Patent Publication Number: US-10331389-B2

Title: Remote communication control system that improves security of remote session between image forming apparatus and connection terminal, remote communication system, session management system, and recording medium

Description:
INCORPORATION BY REFERENCE 
     This application is based upon, and claims the benefit of priority from, corresponding Japanese Patent Application No. 2017-128657 filed in the Japan Patent Office on Jun. 30, 2017, the entire contents of which are incorporated herein by reference. 
     BACKGROUND 
     Unless otherwise indicated herein, the description in this section is not prior art to the claims in this application and is not admitted to be prior art by inclusion in this section. 
     There is known a system that executes a communication between an image forming apparatus and an electronic device located inside a Local Area Network (LAN) to which the image forming apparatus belongs. This system causes the image forming apparatus to display a User Interface (UI) screen generated by the electronic device and causes the image forming apparatus to execute a print job based on print data accumulated in the electronic device. 
     SUMMARY 
     A remote communication control system according to one aspect of the disclosure includes a session relay system and a session management unit. The session relay system relays a session between an image forming apparatus and an electronic device by associating a connection established with the image forming apparatus with a connection established with the electronic device. The electronic device is located outside a network to which the image forming apparatus belongs. The session management unit manages the session. When the electronic device requests a start of the session, the session management unit causes the image forming apparatus to install an application required to establish the session. 
     These as well as other aspects, advantages, and alternatives will become apparent to those of ordinary skill in the art by reading the following detailed description with reference where appropriate to the accompanying drawings. Further, it should be understood that the description provided in this summary section and elsewhere in this document is intended to illustrate the claimed subject matter by way of example and not by way of limitation. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  illustrates a block diagram of a remote communication system according to one embodiment of the disclosure; 
         FIG. 2  illustrates a block diagram when an image forming apparatus according to the one embodiment is an MFP; 
         FIG. 3  illustrates a block diagram of a connection terminal according to the one embodiment; 
         FIG. 4  illustrates a block diagram of a remote maintenance system according to the one embodiment when the remote maintenance system is configured using one server computer; 
         FIG. 5  illustrates a function implemented by a session relay system according to the one embodiment; 
         FIG. 6  illustrates an operation of the remote communication system according to the one embodiment when a user of the connection terminal logs in to the remote maintenance system; 
         FIG. 7  illustrates an operation of the remote communication system according to the one embodiment when a remote maintenance is executed via the remote maintenance system; 
         FIG. 8  illustrates an operation of the remote communication system according to the one embodiment when a remote session is started; 
         FIG. 9  illustrates a sequence diagram of a server application confirmation illustrated in  FIG. 8 ; 
         FIG. 10  illustrates a sequence diagram of a device side session establishment illustrated in  FIG. 8 ; 
         FIG. 11  illustrates a sequence diagram of a connection terminal side session establishment illustrated in  FIG. 8 ; 
         FIG. 12  illustrates an exemplary remote session approval screen displayed in the operation illustrated in  FIG. 8 ; 
         FIG. 13  illustrates an exemplary application installation approval screen displayed in the operation illustrated in  FIG. 8 ; 
         FIG. 14  illustrates an operation of the remote communication system according to the one embodiment when the image forming apparatus operates corresponding to a request from the connection terminal via the remote session; 
         FIG. 15A  illustrates HTTP data processed by a server application in the operation illustrated in  FIG. 14 ; 
         FIG. 15B  illustrates HTTP data for relaying the HTTP data illustrated in  FIG. 15A  on the Internet; 
         FIG. 16  illustrates an operation of the remote communication system according to the one embodiment when the remote session is terminated; and 
         FIG. 17  illustrates a sequence diagram of a device side session termination illustrated in  FIG. 16 . 
     
    
    
     DETAILED DESCRIPTION 
     Example apparatuses are described herein. Other example embodiments or features may further be utilized, and other changes may be made, without departing from the spirit or scope of the subject matter presented herein. In the following detailed description, reference is made to the accompanying drawings, which form a part thereof. 
     The example embodiments described herein are not meant to be limiting. It will be readily understood that the aspects of the present disclosure, as generally described herein, and illustrated in the drawings, can be arranged, substituted, combined, separated, and designed in a wide variety of different configurations, all of which are explicitly contemplated herein. 
     The following describes one embodiment of the disclosure with reference to the drawings. 
     First, a configuration of a remote communication system according to the embodiment will be described. 
       FIG. 1  illustrates a block diagram of a remote communication system  10  according to the embodiment. 
     As illustrated in  FIG. 1 , the remote communication system  10  includes an image forming apparatus  20 , a gateway  30 , a connection terminal  40 , and a remote communication control system  15 . The gateway  30  connects a network, such as a Local Area Network (LAN), to which the image forming apparatus  20  belongs, to a network, such as the Internet. The connection terminal  40  is an electronic device located outside the network to which the image forming apparatus  20  belongs. The remote communication control system  15  controls a communication between the image forming apparatus included in the remote communication system  10  and the connection terminal included in the remote communication system  10 . 
     The remote communication control system  15  includes a remote maintenance system  50  and a session relay system  60 . The remote maintenance system  50  is a cloud service that executes a remote maintenance to the image forming apparatus included in the remote communication system  10  corresponding to an instruction from the connection terminal included in the remote communication system  10 . The session relay system  60  is a cloud service that relays a direct interconnection between the image forming apparatus included in the remote communication system  10  and the connection terminal included in the remote communication system  10 , that is, a Peer to Peer session (hereinafter referred to as a “remote session”). 
     The remote communication system  10  can include an image forming apparatus in addition to the image forming apparatus  20  in the network to which the image forming apparatus  20  belongs. The remote communication system  10  can include a network to which an image forming apparatus belongs in addition to the network to which the image forming apparatus  20  belongs. The image forming apparatus included in the remote communication system  10  is, for example, an image forming apparatus, such as a Multifunction Peripheral (MFP), a printer-only machine, a copy-only machine, a FAX-only machine, and a scanner-only machine. 
     The gateway  30  configures a firewall that prevents an attack to an inside of the network to which the image forming apparatus  20  belongs from an outside of this network. Therefore, a communication between the image forming apparatus included in the remote communication system  10  and the remote maintenance system  50  is maintained by keeping the image forming apparatus included in the remote communication system  10  connecting to the remote maintenance system  50  by an Extensible Messaging and Presence Protocol (XMPP). 
