Patent Publication Number: US-2007106910-A1

Title: Device management system, device management method, computer program, and computer readable storage medium

Description:
BACKGROUND OF THE INVENTION  
      1. Field of the Invention  
      The present invention relates to a device management system, a device management method, a computer program, and a computer readable storage medium. More particularly, the present invention relates to a technique capable of efficiently managing cryptographic information relating to a print job.  
      2. Description of the Related Art  
      A computer network (hereinafter, simply referred to as “network”) can be preferably employed to connect a plurality of computers provided in a relatively small area, such as a floor in a building, or the entire building, or a group of buildings. Furthermore, a plurality of networks can be connected with each other to cover a relatively large area and form a global network, such as “Internet.” 
      Each network can include computers and various peripheral devices, such as printers, facsimiles, and copying machines. Users of the computers can operate the computer peripheral devices via the network. The network-based printing system (hereinafter, referred to as “network printing system”) enables users of computers, even the remote users, to commonly use highly advanced and speedy printers and expensive color printers to perform printing operations.  
      On the other hand, in view of security and cost management, each print job must be carefully and accurately managed. To this end, a conventional system issues a certificate for each print request so that the properness of the print job can be confirmed based on the certificate or the printing operation can be allowed based on the certificate.  
      In general, networks and Internet are opened to the public. Hence, print jobs may be falsified by third persons (or parties) when they are transferred via the network. Especially, a print job including secret data, such as client information and confidential information, must be surely protected against falsifications or unauthorized printing by third persons (parties) when it is transferred and printed via the network.  
      As a conventional method for protecting network print jobs against falsifications (or pretending acts), all or part or attached data of the print job can be encrypted. For example, as discussed in Japanese Patent Application Laid-open No. 2004-86894, a public key encryption system can be used, according to which a print job is encrypted beforehand using a public key and transmitted to a printer having a private key and printing of the print job is allowed only when the public key and the private key match with each other.  
      More specifically, according to the system proposed in Japanese Patent Application Laid-open No. 2004-86894, a print job is transmitted to a designated printer via a communication medium and only the designated printer can print the print job. To this end, the print job is encrypted using an encryption method that allows only the designated printer to decrypt the encrypted print job. Accordingly, even if an encrypted print job is stolen, the print job cannot be printed by other printers and accordingly cannot be unfaithfully used by third persons (parties).  
      As described above, the encryption processing for protecting the print jobs is important in the network printing system. To this end, it is generally necessary to adequately manage cryptographic information used in the encryption processing. For example, when the public key encryption system is used, a print control device including a printer driver is required to get a public key of a printing device to perform encryption relating to a print job. In this case, it is generally necessary to obtain the public key from the printing device and send the public key to the print control device.  
      When a total number of network devices (e.g., print control devices and printing devices) is relatively small, it may be possible to manually send the public key to each of the network devices. However, the scale of a network can be unlimitedly expanded to include a huge number of network devices or enable remote users to operate the network devices. In such a case, it is difficult to manually distribute the public key to all of network devices.  
      Furthermore, for management of a system, it is generally required to identify the public key of each printing device and designate a destination (i.e., print control device) to which the public key should be transmitted. However, managing the public keys is very complicated in a large-scale network including several tens to thousands network devices. Therefore, due to the complexity associated with managing public keys in a large-scale network, the system may not be appropriately maintained.  
     SUMMARY OF THE INVENTION  
      Embodiments of the present invention are directed to a technique capable of overcoming or at least mitigating the above-described drawbacks of the related technology.  
      According to an aspect of the present invention, at least one exemplary embodiment is directed to a device management system configured to manage a device connected to a network, including: an identifying unit configured to identify a device newly connected to the network; a cryptographic information acquiring unit configured to obtain cryptographic information relating to a print job designating the device identified by the identifying unit; and a storage control unit configured to store, into a storage medium, device information specifying the device identified by the identifying unit and the cryptographic information obtained by the cryptographic information acquiring unit, in relation to belonging information of the device identified by the identifying unit.  
      According to another aspect of the present invention, at least one exemplary embodiment is directed to a method for managing a device connected to a network. The method includes: identifying a device newly connected to the network; obtaining cryptographic information relating to a print job designating the identified device; and storing, into a storage medium, device information specifying the identified device and the obtained cryptographic information, in relation to belonging information of the identified device.  
      According to yet another aspect of the present invention, at least one exemplary embodiment is directed to a computer program including computer-executable instructions for realizing the above-described device management method. Additionally, according to still another aspect of the present invention, at least one exemplary embodiment is directed to a computer-readable storage medium storing the above-described computer program.  
      Further features and aspects of the present invention will become apparent from the following detailed description of exemplary embodiments with reference to the attached drawings. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
      The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the invention.  
       FIG. 1  is a block diagram illustrating an example of a print processing system in accordance with a first exemplary embodiment.  
       FIG. 2  is a block diagram illustrating an example of a computer provided in a print management server in accordance with the first exemplary embodiment.  
       FIG. 3  is a flowchart showing an example of a management function provided by a printing device management program that the print management server can execute in accordance with the first exemplary embodiment.  
