censorship processing. The user data management unit 1104 manages the user's images, documents, etc. The error notification control unit 1105 has the function of notifying the user of an error if a censorship keyword is present in the scanned data. The communication control unit 1106 is responsible for communication with the image forming apparatus 100.

[0086] Figure 12(a) is a flowchart of the data censorship process. The entity executing this process and the execution / start conditions are the same as those shown in Figure 4(b). In this embodiment, the data censorship process shown in Figure 12(a) is adopted instead of Figure 4(b) compared to the first embodiment.

[0087] In steps S1201 and S1202, the same processes as in steps S411 and S901 in Figure 9 are executed. Based on the determination in step S1202, if the censorship setting management unit 318 determines that the submitted job does not require censorship processing, it proceeds to step S1207; if it determines that the submitted job does require censorship processing, it proceeds to step S1203.

[0088] In steps S1203 to S1206, the CPU 111 performs a determination process on the scan data acquired in step S401 in Figure 4(a). First, in step S1203, the image processing unit 315 performs the same process as in step S412.

[0089] In step S1204, the image processing unit 315 determines whether there is any unscanned data (i.e., OCR has been performed on all scanned data). If there is unscanned data, the image processing unit 315 returns to step S1203; if there is no unscanned data, it proceeds to step S1205.

[0090] In step S1205, the data censorship processing unit 319 transmits the text data extracted in step S1203 to the external device, the server device 180, using the communication control unit 317. That is, the data censorship processing unit 319 transmits the string extracted from the scan data to the server device 180, requesting that the extracted string be censored to determine whether or not it contains censorship keywords. Here, the censorship dictionary containing the censorship keywords is transmitted from the image forming apparatus 100 to the server device 180 as needed. For example, each time the dictionary registration process (Figure 7) is executed, the censorship dictionary managed by the server device 180 is updated.

[0091] In response to the above request, the server device 180 performs censorship and returns the censorship result (Figure 12(b) described later). In step S1206, the data censorship processing unit 319 receives the censorship result from the server device 180 using the communication control unit 317. Furthermore, the data censorship processing unit 319 determines, based on the censorship result, whether or not there is a string in the extracted string that matches the censorship keyword (i.e., the extracted string does not contain the censorship keyword). If, as a result of this determination, the data censorship processing unit 319 does not find a string in the extracted string that matches the censorship keyword, it proceeds to step S1207. In steps S1207 to S1211, the same processing as in steps S416 to S420 in Figure 4(b) is performed.

[0092] On the other hand, if the data censorship processing unit 319 determines, based on the results of the determination in step S1206, that there is a string in the extracted string that matches the censorship keyword, then the censored data in this case requires a high level of information leakage prevention, and proceeds to step S1212. In step S1212, the data censorship processing unit 319 performs the same processing as in step S422 in Figure 4(b). Therefore, the censored data is not printed, transmitted, or saved.

[0093] Figure 12(b) is a flowchart showing the server-side censorship process executed by the server device 180. This process is realized when the CPU of the server device 180 loads a program stored in the ROM of the server device 180 into the RAM of the server device 180 and executes it. This process starts when the image forming apparatus 100 receives the censorship request transmitted in step S1205 of Figure 12(a).

[0094] In step S1221, the communication control unit 1106 receives the text data to be censored transmitted from the image forming apparatus 100. In step S1112, the data censorship processing unit 1102 performs data censorship on the received text data. Specifically, the data censorship processing unit 1102 compares the string of text data with a censorship dictionary and checks whether the extracted string contains a censorship keyword.

[0095] In step S1223, the data censorship processing unit 1102 determines whether or not there are any strings in the extracted strings that match the censorship keyword (i.e., the extracted strings do not contain the censorship keyword) as a result of the data censorship in step S1222. If, as a result of this determination, the data censorship processing unit 1102 determines that there are no strings in the extracted strings that match the censorship keyword, it proceeds to step S1224.

[0096] In step S1224, the data censorship processing unit 1102 notifies the image forming apparatus 100 of the censorship result indicating that output is possible. That is, the data censorship processing unit 1102 transmits a censorship result to the image forming apparatus 100 using the communication control unit 1106, indicating that no string matching the censorship keyword exists in the extracted string.

[0097] Based on the results of the determination in step S1223, if the extracted string contains a string that matches the censorship keyword, the data censorship processing unit 1102 proceeds to step S1225. In step S1225, the data censorship processing unit 1102 notifies the image forming apparatus 100 of the censorship result indicating that output is not possible. That is, the data censorship processing unit 1102 transmits the censorship result indicating that the extracted string contains a string that matches the censorship keyword to the image forming apparatus 100 using the communication control unit 1106. After steps S1224 and S1225, the process shown in Figure 12(b) is completed.

