Image forming system, image forming apparatus, and job issuing method

An image forming system including a plurality of image forming apparatuses installed in a plurality of areas and in communication with one another via a network includes a management unit configured to manage level information indicating a level related to information management with respect to each of the plurality of areas, and a job issuing unit configured to issue a job, including data for image formation, for causing at least one of the plurality of image forming apparatuses to perform image formation. The image forming system identifies at least one image forming apparatus that can be selected as a destination of the job issued by the job issuing unit based on the level information managed by the management unit.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to an image forming system, an image forming apparatus, and a job issuing method.

2. Description of the Related Art

Japanese Patent Application Laid-Open No. 2001-257827 discusses a method, using a plurality of image forming apparatuses connected with one another via a network, for outputting image data input by one image forming apparatus with another image forming apparatus. Such an operation is referred to as a “remote copy”.

In addition, a conventional entry and exit management system manages and restricts an entrance into an office room or office building.

In order to enhance security, an entry and exit management system issues an identification (ID) card or a password to a registered user to restrict entry into an area to only registered individuals. Such an entry and exit management system requires a person entering such an area to present or enter the issued ID card or password, and permits the person to enter the area only when information described on the ID card or the password matches previously registered ID information or password.

Japanese Patent Application Laid-Open No. 2005-342964 discusses a system utilizing the above-described conventional entry and exit management system. The system discussed in Japanese Patent Application Laid-Open No. 2005-342964 determines, in the case of a network printing, whether a person exists in a room in which an image forming apparatus that has received a print instruction is installed, to determine whether to permit printing.

However, in the case where the above-described remote copy is performed under an environment in which an entry and exit management system operates, an area (room) in which an image forming apparatus that performs printing or outputting is installed may be different from an area in which a user who instructs a remote copy exists.

In this case, a person present in the area in which the image forming apparatus, which is an output destination of the instructed remote copy, is installed cannot be identified. For example, an outsider who has been temporarily permitted to enter the room may be present in the area. In such a case, information leakage may occur such that a print product obtained with the remote copy may be stolen, obtained, or read by the outsider.

Such a problem may occur in the case of performing a print job with an image forming apparatus from a personal computer via a network, in addition to the case of remote copy. That is, a user instructs printing from a computer in an area different from the area where the targeted image forming apparatus exists, a problem similar to the case of remote copying may arise.

SUMMARY OF THE INVENTION

The present invention is directed to an image forming system and an image forming apparatus configured to reduce a risk of information leakage via an output product obtained by image forming.

According to an aspect of the present invention, an image forming system including a plurality of image forming apparatuses installed in a plurality of areas and in communication with one another via a network includes a management unit configured to manage level information indicating a level related to information management with respect to each of the plurality of areas, a job issuing unit configured to issue a job, including data for image formation, for causing at least one of the plurality of image forming apparatuses to perform image formation, and an identification unit configured to identify at least one image forming apparatus as a destination of the job issued by the job issuing unit based on the level information managed by the management unit.

According to yet another aspect of the present invention, an image forming apparatus connected via a network to a plurality of other image forming apparatuses installed in a plurality of areas includes an acquisition unit configured to acquire information about an area from a management device connected to the image forming apparatus via the network and configured to manage level information indicating a level related to information management with respect to each of the plurality of areas, a job issuing unit configured to issue a job for causing at least one of the plurality of image forming apparatuses to perform image formation, and an identification unit configured to identify at least one image forming apparatus as a destination of the job issued by the job issuing unit based on the information about the area acquired by the acquisition unit.

DETAILED DESCRIPTION OF THE EMBODIMENTS

FIG. 1illustrates an exemplary configuration of an image forming system according to an exemplary embodiment of the present invention.

Referring toFIG. 1, area A108, area B109, and area C110are spaces, such as a room, that are physically partitioned by a wall or the like from other spaces (hereinafter referred to as an “area”). While three areas are illustrated inFIG. 1, the number of areas can be greater or smaller than three.

The area A108, the area B109, and the area C110include electric lock doors107a,107b, and107c, respectively. Furthermore, the area A108, the area B109, and the area C110include non-contact integrated circuit (IC) card readers (hereinafter referred to as “IC card readers”)106a,106b, and106c, respectively, for reading identification (ID) information on an ID card that a user carries to identify the user at electronic lock doors107a,107b, and107c.

The IC card readers106athrough106care located outside of area A108, area B109, and area C110, respectively. Additional card readers can be located inside area A108, area B109, and area110C. Thus, when a user carrying an ID card (described below) enters or leaves area A108, or area B109, or area C110, IC card readers106a,106b, and106ccan detect a user entering or exiting a specific area.

Users111,113a,113b,114athrough114d,115a, and115buse the image forming system according to the present embodiment. Each of these users carries an ID card112that records ID information for identifying each user.