     The remote communication system  10  can include a connection terminal in addition to the connection terminal  40 . The connection terminal included in the remote communication system  10  is, for example, a computer, such as a Personal Computer (PC). 
     The remote maintenance system  50  is constituted of, for example, a server computer. The remote maintenance executed by the remote maintenance system  50  is, for example, maintenance, such as a confirmation of a counter of the image forming apparatus and an installation of firmware to the image forming apparatus. The remote maintenance system  50  not only executes the remote maintenance but also manages a remote session. That is, the remote maintenance system  50  configures the session management system of the disclosure. 
     The session relay system  60  is constituted of, for example, a server computer. 
     The image forming apparatus included in the remote communication system  10  and the remote maintenance system  50  can communicate via a network, such as the Internet. The image forming apparatus included in the remote communication system  10  and the session relay system  60  can communicate via a network, such as the Internet. The connection terminal included in the remote communication system  10  and the remote maintenance system  50  can communicate via a network, such as the Internet. The connection terminal included in the remote communication system  10  and the session relay system  60  can communicate via a network, such as the Internet. The remote maintenance system  50  and the session relay system  60  can communicate via a network, such as the Internet. 
       FIG. 2  illustrates a block diagram when the image forming apparatus  20  is an MFP. 
     The image forming apparatus  20  illustrated in  FIG. 2  includes an operation unit  21 , a display  22 , a scanner  23 , a printer  24 , a fax communication unit  25 , a communication unit  26 , a storage unit  27 , and a control unit  28 . The operation unit  21  is an input device, such as buttons, with which various kinds of operations are input. The display  22  is a display device, such as a Liquid Crystal Display (LCD), that displays various pieces of information. The scanner  23  is a reading device that reads an image from an original document. The printer  24  is a print device that prints the image on a recording medium, such as a paper sheet. The fax communication unit  25  is a facsimile device that carries out fax communication with an external fax device (not illustrated) via a communication line, such as a dial-up line. The communication unit  26  is a communication device that communicates with an external device via a network or directly with wire or wireless without a network. The storage unit  27  is a non-volatile storage device, such as a semiconductor memory and a Hard Disk Drive (HDD), that stores various pieces of information. The control unit  28  controls the whole image forming apparatus  20 . 
     The control unit  28  includes, for example, a Central Processing Unit (CPU), a Read Only Memory (ROM) that stores programs and various data, and a Random Access Memory (RAM) used as a work area for the CPU The CPU executes the programs stored in the ROM or the storage unit  27 . 
     The control unit  28  executes the programs stored in the ROM or the storage unit  27  to implement a server application  28   a  used from the connection terminal included in the remote communication system  10  via the remote session, a Cloud Hub Agent  28   b  that controls a communication with the session relay system  60  (see  FIG. 1 ), and a remote session control unit  28   c  that controls a remote session. 
     The control unit  28  can implement a server application in addition to the server application  28   a  by executing the programs stored in the ROM or the storage unit  27 . 
     The server application implemented by the control unit  28  includes, for example, a Web Server that notifies the outside of the network to which the image forming apparatus  20  belongs of various setting conditions of the image forming apparatus  20  and accepts various settings of the image forming apparatus  20  from the outside of the network to which the image forming apparatus  20  belongs. Additionally, the server application implemented by the control unit  28  includes, for example, a Remote APP Server that transmits data of a screen (for example, a Webpage) displayed on the display  22  of the image forming apparatus  20  to the outside of the network to which the image forming apparatus  20  belongs and receives an operation to the screen displayed based on this data from the outside of the network to which the image forming apparatus  20  belongs to cause the image forming apparatus  20  to operate corresponding to the received operation. 
     The server application implemented by the control unit  28  can be identified by an application ID. 
       FIG. 3  illustrates a block diagram of the connection terminal  40 . 
     As illustrated in  FIG. 3 , the connection terminal  40  includes an operation unit  41 , a display  42 , a communication unit  43 , a storage unit  44 , and a control unit  45 . The operation unit  41  is an input device, such as a keyboard and a mouse, with which various kinds of operations are input. The display  42  is a display device, such as an LCD, that displays various pieces of information. The communication unit  43  is a communication device that communicates with an external device via the network or directly with wire or wireless without the network. The storage unit  44  is a non-volatile storage device, such as a semiconductor memory and an HDD, that stores various pieces of information. The control unit  45  controls the whole connection terminal  40 . 
     The control unit  45  includes, for example, a CPU, a ROM that stores programs and various data, and a RAM used as a work area for the CPU. The CPU executes the programs stored in the ROM or the storage unit  44 . 
     The control unit  45  executes the programs stored in the ROM or the storage unit  44  to implement a login unit  45   a , a remote maintenance instruction unit  45   b , a client  45   c , and a remote session control unit  45   d . The login unit  45   a  executes a login process to the remote maintenance system  50 . The remote maintenance instruction unit  45   b  instructs the remote maintenance to the remote maintenance system  50 . The client  45   c  uses the server application of the image forming apparatus included in the remote communication system  10  via the remote session. The remote session control unit  45   d  controls the remote session. 
     The control unit  45  can implement a client in addition to the client  45   c  by executing the programs stored in the ROM or the storage unit  44 . 
     The client implemented by the control unit  45  includes, for example, a Web Browser that displays a setting condition notified from the Web Server as the server application on the display  42  and instructs various kinds of settings input from the operation unit  41  to this Web Server. Additionally, the client implemented by the control unit  45  includes, for example, an application, such as a Remote APP Client, that displays a screen based on data of a screen received from a Remote APP Server as a server application on the display  42  and transmits the operation input to this screen from the operation unit  41  to this Remote APP Server. 
     The client implemented by the control unit  45  can be identified by an application ID. The application ID for identifying the client implemented by the control unit  45  is identical to the application ID for identifying the server application of the image forming apparatus corresponding to this client. 
       FIG. 4  illustrates a block diagram of the remote maintenance system  50  when the remote maintenance system  50  is configured using one server computer. 
