Patent Application
20090046315
The present invention relates to access to distributed imaging services and, more particularly, to methods and systems that enable unified determinations of access to composite imaging services.
In distributed imaging services environments, some imaging services are offloaded from an imaging node, such as a multifunction printer (MFP) to other network nodes, such as imaging server nodes. A logical group of imaging services, sometimes called a composite imaging service, is then formed from the on-board imaging services and the offloaded imaging services. As one of numerous examples, a printing service on a printing node may be combined into a composite print service with a format conversion service on a print server node that converts print jobs into a format native to the printing node so that a print job can be successfully output on the printing node. More generally, composite imaging services may be formed from a broad array of accounting, auditing, conversion, copying, displaying, faxing, filing, printing, publishing, scanning and stamping services, to name a few.
The component services of a composite imaging service may maintain their own access control lists. When they do, certain problems can arise. For example, in a composite print service in which some component services reside on a printing node and others reside on a print server node, the component services may have different authorized client or user lists. As a result, a print job submitted to the composite print service may be accepted and processed by the printing node only to be later rejected by the print server node for lack of authorization, or vice versa. This wastes time and system resources. Moreover, composite imaging services typically do not provide the client or user a mechanism for making an advance determination as to whether the client or user is authorized to access all component services of the composite imaging service.
The present invention, in a basic feature, provides methods and systems that enable unified determinations of access to composite imaging services. In some aspects, the invention provides a unified predetermination of access to a composite imaging service, e.g., a unified determination made before a print job is sent that an entity is authorized to access all component services of a composite print service. In other aspects, the invention provides a unified early-stage determination of access to a composite imaging service, e.g., a unified determination made in early-stage processing of a print job that an entity is authorized to access all component services of a composite print service. In either event, such unified determinations save time and system resources relative to fragmented determinations of access to composite imaging services in prior systems that can result in rejection of imaging jobs after substantial processing has already been done.
In some aspects, the invention provides methods and systems for unified predetermination of access to composite imaging services using probe requests and responses. In one embodiment, a method comprises the steps of receiving on a node from an entity a probe request identifying one or more imaging services, authenticating by the node the entity, identifying on the node one or more imaging services corresponding to imaging services in the request including at least one composite imaging service, wherein the at least one composite imaging service has component services distributed among a plurality of nodes and wherein two or more of the component services have independent access control lists, determining on the node that the entity is authorized for the one or more corresponding imaging services including determining on the node that the entity is authorized for each of the two or more component services that have independent access control lists and transmitting by the node to the entity a probe response indicating authorization for the corresponding imaging services.
In another embodiment, a method comprises the steps of receiving on a node from an entity a probe request, authenticating by the node the entity, identifying on the node one or more imaging services, wherein the imaging services comprise at least one composite imaging service having component services distributed among a plurality of nodes and wherein two or more of the component services have independent access control lists, determining on the node that the entity is authorized for the imaging services including determining on the node that the entity is authorized for each of the two or more component services that have independent access control lists and transmitting by the node to the entity a probe response indicating authorization to the imaging services.
In some aspects, the invention provides methods and systems for unified administrative determination of access to composite imaging services using probe requests and responses. In one embodiment, a method comprises the steps of receiving on a node from an administrative entity a probe request for administrative level information on imaging services, authenticating by the node the administrative entity, identifying on the node one or more imaging services, wherein the identified imaging services comprise at least one composite imaging service having component services distributed among a plurality of nodes and wherein two or more of the component services have independent access control lists, determining on the node respective lists of authorized entities for the identified imaging services including determining on the node for each of the two or more component services that have independent access control lists which entities are authorized and transmitting by the node to the administrative entity a probe response identifying the identified imaging services and respective lists of authorized entities.
In other aspects, the invention provides methods and systems for unified determination of access to composite imaging services using service requests. In one embodiment, a method comprises the steps of receiving on a node from an entity an imaging service request, authenticating by the node the entity, identifying on the node one or more imaging services corresponding to imaging service request including at least one composite imaging service, wherein the at least one composite imaging service has component services distributed among a plurality of nodes and wherein two or more of the component services have independent access control lists, determining on the node that the entity is authorized for the one or more corresponding imaging services including determining on the node that the entity is authorized for each of the two or more component services that have independent access control lists and accepting the request.
The component services may comprise Web services (WS), for example.
The component services may comprise accounting, auditing, conversion, copying, displaying, faxing, filing, printing, publishing, scanning or stamping services, for example.
The entity may comprise a client computing device or a human user, for example.
The node that processes the request may comprise a printing node or a print server node, for example..
The plurality of nodes among which the component services are distributed may comprise a printing node and one or more print server nodes, for example.
The node that processes the request may discover authorized entities for the component services through manual input or auto-discovery, for example. Auto-discovery may be initiated by the node that processes the request or by the nodes that host the component services, for example.
These and other aspects of the invention will be better understood by reference to the following detailed description taken in conjunction with the drawings that are briefly described below. Of course, the invention is defined by the appended claims.
