Abstract:
An image forming apparatus connected to a network including a reading device configured to read a document having ID data; a storage device configured to store a document data that is transmitted by the reading device; an analyzing device configured to analyze the document data and to determine an image forming apparatus that formed the document using the ID data; a communication device configured to transmit the ID data to the image forming apparatus found by the analyzing device; and an image generating device configured to generate the document data on a media when said communication device receives an authorization to copy sent by the image forming apparatus that is found by the analyzing device.

Description:
CROSS-REFERENCE OF APPLICATIONS 
       [0001]    The present application claims priority to corresponding Japanese Application No. 2006-248216, filed on Sep. 13, 2006, the entire contents of which are hereby incorporated by reference. 
       BACKGROUND OF THE INVENTION 
       [0002]    1. Field of the Invention 
         [0003]    The present invention generally relates to management of information security, and particularly to a document security managing technique. The present invention also relates to an image generating method, device, and system including an image forming apparatus utilizing an image reader. More particularly, the invention relates to a technique for inhibiting the unauthorized copying of a document wherein the unauthorized copying is inhibited when the document image is read by a copying machine. 
         [0004]    2. Discussion of the Background 
         [0005]    In recent years, the problem of how to secure information resources has been increasing in concern. In particular, it is important to secure information resources that have secret or sensitive information including, for example, trade secrets, patent information, etc. But a complete prohibition of copying documents of this nature would prevent copying of those documents when needed. 
         [0006]    Consequently, a number of techniques have been suggested for managing systems including image forming apparatuses, servers, and microcomputers, such as PCs wherein the image forming apparatus has a reading device. When the reading device reads a document that has ID data, the image forming apparatus sends the ID data and an input password. The server has a list of ID data and corresponding passwords. The server checks the received ID data and password provided on the list. If there is a match, the user can copy the document. On the other hand, if there is no match, then the user can&#39;t copy the document. 
         [0007]    Techniques of this nature require a server to implement the password checking process. Consequently, these techniques are inflexible. 
       SUMMARY OF THE INVENTION 
       [0008]    The present invention provides an image forming apparatus and method of forming an image which addresses, among other things, the just described technique using a password checking system. 
         [0009]    In one embodiment, an image forming apparatus is connected to a network, including, a reading device configured to read a document that has ID data, an analyzing device configured to analyze document data of the document and to determine an image forming apparatus that formed the document using the ID data; a communication device configured to transmit the ID data to an image forming apparatus found by the analyzing device, and an image generating device configured to generate the document data on a media (e.g., paper) when the communication device receives from the found image forming apparatus authorization to copy. 
         [0010]    The present invention additionally provides a method for forming an image using an image forming apparatus, including, reading a document that has ID data, analyzing document data of the document, determining an image forming apparatus that formed the document using the ID data, transmitting the ID data to the found image forming apparatus, generating the document data on a media when the image forming apparatus receives from the found image forming apparatus authorization to copy. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS  
         [0011]      FIG. 1  illustrates an image forming system including an image forming apparatus according to the present invention; 
           [0012]      FIG. 2  is a block diagram illustrating an embodiment of the image forming apparatus according to the present invention; 
           [0013]      FIG. 3  is an example of a user display image of the operating device or display apparatus connected to a personal computer according to the present invention; 
           [0014]      FIG. 4  is an example of a security data table stored in an image forming apparatus according to the present invention; 
           [0015]      FIG. 5A  is an example of another security data table stored in an image forming apparatus according to the present invention; 
           [0016]      FIG. 5B  is an example of another security data table stored in an image forming apparatus according to the present invention; 
           [0017]      FIG. 6  is a flow chart illustrating the process for providing an ID on a document according to the present invention; 
           [0018]      FIG. 7  is a flow chart illustrating a secure copying procedure according to the present invention; and 
           [0019]      FIG. 8  illustrates a screen shot for entering a Document ID for modifying values of a security data table. 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION  
       [0020]    In the following, embodiments of the present invention will be described with reference to the accompanying drawings. 
         [0021]    In  FIG. 1 , an image forming system  10  includes an image forming apparatus  11  which functions as a printer, a copier and a scanner. A second image forming apparatus  12 , a personal computer  13 , a first router  14 , a second router  15 , a third router  16  and a network  17  (e.g., a local area network) for interconnecting these apparatuses are also provided. 
         [0022]      FIG. 1  also identifies example IP addresses for each apparatus. The IP address of the image forming apparatus  11  is 192.168.5.101. The IP address of the second image forming apparatus  12  is 192.168.0.101. The IP address of the personal computer  13  is 192.168.0.201. The IP addresses of the first router  14  are 192.168.2.1 and 192.168.0.2. The IP addresses of the second router  15  are 192.168.0.1 and 192.168.1.1. The IP addresses of the third router  16  are 192.168.1.2 and 192.168.5.1. Therefore, the image apparatuses connected to the network  17  are visible to the image forming system  10 . 