       FIG. 4  is a flowchart showing the rest of the management function provided by the printing device management program that the print management server can execute in accordance with the first exemplary embodiment.  
       FIG. 5  is a block diagram schematically illustrating a practical communication state relating to a retrieval request packet and a retrieval response packet in the print processing system in accordance with the first exemplary embodiment.  
       FIG. 6  is a view schematically showing an example of a device management table in accordance with the first exemplary embodiment.  
       FIG. 7  is a block diagram schematically illustrating a practical communication state relating to a public key certificate of a printing device transmitted to the print management server in accordance with the first exemplary embodiment.  
       FIG. 8  is a view schematically showing an example of a program management table in accordance with the first exemplary embodiment.  
       FIG. 9  is a block diagram schematically illustrating a practical communication state relating to a printer driver incorporating a public key which is transmitted and installed on a print control device in accordance with the first exemplary embodiment.  
       FIG. 10  is a block diagram schematically illustrating a practical communication state relating to transmission of a print job encrypted using a public key of a newly connected printing device in accordance with the first exemplary embodiment.  
       FIG. 11  is a block diagram illustrating an example of a print processing system in accordance with a second exemplary embodiment.  
       FIG. 12  is a flowchart showing an example of a management function provided by a printing device management program that the print management server can execute in accordance with the second exemplary embodiment.  
       FIG. 13  is a flowchart showing an example of an operation of the print control device that obtains a public key registered in a directory device in accordance with the second exemplary embodiment.  
       FIG. 14  is a block diagram schematically illustrating a practical communication state relating to registration of a public key and acquisition of the public key in accordance with the second exemplary embodiment. 
    
    
     DETAILED DESCRIPTION OF THE EMBODIMENTS  
      The following description of exemplary embodiments is merely illustrative in nature and is in no way intended to limit the invention, its application, or uses.  
      Processes, techniques, apparatus, and systems as known by one of ordinary skill in the art may not be discussed in detail but are intended to be part of the enabling description where appropriate.  
      For example, certain circuitry for signal processing and other uses may not be discussed in detail. However these systems and the methods to fabricate these system as known by one of ordinary skill in the relevant art is intended to be part of the enabling disclosure herein where appropriate.  
      It is noted that throughout the specification, similar reference numerals and letters refer to similar items in the following figures, and thus once an item is defined in one figure, it may not be discussed for following figures.  
      Various exemplary embodiments, features, and aspects of the present invention will be described in detail below with reference to the drawings. It should be noted that the relative arrangement of the components, the numerical expressions and numerical values set forth in these embodiments do not limit the scope of the present invention unless it is specifically stated otherwise.  
     First Exemplary Embodiment  
      First, the first exemplary embodiment of the present invention will be described.  FIG. 1  is a block diagram illustrating a print processing system in accordance with a first exemplary embodiment. In  FIG. 1 , a network  1  can connect later-described terminal devices. The print processing system shown in  FIG. 1  can provide a networking service based on Ethernet (registration trademark) technologies for a local user group including users on the same floor, or continuous floors, of a building.  
      Furthermore, a wide area network (WAN) can be used to configure a network for users separated in different buildings or located at mutually remote places. The WAN is basically an assembly of two or more LANs mutually connected by high-speed digital lines, such as wide area Ethernet (registration trademark) or ISDN telephone lines. The connection of LANs is a simple electric connection realized by buses.  
      A print management system  2  can manage network devices (e.g., printing devices  14 - 16  and  24 - 26  and print control devices  11 - 13  and  21 - 23 ) connected to the network  1 . In the print management system  2 , each computer can operate under an operating system (OS) such as Microsoft Windows (registration trademark) and UNIX (registration trademark) . Furthermore, not only the OS but also application programs for managing the network devices (i.e., the printing devices  14 - 16  and  24 - 26  and the print control devices  11 - 13  and  21 - 23 ) can run on the computer. An example of a detailed arrangement of the computer is shown in  FIG. 2 .  
      In  FIG. 1 , a dotted frame  3  is a subnet group of a client (i.e., an belonging unit including a client which is logically formed in the network  1 ). Each terminal device connected to the network  1  is allocated a network address. An assembly of network addresses can logically form a “subnet” group. For example, according to the IP v4 protocol, the subnet mask can define what subnet each network address belongs to, so that each terminal device belonging to a subnet can be managed and controlled. The subnet group  3  includes three print control devices  11 - 13 , three printing devices  14 - 16 , a file server (not shown) and a database server (not shown).  
      A dotted frame  4  is a subnet group of another client (i.e., an belonging unit including another client which is logically formed in the network  1 ). The subnet group  4  is different from the subnet group  3 . The subnet group  4  includes three print control devices  21 - 23 , three printing devices  24 - 26 , a file server (not shown) and a database server (not shown).  
      The print control device  11  can be configured by a computer (i.e., information processing apparatus) that can install an OS such as Microsoft Windows (registration trademark) and UNIX (registration trademark) . The print control device  11  includes a print control program (e.g., a printer driver) that can produce a print job and output the print job to the printing devices  14 - 16 .  