Printing node 130 is a printing device having a wired or wireless network interface, such as an Ethernet interface or a USB interface, that communicatively couples printing node 130 with communication network 120. Printing node 130 is capable of receiving via the network interface probe requests and service requests initiated on client node 110, processing probe requests and service requests and outputting a hard copy of print jobs conformant with service requests by invoking internal print services. In some embodiments, printing node 130 is a multifunction printer (MFP) that supports multiple imaging services, such as scanning, copying and faxing. Printing node 130 also has a user interface for accepting inputs from a user and displaying output to a user. Internal to printing node 130, the user and network interfaces are communicatively coupled with a processor (CPU), a memory, a print engine and, in some embodiments, a scan, copy and/or fax engine. The print engine includes printer logic, such as one or more integrated circuits (IC), and a mechanical section for performing printing functions. For example, the print engine may have a color ink jet head mounted on a movable carriage for outputting a hard copy of print jobs under the control of a printer IC. In some embodiments, information associated with service requests is transmitted to one or more of print server nodes 140, 150 for additional processing by external print services before, during or after processing of service requests on printing node 130.
Printing node 130 is coupled via communication network 120 with print server nodes 140, 150. Print server nodes 140, 150 host external imaging services that enable, facilitate or extend the internal print services hosted on printing node 130. External print services may include accounting, auditing, format conversion, copying, displaying, faxing, filing, publishing, scanning or bates stamping services, for example. External print services hosted on print server nodes 140, 150 may be logically coupled with internal print services hosted on printing node 130 to form a composite print service. External and internal print services that are joined in a composite print service are sometimes referred to herein as component services of the composite print service. In some embodiments, component services of a composite print service comprise Web services (WS) that communicate via communication network 120 using eXtensible Markup Language (XML) messages that follow the Simple Object Access Protocol (SOAP) and related standards. In other embodiments, component services of a composite print service may communicate using other protocols, such as HyperText Transfer Protocol (HTTP). A composite print service may be created in various ways, such as serial physical or logical coupling of nodes, application of predefined coupling rules, inferences from the print services involved, or manual definition, for example.
A composite print service can be exposed such that one or more of a client node 110, client software installed on client node 110, or a user of client node 110 can request the composite print service. If a composite print service is exposed, the component services within the composite print service may or may not be separately exposed as composed or non-composed print services.
External print services within a composite print service may have independent access control lists (ACLs) whose membership differs from ACLs of other external and internal print services in the same composite print service, which can create non-uniform access control decisions. One important object of the present invention is eliminating these non-uniformities by enabling access determinations for composite print services to be made on printing node 130 in unified fashion.
Turning now to
Turning now to
Exposed print service list 320 stores identities of composite and non-composite print services that are exposed on printing node 130. Continuing with the example of
Unified access databases 330, 340, 350 store authentication information for entities authorized to use exposed composite print service A 210, composite print service B 220 and non-composite print service C, respectively. Authorized entities may include client nodes, client software or human users, for example. Where the authorized entities include client nodes, the authentication information may include authorized machine addresses, machine identifiers and/or machine certificates, for example. Where the authorized entities include human users, the authentication information may include authorized usernames, passwords, user certificates and/or biometric information, for example. In some embodiments, unified access database 330 for composite print service A 210 separately maintains authentication information for the authorized entities of each component service A1, A2, A3 within composite print service A 210. Similarly, in some embodiments, unified access database 340 for composite print service B 220 separately maintains authentication information for the authorized entities of each component service B1, B2 within composite print service B 220. Printing node 130 may discover authentication information respecting authorized entities of component services of composite print services, as well as of non-composite print services, through auto-discovery or manual data entry, for example. Auto-discovery of authentication information for authorized entities of external print services may be initiated by printing node 130, for example, by querying print server nodes 140, 150 via communication network 120 for the ACL contents of each of their print services. Alternatively, auto-discovery of authentication information for authorized entities of external print services may be initiated by print server nodes 140, 150, for example, by registering with printing node 130 via communication network 120 the ACL contents of each of their print services. Auto-discovery may be periodic or event-driven. Naturally, a secure communication protocol is used to ensure that authentication information is not compromised while in transit.
Printing device 130 receives the probe request and print service manager 310 authenticates the entity (420). Authentication may be accomplished using any of numerous mechanisms. In some embodiments, for example, the probe request has encrypted authentication information that is decrypted by print service manager 310 and then compared with authentication information maintained in a database of authorized entities. Such authentication information may be stored in a memory on printing node 130, for example. In any event, if print service manager 310 is unable to authenticate the entity, print service manager 310 rejects the probe request and, in some embodiments, returns a probe response to the entity indicating an authentication failure.
