This patent application is based on and claims priority pursuant to 35 U.S.C. §119(a) to Japanese Patent Application No. 2015-101008, filed on May 18, 2015 in the Japan Patent Office, the entire disclosures of which are hereby incorporated by reference herein.
1. Technical Field
The present invention relates to an information processing apparatus, an information processing method, and an information processing system.
2. Background Art
The information processing apparatuses such as multifunction peripherals (MFPs) and terminals, which may be shared among a plurality of users, record a log of jobs relating to regular operations or a log of accesses to the apparatuses for managing such accesses. The usage history information, such as the logs described above, is stored along with user identification of the log-in user, and may be later browsed by an auditor as needed.
Depending on a policy of organizations such as corporations, universities, or public offices, names or employee numbers that can identify an individual are included in the user identification in many cases. Since it is assumed that the auditor is thoroughly reliable, regardless of purposes of using the usage history information, users' identification including user's privacy information are included in the usage history information as is.
It cannot be a problem as long as the information processing apparatuses are operated with the aim of auditing security under control of the reliable auditors. In reality, however, the apparatuses are operated under environment, with less security threat from outside, or with the purpose of understating general usage as opposed to ensuring security, such that it is not always necessary to identify a user. Further, the apparatuses are often operated by general system administrators not the professional auditors, or by no administrators. Under those circumstances, if the user identification that can include privacy information are included in usage history information, it can be a risk if the usage history information is leaked to outside due to inadequate management.
Example embodiments of the present invention provide a novel information processing apparatus that includes a first memory that stores a registered identification name of a user who is eligible to use the information processing apparatus and first publishable information indicating whether or not the registered identification name of the user is publishable, circuitry that determines whether the first publishable information indicates that the registered identification name of the user is publishable, and generates usage history information of the user using the registered identification name based on a determination indicating that the registered identification name of the user is publishable or using an anonymized identification name based on a determination indicating that the registered identification name of the user is not publishable, and a second memory that stores the generated usage history information.
Further embodiments of the present invention provide a recording medium storing an information processing program, and an information processing system.
A more complete appreciation of the disclosure and many of the attendant advantages and features thereof can be readily obtained and understood from the following detailed description with reference to the accompanying drawings, wherein:
The accompanying drawings are intended to depict example embodiments of the present invention and should not be interpreted to limit the scope thereof. The accompanying drawings are not to be considered as drawn to scale unless explicitly noted.
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the present invention. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “includes” and/or “including”, when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
In describing preferred embodiments illustrated in the drawings, specific terminology is employed for the sake of clarity. However, the disclosure of this patent specification is not intended to be limited to the specific terminology so selected, and it is to be understood that each specific element includes all technical equivalents that have the same function, operate in a similar manner, and achieve a similar result.
A more complete appreciation of the disclosure and many of the attendant advantages thereof will be readily obtained as the same becomes better understood by reference to the following detailed description when considered in conjunction with the accompanying drawings.
In the embodiments described below, an information apparatus and a log management system 100 are described as examples of the information processing apparatus and the information processing system.
The MFP 110 is the information apparatus that provides various image processing services such as print, scan, copy, and facsimile etc. to users. The information terminal 112 is the information apparatus that provides various services such as government services and a service of selling movie tickets and concert tickets etc. to users.
In
The MFP 110, the information terminal 112, and the auditor terminal 190 are respectively connected to a network 102 to be communicable with one another via the network 102. The network 102 is not limited to a particular example, and the network 102 can include at least either one of a local area network (LAN) and the Internet that are wired, wireless, or mixture of wired networks and wireless networks.
In the information apparatuses such as the MFP 110 and the information terminal 112 illustrated in
In the logs described above, contents of operation and contents of execution are recorded along with user identification obtained through login processing. Depending on a policy of organizations, it is possible that login names that include names and employee numbers that can identify an individual are used as the user identification in some cases. It is possible that some users do not want that information for identifying an individual to be included in the logs. On the other hand, if the information that can identify the user is not completely included, it is difficult that the auditor trances the logs at a later date.
To cope with this issue, in the log management system 100 in this embodiment, the information apparatuses such as the MFP 110 and the information terminal 112 etc. preliminarily stores registered identification such as names of authorized users and disclosure information that defines whether or not the registered identification are publishable, i.e., whether or not it is possible to publish the registered identification. Subsequently, in generating the logs, either the registered identification allowed to be disclosed in the disclosure information described above or an anonymized identification if the registered identification is not allowed to be disclosed in the disclosure information described above is considered as the user identification name to generate and store the logs.