      Furthermore, the print control device  11  can execute encryption processing relating to a print job based on cryptographic information when the print job is produced. The print job related encryption processing includes, for example, processing for encrypting a print job itself and processing for encrypting a certificate proving the correctness of the print job. The printing device can only decrypt a print job having been subjected to encryption processing corresponding to the device. As a result, any print job having been not subjected to correct encryption processing cannot be printed out.  
      An encryption key or information required for encrypting a print job (or a decryption key or information required for decrypting the encrypted print job) can be referred to as “cryptographic information” in the present exemplary embodiment.  
      The cryptographic information can be regarded as secrecy information for keeping a print job secret (or information required for canceling the secrecy of all or part or attached data of a print job). Furthermore, the cryptographic information can be regarded as falsification prohibiting information for preventing the print job from being falsified (or information required for canceling a falsification prohibited state of the print job).  
      As shown in  FIG. 1 , the print control device  11  is connected to the network  1  and belongs to the subnet group (i.e., belonging unit)  3 . Other print control devices  12  and  13  are structurally similar to the print control device  11 . In the present exemplary embodiment, the print control devices  11 - 13  can control print processing performed in the printing devices  14 - 16  belonging to the subnet group  3  (i.e., the same belonging unit).  
      In the following description, each subnet group is an example of the belonging unit. However, the belonging unit can be a division ID correlated to each client (which may be also referred to as a user ID to identify a user) . Furthermore, in a switch/hub, virtually realizing an internal division of the switch can define a virtual subnet for separating a physical connection state from a division work for a network. Thus, each network device (print control device or printing device) or each user belongs to any one of belonging units.  
      The printing device  14  can form an image based on a received print job and can output an image on a paper. The printing device  14  is, for example, a multifunction peripheral capable of functioning as a printer, a copying machine, or a facsimile machine. Furthermore, the printing device  14  has a function of executing encryption processing. As shown in  FIG. 1 , the printing device  14  belongs to the subnet group (belonging unit)  3  connected to the network  1 . The printing devices  15  and  16  are identical in arrangement to the printing device  14 .  
      The print control devices  21 - 23  are similar to the print control device  11  in the internal arrangement and abilities. However, as shown in  FIG. 1 , the print control devices  21 - 23  belong to the subnet group (belonging unit)  4 . In  FIG. 1 , the print control devices  21 - 23  can control print processing performed in the printing devices  24 - 26  belonging to the subnet group  4 . The printing devices  24 - 26  are similar to the printing device  14  in the internal arrangement and abilities. However, as shown in  FIG. 1 , the printing devices  24 - 26  belong to the subnet group (belonging unit)  4 .  
       FIG. 2  is a block diagram illustrating an example of the computer (e.g., the print control device  11 ) provided in the print management system  2 . In  FIG. 2 , the print management system  2  includes a CPU  501  that can execute a printing device management program stored in a ROM  502  or a hard disk (HD)  511 , or supplied from a flexible disk drive (FD)  512 . The CPU  501  can control each device connected to a system bus  504 .  
      A RAM  503  can function as a main memory or a work area of the CPU  501 . A keyboard controller (KBC)  505  can control a keyboard (KB)  509  and a pointing device (not shown) that enables a user to input instructions. A CRT controller (CRT C)  506  can control a CRT display (CRT)  510  that can display images, data and information.  
      A disk controller (DKC)  507  can control a hard disk (HD)  511  and a flexible disk controller (FD)  512  storing a boot program, various applications, edit files, user files, and the printing device management program. A network interface card (NIC)  508  can control bidirectional data communications performed between the print management system  2  and each printing device ( 14 - 16  and  24 - 26 ) and each print control device ( 11 - 13  and  21 - 23 ) via the network  1 .  
      Furthermore, user interfaces of the print management system  2  according to the present exemplary embodiment include not only the devices (e.g., KB 509 and CRT 510) physically connected to the print management system  2  but also Web interfaces utilizing HTTP/HTML. Accordingly, a management computer of the network  1  can operate the print management system  2  via the network  1 . In this case, the management computer can be part of the print management system  2 .  
      Furthermore, the ROM  502  or the hard disk (HD)  511  can store, in addition to the printing device management program, a device management table  60  storing the information relating to devices to be managed, and a program management table  80  storing print control programs (i.e., printer drivers) of respective printing devices.  
      Next, a practical operation of the print processing system according to the present exemplary embodiment will be described below in detail. The encryption system employed in the present exemplary embodiment is a public key encryption system (i.e., public key infrastructure).  
      The public key encryption system uses private and public keys as cryptographic information, according to which the data encrypted using a private key can only be decrypted using a corresponding public key, or vice versa. In general, the public key is opened to the public while the private key is kept in secret.  
      According to this system, it is unnecessary to prepare cryptographic information (public key) for each communication partner. The public key can be arbitrarily opened to the public. Accordingly, an encryption key can be easily transmitted to a communication partner, and only an authorized user can decrypt the encrypted data.  
      The print processing system of the present exemplary embodiment can perform encryption processing relating to a print job based on the public key encryption system.  