In the present embodiment, the ID card112can be a non-contact IC card utilizing radio frequency identification (RFID) technology.

In addition, the ID card112can be a contact type IC card. In this case, a contact type IC card reader is used for each of the IC card readers106athrough106c. As described above, the ID card112records a user ID unique to each of the users111,113a,113b,114athrough114d,115a, and115b.

An entry and exit management server101operates in cooperation with the IC card readers106athrough106c, and stores and manages entering/exiting person management information and area information about each area.

A device management server102manages information about an installation location of each of image forming apparatuses103athrough103d, which are installed within the image forming system. Each of the image forming apparatuses103athrough103dis a multifunction peripheral (MFP), such as a digital copying machine.

IC card readers104athrough104dare connected to the image forming apparatuses103athrough103drespectively. The IC card readers104athrough104dare used for authenticating a user of the image forming apparatuses103athrough103d(hereinafter may be referred to as a “device”). The user can log into the image forming apparatuses103athrough103dusing the ID card112.

In the image forming system according to the present embodiment, the ID card112, which is used by the user when entering or exiting areas A108, B109, and C110, can be used for the user authentication by the image forming apparatuses103athrough103d.

A personal computer (PC)120is capable of sending a print job to the image forming apparatuses103athrough103dvia a network105. The image forming apparatuses103athrough103deach receive the print job from the PC120, form an image according to the print job, and output a print product of the print job.

The network105can include any type of network structure, such as a wireless local area network (WLAN) or Ethernet®. Each of areas A108, B109, and C110are connected to the network105. The entry and exit management server101, the device management server102, the image forming apparatuses103athrough103d, and the PC120are in communication with one another via the network105.

The number of image forming apparatuses and PCs connected to the network105is not limited to the number of devices illustrated inFIG. 1.

In the present embodiment, the IC card readers106athrough106care connected to the entry and exit management server101via a cable122. Alternatively, each of the IC card readers106athrough106ccan be connected to the network105. The IC card readers106athrough106cand the entry and exit management server101can also be connected via a wireless communication (e.g., Bluetooth).

In the present embodiment, the entry and exit management server101and the device management server102are installed in an area other than areas A108, B109, and C110, such as a separate server room (not shown). However, the entry and exit management server101and the device management server102can be installed in any location, e.g., any one of areas A108, B109, or C110, that would enable practice of the present invention.

FIG. 13illustrates an exemplary hardware configuration of an information processing apparatus1300that constitutes the entry and exit management server101, the device management server102, or the PC120.

A central processing unit (CPU)1302, a read-only memory (ROM)1304, a random access memory (RAM)1306, a hard disk drive (HDD)1308, a keyboard (KB)1310, a mouse1312, a display1314, a network interface (I/F)1316, and a local I/F1318are connected with one another via a system bus1320.

The CPU1302executes a program stored on the ROM1304or the HDD1308and loaded to the RAM1306to control the information processing apparatus1300. The ROM1304stores the program to be executed by the CPU1302and information unique to the information processing apparatus1300. The RAM1306serves as a work memory for the CPU1302in executing a program. The HDD1308stores various application programs.

In the case where the information processing apparatus1300is used as the entry and exit management server101, the HDD1308stores an area information table200, entering person management information300, and a user information table400, which are described below with reference toFIGS. 2 through 4.

In the case where the information processing apparatus1300is used as the device management server102, the HDD1308stores a device information table800, which is described below with reference toFIG. 8.

The keyboard1310and the mouse1312are used by the user to enter information for operating the information processing apparatus1300. The display1314displays various information about the information processing apparatus1300.

The network I/F1316is an interface for locally connecting the information processing apparatus1300with the network105. The local I/F1318is an interface, such as a universal serial bus (USB), for locally connecting the information processing apparatus1300with various devices.

In the case where the information processing apparatus1300is used as the entry and exit management server101, the local I/F1318serves as an interface between the information processing apparatus1300and the IC card readers106athrough106cvia the cable122.

FIG. 9illustrates an exemplary configuration of each of the image forming apparatuses103athrough103d.

Referring toFIG. 9, the image forming apparatuses103athrough103deach include a controller unit905. A scanner901and a printer902are connected to the controller unit905. The controller unit905is connected to the network105and a public line (wide area network (WAN))921.

The image forming apparatuses103athrough103deach have a copy function, a printer function for printing out a print job received via the network105, a facsimile transmission function performed via the public line921, and an image sending function performed via the network105. The controller unit905controls input and output of image information and device information used for these functions, and controls each of the image forming apparatuses103athrough103d.

The controller unit905includes a CPU907. The CPU907activates an operating system (OS) based on a boot program stored in a ROM904and reads and executes various control programs stored on an HDD903, using a RAM906as a work area. The HDD903stores image data in addition to the various programs.

The RAM906, the ROM904, the HDD903, an operation unit I/F908, a LAN I/F909, a modem910, and an image bus I/F911are connected to the CPU907via a system bus912.