         [0023]      FIG. 1  also reflects that the network  17  has several divisions as described below. The second image forming apparatus  12 , the personal computer  13 , the first router  14 , and the second router  15  are connected to first network segment  18  (192.168.0.0). The second router  15  and the third router  16  are connected to a second network segment  19  (192.168.1.0), and the image forming apparatus  11  and the third router  16  are connected to a third network segment  20  (192.168.5.101). IP address (255.255.255.0) is a subnet mask. 
         [0024]      FIG. 2  illustrates that the image forming apparatus  11  and the second image forming apparatus each  12  have a CPU  201 , ROM  202 , RAM  203 , NV-RAM  204 , a communication controller  205 , an operating device  206 , a controller for an engine  207 , an engine for scanning and printing  208 , a disc driver  209 , a storage device  210 , a modem  211 , an external interface  212 , and a communication controller  213 . These devices are connected by data bus  214 . The CPU  201  controls each of these devices. 
         [0025]    The ROM  202  stores static data, for example, program code and font data, etc. The RAM is the working memory of the CPU  201  and temporary storage area. The NV-RAM  204  stores data that requires non-volatile storage and firmware. The communication controller  205  and the operating device  206  function as an interface for the user. The engine controller  207  and the scanning and printing engine  208  function as an input and output unit to scan documents and to generate images on a media (e.g., paper). The disc drive  209  and the storage device  210  function to store document data and older versions of firmware, constructing a table of firmware, and the history of changing firmware versions. The modem  211  is connected to a public switched telephone network and is configured to communicate with external apparatuses. The external interface  212  is configured to communicate with external apparatuses by using, for example, a centronics interface and RS232 etc. The communication controller  213  connected to a LAN and is configured to communicate with external apparatuses. All of these devices are connected by a data bus  214 . 
         [0026]      FIG. 3  illustrates that a user is able to set-up a security level of a document  301  and a prohibition level of copying  302 . Copying authorization can be provided to a department  303  or to another user. A time period of protection  305  can be defined and a document password  306  can be required. If the user wishes not to establish a security-level for the document, then the user can merely copy or print the document by selecting CANCEL  307 . 
         [0027]    According to this example embodiment, the security level of document  301  can be set to top secret  301   a , secret  301   b , or confidential to the outside of the company  301   c.    
         [0028]    The prohibition level of copying  302  can be set to copying authorized  302   a , conditional authorization of copying  302   b , and prohibition of copying  302   c.    
         [0029]    The right to copy can be set by department. For example, the management department  303   a  may be authorized to copy, the human resource department  303   b  may be prohibited from copying, and the intellectual property department  303   c  may have a conditional authorization to copy. New departments  303   d  may be added. If a user chooses department  303 , a department ID is stored in the storage device in the second image forming apparatus. If the user chooses to add department  303   d , then the user is able to add the department. The right to copy can be set for each individual user via the user ID instead of through a department wide authorization. The user ID can be entered in input box  304   a.    
         [0030]    The time period of protection  305  can be set, for example, to 1 month  305   a , 6 months  305   b , or 1 year  305   c . The document password  306  is available for getting a password that is needed when the user wishes to copy the document. 
         [0031]      FIG. 4  is an example of the data table stored in the second image forming apparatus  12 . The data table  40  includes, for example, a document ID  41 , document name  42 , a security level  43 , a period of protection  44 , a department ID or a user ID reflecting a right to copy  45 , a document password  46 , and a history  47 . 
         [0032]    The document ID  41  is set by the second image forming apparatus automatically when a user copies or prints a document. The document ID  41  is generated from the second image forming apparatus&#39;s data including IP address, MAC address, subnet mask etc. 
         [0033]    The document name  42  is set by the user, when the user copies or prints a document, using the operating device  206  or a keyboard or a mouse connected to the personal computer  13 . Moreover, the document name  42  is also set by the second image forming apparatus  12  based on metadata of the document when another user prints out the document. The security level  43 , the period of protection  44 , the department or user ID  45 , and the document password  46  are set by the user via the display image  300 . 
         [0034]      FIG. 5A  is an example of another data table stored in the second image forming apparatus  12 . This data table is accessed when the user copies the document at the image forming apparatus  11 . The data table  50   a  includes User ID  51   a , User password  52   a , and the User&#39;s department  53   a . This data is set by the system manager or the user. 
         [0035]      FIG. 5B  is an example of another data table stored in the second image forming apparatus  12 . This data table is accessed when the user copies the document at the image forming apparatus  11 . The data table  50   b  includes Department ID  51   b , and Department password  52   b . This data is set by the system manager or user. 
         [0036]      FIG. 6  is a flow chart exemplarily showing the process for generating a document ID using the second image forming apparatus  12 . 
         [0037]    The second image forming apparatus  12  receives a signal to generate document data on a media (step S 101 ). The second image forming apparatus  12  receives the signal to generate the document via the operating device  206  or the network  17  via the personal computer  13 . 