       FIG. 3  is a flowchart showing an example of a management function provided by a printing device management program that the print management system  2  can execute in accordance with the first exemplary embodiment.  
      First, in step S 101 , the print management system  2  outputs a retrieval request packet to the network  1  to discriminate the printing devices  14 - 16  and  24 - 26  connected to the network  1 , and starts retrieving the printing devices  14 - 16  and  24 - 26 . The retrieval request packet used in the present exemplary embodiment is, for example, an SLP (Service Location Protocol) multicast packet or an SNMP (Simple Network Management Protocol) broadcast packet.  
      The SLP is a network protocol defined by the IETF RFC2165, which enables the print management system  2  to retrieve a service on the network  1  (i.e., a network address of a node providing the service). In the present exemplary embodiment, the print management system  2  transmits an SLP multicast packet that designates a printer as a service type, and retrieves the printers (i.e., printing devices  14 - 16  and  24 - 26 ) connected to the network  1  including the subnet groups  3  and  4 .  
      Furthermore, to retrieve a network device not complying with the SLP, the print management system  2  can transmit an SNMP broadcast packet to the subnet groups  3  and  4  as described above. The SNMP is a network protocol defined by the IETF RFC1157, which enables the print management system  2  to obtain the information relating to a node on the network  1  if used together with spoofing MIB (management information base).  
      The print management system  2  transmits a broadcast packet of the printer MIB (IETF RFC1759) and retrieves the printers (i.e., printing devices  14 - 16  and  24 - 26 ) connected to the network  1  including the subnet groups  3  and  4 .  
      Next, in step S 102 , the print management system  2  receives a retrieval response packet returned from the printing devices  14 - 16  and  24 - 26  in response to the retrieval request packet. The retrieval request packet is a multicast or broadcast packet, while the retrieval response packet returned from each network device has a packet format differentiated for each of the SLP and the SNMP.  
      If the print management system  2  receives a retrieval response packet from any one of the network devices, the processing flow immediately proceeds to the next step S 103 .  FIG. 5  is a block diagram schematically illustrating a practical communication state relating to a retrieval request packet and a retrieval response packet in the print processing system in accordance with the first exemplary embodiment.  
      Next, in step S 103 , the print management system  2  extracts, from the received retrieval response packet, a network address (belonging information) of the printing device that has returned the retrieval response packet. Then, the print management system  2  registers the obtained network address into the device management table  60  shown in  FIG. 6 .  
      The belonging information extracted in this case is information that specifies the belonging unit. The device management table  60  is capable of storing printing device management programs. As shown in  FIG. 6 , the device management table  60  stored in the printing device management program has a configuration capable of storing printing device information including network addresses of the printing devices  14 - 16  and  24 - 26  and the print control devices  11 - 13  and  21 - 23  and the identifiers (e.g., MAC address) on the network  1 .  
      In the present exemplary embodiment, each of the printing devices  14 - 16  and  24 - 26  has a component capable of temporarily storing a public key. The network addresses registered in the device management table  60  can be IP addresses. Furthermore, the network address can be replaced with FQDN (Fully Qualified Domain Name).  
      Next, in step S 104 , the print management system  2  determines whether a predetermined retrieval response waiting time has elapsed. An arbitrary value can be set for the retrieval response waiting time based on the settings of the printing device management programs, or according to user&#39;s designation. If the retrieval response waiting time has elapsed (i.e., YES in step S 104 ), the processing flow proceeds to step S 105 . On the other hand, when the retrieval response waiting time has not yet elapsed (i.e., NO in step S 104 ), the print management system  2  repeatedly executes the processing of steps S 102  to S 104 .  
      In step S 105 , the print management system  2  determines whether a new printing device is discovered in the present retrieval processing, with reference to the device management table  60 . To check the presence of a new printing device, the print management system  2  can determine whether new printing device identification information, such as a printing device name or a MAC address of the printing device, can be retrieved. In the present exemplary embodiment, as shown in  FIG. 5 , the printing device  16  is newly connected to the network  1  and the print management system  2  can discover the printing device  16  as a new printing device.  
      According to the present exemplary embodiment, the print management system  2  is configured to retrieve information (e.g., identification information) associated with a new printing device. However, any other method can be used to identify a new printing device. For example, the printing device newly connected to the network  1  can be configured to transmit identification information (e.g., MAC address) to the print management system  2  so that the print management system  2  can execute the processing of step S 106  and succeeding steps in response to the received identification information.  
      Next, in step S 106 , the print management system  2  determines whether a new printing device is discovered. If the new printing device retrieval processing is finished and no new printing device is present in the device management table  60  (i.e., NO in step S 106 ), the processing flow proceeds to step S 201  of  FIG. 4 . On the other hand, when a new printing device is present in the device management table  60  (i.e., YES in step S 106 ), the processing flow proceeds to step S 107 . In the present exemplary embodiment, the print management system  2  can discover the printing device  16  as a new printing device. Therefore, the printing device  16  is subjected to the processing for a newly discovered printing device.  
      Next, in step S 107 , the print management system  2  obtains, from the new printing device (i.e., printing device  16 ), ability information of the printing device including encryption ability and functions of the public key encryption system. The print management system  2  can obtain the ability information by using an SLP or SNMP unicast packet.  