The operation unit I/F908is an interface with an operation unit913. The operation unit I/F908transfers to the operation unit913image data to be displayed thereon. In addition, the operation unit I/F908transfers a signal generated by a user input via the operation unit913to the CPU907.

The operation unit913includes a display unit and an input unit. The display unit displays a current setting state for each function of the image forming apparatuses103athrough103dand an information input screen for inputting setting information for each function. The input unit includes various keys for inputting setting information for each function.

The operation unit913further includes a numeric keypad for inputting a value for the number of copies and a phone number used in sending a facsimile. The operation unit913also includes a clear button, a reset button, and function buttons, which can be pressed by the user to execute various functions or perform various settings.

In addition, the operation unit913includes a start button and a stop button. The start button can be operated by a user to start a job, such as a copy job, a facsimile job, or a scan job. The stop button can be operated by a user to stop a currently performed job.

Furthermore, the operation unit913includes a display having a touch panel. The user can enter information for various other settings via the touch panel display. A liquid crystal display (LCD) is used for the display.

The LAN I/F909connects the controller unit905with the network105. The LAN I/F909inputs and outputs information via the network105. The modem910connects the controller unit905with the public line921. The modem910inputs and outputs information via the public line921.

The image bus I/F911connects an image bus914with the system bus912. The image bus I/F911is a bus bridge for converting a data structure. The image bus914can be a peripheral component interconnect (PCI) bus or Institute of Electrical and Electronic Engineers (IEEE) 1394 bus, via which image data can be transferred at a high speed.

A raster image processor (RIP)915, a device I/F916, a scanner image processing unit917, a printer image processing unit918, an image rotation unit919, and an image compression/decompression unit920are connected to the image bus914.

The RIP915rasterizes page description language (PDL) code included in a print job into a bitmap image. The device I/F916is an interface between the controller unit905and each of the scanner901and the printer902.

The scanner image processing unit917performs various processing, such as correction, processing, and editing, on image data input by the scanner901. The printer image processing unit918performs processing, such as image correction and resolution conversion, on image data to be printed out.

The image rotation unit919rotates image data. The image compression/decompression unit920compresses or decompresses multivalued image data according to Joint Photographic Experts Group (JPEG) format. In addition, the image compression/decompression unit920compresses or decompresses binary image data according to Joint Bi-level Image Experts Group (JBIG) format, Modified Modified Read (MMR) format, or Modified Huffman (MH) format.

As described above, the CPU907of the controller unit905controls all accesses between the controller unit905and various devices connected via the system bus912according to various control programs. Furthermore, the CPU907performs a control operation to read image data from the scanner901via the device I/F916, to perform predetermined processing on the read image data, and to output the processed image data to the printer902via the device I/F916.

FIG. 2illustrates an example of the area information table200handled by the entry and exit management server101according to the present embodiment. The area information table200is stored on the HDD1308of the entry and exit management server101. The area information table200includes items, such as area type information201, area size information202, and information203about a current alert level in an area for each of areas A108, B109, and C110.

The area type information201indicates a purpose of use of the area. Information indicating a purpose of use includes “office room”, “meeting room”, “reception room”, “lounge”, etc. A setting for the area type information201is not changed unless a configuration of the area is changed.

The area size information202indicates the size of an area. In the present embodiment, the area size information202is expressed by three levels, “large”, “medium”, and “small”. The area size information202can be expressed by a larger number of levels, wherein each level is divided into a smaller area size. Alternatively, the size of an area can be expressed by a numerical value.

The alert level information203indicates a level of management for a particular area. In the present embodiment, the alert level information203describes a degree of risk of information leakage. In the present embodiment, the alert level information203is expressed by two levels, “high” and “low”.

The area type information201and the area size information202of the area information table200can be set by an administrator of the system by accessing the entry and exit management server101via a PC (e.g., the PC120). The entry and exit management server101automatically sets the alert level information203. The operation for setting the alert level information203performed by the entry and exit management server101is described below.

FIG. 3illustrates an example of entering person management information300, which is handled by the entry and exit management server101according to the present embodiment.

The entering person management information300is stored on the HDD1308of the entry and exit management server101. The entering person management information300includes a plurality of entered personnel lists corresponding to each of areas A108, B109, and C110.

An entered personnel list301corresponds to the area A108, an entered personnel list302corresponds to the area B109, and an entered personnel list303corresponds to the area C110. That is, the entering person management information300is generated and managed for each area.

Each of the entered personnel list301, entered personnel list302, and entered personnel list303includes user ID information304and user status information305. The user ID information304indicates a user ID of a user who currently exists in an area. The user status information305can be acquired from the user information table400, which is described below with reference toFIG. 4.

When a user, carrying ID card112, enters an area, the user inserts or presents the ID card112into or to any one of the IC card readers106athrough106c. Thus, the entered personnel list for the corresponding area is updated. This operation is described below.