As a result, it is possible to reduce a risk of leaking the identification that is not allowed to be disclosed and store the logs that can be traced using the user identification.
Configuring whether or not the logs can be disclosed using the registered identification name and the function of generating the logs based on the configuration whether or not the log can be disclosed implemented by the log management system 100 in a first embodiment is described below with reference to
The functional block 200 of the MFP 110 in
The communication unit 202 includes a network interface card (NIC) etc. and connects the MFP 110 to the network 102. In this embodiment, the communication unit 202 receives a request to browse the logs from application on the auditor terminal 190, such as a browser and a management tool etc. and returns the logs in response to the request. The scan unit 204 includes an image scanning circuit and performs an operation of scanning an image in image processing services such as copy service and scan service, etc. The print unit 206 includes an image forming circuit and performs an operation of forming an image in image processing services such as copy service and print service, etc. The operation unit 208 includes a touch panel etc. operated by a user of the MFP 110 and provides a user interface (UI) that accepts various user operations such as login operation, a command to execute a job, and logout operation etc. The basic processor 210 controls the whole MFP 110 to perform basic functions of the MFP such as the communication unit 202, the scan unit 204, the print unit 206, and the operation unit 208 etc.
In
The basic processor 210 requests the log generation processor 220 to generate the log if a predetermined event that the log is to be recorded occurs. For example, if operations such as the login operation, job execution operation, and logout operation are input on the operation unit 208 by user operation, the basic processor 210 issues the request to generate log corresponding to login, job execution, and logout. In addition, if an error occurs in the communication unit 202, the scan unit 204, or the print unit 206 etc., the basic processor 210 issues the request to generate log corresponding to the occurred error to the log generation processor 220.
The log generation processor 220 generates log in association with the login user identification name in response to the request to generate log by the basic processor 210 and stores the log in the log storage unit 222. The log storage unit 222 stores various logs generated based on various operations and events on the MFP 110, and the log storage unit 222 is configured as a storage unit (memory) that stores a log generated by the log generation processor 220 in this embodiment. It should be noted that the associated user identification name is described in detail later.
The user information manager 230 manages user information regarding generating log, writes the user information in the user information table 232, and reads the user information from the user information table 232. The user information manager 230 modifies content of the user information table 232 in response to requests to register and modify the user information by user operation via the operation unit 208.
The user information table 232 is managed by the user information manager 230 and stores the user information regarding the log generation. In this embodiment, in the request to register or modify the user information, a selection whether or not the registered identification names such as names and employee numbers etc. is publishable in included. The user information table 232 stores registered identification names and disclosure information defining whether or not the registered identification name is publishable for each of equal to or more than one users who are eligible for using the MFP 110. The user information table 232 functions as a storing unit (memory) in this embodiment.
In this embodiment, the user's name is used as the registered identification name. However, the registered identification is not limited to that case. For example, in other embodiments, whatever information such as the employee number, membership number, customer identifier account identifier, e-mail address, and telephone number etc. that can identify a specific user can be used as the registered identification name.
The operation of registering or modifying user information performed by the user information manager 230 is described below with reference to a graphical user interface (GUI) in
The user information registration screen 300 in
If the registration button 308 is pressed after inputting information in the text boxes 302 and 304 and selecting the “name” radio button 306a, it is configured that the user allows to disclose his/her name as the user identification name. By contrast, if the registration button 308 is pressed after selecting the “handle name” radio button 306b, it is configured that the user disagrees with disclosing his/her name and allows to disclose his/her handle name as the user identification name. Furthermore, if the registration button 308 is pressed after selecting the “unpublishable” radio button 306c, it is configured that the user disagrees with disclosing both his/her name and his/her handle name. In this case, neither the name nor the handle name is not used as the user identification name, and a string such as “Anonymous” that indicates the user is anonymized is configured.
In this embodiment, the name is the registered identification name controlled whether or not it is publishable in the first place. The handle name is a false name controlled whether or not it is publishable in the second place if it is selected that the name is unpublishable. While the false name does not satisfy anti-connectivity, the false name has anonymity since it is impossible to specify a user uniquely, and the false name is included in the anonymized identification name in these embodiments. Since the same string that indicates anonymity such as “Anonymous” is given to unspecified majority, that identification name has high anonymity, and that identification name is included in anonymized identification names.