     As illustrated in  FIG. 4 , the remote maintenance system  50  includes an operation unit  51 , a display  52 , a communication unit  53 , a storage unit  54 , and a control unit  55 . The operation unit  51  is an input device such as a keyboard and a mouse to which various kinds of operations are input. The display  52  is a display device such as an LCD that displays various kinds of information. The communication unit  53  is a communication device that communicates with an external device via the network or directly with wire or wireless without the network. The storage unit  54  is a non-volatile storage device such as a semiconductor memory and an HDD that store various kinds of information. The control unit  55  controls the entire remote maintenance system  50 . 
     The storage unit  54  stores a session management program  54   a  for managing the remote session. 
     The control unit  55  includes, for example, a CPU, a ROM that stores programs and various kinds of data, and a RAM used as a work area for the CPU. The CPU executes the programs stored in the ROM or the storage unit  54 . 
     The control unit  55  executes a specific program stored in the ROM or the storage unit  54  to implement a login permission determining unit  55   a  and a remote maintenance unit  55   b . The login permission determining unit  55   a  determines whether to permit a user login. The remote maintenance unit  55   b  executes the remote maintenance. 
     The control unit  55  executes the session management program  54   a  to implement a session management unit  55   c  that manages the remote session. 
       FIG. 5  illustrates a function implemented by the session relay system  60 . 
     As illustrated in  FIG. 5 , the session relay system  60  executes a specific program to implement a Cloud Hub  61  that controls a communication with the image forming apparatus included in the remote communication system  10 . The session relay system  60  executes a specific program so as to ensure implementing a Cloud Hub in addition to the Cloud Hub  61 . 
     The session relay system  60  executes a specific program to implement a Web Agent  62  that controls a communication with the connection terminal included in the remote communication system  10 . The session relay system  60  executes a specific program so as to ensure implementing a Web Agent in addition to the Web Agent  62 . 
     The session relay system  60  executes a specific program to implement a Master  63  and a session management database  64 . The Master  63  determines which Cloud Hub is connected to the image forming apparatus and which Web Agent is connected to the connection terminal. The session management database  64  stores a log relating to the remote session. 
     The Cloud Hub included in the session relay system  60  and the Web Agent included in the session relay system  60  are in a relationship on a one-to-one basis. That is, a count of the Cloud Hub included in the session relay system  60  and a count of the Web Agent included in the session relay system  60  are identical. 
     When the image forming apparatus included in the remote communication system  10  is connected to the session relay system  60 , the Master  63  determines which Cloud Hub is connected to this image forming apparatus. However, an operation of the Master  63  will not be further elaborated below. 
     Similarly, when the connection terminal included in the remote communication system  10  is connected to the session relay system  60 , the Master  63  determines which Web Agent is connected to this connection terminal. However, an operation of the Master  63  will not be further elaborated below. 
     Next, an operation of the remote communication system  10  will be described. 
     First, an operation of the remote communication system  10  when a user of the connection terminal  40  logs in to the remote maintenance system  50  will be described. 
       FIG. 6  illustrates the operation of the remote communication system  10  when the user of the connection terminal  40  logs in to the remote maintenance system  50 . 
     The user of the connection terminal  40  can instruct a login to the remote maintenance system  50  by inputting a user ID and a password via the operation unit  41 . When accepting the instruction to log in to the remote maintenance system  50 , the login unit  45   a  of the connection terminal  40  notifies the remote maintenance system  50  of the user ID and the password input via the operation unit  41  as illustrated in  FIG. 6  to execute a login process to the remote maintenance system  50  (Step S 101 ). 
     The login permission determining unit  55   a  of the remote maintenance system  50  determines whether the login of the user is permitted or not based on a combination of the user ID and the password notified from the connection terminal  40  when the connection terminal  40  requests the login (Step S 102 ), and replies a determination result to the connection terminal  40  (Step S 103 ). 
     Next, an operation of the remote communication system  10  when the remote maintenance is executed via the remote maintenance system  50  will be described. 
       FIG. 7  illustrates the operation of the remote communication system  10  when the remote maintenance is executed via the remote maintenance system  50 . 
     When being logged in to the remote maintenance system  50 , the user of the connection terminal  40  can instruct the remote maintenance of a specific image forming apparatus (hereinafter described as the image forming apparatus  20  in the description of the operation illustrated in  FIG. 7 ) via the remote maintenance system  50 . This remote maintenance is instructed via the operation unit  41 . When accepting the instruction of the remote maintenance via the remote maintenance system  50 , the remote maintenance instruction unit  45   b  of the connection terminal  40  notifies the remote maintenance system  50  of a device ID of the image forming apparatus  20  instructed via the operation unit  41  as illustrated in  FIG. 7  to instruct the remote maintenance instructed via the operation unit  41  to the remote maintenance system  50  (Step S 121 ). 
     When being instructed the remote maintenance from the connection terminal  40 , the remote maintenance unit  55   b  of the remote maintenance system  50  requests the image forming apparatus  20  designated as a target of the remote maintenance from the connection terminal  40  to execute the maintenance instructed from the connection terminal  40  by the XMPP (Step S 122 ). 
     When the remote maintenance system  50  requests the maintenance, the control unit  28  of the image forming apparatus  20  executes the maintenance requested by the remote maintenance system  50  (Step S 123 ), and notifies the remote maintenance system  50  of an execution result of the maintenance by the XMPP (Step S 124 ). 
     When the execution result of the maintenance is notified from the image forming apparatus  20 , the remote maintenance unit  55   b  of the remote maintenance system  50  notifies the connection terminal  40  of the execution result notified from the image forming apparatus  20  (Step S 125 ). 
     Next, an operation of the remote communication system  10  when the remote session is started will be described. 
       FIG. 8  illustrates the operation of the remote communication system  10  when the remote session is started.  FIG. 9  illustrates a sequence diagram of a server application confirmation illustrated in  FIG. 8 .  FIG. 10  illustrates a sequence diagram of a device side session establishment illustrated in  FIG. 8 .  FIG. 11  illustrates a sequence diagram of a connection terminal side session establishment illustrated in  FIG. 8 . 