FIG. 4illustrates an example of the user information table400handled by the entry and exit management server101according to the present embodiment. The user information table400includes user IDs of all registered users using the image forming system according to the present embodiment.

User ID information401describes a registered user ID. User status information402describes user status information of a user having the corresponding user ID. The user ID information401and the user status information402are similar to the user ID information304and the user status information305inFIG. 3.

User present location information403describes information about the area the where the user is currently located. Entrance permitted area information404describes information about an area that the user has been permitted to enter. The entrance permitted area information404can include information about a plurality of areas.

The user ID information401, the user status information field402, and the entrance permitted area information404can be set by the system administrator by accessing the entry and exit management server101via a PC (e.g., the PC120). The user present location information403can be acquired by referring to the entering person management information300.

Processing for managing entry into and exit from an area by a user is described below with reference toFIGS. 5 and 6.

FIG. 5is a flow chart illustrating processing performed with respect to a user entering an area according to the present embodiment.

In the flow chart ofFIG. 5, processing illustrated to the right of the dotted line is performed by the entry and exit management server101. The CPU1302of the entry and exit management server101performs the corresponding processing in the flow chart ofFIG. 5. On the other hand, processing illustrated to the left of the dotted line is performed by any one of the IC card readers106athrough106cand any one of the electric lock doors107athrough107ccorresponding to each of the IC card readers106athrough106cunder the control of the entry and exit management server101.

For discussion purposes, the following description with respect toFIG. 5is provided for the case where a user enters area A108. The same processing is applicable for users entering area B109or area C110.

In step S501, the IC card reader106areads the ID card112. In step S502, the IC card reader106asends the user ID information read from the ID card112to the entry and exit management server101to inquire whether the user is permitted to enter the area A108.

In step S503, the entry and exit management server101refers to the user information table400according to the received user ID information to determine whether the user has already entered an area other than area A108. If it is determined in step S503that the user has not entered an area other than area A108(NO in step S503), then flow advances to step S504.

In step S504, the entry and exit management server101refers to the user information table400to check for the entrance permitted area information of the user and checks if the user has been permitted to enter area A108.

If it is determined in step S504that the user has been permitted to enter area A108(YES in step S504), then the flow advances to step S505. In step S505, the entry and exit management server101adds the user to the entered personnel list301for area A108, and the flow advances to step S506. In step S506, the entry and exit management server101updates the current location information about the user in the user information table400.

Then, the entry and exit management server101sends unlock permission information or unlock inhibition information to the electric lock door107a. Here, the unlock permission information describes that the electric lock can be unlocked for the user. The unlock inhibition information describes that the electric lock cannot be unlocked for the user. In step S507, the entry and exit management server101sends information describing that the electric lock can be unlocked for the user, as unlock permission information.

On the other hand, if it is determined in step S503that the user has already entered an area other than area A108(YES in step S503), or if it is determined in step S504that the user is not permitted to enter area A108(NO in step S504), then the flow advances to step S508. In step S508, the entry and exit management server101sends to the electric lock door107ainformation describing that the electric lock cannot be unlocked (i.e., unlocking of the electric lock is inhibited) as unlock inhibition information.

In step S509, the electric lock door107areceives the unlock permission information or the unlock inhibition information sent from the entry and exit management server101, and the flow then advances to step S510.

In step S510, the electric lock door107adetermines if unlocking of the electric lock door107ais permitted according to the information sent from the entry and exit management server101. If it is determined in step S510that unlocking of the electric lock door107ais permitted (YES in step S510), then the processing advances to step S511. In step S511, the electric lock door107ais unlocked. When the user opens the electric lock door107ato enter area A108and closes the electric lock door107a, the electric lock door107ais re-locked.

On the other hand, if it is determined in step S510that the information sent from the entry and exit management server101describes that the electric lock door107acannot be unlocked (i.e., that the unlocking of the electric lock door107ais inhibited) (NO in step S510), then the electric lock door107ais not unlocked. In this case, the user can be notified that the user is inhibited from entering area A108. For example, the user can be notified verbally via a nearby speaker (not shown) or visually via nearby display (not shown).

In the case where a user attempts to enter area B109or area C110, the IC card reader106bor the IC card reader106cand the electric lock door107bor the electric lock door107cperform the corresponding operation described above with respect to IC card reader106aand electric lock door107a. Furthermore, in this case, information corresponding to the entering person management information300(FIG. 3) and information corresponding to the user information table400(FIG. 4) are used.

FIG. 6is a flow chart illustrating processing performed in the case where a user exits an area according to the present embodiment.