The user code is a unique code allocated to users. In the MFP 110, user processes are managed using the user code. The basic processor 210 in
The log name is a user identification name recorded in logs. The name is an item that stores the name as the registered identification name input in the text box 302 on the user information registration screen 300 described above. The handle name is an item that stores the handle name as the false name input in the text box 304 on the user information registration screen 300 described above. The published information stores a value corresponding to the selection on the radio button 306 on the user information registration screen 300 described above. The log name can be modified in accordance with the item value of the published information.
Getting back to
In S103, if it is determined that the publishable information is not “handle name” (NO in S103), the step proceeds to S104. In S104, in the MFP 110, the user information manager 230 sets the string “Anonymous” indicating anonymity to the log name of the corresponding user in the user information table 232, and the operation ends.
By contrast, in S103, if it is determined that the publishable information is “handle name” (YES in S103), the step proceeds to S105. In S105, in the MFP 110, the user information manager 230 sets the value stored in the item of the handle name to the log name of the corresponding user in the user information table 232, and the operation ends.
In S102, if it is determined that the publishable information is “name” (YES in S102), the step proceeds to S106. In S106, in the MFP 110, the user information manager 230 sets the value stored in the item of the name to the log name of the corresponding user in the user information table 232, and the operation ends.
In
In this case, as shown in
As described above, depending on the operation in registering/modifying user, the registered identification name (name) in case of allowing to be published, the false name (handle name) in case of allowing to be published, and publishable information defining whether or not the registered identification name is publishable and the false name is publishable are stored in the user information table 232. Regarding users who do not allow to publish both the registered identification name and the false name, the string “Anonymous” is configured as the user identification name for the users and stored in the user information table 232.
Here, an operation of generating a log based on the setting of whether or not the registered identification name can be published in the log is described below in detail with reference to
The operation in
In S203, the basic processor 210 requests the user information table 232 to obtain the user code used for the login operation and acquires the user code. The obtained user code is used for managing the user process until the user is logged out. In S204, to record a log for the login operation this time, the basic processor 210 requests the log generation processor 220 to generate a log along with the user code.
In S205, the log generation processor 220 requests the user information table 232 to obtain the log name corresponding to the user code and acquires the log name. In S206, the log generation processor 220 generates a log using the obtained log name and stores the generated log in the log storage unit 222.
In addition, an operation of executing a job after logging in is illustrated in
In S304, the log generation processor 220 requests the user information table 232 to obtain the log name corresponding to the user code and acquires the log name. In S305, the log generation processor 220 generates the log using the obtained log name and stores the generated log in the log storage unit 222.
The log consists of equal to or more than one records including date/time when the log is generated, user's log names, events, and results. By comparison with
As described above, the log generation processor 220 generates the log using either the registered identification name (name) allowed to be published by the publishable information or the anonymized identification name (handle name or the string “Anonymous”) not allowed to be published by the publishable information as the user identification name.
As a result, it is possible to reduce a risk of leaking the identification names that is not allowed to be disclosed and store the logs that can be traced using the user identification names to a certain degree. That is, instead of publishing the registered identification names such as the names, it is possible to trace processes corresponding to the users in the log. Furthermore, since the generated log itself does not include the identification name not allowed to be published, even if the log is backed up or duplicated by other methods, it is possible to prevent the identification name not allowed to be published from being leaked due to failure of managing the backup log.
In the first embodiment described above, the users who do not allow to publish both the registered identification name and the false name are recorded using the same string in the log. For example, in
To cope with this issue, a second embodiment that it is possible to precisely trace sequential operations by users who do not allow to publish both the registered identification name and the false name is described below with reference to
In S401, the MFP 110 performs the operation of registering/modifying user information. In S402, in the MFP 110, the operation is branched depending on whether or not the input publishable information is “name”. In S402, if it is determined that the publishable information is not “name” (NO in S402), the step proceeds to S403. In S403, in the MFP 110, the operation is further branched depending on whether or not the publishable information is “handle name”. In S403, if it is determined that the publishable information is not “handle name” (NO in S403), the step proceeds to S404.
In S404, in the MFP 110, the user information manager 230 obtains a random number code generated by a pseudo random number generator etc. In S405, in the MFP 110, the user information manager 230 adds the random number code generated at random to the string “Anonymous” indicating anonymity and generates the log name for the user. In S406, the MFP 110 determines whether or not the same log name already exists with reference to the user information table 232. If it is determined that the same log name exists (YES in S406), the operation goes back to S404, and the log name using the random number is generated repeatedly until an unregistered log name is generated. In this case, the user information manager 230 implements an identification name generator in this embodiment.