If print service manager 310 successfully authenticates the entity, print service manager 310 accepts the probe request and filters any print services identified in the probe request that are not within exposed print service list 320 (430). Print service manager 310 compares print service identifiers included in the probe request with print service identifiers stored in exposed print services list 320 and filters print services identified in the probe request for which no match is found. For example, returning to the arrangement of
Next, print services manager 310 filters the remaining print services identified in the probe request for which the entity is not authorized (440). Print service manager 310 consults the ones of unified access databases 330, 340, 350 that correspond to the print services identified in the probe request that remain after Step 430 and compares the authentication information included in the probe request with the authentication information in the corresponding ones of unified access databases 330, 340, 350. Print service manager 310 then filters remaining print services identified in the probe request for which no match is found. It bears noting that for any composite print services identified in the probe request that remain after Step 430, authorization is required for each component service of the composite print service in order for the composite print service to avoid being filtered. For example, continuing the above example, print service identifiers A and C from the probe request remain after Step 430. Of these, print service A is a composite print service that includes component services A1, A2, A3. Print service manager 310 thus in some embodiments searches unified access database 330 for a match of authentication information in the probe request with authentication information stored in unified access database 330 for each component service A1, A2, A3. If a match is not found for any one of component services A1, A2, A3, print service A is filtered from the probe request. If a match is found for each of component services A1, A2, A3, print service A is not filtered. In other embodiments, unified access database 330 may be arranged to include a composite list having authentication information only for entities that have access privileges for all component services A1, A2, A3. In such embodiments, print services manager 310 searches for a match of authentication information in the probe request with authentication information in the composite list. If a match is not found in the composite list, print service A is filtered from the probe request and is otherwise retained. Naturally, print service manager 310 also searches the authentication information in unified access database 350 associated with non-composite print service C for a match with authentication information received in the probe request and filters or retains print service C according to the result.
Finally, printing node 130 under control of print service manager 310 transmits to client node 110 a probe response identifying the print services remaining after Step 440 (450). The probe response advantageously informs client node 110 or a user thereof, in advance of sending a print job requiring the print services that were identified in the probe request, whether the print job would be accepted or rejected.
The entity initiates a probe request in advance of sending a print job (510). Printing device 130 receives the probe request and print service manager 310 authenticates the entity (520). If print service manager. 310 is unable to authenticate the entity, print service manager 310 rejects the probe request and, in some embodiments, returns a probe response to the entity indicating an authentication failure. If print service manager 310 is able to successfully authenticate the entity, print service manager 310 accepts the probe request and identifies all services within exposed print services list 320 (530). For example, returning once again to the arrangement shown in
An administrative entity initiates a probe request (610). Printing device 130 receives the probe request and print service manager 310 authenticates the administrative entity (620). In some embodiments, the probe request has encrypted authentication information that is decrypted by print service manager 310 and then compared with authentication information maintained for authorized administrative entities. After successful authentication, print service manager 310 accepts the probe request and identifies all services within exposed print services list 320 (630). For example, returning to the arrangement of
Printing device 130 receives the service request and print service manager 310 authenticates the entity (720). If print service manager 310 is unable to authenticate the entity, print service manager 310 rejects the service request and, in some embodiments, returns a service response to the entity indicating an authentication failure.
If print service manager 310 is able to successfully authenticate the entity, print service manager 310 next verifies that the service request is directed to an exposed print service by reference to exposed print service list 320 (730). Print service manager 310 decomposes the service request to determine the services still to be processed and compares them with print services stored in exposed print service list 320. If the requested print services are not within exposed print service list 320, print service manager 310 rejects the service request and, in some embodiments, returns a service response to the entity indicating a failure for unavailability of the requested print services (760). Continuing the above example, composite print service B is requested here and would be found within exposed print service list 320.
Next, print services manager 310 verifies that the entity is authorized for the requested print services (740). Print service manager 310 consults ones of unified access databases 330, 340, 350 that correspond to the requested print services and compares the authentication information included in the service request with the authentication information in the corresponding ones of unified access databases 330, 340, 350. For example, continuing the above example, composite print service B is identified in Step 730. Print service manager 310 thus searches unified access database 340 for a match of authentication information received in the service request with authentication information stored in unified access database 340 for each component service B1, B2, or stored in a composite list for all component services B1, B2. If the authentication information is not found in unified access database 340, print service manager 310 rejects the service request and, in some embodiments, returns a service response to the entity indicating an authorization failure (760).
Finally, if print services manager 310 is able to successfully verify that the entity is authorized for the print services in the service request, printing node 130 under control of print service manager 310 delivers the requested services (750).
In some embodiments, component services of a composite print service may be separately exposed as either composite or non-composite services, in which case such separately exposed services are separately listed in the exposed print service list and in which case a unified access database is separately maintained for such services.
It will be appreciated by those of ordinary skill in the art that the invention can be embodied in other specific forms without departing from the spirit or essential character hereof. For example, while the described embodiments have involved composite print services, the invention can be applied to composite services that have independent ACLs but do not involve printing. The present description is therefore considered in all respects to be illustrative and not restrictive. The scope of the invention is indicated by the appended claims, and all changes that come with in the meaning and range of equivalents thereof are intended to be embraced therein.