In the flow chart ofFIG. 6, the processing illustrated to the right of the dotted line is performed by the entry and exit management server101. The CPU1302of the entry and exit management server101performs the corresponding processing in the flow chart ofFIG. 6. On the other hand, the processing illustrated to the left of the dotted line is performed by any one of the IC card readers106athrough106cand any one of the electric lock doors107athrough107ccorresponding to each of the IC card readers106athrough106cunder the control of the entry and exit management server101.

As in the case of the description associated withFIG. 5, for discussion purposes, reference to area A108will be used to describe the process ofFIG. 6. The same processing is applicable for users exiting area B109or area C110.

In step S601, the IC card reader106areads the ID card112. In step S602, the IC card reader106asends the user ID information read from the ID card112to the entry and exit management server101to inquire whether the user is permitted to exit area A108.

In step S603, the entry and exit management server101refers to the user information table400according to the received user ID information to determine whether the user has already entered area A108. If it is determined in step S603that the user has entered area A108(YES in step S603), then the flow advances to step S604.

In step S604, the entry and exit management server101deletes the user ID of the user from the entered personnel list301for the area A108, and the flow advances to step S605. In step S605, the entry and exit management server101updates the present location information about the user stored in the user information table400.

The processing illustrated in the flow chart ofFIG. 6is performed to allow the user to move to a location other than area A108, area B109, or area C110. Accordingly, in this case, when the user has moved to a location other than area A108, area B109, or area C110, no information is described in the user present location information403of the user information table400. Alternatively, information describing that the user does not exist in any of areas A108, B109, or C110is described in the user present location information403of the user information table400.

Then, the entry and exit management server101sends unlock permission information or unlock inhibition information to the electric lock door107a. Here, as described above with reference toFIG. 5, the unlock permission information describes that the electric lock can be unlocked for the user. The unlock inhibition information describes that the electric lock cannot be unlocked for the user. In step S606, the entry and exit management server101sends information describing that the electric lock can be unlocked for the user as unlock permission information.

On the other hand, if it is determined in step S603that the user has not entered area A108yet (NO in step S603), then the entry and exit management server101advances to step S607. In step S607, the entry and exit management server101sends to the electric lock door107ainformation describing that the electric lock door107acannot be unlocked (i.e., that the unlocking of the electric lock door107ais inhibited) as unlock inhibition information.

When the electric lock door107areceives the unlock permission information from the entry and exit management server101, the electric lock door107ais unlocked according to the received unlock permission information, and the user exits area A108.

In step S608, the electric lock door107areceives the unlock permission information or the unlock inhibition information sent from the entry and exit management server101, and the flow then advances to step S609.

In step S609, the electric lock door107adetermines whether unlocking of the electric lock door107ais permitted according to the information sent from the entry and exit management server101. If it is determined in step S609that unlocking of the electric lock door107ais permitted (YES in step S609), then the flow advances to step S610. In step S610, the electric lock door107ais unlocked. In this case, when the user opens the electric lock door107a, exists area A108, and closes the electric lock door107a, the electric lock door107ais re-locked.

On the other hand, if it is determined in step S609that unlocking of the electric lock door107ais inhibited (NO in step S609), the electric lock door107ais not unlocked. In this case, the user can be notified that the user is inhibited from exiting area A108. For example, the user can be notified verbally via a nearby speaker (not shown) or visually via a nearby display (not shown).

In the case where a user attempts to exit area B109or area C110, the IC card reader106bor the IC card reader106cand the electric lock door107bor the electric lock door107cperform the corresponding operation. Furthermore, in this case, information corresponding to the entering person management information300(FIG. 3) and information corresponding to the user information table400(FIG. 4) are used.

By performing the processing in the flow charts ofFIGS. 5 and 6, the entry and exit management server101can identify a present location of a user and thus manage a user's entry into and exit from an area.

Processing for updating an alert level according to area information will now be described with reference toFIG. 7.

First, a basic application method of an “alert level” according to the present embodiment will be briefly described. In the present embodiment, an “alert level” indicates a degree of risk of information leakage. Here, “information” includes information described on a print product produced by image forming apparatuses103athrough103dor information displayed on a display of PC120.

When a third party who is not authorized to be in a particular area, i.e., a non-employee or an employee who is not associated with the department associated with the particular area (hereinafter referred to as an “outsider”), is in the particular area, it is necessary to raise the alert level for the area. This is because there is a risk of information leakage if the outsider reads or obtains confidential information while in the area.

The alert level is also determined based on the size of the area or a purpose of use of the area. For example, in the case where the area in question is small and an employee authorized to be in the area is present to see what an outsider in the area is doing, the risk of information leakage is low.

Furthermore, with respect to an area used as a meeting room, the risk of information leakage does not necessarily become high if an outsider is in the area, as long as the outsider cannot freely act in the area. That is, with respect to a small area and an area used for a specific purpose, it is not always necessary to raise the alert level, even if an outsider is present in the area.

The basic method for setting an alert level according to the present embodiment is as described above. However, the method for setting an alert level for an area is not limited to this.

