Remote Process Authorization for External Office Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to securely manage and control the execution of processes by information processing apparatuses, such as multifunction devices, when accessed outside a company's local area network, especially in teleworking scenarios, without compromising security.
Innovation Solution
An information processing system that utilizes a virtual private line to manage and control processes executed by an information processing apparatus outside the local area network, involving a server and an information processing apparatus with processors that associate identification information to generate processing management information, check for execution permissions, and execute processes only if authorized, while preventing unauthorized use.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If an information processing apparatus is accessed from outside the local area network, then usability for teleworking is improved, but security risk increases
Solution Approach 1:
A server acts as an intermediary between external access requests and the information processing apparatus. The server receives process request information from outside the local area network, relays it to the apparatus, and controls the execution of processes. This intermediary mechanism enables teleworking access while maintaining security by preventing direct external connections to the apparatus.
2Adaptability or versatility
If direct access to the information processing apparatus is allowed from outside the local area network, then operational flexibility is improved, but control over process execution deteriorates
Solution Approach 1:
The server serves as a control intermediary that manages process execution requests. It receives process request information containing identification information about the apparatus and process details, associates this information to generate processing management information, and controls whether processes are executed. This maintains operational flexibility for teleworking while preserving control over what processes run on the apparatus.
3Reliability
If the server associates identification information to generate processing management information, then security control is improved, but system complexity increases
Solution Approach 1:
The server performs preliminary association of identification information before process execution. When relaying process request information, the server associates the identification information of the information processing apparatus with the process information to generate processing management information in advance. This preliminary action establishes security control mechanisms before actual process execution, ensuring reliable security verification while managing system complexity through structured information organization.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An information processing system includes a first processor mounted on a server connected to a local area network of an organization to which a user belongs, and a second processor mounted on an information processing apparatus provided outside the local area network, in which the first processor is configured to in a case of relaying process request information addressed to the information processing apparatus, the process request information including data which is a target of a process, and process information including identification information on the process, information specifying a request source of the process, and identification information on the information processing apparatus which is a request destination of the process, associate the identification information on the process with the identification information on the information processing apparatus included in the process request information to generate processing management information, and register the generated processing management information in a process management information storage unit, and return execution permission information indicating that execution of the process is permitted, in response to a check request for checking whether or not the process is executable for the process request information transmitted from the information processing apparatus via a virtual private line established with the information processing apparatus, in a case where a set of the identification information on the information processing apparatus and the identification information on the process included in the check request is registered in the process management information storage unit, and the second processor is configured to, in response to the process request information, transmit a check request for checking whether or not the process is executable, the check request including the identification information on the information processing apparatus and the identification information on the process requested to be executed, to the server via a virtual private line established with the server, and execute the requested process in a case where the execution permission information is returned from the server in response to the transmitted check request.