         [0038]    The second image forming apparatus  12  displays the display image  300  using, for example, a liquid crystal display, a part of the operating device  206 , or sends the display image  300  to the personal computer  13 . (step S 102 ) 
         [0039]    If the other image forming apparatus  12  receives a copy restriction signal (step S 103 : YES), the second image forming apparatus  12  generates a document ID based on the IP address, MAC address and subnet mask of the second image forming apparatus  12  (step S 104 ). If the second image forming apparatus  12  doesn&#39;t receive a copy restriction signal (step S 103 : NO), the second image forming apparatus  12  generates the document data on the media, for example, paper (step S 105 ). 
         [0040]    The second image forming apparatus  12  adds the document ID data to the document data (step S 106 ). The second image forming apparatus  12  then generates the document data added to the document ID on the media (step S 107 ). Document ID data is added as a two-dimensional code or a digital watermarking etc. 
         [0041]    The second image forming apparatus  12  stores the document ID and copy data, set by the user via display image  300 , for example, a security level of the document  301  etc., to the history data table  40  (step S 108 ). 
         [0042]      FIG. 7  is a flow chart exemplarily showing a copying procedure of the image forming apparatus  11 . The image forming apparatus  11  generates an image file of a document that is read by a reading device. Additionally, the image forming apparatus  11  stores the image file in the storage device  210  (step S 201 ). 
         [0043]    The analyzing device of the image forming apparatus  11  analyzes the document file to find the document ID data. If the document file doesn&#39;t have the document ID (step S 202 : NO), then the image forming apparatus copies the document (step S 203 ). If the document file has the document ID (step S 202 : YES), then the image forming apparatus analyzes the document ID to identify the second image forming apparatus using, for example, it&#39;s IP address, MAC address, and subnet mask etc. Additionally, the image forming apparatus communicates with the second image forming apparatus  12  via a predetermined protocol, for example, SNMP or SOAP etc (step S 204 ). More specifically the image forming apparatus  11  sends the document ID to the second image forming apparatus  12 . 
         [0044]    The image forming apparatus  11  determines whether communication to the second image forming apparatus was a success or failure. If the image forming apparatus  11  determines that the communication was a failure (step S 205 : NO), then the image forming apparatus  11  determines which network segment is connected to the second image forming apparatus  12  using the second image forming apparatus&#39;s IP address and subnet mask. The image forming apparatus  11  then sends the document ID to the second image forming apparatus using the predetermined protocol (step S 206 ). If the image forming apparatus  11  determines that the communication was a success (step S 205 : YES), then the image forming apparatus  11  processes step S 210  as follows. 
         [0045]    The image forming apparatus  11  sends a document password input by the user, the image forming apparatus  11 &#39;s IP address, and MAC address etc (step S 210 ). The second image forming apparatus  12  receives the document password and the image forming apparatus  11 &#39;s IP address, and MAC address etc. The image forming apparatus  12  compares the received document password with the document password in the data table  40  of the second image forming apparatus  12 . If they are a match, then the second image forming apparatus  12  sends authorization of copying to the image forming apparatus  11 . If they are not a match, then the second image forming apparatus  12  doesn&#39;t send an authorization to copy. The second image forming apparatus  12  stores the history of the transaction and the image forming apparatus IP address, and MAC address etc in the data table  40 . 
         [0046]    If the image forming apparatus  11  receives authorization (step S 211 : YES), then the image forming apparatus  11  copies the document and sends the transaction history to the second image forming apparatus  12 . The second image forming apparatus  12  stores the history and the image forming apparatus IP address, and MAC address etc in the data table  40 . 
         [0047]    If the image forming apparatus  11  doesn&#39;t receive authorization (step S 212 : NO), then the image forming apparatus  11  doesn&#39;t copy the document. 
         [0048]    According to an additional embodiment of the present invention, the user is able to input the department or user ID and password in addition to or instead of the document password (step S 210 ). Then the second image forming apparatus  12  accesses the data table  40 , specifically the department or user ID, and data table  50   a  or  50   b . The second image forming apparatus  12  sends authorization of copying if the received ID and password are a match, and confirms the department or user of the right to copy. Although the data table  40  only stores the ID as the value of the ID  45  and the second image forming apparatus received the user ID and password, the second image forming apparatus can confirm the authorization by cross-checking table  50   a , specifically the department value of  53   a  associated with the User ID. 
         [0049]    Users can modify a value of the data table  40  using the operating device  206  or the personal computer  13 .  FIG. 8  is an example of the user interface for modifying values of the data table  40 . The user can access display image  80  if the user changes from a default mode to a modify mode at the operating device  206  or can input the ID address of the second image forming apparatus  12  using the keyboard connected to the personal computer  13 . If the user inputs the document ID at box  81 , the user can retrieve display image  300  with present values. Then the user can modify the values in the data table  40 . 
         [0050]    The present invention is not limited to these embodiments, but various variations and modifications may be made without departing from the scope of the present invention.