For example, the alert level can be variably set in a manner such that the alert level is set relatively low in daytime and relatively high in nighttime. Alternatively, the alert level can be variably set according to a day of the week, in a manner such that the alert level is set relatively low on weekdays and relatively high on weekends.

FIG. 7is a flow chart illustrating processing for updating an alert level in the area information table200according to the present embodiment. The processing in the flow chart ofFIG. 7is performed by the entry and exit management server101.

The entry and exit management server101updates a list of persons entering or exiting from each area by the processing illustrated in the flow charts ofFIGS. 5 and 6. In step S701, the entry and exit management server101determines whether the list of persons having entered a particular area is updated.

If it is determined in step S701that the list of persons having entered a particular area is updated (YES in step S701), then the flow advances to step S702. In step S702, the entry and exit server101determines whether an outsider exists in a particular area according to the status information about all the entered persons listed in the entered person list for that particular area.

On the other hand, if it is determined in step S701that the list of persons having entered a particular area is not updated (NO in step S701), then the entry and exit management server101does not change the alert level for that particular area, and the processing ends.

If it is determined in step S702that no outsider exists in the particular area (NO in step S702), then the flow advances to step S706. In step S706, the entry and exit management server101determines that the risk of information leakage in that area is low, and sets the alert level information for the area to “low”. On the other hand, if it is determined in step S702that an outsider exists in the particular area (YES in step S702), then the flow advances to step S703.

In step S703, the entry and exit management server101determines whether the type of the particular area is a meeting room. If it is determined in step S703that the type of the particular area is not a meeting room (NO in step S703), then the flow advances to step S707. In step S707, the entry and exit management server101determines that the risk of information leakage in the area is high, and sets the alert level information for the area to “high”. On the other hand, if it is determined in step S703that the type of the particular area is a meeting room (YES in step S703), then the flow advances to step S704.

In step S704, the entry and exit management server101refers to the area information table200to determine the size of the particular area, e.g., whether the area size information is “small”.

If it is determined in step S704that the area size information is not “small” (NO in step S704), then the flow advances to step S707. On the other hand, if it is determined in step S704that the area size information is “small” (YES in step S704), the flow advances to step S705.

In step S705, the entry and exit management server101refers to the entered personnel list for the particular area to determine whether the entered personnel list includes information about an insider, e.g., whether an insider exists in the particular area. Here, an “insider” refers to an individual who is permitted to access confidential information and is expected to maintain the confidentiality of certain information.

If it is determined in step S705that no insider is present in the particular area (NO in step S705), then the flow advances to step S707. In step S707, the entry and exit management server101determines that the risk of information leakage in the area is high because only an outsider is present in the area, and sets the alert level information for the concerned area to “high”. On the other hand, if it is determined in step S705that an insider is present in the particular area (YES in step S705), then the entry and exit management server101advances to step S706. In step S706, the entry and exit management server101sets the alert level information for the concerned area to “low”.

After the entry and exit management server101sets the alert level for the particular area to “low” in step S706or the entry and exit management server101sets the alert level for the particular area to “high” in step S707, the processing ends.

In the case where the users114dand115aare outsiders in the system according to the present embodiment (FIG. 1), the area information describes a content illustrated inFIG. 2.

In this case, the alert level for area A108is set to “low” because no outsider is present in area A108. The alert level for area B109is set to “high” because an outsider is present in area B109and the type of area B109is not a meeting room. The alert level for area C110is set to “low” because, in a state illustrated inFIG. 1, although an outsider is present in area C110, the type of area C110is a meeting room and the user115b, who is an insider, is present in area C110.

In the present embodiment, the entry and exit management server101determines whether the type of the particular area is a “meeting room” in step S703. However, the type of the particular area used as a determination reference can be any type of room, such as a server room or a reception room. In addition, a plurality of area types can be used as determination references. The type of area used as a determination reference in step S703can be set by a system administrator by accessing the entry and exit management server101via a PC (e.g., the PC120).

In the processing in the flow chart ofFIG. 7, even if an outsider is present in the particular area, the alert level can be set to “low” depending on the area type and the area size. However, if enhancement of security is desired, the alert level can be determined based only on whether an outsider is present in the particular area, regardless of the area type and the area size. In this case, the alert level is set to “high” if an outsider is present, and to “low” if no outsider is present.

FIG. 8illustrates an example of a device information table800stored on the HDD1308of the device management server102according to the present embodiment.

The device information table800includes information of a device name801, a device model type802, and an area name803of an area in which an image forming apparatus is installed. If image forming apparatuses are newly connected to the network105, the system administrator updates the device information table800by accessing the device management server102via a PC (e.g., the PC120).

A remote copy operation, which is an example of an operation performed by the image forming system according to the present embodiment, is described with reference toFIGS. 10,11, and12.