      Next, in step S 108 , the print management system  2  determines whether the new printing device can support the public key encryption system, based on the ability information obtained in step S 107 . If the new printing device can support the public key encryption system (i.e., YES in step S 108 ), the processing flow proceeds to step S 109 . On the other hand, when the new printing device cannot support the public key encryption system (NO in step S 108 ), the processing flow returns to step S 105 .  
      In step S 109 , the print management system  2  communicates with the new printing device (i.e., printing device  16 ) according to the SSL (Secure Socket Layer) which is a security protocol proposed by Netscape Communications to provide encryption, authentication, and anti-falsification functions. The version presently used is SSL3.0. TLS1.0 is presently opened to the public, as RFC2246, which is standardized by the IETF based on the SSL3.0. A version number 3.1 is used for the TLS1.0. Accordingly, the actual version of the SSL is SSL 3.1.  
      According to an SSL handshake protocol of the SSL 3.0, a server can use a certificate message to transmit a public key certificate to a client. The public key certificate according to the SSL can be defined by X.509 v3. In the present exemplary embodiment, the printing device  16  is an SSL server and the print management system  2  is a client. Hence, as shown in  FIG. 7 , the printing device  16  can transmit a public key certificate to the print management system  2 .  
      Next, in step S 110 , the print management system  2  determines whether the SSL communication with the new printing device succeeds. If no public key is produced as cryptographic information and the SSL communication fails (i.e., NO in step S 110 ), the processing flow proceeds to step S 111  before executing step S 112 . On the other hand, when the SSL communication succeeds (i.e., YES in step S 110 ), the processing flow directly proceeds to step S 112  without executing step S 111 .  
      For example, the print management system  2  can obtain, from the printing device, status information indicating whether cryptographic information is produced and can determine based on the obtained status information whether the cryptographic information is not produced.  
      In step S 111 , the print management system  2  instructs the new printing device (i.e., the printing device  16 ) to produce a public key. The new printing device can use an SLP or SNMP unicast packet to produce a public key.  
      In step S 112 , the print management system  2  obtains a public key from the public key certificate. Then, the print management system  2  registers the obtained public key into the device management table  60  shown in  FIG. 6  which can store the public key in relation to a network address (i.e., belonging information).  
      Through the above-described processing, the print management system  2  can accomplish the processing for obtaining a public key of a new printing device. Subsequently, the processing flow returns to step S 105 .  
      If no new printing device is present in the device management table  60  (i.e., NO in step S 106 ), the processing flow proceeds to step S 201  of  FIG. 4 .  
      In step S 201 , the print management system  2  retrieves new cryptographic information with reference to the device management table  60 . According to the exemplary processing shown in  FIG. 4 , the new cryptographic information to be retrieved is a new public key.  
      Next, in step S 202 , the print management system  2  determines whether any new public key is discovered. If a new public key is discovered (i.e., YES in step S 202 ), the processing flow proceeds to step S 203 . On the other hand, when no new public key is discovered (i.e., NO in step S 202 ), the print management system  2  terminates the processing routine of the flowchart.  
      In step S 203 , the print management system  2  retrieves and obtains a network address allocated to a source printing device that has produced the public key with reference to the device management table  60 . In the present exemplary embodiment, the print management system  2  can obtain a network address of the printing device  16 .  
      Next, in step S 204 , the print management system  2  retrieves a print control device belonging to the subnet group (belonging unit) corresponding to the network address (i.e., the network address of the printing device  16 ) obtained in step S 203 , with reference to the device management table  60 .  
      As described above, according to the IP v4 protocol, the subnet mask can determine what subnet each network address belongs to. The print management system  2  can retrieve a print control device belonging to the determined subnet. As shown in  FIG. 6 , a print control device and its network address (belonging information) are registered beforehand in the device management table  60 .  
      Next, in step S 205 , the print management system  2  determines whether any corresponding print control device is present. If the corresponding print control device is present (i.e., YES in step S 205 ), the processing flow proceeds to step S 206 . On the other hand, when no corresponding print control device is present, the print management system  2  terminates the processing routine of the flowchart.  
      In the present exemplary embodiment, the printing device  16  belongs to the subnet group  3  and the corresponding print control device is each of the print control devices  11 - 13 . In step S 206 , the print management system  2  obtains a print control program (e.g., a printer driver) of the corresponding printing device from the program management table  80  shown in  FIG. 8 . The printer driver of each printing device is registered beforehand in the program management table  80 .  
      Next, in step S 207 , the print management system  2  incorporates a public key (i.e., cryptographic information) into the printer driver obtained in step S 206 . Next, in step S 208 , the print management system  2  transmits the printer driver incorporating the public key to the corresponding print control device so that the print control device can install the transmitted printer driver. In the present exemplary embodiment, as shown in  FIG. 9 , the print management system  2  transmits the printer driver incorporating the public key to each of the print control devices  11 - 13 , so that each print control device can install the printer driver involving the cryptographic information.  