By contrast, if it is determined that the same log name does not exist (NO in S406), the operation proceeds to S407. In S407, in the MFP 110, the user information manager 230 sets the generated string “Anonymous” adding “the random number code” to the log name of the corresponding user in the user information table 232, and the operation ends.
By contrast, if it is determined that the publishable information is “handle name” (YES in S406), the value stored in the item of the handle name is set to the log name of the corresponding user, and the operation ends. By contrast, if it is determined that the publishable information is “name” (YES in S402), the value stored in the item of the name is set to the log name of the corresponding user, and the operation ends.
For example, if a generated random number is “1265”, Jiro Ota's log name is set to “Anonymous1265”. On the other hand, Shiro Funeki's log name is set to “Anonymous3721” for example. As a result, it is possible to recognize that the data deletion at 10:12 and the data registration at 10:20 are sequential operations and the data transfer at 10:21 belongs to another operation, and it is possible to trace the log precisely.
In the second embodiment, since the log name corresponds to the user on one-on-one basis, it is possible to trace operations in the same way as handle names with higher anonymity compared to the handle names instead of publishing names
As a result, in the second embodiment described above, even in case of the users who do not allow to publish both the registered identification name and the false name, it is possible to generate the string that can identify a user uniquely as a log name. Consequently, it is possible to trace logs precisely. However, it could be possible to analogize the relationship between log names and users in the long term. For example, if “Anonymous1265” is recorded as the user identification name in the log whenever Jiro Ota operates the apparatus, it could be possible to analogize that “Anonymous 1265” is related to Jiro Ota.
To cope with this issue, a third embodiment that it is possible to trace operations from login to logout and it is difficult to trace operations among logins is described below with reference to
In the third embodiment, when it is requested to register/modify user information, if it is selected that both the registered identification name and the false name are unpublishable, the user information manager 430 keeps the log name in the user information table 432 blank.
The login processor 434 controls user authentication in logging in. Known technologies can be used for the user authentication. After logging in, the login processor 434 reads the user information table 432 and checks the publishable information for the login user. If it is selected that both the registered identification name and the false name are unpublishable, the login processor 434 generates a string indicating anonymity using a random number code generated using the pseudo random number generator etc. and updates a log name in the user information table 432. The login processor 434 functions as an identification name generator that generates the string indicating anonymity for each login by user operation in this embodiment.
In S504, in the MFP 110, the login processor 434 obtains a random number code generated by a pseudo random number generator etc. In S505, in the MFP 110, the login processor 434 adds the random number code generated at random to the string “Anonymous” indicating anonymity and generates the log name for the user.
In S506, the MFP 110 determines whether or not the same log name exists with reference to the user information table 432. If it is determined that the same log name exists (YES in S506), the operation goes back to S504, and the log name using the random number is generated repeatedly until an unregistered log name is generated. By contrast, if it is determined that the same log name does not exist (NO in S506), the operation proceeds to S507. In S507, in the MFP 110, the login processor 434 sets the generated log name, i.e., adding the random number code to the string “Anonymous”, to the corresponding user's log name. In S508, the configured user information table 432 is written in, and the operation ends. By contrast, if it is determined that the publishable information is not “unpublishable” (NO in S503), the operation ends as is.
In the third embodiment, since the log name corresponds to the user on one-on-one basis, it is possible to trace operations in the same way as handle names with higher anonymity compared to the handle names instead of publishing names. In addition, since the user identification name is modified for each login, it is possible to trace operations only while the process is valid, i.e., only while the user is logging in. Since names recorded in logs are dynamically modified, it is possible to reduce a possibility of associating an individual with a name in the long term even if personal operations are monitored.
In the embodiments described above, the log is browsed by accessing the information apparatuses 110 and 112 directly from the auditor terminal 190. However, in other embodiments, it is possible to connect one or more servers that collect logs from the information apparatuses 110 and 112 and browse the logs by accessing the servers from the auditor terminal 190.
In
A hardware configuration of the MFP 110 in the embodiments is described below with reference to
The ASIC 60 is connected to a local memory 62, a hard disk drive (HDD) 64, and a nonvolatile memory (e.g., a flash memory etc.) 66 (hereinafter referred to as “NVRAM 66”). The local memory 62 is used as an image buffer for copying and a code buffer, and the HDD 64 is a storage device that stores image data, document data, programs, font data, and form data etc. The HDD 64 in this embodiment can provide a storage area for the log storage devices 222 and 422 that store logs. When the log is transferred to the external log management server 150, the HDD 64 provides a temporary storage area. The NVRAM 66 stores programs for controlling the MFP 110, various system information, and various setting information.