In the present embodiment, “remote copy” refers to an operation for sending image data input by an image forming apparatus to another image forming apparatus and printing out the image data at that image forming apparatus. An image forming apparatus that inputs an image is hereinafter referred to as a “local apparatus”, and an image forming apparatus that prints out received image data is hereinafter referred to as a “remote apparatus”.

A user generates an instruction for starting a remote copy via the operation unit913of the local apparatus. In starting the remote copy instructed by the user, the local apparatus sends image data and data describing the user instruction for starting the remote copy to the remote apparatus. The image data and the data for instructing a start of a remote copy is hereinafter collectively referred to as “remote copy job”. The local apparatus sends a remote copy job to the remote apparatus to instruct the remote apparatus to start the remote copy.

FIG. 10is a flow chart illustrating remote copy processing according to the present embodiment.

For discussion purposes, a case of starting a remote copy instructed by the user113avia the image forming apparatus103ainstalled in area A108will be used to describe the process ofFIG. 10. The processing illustrated inFIG. 10is applicable to a user starting a remote copy from an image forming apparatus in area B109or area C110.

InFIG. 10, processing flow (a) is performed by the image forming apparatus103a, processing flow (b) is performed by the entry and exit management server101, and processing flow (c) is performed by the device management server102.

In step S1000, the user113alogs into the image forming apparatus103ain area A108to generate an instruction for starting a remote copy. More specifically, the user113auses the ID card112in conjunction with the IC card reader104aconnected to the image forming apparatus103ato log into the image forming apparatus103a.

When the user113ahas successfully logged into the image forming apparatus103a, the operation unit913of the image forming apparatus103adisplays a copy setting screen1100as illustrated inFIG. 11.

In step S1001, when the user113apresses a remote copy function button1101(FIG. 11), the image forming apparatus103asends the user ID of the user113awho has logged into the image forming apparatus103ato the entry and exit management server101. In step S1002, the image forming apparatus103aaccesses the entry and exit management server101to request for user print-permitted area information.

In step S1003, the entry and exit management server101extracts from the area information table an area whose alert level is set to “low”. In step S1004, the entry and exit management server101determines whether an area in which the user113ais present is included in the areas extracted in step S1003.

If it is determined in step S1004that the area in which the user113ais present is not included in the areas extracted in step S1003(NO in step S1004), then the entry and exit management server101advances to step S1005. In step S1005, the entry and exit management server101adds the area in which the user113ais presently located to the list of areas. Then, the processing advances to step S1006.

On the other hand, if it is determined in step S1004that the area in which the user113ais present is included in the areas extracted in step S1003(YES in step S1004), then the entry and exit management server101advances to step S1006.

In step S1006, the entry and exit management server101sends the generated area information to the image forming apparatus103aas user print permitted area information. Here, the list of areas generated by the entry and exit management server101includes areas in which the risk of information leakage is low even when the remote copy job is printed out therein.

As described above, in step S1006, the areas whose risk of information leakage are extracted. Accordingly, the risk that the user113amay select an image forming apparatus installed in an area in which the risk of information leakage is high can be reduced.

In step S1007, the image forming apparatus103areceives the user print permitted area information from the entry and exit management server101. In step S1008, the image forming apparatus103asends the user print permitted area information to the device management server102to request information about the presence or absence of a printer in the user print permitted area. The device management server102, according to the received area information, searches the device information table800for information about a printer.

In step S1009, the device management server102extracts a printer installed in the user print permitted area. In step S1010, the device management server102sends a list of printers to the image forming apparatus103aas printer information, which includes information about a printer name, a printer model type, and a name of an area in which the printer is installed.

In step S1011, the image forming apparatus103areceives the printer list. In step S1012, the image forming apparatus103adisplays a list of image forming apparatuses (a device list) capable of printing out the remote copy job on a display of the operation unit913.

The image forming apparatuses installed in an area in which the risk of information leakage is low are displayed in step S1012. Accordingly, the user113acan be prevented from selecting an image forming apparatus installed in an area whose risk of information leakage is high.

FIG. 12illustrates an example of an operation screen1200displaying a list of printers available for printing on a display of the operation unit913of the image forming apparatus103a. The printers available for printing include the image forming apparatus103dinstalled in area A108, the image forming apparatus103cin area C110, and an image forming apparatus (not illustrated) in an area Z (not illustrated).

A user can select an image forming apparatus to be used as a remote apparatus by checking a check box1202.FIG. 12illustrates a state in which the user113ahas selected the image forming apparatus103cinstalled in area C110. The user can select a plurality of remote apparatuses.

Returning toFIG. 10, the user selects an image forming apparatus that is a print destination in step S1013and presses a job start key (not illustrated) to generate an instruction for starting a remote copy.

The image forming apparatus103a(i.e., a local apparatus), after receiving the user instruction for starting the remote copy, reads an image of a document and generates image data according to the read document image. Then, the image forming apparatus103asends the generated image data to the image forming apparatus103c(i.e., a remote apparatus) via the network105.