      Through the processing shown in the flowchart of  FIGS. 3 and 4 , the print control device  11  can obtain the public key of the newly connected printing device  16  and can transmit a print job encrypted using the obtained public key to the printing device  16 , as shown in  FIG. 10 .  
      As described above, according to the present exemplary embodiment, the print management system  2  can retrieve the printing devices  14 - 16  and  24 - 26  connected to the network  1  periodically or at arbitrary timing and can update the device management table  60  according to the retrieved result. Then, if the print management system  2  detects the printing device  16  newly connected to the network  1  (with reference to the device management table  60 ), the print management system  2  can obtain ability information of the new printing device  16 .  
      Subsequently, based on the obtained ability information, the print management system  2  can determine whether the new printing device  16  has encryption ability. When the new printing device  16  has encryption ability, the new printing device  16  can obtain cryptographic information (public key) and register the obtained cryptographic information and a network address of the new printing device  16  into the device management table  60 .  
      Thus, the print management system  2  can automatically collect the cryptographic information of the printing device  16  newly connected to the network  1 , and can easily manage the cryptographic information. Accordingly, when numerous network devices (e.g., printing devices and print control devices) are connected to the network  1 , the print management system  2  can efficiently manage and distribute the cryptographic information of each printing device. Each of the print control devices  11 - 13  and  21 - 23  can promptly obtain the cryptographic information of the printing devices  14 - 16  and  24 - 26 . Thus, the encrypted printing in the network printing system can be adequately realized.  
      Furthermore, when the print management system  2  obtains the cryptographic information (public key) of the printing device  16  newly connected to the network  1 , if the new printing device  16  includes no cryptographic information, the print management system  2  can instruct the new printing device  16  to produce cryptographic information. Therefore, the print management system  2  is not required to prepare the cryptographic information of the new printing device  16  beforehand. If no cryptographic information is present in the new printing device  16 , the print management system  2  can create a pair of keys (private keys) and transmit the created private keys to the new printing device  16  that can install the received keys.  
      Moreover, with reference to the network address (belonging information) of the new printing device  16 , the print management system  2  can specify the print control devices  11 - 13  that can use the new printing device  16  and can distribute a print control program involving cryptographic information to the specified print control devices.  
      Each of the print control devices  11 - 13  can easily obtain the print control program and cryptographic information of the new printing device  16 . Furthermore, performing the above-described processing can enhance the security of a print job managed in the network  1 .  
      In the present exemplary embodiment, the print management system  2  can automatically determine what subnet (belonging unit) each network device belongs to, based on the network address (belonging information) of the network device.  
      For example, instead of determining the subnet groups  3  and  4  according to the IP V4 protocol, a user can designate and edit the subnet groups  3  and  4  by designating a range of network addresses. In this case, if a new printing device is discovered, the print management system  2  can identify a subnet group (belonging unit) of the newly discovered printing device by determining whether the new printing device is within the range of the network addresses designated by a user.  
      Furthermore, in the present exemplary embodiment, the print management system  2  automatically transmits the printer driver of the printing device newly connected to the network to the print control devices  11 - 13  so that each print control device can install the printer driver of the newly connected printing device (refer to step S 208  of  FIG. 4 ). However, when a request is received from a print control device, the print management server can transmit a printer driver of the new printing device to the print control device. In other words, the printer driver can be a push-install type or a pull-install type.  
      Moreover, in addition to the printer driver, the print control device can install printer setup information such as an IP address of the new printing device. Furthermore, in the processing of step S 208  of  FIG. 4 , it has been described that the cryptographic information used in the production of a print job by the print control device can be incorporated into the printer driver and distributed. However, the cryptographic information of the printer driver can be a plug-in type and cryptographic information other than the printer driver can be distributed to the print control device.  
      In this case, the print control device can receive cryptographic information from the print management system  2 , and can incorporate the received cryptographic information into a printer driver installed beforehand. The above-described modified arrangements can also enhance the security of a print job managed in the network  1 .  
     Second Exemplary Embodiment  
      Next, the second exemplary embodiment of the present invention will be described. According to the above-described first exemplary embodiment, the print management system  2  is configured to transmit cryptographic information (public key) of a newly connected printing device to the print control device.  
      The present exemplary embodiment is characterized in that the print management system  2  can register a cryptographic information (public) key in a later-described directory device so that each print control device can obtain the registered public key.  
      In other words, the second exemplary embodiment is different from the above-described first exemplary embodiment in a part of the processing performed in the print processing system. Accordingly, in the following description, the portions identical or similar to those disclosed in the first exemplary embodiment are denoted by the same reference numerals shown in FIGS.  1  to  10  and will not be described below in detail.  
       FIG. 11  is a block diagram illustrating an example of a print processing system in accordance with the second exemplary embodiment. The print processing system shown in  FIG. 11  is different from the print processing system shown in  FIG. 1  in that a directory device  5  is additionally provided. The directory device  5  can be added as an independent hardware device or a logical section in the print management system  2 .  