     When being logged in to the remote maintenance system  50 , the user of the connection terminal  40  can designate a specific client (hereinafter described as the client  45   c  in the description of the operation illustrated in  FIGS. 8 to 11 ) and instruct to start the remote session with a specific image forming apparatus (hereinafter described as the image forming apparatus  20  in the description of the operation illustrated in  FIGS. 8 to 11 ) via the operation unit  41 . As illustrated in  FIGS. 8 to 11 , when accepting the instruction to start the remote session, the remote session control unit  45   d  of the connection terminal  40  notifies the remote maintenance system  50  of the device ID of the image forming apparatus  20  instructed via the operation unit  41  and an application ID of the client  45   c  instructed via the operation unit  41  to request the remote maintenance system  50  to start the remote session (Step S 141 ). 
     It is preferred that the user of the connection terminal  40  separately inform a user of the image forming apparatus  20  of the fact that starting the remote session with the image forming apparatus  20  is desired by means of, for example, a telephone call in advance before instructing to start the remote session with the image forming apparatus  20  via the operation unit  41  when the user of the connection terminal  40  instructs to start the remote session with the image forming apparatus  20  via the operation unit  41 . 
     When accepting the request at Step S 141 , the session management unit  55   c  of the remote maintenance system  50  notifies the image forming apparatus  20  specified by the device ID notified at Step S 141  of the application ID notified at Step S 141  to query whether the server application specified by this application ID is installed in the image forming apparatus  20  or not by the XMPP (Step S 142 ). 
     When receiving the query at Step S 142 , the remote session control unit  28   c  of the image forming apparatus  20  determines whether the server application specified by the application ID notified at Step S 142  among the server applications of the image forming apparatus  20  is installed or not (Step S 143 ), and notifies the determination result by the XMPP (Step S 144 ). 
     When receiving the notification of Step S 144  that indicates that the target server application is installed, the session management unit  55   c  of the remote maintenance system  50  notifies the application ID notified at Step S 141  to request the image forming apparatus  20  to approve the start of the remote session by the XMPP (Step S 145 ). 
     When receiving the request of Step S 145 , the remote session control unit  28   c  of the image forming apparatus  20  displays a remote session approval screen  70  (see  FIG. 12 ) that accepts the instruction whether to approve the start of the remote session on the display  22  (Step S 146 ). 
       FIG. 12  illustrates an example of the remote session approval screen  70 . 
     The remote session approval screen  70  illustrated in  FIG. 12  includes a message  71 , a YES button  72 , and a NO button  73 . The message  71  queries whether the remote session is approved or not. The YES button  72  is for accepting an instruction to approve starting the remote session. The NO button  73  is for accepting an instruction not to approve starting the remote session. The user of the image forming apparatus  20  can press any one of the YES button  72  and the NO button  73  via the operation unit  21 . 
     As illustrated in  FIGS. 8 to 11 , when the YES button  72  is pressed via the operation unit  21 , the remote session control unit  28   c  notifies the remote maintenance system  50  by the XMPP of the fact that the remote session is approved (Step S 147 ). 
     Although the illustration is omitted, when the NO button  73  is pressed with respect to the remote session approval screen  70  displayed on the display  22  via the operation unit  21  at Step S 146 , the remote communication system  10  operates as follows. First, the remote session control unit  28   c  of the image forming apparatus  20  notifies the remote maintenance system  50  by the XMPP of the fact that the remote session has failed to be approved. Next, the session management unit  55   c  of the remote maintenance system  50  notifies the connection terminal  40  of the fact that the remote session has failed to be approved. Then, the remote session control unit  45   d  of the connection terminal  40  displays the fact that the remote session has failed to be approved on the display  42 . 
     When receiving the notification of Step S 144  indicating that the target server application is not installed, the session management unit  55   c  of the remote maintenance system  50  notifies the application ID notified at Step S 141  to request the image forming apparatus  20  to approve the installation of the server application specified by this application ID by the XMPP (Step S 148 ). 
     When receiving the request of Step S 148 , the remote session control unit  28   c  of the image forming apparatus  20  displays an application installation approval screen  75  (see  FIG. 13 ) that accepts the instruction whether the installation of the server application specified by the application ID notified at Step S 148  is approved or not on the display  22  (Step S 149 ). 
       FIG. 13  illustrates an example of the application installation approval screen  75 . 
     The application installation approval screen  75  illustrated in  FIG. 13  includes a message  76 , a YES button  77 , and a NO button  78 . The message  76  queries whether the installation of the server application for the remote session is approved or not. The YES button  77  is for accepting an instruction to approve the start of installing the server application. The NO button  78  is for accepting an instruction not to approve the start of installing the server application. The user of the image forming apparatus  20  can press any one of the YES button  77  and the NO button  78  via the operation unit  21 . 
     When the YES button  77  is pressed via the operation unit  21 , the remote session control unit  28   c  notifies the remote maintenance system  50  of the fact that the installation of the target server application is approved by the XMPP as illustrated in  FIGS. 8 to 11  (Step S 150 ). 
     Although the illustration is omitted, when the NO button  78  is pressed with respect to the application installation approval screen  75  displayed on the display  22  via the operation unit  21  at Step S 149 , the remote communication system  10  operates as follows. First, the remote session control unit  28   c  of the image forming apparatus  20  notifies the remote maintenance system  50  by the XMPP of the fact that the installation of the target server application has failed to be approved. Next, the session management unit  55   c  of the remote maintenance system  50  notifies the connection terminal  40  of the fact that the remote session has failed to be approved. Then, the remote session control unit  45   d  of the connection terminal  40  displays the fact that the remote session has failed to be approved on the display  42 . 
     When receiving the notification of Step S 147  or S 150 , the session management unit  55   c  of the remote maintenance system  50  requests connection information from the session relay system  60  by an Application Program Interface (API) (Step S 151 ). 
     When receiving the request of Step S 151 , the Cloud Hub  61  of the session relay system  60  generates a session ID for the session relay system  60  to identify the communication made by this remote session (Step S 152 ), and notifies the remote maintenance system  50  of the generated session ID as the connection information using the API (Step S 153 ). As the session ID, random identification information is employed. The random identification information includes, for example, a random number sequence generated by a hash algorithm, such as a Hash-based Message Authentication Code (HMAC), which is BASE64 encoded so as to be handled on a Hypertext Transfer Protocol (HTTP). 