[0098] According to this embodiment, the same effects as the first embodiment can be achieved in terms of enhancing the effect of preventing information leakage regarding scanned data.

[0099] Furthermore, in the judgment process when attempting to save or output the acquired scan data, the image forming apparatus 100 sends the string extracted from the scan data to the server device 180 to request censorship (S1205). The image forming apparatus 100 then determines, based on the censorship results received from the server device 180, whether or not the extracted string contains a censorship keyword (string to be censored) (S1206). Therefore, by performing the judgment process in cooperation with the server device 180, the processing resources consumed can be reduced, and processing delays can be suppressed.

[0100] (Fourth embodiment) In each of the above embodiments, if the extracted string contains a string that matches a censorship keyword, a notification process is performed to alert the user of the error, and the scanned data is not printed, sent, or saved. In particular, in the case of transmission jobs (scan transmission jobs, fax transmission jobs), transmission itself becomes impossible. Therefore, in the fourth embodiment of the present invention, even if the scanned data contains a string that matches a censorship keyword, transmission is made possible under certain conditions.

[0101] Figure 13 is a flowchart of the data censorship process. The entity executing this process and the execution / start conditions are the same as those shown in Figure 4(b). In this embodiment, the data censorship process shown in Figure 13 is added as a data censorship process compared to the first embodiment. This process is executed in response to the start of the scan process based on the transmission job (Figure 4(a)).

[0102] The processes shown in Figure 4(b) and Figure 13 are used in combination. In other words, for copy jobs or BOX save jobs, the process shown in Figure 4(b) is executed, and for scan transmission jobs or fax transmission jobs, the process shown in Figure 13 is executed. Note that step S419 in Figure 4(b) is abolished.

[0103] In step S1301, the same process as in step S411 in Figure 4 is executed. Based on the results of the determination in step S1301, the censorship setting management unit 318 proceeds to step S1302 if the censorship mode is set to ON, and to step S1307 if the censorship mode is set to OFF.

[0104] In step S1302, the same process as in step S901 in Figure 9 is performed. Based on the determination in step S1302, if the censorship setting management unit 318 determines that the submitted job does not require censorship, it proceeds to step S1307; if it determines that the submitted job does require censorship, it proceeds to step S1303. In step S1307, the same process as in step S419 is performed.

[0105] In steps S1303 to S1306, the CPU 111 performs a judgment process on the scan data acquired in step S401. First, in steps S1303, S1304, and S1305, the same process as in steps S412, S413, and S415 in Figure 4(b) is performed. Based on the judgment result in step S1305, the data censorship processing unit 319 returns to step S1303 if there is uncensored data, or proceeds to step S1306 if there is no uncensored data, as data censorship has been completed for all data.

[0106] In step S1306, the data censorship processing unit 319 determines whether or not the extracted string contains any strings that match the censorship keyword (i.e., the extracted string does not contain the censorship keyword) as a result of the data censorship in step S1304. If, as a result of this determination, the extracted string contains no strings that match the censorship keyword, the data censorship processing unit 319 proceeds to step S1307. On the other hand, if the extracted string contains a string that matches the censorship keyword, the data censorship processing unit 319 proceeds to step S1308.

[0107] In step S1308, the communication control unit 317 adds a password to the scan data and sends the password-protected scan data to the destination specified by the user in the transmission format specified by the user.

[0108] For example, the communication control unit 317 converts the scanned data into a password-protected PDF to prevent unauthorized access to the scanned data. This password may be set in advance by the user with the censorship setting management unit 318. Alternatively, an input screen may be displayed on the operation unit 130, allowing the user to specify the password. In addition to adding a password, unauthorized access may also be prevented by adding a signature or encrypting the data. The type of file to which the scanned data is converted may be configured in advance via a settings screen. In addition to file conversion, unauthorized access may also be prevented by encrypting the communication path using SSL, such as by changing the communication protocol during transmission from SMTP to SMTPS. After steps S1307 and S1308, the process shown in Figure 13 is completed.

[0109] According to this embodiment, the same effects as the first embodiment can be achieved in terms of enhancing the effect of preventing information leakage regarding scanned data.

[0110] Furthermore, when executing a scan transmission job, if the extracted string contains a censorship keyword, the scan data is password-protected or encrypted before transmission (S1308). This ensures that even scan data deemed to pose a risk of information leakage can be transmitted in a form that avoids information leakage through passwords or encryption. Consequently, the burden on the user can be reduced.