      The directory device  5  can store configuration information (e.g., node information) of the network  1 , and can register or retrieve the information to or from the node having proper authorization. The print processing system shown in  FIG. 11  is similar to the print processing system shown in  FIG. 1  in the rest of the arrangement. The printing device management server  2  has an internal arrangement similar to that disclosed in  FIG. 2 . Furthermore, the encryption system used for printing is similar to that described in the first exemplary embodiment.  
       FIG. 12  is a flowchart showing an example of a management function provided by a printing device management program that the print management system  2  can execute in accordance with the second exemplary embodiment.  
      First, in step S 301 , the print management system  2  transmits a retrieval request packet, such as an SLP multicast packet or an SNMP broadcast packet, to the network  1  and starts retrieval of the printing devices  14 - 16  and  24 - 26  connected to the network  1 .  
      As described in the first exemplary embodiment, the SLP enables the print management system  2  to retrieve a service on the network  1 . In the present exemplary embodiment, the print management system  2  transmits an SLP multicast packet that designates a printer as a service type, and retrieves the printers (i.e., printing devices  14 - 16  and  24 - 26 ) connected to the network  1  including the subnet groups  3  and  4 .  
      Furthermore, to retrieve a network device not complying with the SLP, the print management system  2  can transmit an SNMP broadcast packet to the subnet groups  3  and  4  as described in the first exemplary embodiment. The print management system  2  can obtain the information of a node on network  1  by using the SNMP and the MIB. The print management system  2  transmits a broadcast packet of the printer MIB (IETF RFC1759) and retrieves the printers (i.e., printing devices  14 - 16  and  24 - 26 ) connected to the network  1  including the subnet groups  3  and  4 .  
      Next, in step S 302 , the print management system  2  receives a retrieval response packet returned from the printing devices  14 - 16  and  24 - 26  in response to the retrieval request packet. The retrieval request packet is a multicast or broadcast packet, while the retrieval response packet returned from each network device has a packet format differentiated for each of the SLP and the SNMP. If the print management system  2  receives a retrieval response packet from any one of the network devices, the processing flow immediately proceeds to the next step S 303 .  
      Next, in step S 303 , the print management system  2  extracts, from the received retrieval response packet, a network address (belonging information) of the printing device that has returned the retrieval response packet. Then, the print management system  2  registers the obtained network address into the device management table  60  shown in  FIG. 6 .  
      Next, in step S 304 , the print management system  2  determines whether a predetermined retrieval response waiting time has elapsed. An arbitrary value can be set for the retrieval response waiting time based on the settings of the printing device management programs, or according to user&#39;s designation. If the retrieval response waiting time has elapsed (i.e., YES in step S 304 ), the processing flow proceeds to step S 305 . On the other hand, when the retrieval response waiting time has not yet elapsed (i.e., NO in step S 304 ), the print management system  2  repeatedly executes the processing of steps S 302  to S 304 .  
      In step S 305 , the print management system  2  determines whether a new printing device is discovered in the present retrieval processing, with reference to the device management table  60 . In the present exemplary embodiment, as shown in  FIG. 5 , the printing device  16  is newly connected to the network  1  and the print management system  2  can discover the printing device  16  as a new printing device.  
      Next, in step S 306 , the print management system  2  determines whether a new printing device is discovered. If the new printing device retrieval processing is finished and no new printing device is present in the device management table  60  (i.e., NO in step S 306 ), the print management system  2  terminates the processing routine of the flowchart. On the other hand, when a new printing device is present in the device management table  60  (i.e., YES in step S 306 ), the processing flow proceeds to step S 307 . In the present exemplary embodiment, the print management system  2  can discover the printing device  16  as a new printing device. Therefore, the printing device  16  is subjected to the processing for a newly discovered printing device.  
      Next, in step S 307 , the print management system  2  obtains, from the new printing device (i.e., printing device  16 ), ability information of the printing device including encryption ability and functions of the public key encryption system. The print management system  2  can obtain the ability information by using an SLP or SNMP unicast packet.  
      Next, in step S 308 , the print management system  2  determines whether the new printing device can support the public key encryption system, based on the ability information obtained in step S 307 . If the new printing device can support the public key encryption system (i.e., YES in step S 308 ), the processing flow proceeds to step S 309 . On the other hand, when the new printing device cannot support the public key encryption system (NO in step S 308 ), the processing flow returns to step S 305 .  
      In step S 309 , the print management system  2  communicates with the new printing device (i.e., printing device  16 ) according to the SSL. In the present exemplary embodiment, the printing device  16  is an SSL server and the print management system  2  is a client. Hence, as shown in  FIG. 7 , the printing device  16  can transmit a public key certificate to the print management system  2 .  
      Next, in step S 310 , the print management system  2  determines whether the SSL communication with the new printing device has succeeded. If no public key is produced as cryptographic information and the SSL communication is failed (i.e., NO in step S 310 ), the processing flow proceeds to step S 311  before executing step S 312 . On the other hand, when the SSL communication is succeeded (i.e., YES in step S 310 ), the processing flow directly proceeds to step S 312 .  
      In step S 311 , the print management system  2  instructs the new printing device (i.e., the printing device  16 ) to produce a public key. The new printing device can use an SLP or SNMP unicast packet to produce a public key.  