The controller 52 further includes a Southbridge (SB) 68, a network interface card (NIC) 70, a Secure Digital (SD) card slot 72, a USB interface 74, an IEEE 1394 interface 76, and a Centronics interface 78, and those components are connected to the NB 58 via a PCI bus 90. The SB 68 is a bridge that connects a ROM (not shown in figures) and PCI bus peripheral devices etc. to the NB 58. The NIC 70 is an interface that connects the MFP 110 to the network 102 such as the Internet and a LAN etc., and the NIC 70 accepts commands and requests via the network. An example of a command via the network is a request for remote login. The SD card slot 72 mounts a SD card (not shown in figures) detachably. The USB interface 74, the IEEE 1394 interface 76, and the Centronics interface 78 are interfaces compatible with each standard and accepts a print job etc.
The control panel 82 as a display is connected to the ASIC 60 in the controller 52 to accept various input commands and requests by user operation and provide a user interface for displaying a screen. The control panel 82 can include a display, a keyboard, and a mouse. Otherwise, the control panel 82 can consist of a touch panel. The FCU 84 and the engine 86 are connected to the ASIC 60 via the PCI bus 92. The FCU 84 performs communication methods compatible with facsimile communication specifications such as G3 and G4 etc. After accepting a request for print and a request for scan issued by an application, the engine 86 performs an image forming process and an image scanning process. The engine 86 constructs the scanner and the printer. The MFP 110 in this embodiment reads control programs from the HDD 64 and NVRAM 66 and expands the read control program into a work area provided by the system memory 56 and the local memory 62 to implement the functional units (functional components) and processes described above under control of the CPU 54.
As described above, in this embodiment, the information processing apparatus that can reduce a risk of leaking unpublishable identification names and store usage history information traceable using a user identification name is provided.
By adopting the configurations described above, in accordance with environment where the information apparatus is used, it is possible to configure publishable ranges of privacy information stored in logs by user operation under predetermined operations. Even if the log information is leaked, it is possible to reduce a risk of leaking information that is not allowed to be published by user operation.
In the embodiments described above, it should be noted that each functional component shown in
The present invention also encompasses an information processing method performed by an information processing apparatus. The method includes the steps of storing a registered identification name of a user who is eligible to use the information processing apparatus and first publishable information indicating whether or not the registered identification name is publishable in a first memory, generating usage history information using either the registered identification name allowed to be published defined in the first publishable information or an anonymized identification name if it is not allowed to publish the registered identification name defined in the first publishable information, and storing the generated usage history information in a second memory.
Numerous additional modifications and variations are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims, the disclosure of the present invention may be practiced otherwise than as specifically described herein.
For example, elements and/or features of different illustrative embodiments may be combined with each other and/or substituted for each other within the scope of this disclosure and appended claims.
As can be appreciated by those skilled in the computer arts, this invention may be implemented as convenient using a conventional general-purpose digital computer programmed according to the teachings of the present specification. Appropriate software coding can readily be prepared by skilled programmers based on the teachings of the present disclosure, as will be apparent to those skilled in the software arts. The present invention may also be implemented by the preparation of application-specific integrated circuits or by interconnecting an appropriate network of conventional component circuits, as will be readily apparent to those skilled in the relevant art.
Each of the functions of the described embodiments may be implemented by one or more processing circuits or circuitry. Processing circuitry includes a programmed processor, as a processor includes circuitry. A processing circuit also includes devices such as an application specific integrated circuit (ASIC), digital signal processor (DSP), field programmable gate array (FPGA), and conventional circuit components arranged to perform the recited functions.
As described above, the present invention can be implemented in any convenient form, for example using dedicated hardware, or a mixture of dedicated hardware and software. The present invention may be implemented as computer software implemented by one or more networked processing apparatuses. The network can comprise any conventional terrestrial or wireless communications network, such as the Internet. The processing apparatuses can compromise any suitably programmed apparatuses such as a general purpose computer, personal digital assistant, mobile telephone (such as a WAP or 3G-compliant phone) and so on. Since the present invention can be implemented as software, each and every aspect of the present invention thus encompasses computer software implementable on a programmable device. The computer software can be provided to the programmable device using any storage medium for storing processor readable code such as a floppy disk, hard disk, CD ROM, magnetic tape device or solid state memory device.
Number | Date | Country | Kind |
---|---|---|---|
2015-101008 | May 2015 | JP | national |