[0111] In addition, in each of the above embodiments, the image processing unit 315 may be configured to perform OCR on the scanned data and create scanned data containing text information.

[0112] Figure 14 shows an example of the transmission file settings screen. This transmission file settings screen 1400 is a screen for setting the file format when scanning is performed and is displayed on the operation unit 130. The censorship setting management unit 318 sets whether or not to perform OCR at the same time as scanning (when acquiring scanned data) based on user instructions on the transmission file settings screen 1400. The user selects button 1401 with a touch operation and presses the OK button 1403 to instruct the execution of OCR. Pressing the cancel button 1402 cancels the selection.

[0113] The OCR execution instruction may be set for each individual scanned image, or it may be set for a job consisting of multiple images. The CPU 111 may be configured to handle the scanned data as, for example, a Searchable PDF when button 1401 is selected.

[0114] In addition, in each of the above embodiments, the scanning process shown in Figure 15 may be used instead of the scanning process shown in Figure 4(a). Figure 15 differs from Figure 4(a) in that steps S423 and S424 are added. Therefore, the processing in steps S401, S402, and S403 is as described in Figure 4(a). Furthermore, whether or not to perform OCR simultaneously with scanning is set by the transmission file setting screen 1400 (Figure 14).

[0115] In step S423, the scanner control unit 314 determines whether or not it is set to perform OCR simultaneously with scanning. If the scanner control unit 314 is not set to perform OCR simultaneously with scanning, it proceeds to step S402; if it is set to perform OCR simultaneously with scanning, it proceeds to step S424. In step S424, the image processing unit 315 extracts strings (text data) from the scanned data by performing OCR on the scanned data acquired in step S401.

[0116] The OCR in step S424 may be performed with the same level of accuracy as the OCR performed in step S412, or the speed of the OCR may be increased by reducing the accuracy of character extraction. After step S424, the image processing unit 315 proceeds to step S402.

[0117] Therefore, for example, in the censorship process in the first embodiment, the string extracted in step S412 was compared with the censorship dictionary, but this is not limited to that. For example, in the censorship process that is executed when OCR is performed in step S424 and the censorship mode is set to ON in step S411, the string extracted in step S424 is compared with the censorship dictionary. In other words, the execution of OCR in step S412 is omitted. In this case, the determination process does not include OCR processing on the scanned data.

[0118] Furthermore, if the system is configured to perform OCR simultaneously with scanning, even if the censorship mode is set to OFF in step S411, the OCR will still be performed on the scanned data (in S424) as a result.

[0119] In addition, in each of the above embodiments, the order of the steps shown in Figure 4(b) may be changed as follows. For example, the processing may be performed in the order S412 → S411 → S413. That is, when data censorship is started, OCR is performed on the scanned data in step S412, and it is determined in step S411 whether or not the censorship mode is set to ON. If the censorship mode is set to ON, the censorship setting management unit 318 proceeds to step S413, and if the censorship mode is set to OFF, it does not perform censorship processing and proceeds to step S416. If it is determined to be No in step S415, the censorship setting management unit 318 returns to step S412. The other processing is the same as that described in Figure 4(b).

[0120] Although the present invention has been described in detail above based on its preferred embodiments, the present invention is not limited to these specific embodiments, and various forms that do not depart from the spirit of the invention are also included in the present invention. Some of the above embodiments may be combined as appropriate.

[0121] (Other examples) The present invention can also be realized by supplying a program that implements one or more of the functions of the above embodiments to a system or device via a network or a non-transient storage medium, and by having one or more processors in the computer of that system or device read and execute the program. The above program and the storage medium that stores the above program constitute the present invention. Furthermore, the present invention can also be realized by a circuit (e.g., an ASIC) that implements one or more functions. [Explanation of Symbols]

[0122] 111 CPU 200 BOX 315 Image Processing Unit 319 Data Censorship Processing Unit 321 User Data Management Department

Claims

1. An extraction means for extracting strings from scanned data obtained by scanning a document, A storage means that stores the acquired scan data in a storage unit, provided that the string extracted from the acquired scan data by the extraction means does not contain a predetermined string, A setting means for setting a string to be added to the predetermined string, When executing a job to output scan data stored in the storage unit, the determination means performs a determination process to determine whether the string extracted by the extraction means contains the predetermined string which includes the set string, An information processing apparatus characterized by having a control means that controls the stored scan data not to be output if the determination means determines that the extracted string contains the predetermined string which includes the set string, and outputs the stored scan data if the determination means determines that the extracted string does not contain the predetermined string which includes the set string.