     When the session ID is notified at Step S 153 , the session management unit  55   c  of the remote maintenance system  50  generates a token for the remote maintenance system  50  to recognize a valid duration of the remote session (Step S 154 ). 
     When the fact that the remote session is approved is notified at Step S 147 , the session management unit  55   c  notifies the image forming apparatus  20  of the token generated at Step S 154  and the session ID notified at Step S 153  by the XMPP after the process at Step S 154  (Step S 155 ). 
     When the fact that the installation of the target server application is approved is notified at Step S 150 , the session management unit  55   c  notifies the image forming apparatus  20  of the token generated at Step S 154 , the session ID notified at Step S 153 , and the target server application by the XMPP after the process at Step S 154  (Step S 156 ). 
     When receiving the server application transmitted at Step S 156 , the remote session control unit  28   c  of the image forming apparatus  20  installs this server application to the image forming apparatus  20  itself (Step S 157 ). 
     Hereinafter, the server application specified by the application ID notified from the connection terminal  40  to the remote maintenance system  50  at Step S 141  is described as the server application  28   a.    
     After the process at Step S 155  or S 156 , the session management unit  55   c  of the remote maintenance system  50  notifies the connection terminal  40  of the fact that the token and the session ID are obtained (Step S 158 ). 
     When the token and the session ID are notified at Step S 155  or S 156 , the server application  28   a  of the image forming apparatus  20  activates the Cloud Hub Agent  28   b  to which the token and the session ID notified at Step S 155  or S 156  are set (Step S 171 ). 
     Next, the Cloud Hub Agent  28   b  notifies the session relay system  60  of the set token and session ID to request the session relay system  60  to establish the session (Step S 172 ). 
     When receiving the request of Step S 172 , the Cloud Hub  61  associated with the session ID notified at Step S 172  among the Cloud Hubs of the session relay system  60  requests the remote maintenance system  50  to execute an authentication by the token notified at Step S 172 , using the API (Step S 173 ). Accordingly, the session management unit  55   c  of the remote maintenance system  50  executes the authentication requested at Step S 173  (Step S 174 ), and notifies the session relay system  60  of a result of the authentication using the API (Step S 175 ). 
     When a successful authentication is notified at Step S 175 , the Cloud Hub  61  of the session relay system  60  stores a log indicating the start of the session with the image forming apparatus  20  in the session management database  64  (Step S 176 ), and notifies the remote maintenance system  50  of the log stored at Step S 176  together with the token, using the API (Step S 177 ). Accordingly, the session management unit  55   c  of the remote maintenance system  50  manages the log notified at Step S 177  as a log of the remote session identified by the token notified at Step S 177  (Step S 178 ), and replies the fact that this log is managed to the session relay system  60 , using the API (Step S 179 ). 
     When the successful authentication is notified at Step S 175 , the Cloud Hub  61  of the session relay system  60  notifies the image forming apparatus  20  of the fact that the session with the image forming apparatus  20  is established (Step S 180 ). That is, an HTTP-based WebSocket connection is established between the image forming apparatus  20  and the session relay system  60 . 
     After the process at Step S 141 , the remote session control unit  45   d  of the connection terminal  40  requests the connection information from the remote maintenance system  50  by polling until ensuring obtaining the connection information from the remote maintenance system  50  (Step S 201 ). 
     When the token is already generated at Step S 154  when the session management unit  55   c  of the remote maintenance system  50  receives the request of Step S 201 , the session management unit  55   c  of the remote maintenance system  50  notifies the connection terminal  40  of this token and the session ID notified from the session relay system  60  at Step S 153  as the connection information (Step S 202 ). 
     When the token and the session ID are notified at Step S 202 , the remote session control unit  45   d  of the connection terminal  40  activates the client  45   c  to which the token and the session ID notified at Step S 202  are set (Step S 203 ). 
     Next, the client  45   c  notifies the session relay system  60  of the set token and session ID to request the session relay system  60  to establish the session (Step S 204 ). 
     When receiving the request of Step S 204 , the Web Agent  62  associated with the session ID notified at Step S 204  among the Web Agents of the session relay system  60  notifies the Cloud Hub  61  of the token and the session ID notified at Step S 204  to request the Cloud Hub  61  to establish the session (Step S 205 ). 
     When receiving the request of Step S 205 , the Cloud Hub  61  of the session relay system  60  requests the remote maintenance system  50  to execute an authentication by the token notified at Step S 205 , using the API (Step S 206 ). Accordingly, the session management unit  55   c  of the remote maintenance system  50  executes the authentication requested at Step S 206  (Step S 207 ), and notifies the session relay system  60  of a result of the authentication using the API (Step S 208 ). 
     When a successful authentication is notified at Step S 208 , the Cloud Hub  61  of the session relay system  60  stores a log indicating the start of the session with the connection terminal  40  in the session management database  64  (Step S 209 ), and notifies the remote maintenance system  50  of the log stored at Step S 209  together with the token, using the API (Step S 210 ). Accordingly, the session management unit  55   c  of the remote maintenance system  50  manages the log notified at Step S 210  as a log of the remote session identified by the token notified at Step S 210  (Step S 211 ), and replies the fact that this log is managed to the session relay system  60 , using the API (Step S 212 ). 
     When the successful authentication is notified at Step S 208 , the Cloud Hub  61  of the session relay system  60  notifies the Web Agent  62  of the fact that the session with the connection terminal  40  is established (Step S 213 ). Accordingly, the Web Agent  62  notifies the connection terminal  40  of the fact that the session with the connection terminal  40  is established (Step S 214 ). That is, an HTTP-based WebSocket connection is established between the connection terminal  40  and the session relay system  60 . 
     The session relay system  60  associates the WebSocket connection established with the image forming apparatus  20  by the operation illustrated in  FIGS. 8 to 11  with the WebSocket connection established with the connection terminal  40  by the operation illustrated in  FIGS. 8 to 11 , using the session ID. Accordingly, the remote session is established by the operation illustrated in  FIGS. 8 to 11 . 
     The following describes an operation of the remote communication system  10  when the image forming apparatus  20  operates corresponding to the request from the connection terminal  40  via the remote session. 
       FIG. 14  illustrates the operation of the remote communication system  10  when the image forming apparatus  20  operates corresponding to the request from the connection terminal  40  via the remote session. 