After receiving the image data from the local apparatus, the image forming apparatus103coutputs an image based on the received image data. Thus, the remote copy processing ends.

The user113ahaving issued an instruction for the remote copy then exits area A108and enters area C110to obtain a print product output by the image forming apparatus103c.

During the time period in which the user moves from area A108to area C110, the print product output by the remote copy is left on a discharge tray of the image forming apparatus103c. However, the risk of information leakage of the print product output from the image forming apparatus103cis low because the alert level of the area C110is set to “low”.

In the processing according to the flow chart ofFIG. 10, the local apparatus is the image forming apparatus103a. However, the local apparatus is not limited to the image forming apparatus103a, and an image forming apparatus other than the image forming apparatus103acan be used as a local apparatus.

In addition, in performing a remote copy according to the processing in the flow chart ofFIG. 10, image forming apparatuses installed in an area that the user who has instructed the remote copy cannot enter (i.e., inhibited from entering) can be excluded from the list of printers available for printing.

If the user having instructed the remote copy selects a remote apparatus installed in an area that the user cannot enter (inhibited from entering), the user cannot enter that area to retrieve the print product output by the remote apparatus. In order to prevent this scenario from occurring, the entry and exit management server101, in step S1003, can refer to the user information table400and notify the image forming apparatus of the list of areas that the user can enter whose alert level is set to “low”.

The processing in the flow chart ofFIG. 10is performed in the case of a remote copy. In this regard, this processing is applicable in the case where a user generates, via the PC120, an instruction for starting a print job by an image forming apparatus connected to the network105. In this case, the PC120performs the processing flow (a) inFIG. 10and a printer driver of the PC120displays the operation screen illustrated inFIG. 12.

In the present embodiment, in performing a remote copy or a print job, a user can select an image forming apparatus to be used for outputting an image based on the alert level for an area in which the image forming apparatus is installed. Accordingly, an output by an image forming apparatus with which there may arise a risk of information leakage can be prevented or reduced. Thus, information leakage by a print product can be prevented or reduced.

The present invention can also be applied to a system including a plurality of devices (e.g., a scanner, a printer, a PC, a copying machine, or a facsimile machine) and to an apparatus that includes one device (e.g., a network multifunction peripheral).

The present invention can be implemented by directly or remotely supplying a program of software implementing functions of the above-described exemplary embodiments (in the exemplary embodiments, the program corresponding to the processing performed according to the flow charts in the drawings) to a system or an apparatus and reading and executing the supplied program code with a computer of the system or the apparatus.

Accordingly, the program code itself, which is installed on the computer for implementing the functional processing of an exemplary embodiment of the present invention with the computer, implements the present invention. That is, the present invention also includes a computer program implementing the functional processing of an exemplary embodiment of the present invention.

The program can be configured in any form, such as object code, a program executed by an interpreter, and script data supplied to an OS.

As the recording medium for supplying such program code, a floppy disk, a hard disk, an optical disk, a magneto-optical disk (MO), a compact disk-read only memory (CD-ROM), a CD-recordable (CD-R), a CD-rewritable (CD-RW), a magnetic tape, a nonvolatile memory card, a ROM, and a digital versatile disk (DVD) (a DVD-read only memory (DVD-ROM) and a DVD-recordable (DVD-R)), for example, can be used.

The above program can also be supplied by connecting to a web site on the Internet by using a browser of a client computer and by downloading the program from the web site to a recording medium such as a hard disk. In addition, the above program can also be supplied by downloading a compressed file that includes an automatic installation function from the web site to a recording medium such as a hard disk. The functions of the above embodiments can also be implemented by dividing the program code into a plurality of files and downloading each divided file from different web sites. That is, a World Wide Web (WWW) server or a file transfer protocol (ftp) server for allowing a plurality of users to download the program file for implementing the functional processing configures the present invention.

In addition, the above program can also be supplied by distributing a storage medium such as a CD-ROM which stores the program according to the present invention after an encryption thereof, by allowing the user who is qualified for a prescribed condition to download key information for decoding the encryption from the web site via the Internet or an intranet, and by executing and installing in the computer the encrypted program code by using the key information.

In addition, the functions according to the embodiments described above can be implemented not only by executing the program code read by the computer, but also implemented by the processing in which an OS or the like carries out a part of or the whole of the actual processing based on an instruction given by the program code.

Further, in an exemplary embodiment of the present invention, after the program code read from the recording medium is written in a memory provided in a function expansion board inserted in a computer or a function expansion unit connected to the computer, a CPU and the like provided in the function expansion board or the function expansion unit carries out a part of or the whole of the processing to implement the functions of the embodiments described above.

This application claims priority from Japanese Patent Application No. 2006-339860 filed Dec. 18, 2006, which is hereby incorporated by reference herein in its entirety.