2. The information processing apparatus according to claim 1, characterized in that the determination means also performs the determination process on the acquired scan data when the storage means attempts to save the acquired scan data to the storage unit.

3. The determination means, when the storage means attempts to save the acquired scan data to the storage unit, starts the determination process on the acquired scan data after the scanner unit has started the scanning process to acquire scan data from the original document. The information processing apparatus according to claim 2, characterized in that the control means controls the scanner unit to stop scanning if it is determined that there are documents that have not been scanned by the scanner unit and that the extracted string contains the predetermined string.

4. The information processing apparatus according to claim 2 or 3, characterized in that, in the determination process when the storage means attempts to save the acquired scan data to the storage unit, the determination means transmits a string extracted from the acquired scan data to an external device and requests the external device to censor whether or not the extracted string contains the predetermined string, and determines whether or not the extracted string contains the predetermined string based on the censorship result received from the external device.

5. The information processing apparatus according to any one of claims 1 to 4, characterized in that the control means notifies an error when it is determined that the string extracted by the extraction means contains the predetermined string.

6. The means for updating the predetermined string is provided, The information processing apparatus according to any one of claims 1 to 5, characterized in that the determination means performs the determination process based on the latest predetermined string.

7. The information processing apparatus according to any one of claims 1 to 6, characterized in that the job is a job that transmits the stored scan data to an external source.

8. The information processing apparatus according to any one of claims 1 to 6, characterized in that the job is a job to print the saved scan data.

9. It has a means to set whether or not to run censorship mode, The information processing apparatus according to any one of claims 1 to 8, characterized in that the determination means executes the determination process on the condition that the execution of the censorship mode is set to be necessary.

10. The information processing apparatus according to any one of claims 1 to 9, characterized in that the determination process includes extracting the string using the extraction means.

11. The system has means for setting, according to user instructions, whether or not to perform a process to extract strings when acquiring the aforementioned scan data. The information processing apparatus according to any one of claims 1 to 9, characterized in that if the extraction means is set to perform a process to extract a string when acquiring the scan data, it extracts a string from the scan data when the scan data is acquired, and if the extraction means is set not to perform a process to extract a string when acquiring the scan data, it extracts a string from the scan data when the determination process is executed by the determination means.

12. The information processing apparatus according to claim 9, characterized in that the determination means causes the extraction means to extract the string before determining whether or not the execution of the censorship mode is set to be necessary.

13. The information processing apparatus according to claim 1, wherein the control means, when executing a job to transmit the acquired scan data to an external source, causes the determination means to perform the determination process, and if the determination means determines that the extracted string contains the predetermined string, controls the acquired scan data to be password-protected or encrypted before transmission.

14. An information processing system comprising an information processing device and an external device that is communicatively connected to the information processing device, The aforementioned information processing device is An extraction means for extracting strings from scanned data obtained by scanning a document, A storage means that stores the acquired scan data in a storage unit, provided that the string extracted from the acquired scan data by the extraction means does not contain a predetermined string, A setting means for setting a string to be added to the predetermined string, When the storage means attempts to save the acquired scan data to the storage unit, it includes a request means that sends the extracted string to an external device and requests the external device to check whether the extracted string contains the predetermined string which includes the set string, The external device is, In response to the request of the request means, the extracted string is checked to determine whether it contains the predetermined string which includes the set string, and the result of the check is transmitted to the information processing device. The aforementioned information processing device further, An information processing system characterized in that, when executing a job to output scan data stored in the storage unit, if it is determined, based on the censorship result received from the information processing device, that the stored scan data is not output if it is determined that the extracted string contains the predetermined string which includes the set string, the stored scan data is output if it is determined that the extracted string does not contain the predetermined string which includes the set string.

15. An extraction step to extract text from scanned data obtained by scanning a document, A storage step in which the acquired scan data is stored in a storage unit, provided that the string extracted from the acquired scan data by the extraction step does not contain a predetermined string, A setting step of setting a string to be added to the predetermined string, When executing a job to output scan data stored in the storage unit, a determination step is performed to determine whether the string extracted in the extraction step contains the predetermined string which includes the string set in the setting step, in the stored scan data. A control method for an information processing device, characterized by comprising: a determination step which controls the device to not output the saved scan data if it is determined by the determination step that the extracted string contains the predetermined string which includes the set string; and a control step which controls the device to output the saved scan data if it is determined by the determination step that the extracted string does not contain the predetermined string which includes the set string.

16. A program for causing a computer to function as one of the means of an information processing apparatus according to any one of claims 1 to 13.

17. A computer-readable storage medium storing a program for causing a computer to function as one of the means of the information processing apparatus described in any one of claims 1 to 13.

Images