     When the remote session is established by the operation illustrated in  FIGS. 8 to 11 , the user of the connection terminal  40  can instruct a request toward the image forming apparatus  20  via the operation unit  41 . When accepting the instruction to request toward the image forming apparatus  20 , the client  45   c  of the connection terminal  40  generates an HTTP request for notifying the request instructed via the operation unit  41  as illustrated in  FIG. 14  (Step S 231 ). 
     Here, a structure of the HTTP request generated at Step S 231  will be described. 
       FIG. 15A  illustrates HTTP data  80  processed by the server application  28   a .  FIG. 15B  illustrates HTTP data  90  for relaying the HTTP data  80  illustrated in  FIG. 15A  on the Internet. 
     As illustrated in  FIGS. 15A and 15B , the HTTP data  80  includes an HTTP header  81  and an HTTP body  82 . The HTTP data  90  includes an HTTP header  91  for relaying on the Internet and the HTTP data  80  as an HTTP body  92 . The HTTP header  91  includes an application ID  91   a  for identifying the server application  28   a.    
     The client  45   c  generates HTTP data having a structure similar to that of the HTTP data  90  illustrated in  FIG. 15B  as the HTTP request for notifying the request instructed via the operation unit  41 . Here, the session ID is stored in a position corresponding to the HTTP header  91 . 
     As illustrated in  FIG. 14 , the client  45   c  of the connection terminal  40  transmits the HTTP request generated at Step S 231  to the session relay system  60  by the WebSocket connection (Step S 232 ). 
     When the HTTP request is transmitted at Step S 232 , the Web Agent  62  associated with the session ID included in the HTTP request transmitted at Step S 232  among the Web Agents of the session relay system  60  passes this HTTP request to the Cloud Hub  61  (Step S 233 ). Accordingly, the Cloud Hub  61  transmits this HTTP request to the image forming apparatus  20  by the WebSocket connection corresponding to the session ID included in this HTTP request (Step S 234 ). 
     When the HTTP request is transmitted at Step S 234 , the Cloud Hub Agent  28   b  of the image forming apparatus  20  identifies the server application  28   a  corresponding to the application ID included in this HTTP request (Step S 235 ). 
     Next, the Cloud Hub Agent  28   b  generates an HTTP request that is made by removing the HTTP header for relaying on the Internet from the HTTP request transmitted at Step S 234  (Step S 236 ). Here, the HTTP request generated at Step S 236  is HTTP data having a structure similar to that of the HTTP data  80  illustrated in  FIG. 15A . 
     Next, the Cloud Hub Agent  28   b  passes the HTTP request generated at Step S 236  to the server application  28   a  identified at Step S 235  (Step S 237 ). 
     When the HTTP request is passed at Step S 237 , the server application  28   a  generates an HTTP response corresponding to this HTTP request (Step S 238 ). Here, the HTTP response generated at Step S 238  is HTTP data having a structure similar to that of the HTTP data  80  illustrated in  FIG. 15A . 
     Next, the server application  28   a  passes the HTTP response generated at Step S 238  to the Cloud Hub Agent  28   b  (Step S 239 ). 
     When the HTTP response is passed at Step S 239 , the Cloud Hub Agent  28   b  generates an HTTP response that is made by putting on the HTTP header for relaying on the Internet to the HTTP response passed at Step S 239  (Step S 240 ). Here, the HTTP response generated at Step S 240  is HTTP data having a structure similar to that of the HTTP data  90  illustrated in  FIG. 15B . The session ID is stored in a position corresponding to the HTTP header  91 . 
     The Cloud Hub Agent  28   b  transmits the HTTP response generated at Step S 240  to the session relay system  60  by the WebSocket connection (Step S 241 ). 
     When the HTTP response is transmitted at Step S 241 , the Cloud Hub  61  associated with the session ID included in the HTTP response transmitted at Step S 241  among the Cloud Hubs in the session relay system  60  passes this HTTP response to the Web Agent  62  (Step S 242 ). Accordingly, the Web Agent  62  transmits this HTTP response to the connection terminal  40  by the WebSocket connection corresponding to the session ID included in this HTTP response (Step S 243 ). 
     Accordingly, the client  45   c  of the connection terminal  40  can receive the HTTP response transmitted at Step S 243 . 
     Next, an operation of the remote communication system  10  when the remote session is terminated will be described. 
       FIG. 16  illustrates the operation of the remote communication system  10  when the remote session is terminated.  FIG. 17  illustrates a sequence diagram of a device side session termination illustrated in  FIG. 16 . 
     The user of the connection terminal  40  can instruct to terminate the remote session with a specific server application (hereinafter described as the server application  28   a  in the description of the operation illustrated in  FIGS. 16 and 17 ) of a specific image forming apparatus (hereinafter described as the image forming apparatus  20  in the description of the operation illustrated in  FIGS. 16 and 17 ) via the operation unit  41 . When accepting the instruction to terminate the remote session the remote session control unit  45   d  of the connection terminal  40  notifies the client  45   c  of the token and the session ID of the remote session instructed via the operation unit  41  as illustrated in  FIGS. 16 and 17  to request the client  45   c  to terminate the remote session (Step S 261 ). Accordingly, the client  45   c  requests the session relay system  60  to terminate the remote session requested at Step S 261  by the WebSocket connection (Step S 262 ). 
     When the termination of the remote session is requested at Step S 262 , the Web Agent  62  associated with a session ID included in the request at Step S 262  among the Web Agents of the session relay system  60  passes this request to the Cloud Hub  61  (Step S 263 ). Accordingly, the Cloud Hub  61  requests the remote maintenance system  50  to terminate the remote session identified by the token included in this request, using the API (Step S 264 ). 
     When receiving the request of Step S 264 , the session management unit  55   c  of the remote maintenance system  50  requests the image forming apparatus  20  as a target of the remote session, which is a target of the request at Step S 264 , to terminate this remote session by the XMPP (Step S 265 ). 
     Next, the session management unit  55   c  notifies the fact that the request to terminate the remote session is accepted to the session relay system  60 , using the API (Step S 266 ). 
     When the acceptance of the request to terminate the remote session is notified at Step S 266 , the Cloud Hub  61  of the session relay system  60  stores a log indicating the termination of the session with the connection terminal  40  in the session management database  64  (Step S 267 ), and notifies the remote maintenance system  50  of the log stored at Step S 267  together with the token, using the API (Step S 268 ). Accordingly, the session management unit  55   c  of the remote maintenance system  50  manages the log notified at Step S 268  as a log of the remote session identified by the token notified at Step S 268  (Step S 269 ), and replies the fact that this log is managed to the session relay system  60 , using the API (Step S 270 ). 
     When receiving the reply at Step S 270 , the Cloud Hub  61  of the session relay system  60  notifies the Web Agent  62  of the termination of the WebSocket connection between the connection terminal  40  and the session relay system  60  (Step S 271 ). Accordingly, the Web Agent  62  notifies the connection terminal  40  of the termination of the WebSocket connection between the connection terminal  40  and the session relay system  60  (Step S 272 ). 
     When the client  45   c  of the connection terminal  40  receives the notification of Step S 272 , the client  45   c  of the connection terminal  40  notifies the termination of the WebSocket connection between the connection terminal  40  and the session relay system  60  to the remote session control unit  45   d  (Step S 273 ), and terminates the operation of the client  45   c  of the connection terminal  40  itself. 
     Accordingly, the remote session control unit  45   d  can display the fact of, for example, the termination of the WebSocket connection between the connection terminal  40  and the session relay system  60  on the display  42 . 
     When receiving the request at Step S 265 , the server application  28   a  as the target of the remote session, which is the target of the request received at Step S 265 , among the server applications of the image forming apparatus  20  notifies the Cloud Hub Agent  28   b  of the token and the session ID of this remote session to request the Cloud Hub Agent  28   b  to terminate the remote session (Step S 291 ). Accordingly, the Cloud Hub Agent  28   b  requests the session relay system  60  to terminate the remote session requested at Step S 291  by the WebSocket connection (Step S 292 ). 
     When receiving the request of Step S 292 , the Cloud Hub  61  of the session relay system  60  requests the remote maintenance system  50  to terminate the remote session identified by the token included in this request, using the API (Step S 293 ). 
     When receiving the request of Step S 293 , the session management unit  55   c  of the remote maintenance system  50  notifies the session relay system  60  of the fact that the request to terminate the remote session is accepted, using the API (Step S 294 ). 
     When the acceptance of the request to terminate the remote session is notified at Step S 294 , the Cloud Hub  61  of the session relay system  60  stores a log indicating the termination of the session with the image forming apparatus  20  in the session management database  64  (Step S 295 ), and notifies the remote maintenance system  50  of the log stored at Step S 295  together with the token, using the API (Step S 296 ). Accordingly, the session management unit  55   c  of the remote maintenance system  50  manages the log notified at Step S 296  as a log of the remote session identified by the token notified at Step S 296  (Step S 297 ), and replies the fact that this log is managed to the session relay system  60 , using the API (Step S 298 ). 
     When receiving the reply at Step S 298 , the Cloud Hub  61  of the session relay system  60  notifies the image forming apparatus  20  of the termination of the WebSocket connection between the image forming apparatus  20  and the session relay system  60  (Step S 299 ). 
     When receiving the notification at Step S 299 , the Cloud Hub Agent  28   b  of the image forming apparatus  20  terminates its operation. 
     When the server application  28   a  is installed at Step S 158 , the control unit  28  of the image forming apparatus  20  uninstalls the server application  28   a  after terminating the Cloud Hub Agent  28   b  (Step S 300 ). 
     When the session management unit  55   c  of the remote maintenance system  50  confirms both that the log indicating the termination of the session between the image forming apparatus  20  and the session relay system  60  is notified from the session relay system  60  and that the log indicating the termination of the session between the connection terminal  40  and the session relay system  60  is notified from the session relay system  60 , the session management unit  55   c  of the remote maintenance system  50  determines that the remote session between the image forming apparatus  20  and the connection terminal  40  via the session relay system  60  is terminated. When the session management unit  55   c  determines that the remote session between the image forming apparatus  20  and the connection terminal  40  via the session relay system  60  is not terminated, the session management unit  55   c  does not permit to establish a new remote session between the image forming apparatus  20  and the connection terminal  40  via the session relay system  60 . 
     As described above, in the remote communication control system  15 , the image forming apparatus  20  and the connection terminal  40  located outside the network to which the image forming apparatus  20  belongs are not directly connected but establish the remote session relayed by the session relay system  60 . This ensures improving the security when the image forming apparatus  20  is controlled from the connection terminal  40  located outside the network to which the image forming apparatus  20  belongs. 
     In the remote communication system  10 , the image forming apparatus  20  establishes the WebSocket connection, which uses the session ID, with the session relay system  60  (Steps S 171  to S 180 ), the connection terminal  40  establishes the WebSocket connection, which uses the session ID, with the session relay system  60  (Steps S 201  to S 214 ), and the session relay system  60  relays the remote session by associating the connection established with the connection terminal  40  with the connection established with the image forming apparatus  20 , using the session ID (Steps S 231  to S 243 ). With this configuration, in the remote communication system  10 , only the connection terminal  40  notified of the session ID from the remote maintenance system  50  among the connection terminals located outside the network to which the image forming apparatus  20  belongs establishes the remote session with the image forming apparatus  20  relayed by the session relay system  60 , thereby ensuring an improved security when the image forming apparatus  20  is controlled from the connection terminal  40  located outside the network to which the image forming apparatus  20  belongs. 
     In the remote communication system  10 , the session ID used by the WebSocket connection established between the image forming apparatus  20  and the session relay system  60  and the session ID used by the WebSocket connection established between the connection terminal  40  and the session relay system  60  are identical session IDs. With this configuration, it is not necessary for the remote communication system  10  to associate two mutually different session IDs in the session relay system  60 , thereby ensuring a simplified process of the session ID in the session relay system  60 . The session ID used by the WebSocket connection established between the image forming apparatus  20  and the session relay system  60  and the session ID used by the WebSocket connection established between the connection terminal  40  and the session relay system  60  may be mutually different as long as they are associated with one another in the session relay system  60 . 
     In the remote communication system  10 , at least one of the WebSocket connection established between the session relay system  60  and the connection terminal  40  and the WebSocket connection established between the session relay system  60  and the image forming apparatus  20  may be a connection with encrypted communication, such as a Secure Sockets Layer (SSL). With this configuration, the remote communication system  10  has at least a part of a path of the remote session between the connection terminal  40  and the image forming apparatus  20  relayed by the session relay system  60  encrypted, thereby ensuring reducing an occurrence of an invalid use, such as cracking, to the image forming apparatus  20 . 
     In the remote communication system  10 , the remote maintenance system  50  accepts the request (Step S 141 ) to start the remote session from the connection terminal  40  when the user of the connection terminal  40  is logged in to the remote maintenance system  50 . The remote maintenance system  50  does not execute the notification (Step S 155  or S 156 ) of the session ID to the image forming apparatus  20  and the notification (Step S 202 ) of the session ID to the connection terminal  40  when the request to start the remote session is not accepted from the connection terminal  40 . With this configuration, the remote communication system  10  has the remote session between the connection terminal  40  and the image forming apparatus  20  relayed by the session relay system  60  established only when the user of the connection terminal  40  can log in to the remote maintenance system  50 , thereby ensuring the improved security of this remote session. 
     In the remote communication system  10 , the remote maintenance system  50  does not execute the notification (Step S 155  or S 156 ) of the session ID to the image forming apparatus  20  and the notification (Step S 202 ) of the session ID to the connection terminal  40  when the start of the remote session is not approved from the user of the image forming apparatus  20 . With this configuration, the remote communication system  10  has the remote session between the connection terminal  40  and the image forming apparatus  20  relayed by the session relay system  60  established only when the start of the remote session is approved by the user of the image forming apparatus  20 , thereby ensuring the improved security of this remote session. The remote maintenance system  50  may be configured not to execute any one of the notification of the session ID to the image forming apparatus  20  and the notification of the session ID to the connection terminal  40  when the start of the remote session is not approved by the user of the image forming apparatus  20 . 
     In the remote communication system  10 , the session relay system  60  changes the session ID (Step S 152 ) every time the session ID is requested by the remote maintenance system  50  (Step S 151 ). With this configuration, the remote communication system  10  has the session ID changed every time the remote session between the connection terminal  40  and the image forming apparatus  20  relayed by the session relay system  60  is established, thereby ensuring the improved security of this remote session. 
     The remote communication system  10  displays the screen identical to the screen displayed on the image forming apparatus  20  on the connection terminal  40  located in the outside of the network to which the image forming apparatus  20  belongs so as to operate the image forming apparatus  20  from this connection terminal  40 , thereby ensuring an easy operation of the image forming apparatus  20  from the connection terminal  40  located in the outside of the network to which the image forming apparatus  20  belongs at a low cost. For example, the connection terminal  40  is configured to cause the user of the connection terminal  40  to execute various kinds of settings to the image forming apparatus  20 , such as a setting of an address book of the image forming apparatus  20 , by displaying a setting screen of the image forming apparatus  20  on the display  42 . The connection terminal  40  is configured to cause the user of the connection terminal  40  to execute confirmations of various pieces of information of the image forming apparatus  20 , such as a confirmation of errors occurred in the image forming apparatus  20 , a confirmation of a printed count with the image forming apparatus  20 , and a remaining amount of a toner in the image forming apparatus  20 , by, for example, displaying a confirmation screen for the various pieces of information of the image forming apparatus  20  on the display  42 . The connection terminal  40  is configured to cause the user of the connection terminal  40  to execute installing various kinds of software to the image forming apparatus  20 , such as an installation of firmware to the image forming apparatus  20  and an installation of an application to the image forming apparatus  20 , by, for example, displaying an installation screen of software to the image forming apparatus  20  on the display  42 . 
     The connection terminal  40  can communicate with various kinds of applications in the image forming apparatus  20  by the remote session, thereby ensuring implementing various functions besides the maintenance to the image forming apparatus  20 . 
     In this embodiment, the remote communication system  10  can execute the remote maintenance via the remote maintenance system  50  as the session management system as illustrated in  FIG. 7 . However, it is not necessary for the remote communication system  10  to be configured to execute the remote maintenance via the session management system. 
     When the connection terminal requests the remote communication control system  15  to start the remote session, the remote communication control system  15  causes the image forming apparatus to install the server application required to establish the remote session (Steps S 156  and S 157 ); therefore, the connection terminal can establish the remote session with the image forming apparatus on which the server application required to establish the remote session requested to be started by this connection terminal is absent. 
     The remote communication control system  15  causes the image forming apparatus to install the server application only when the user of the image forming apparatus approves the installation of the server application through the application installation approval screen  75 ; therefore, the security of the remote session between the connection terminal and the image forming apparatus relayed by the session relay system  60  can be improved. 
     The remote communication control system  15  handles the approval of the installation of the server application from the user of the image forming apparatus as the approval to start the remote session from the user of the image forming apparatus, thereby ensuring reducing a burden to the user of the image forming apparatus. The remote communication control system  15  may be configured to accept the approval to start the remote session from the user of the image forming apparatus when accepting the approval of the installation of the server application from the user of the image forming apparatus. 
     In the remote communication system  10 , the server application required to establish the remote session is installed in the image forming apparatus when the remote session is started and is uninstalled from the image forming apparatus when the remote session is terminated, thereby ensuring reducing the use of the storage capacity of the image forming apparatus more than necessary. 
     For example, if a problem occurs in the image forming apparatus, after a diagnostic program that can diagnose this problem is installed on the image forming apparatus as the server application and a diagnostic result by this diagnostic program is confirmed via the remote session, the remote communication system  10  can cause this diagnostic program to be uninstalled from the image forming apparatus when the remote session is terminated. With this configuration, the remote communication system  10  can execute an appropriate maintenance diagnostic by the diagnostic program appropriate for the specific problem occurred in the image forming apparatus compared with the configuration in which a general diagnostic program has been installed on the image forming apparatus in advance. 
     While various aspects and embodiments have been disclosed herein, other aspects and embodiments will be apparent to those skilled in the art. The various aspects and embodiments disclosed herein are for purposes of illustration and are not intended to be limiting, with the true scope and spirit being indicated by the following claims.