      In step S 312 , the print management system  2  obtains a public key from the public key certificate. Then, the print management system  2  registers the obtained public key into the directory device  5  which can store the public key in relation to the information of the printing device.  
      Through the above-described processing, the print management system  2  can accomplish the processing for obtaining a public key of a new printing device. Subsequently, the processing flow returns to step S 305 .  
       FIG. 13  is a flowchart showing an example of an operation of the print control device ( 11 - 13  and  21 - 23 ) that obtains a public key registered in the directory device  5  in accordance with the second exemplary embodiment. The print management system  2  executes the processing of the flowchart shown in  FIG. 13  after accomplishing the processing of the flowchart shown in  FIG. 12 .  
      First, in step S 401 , the print control device determines whether a start instruction of encrypted printing designating a specific printing device is received, based on a user&#39;s operation on a user interface of the print control device. If the start instruction of encrypted printing designating a specific printing device is received (i.e., YES in step S 401 ), the processing flow proceeds to step S 402 .  
      In step S 402 , it is determined whether the print control device has cryptographic information (public key) of the designated printing device. If the print control device has the cryptographic information (public key) of the designated printing device (i.e., YES in step S 402 ), the processing flow directly proceeds to step S 406  by skipping steps S 403  to S 405 . On the other hand, when the print control device has no cryptographic information (public key) of the designated printing device (i.e., NO in step S 402 ), the processing flow proceeds to step S 403 .  
      In step S 403 , the print control device obtains an identifier (e.g., printing device name, host name, network address, or MAC address) of the designated printing device on the network  1 . In general, the OS of the computer can store the identifier.  
      Next, in step S 404 , the print control device inquires the directory device  5  about the cryptographic information (public key) of the designated printing device, based on the identifier obtained in step S 403 . The directory device  5  retrieves and obtains a public key corresponding to the printing device to which a user wants to send a print job, based on the identifier involved in the inquiry.  
      Next, in step S 405 , the print control device obtains the cryptographic information (public key) retrieved by the directory device  5  in step S 404 .  FIG. 14  is a block diagram schematically illustrating a practical communication state relating to registration of a public key and acquisition of the public key in accordance with the second exemplary embodiment.  
      Next, in step S 406 , the print control device encrypts all or part or attached data of the print job using the cryptographic information (public key) obtained in step S 405 , and transmits the encrypted print job to the designated printing device.  
      As described above, according to the second exemplary embodiment, the print management system  2  can register the cryptographic information (public key) of the printing devices  14 - 16  and  24 - 26  into the directory device  5  on the network  1 . Each of the print control devices  11 - 13  and  21 - 23  can obtain a registered encryption key from the directory device  5 .  
      Thus, in addition to the effects of the above-described first exemplary embodiment, each of the print control devices  11 - 13  and  21 - 23  can obtain the encryption key at arbitrary timing using a general protocol. Thus, even when the print control devices  11 - 13  and  21 - 23  are connected to the network  1  later than the printing devices  14 - 16 , the encryption key can be distributed to the print control devices  11 - 13  and  21 - 23 .  
      According to the present exemplary embodiment, the print control devices  11 - 13  and  21 - 23  can request the directory device  5  to retrieve and obtain the cryptographic information (public key) . Alternatively, the print control devices  11 - 13  and  21 - 23  can request the print management system  2  to retrieve and obtain the cryptographic information (public key). The print management system  2  can return the obtained cryptographic information (public key) to a corresponding print control device.  
      Furthermore, the processing for retrieving a print control device and installing a print control program of the newly connected printing device  16  to the retrieved print control device can be realized by the processing similar to the steps S 201  to S 208  of  FIG. 4 . In this case, the processing of step S 207  can be omitted because the directory device  5  stores the public key. Namely, it is possible to transmit and install a print control program (printer driver) involving no public key on the print control device.  
     Third Exemplary Embodiment  
      Next, a third exemplary embodiment of the present invention will be described. According to the above-described first and second exemplary embodiments, the print management system  2  or the directory device  5  outputs the cryptographic information (public key) to a print control device and the print control device executes the encryption processing. However, any other encryption processing can be employed to efficiently manage the cryptographic information relating to a print job.  
      For example, in response to the inquiry from a print control device (refer to step S 404 ), the print management system  2  or the directory device  5  can retrieve the cryptographic information (public key) of a corresponding printing device. The encryption processing relating to a print job can be performed based on the retrieved cryptographic information. In this case, the print control device is not required to install the cryptographic information (public key).  
      Furthermore, as part of the inquiry processing corresponding to the processing of step S 404 , the print control device can transmit the data to be encrypted to the print management system  2  or the directory device  5 . Then, the print management system  2  or the directory device  5  can encrypt the received data and return the encrypted data to the print control device. The print control device can transmit the encrypted data, as at least part of a print job, to a printing device.  
      According to the above-described exemplary embodiments, the print management system  2  is a single computer (single server). However, functions of the print management system  2  can be realized by two or more computers (for example, plural servers) which are separately provided and capable of cooperatively performing the above-described processing. Furthermore, the print management system  2  can be modified to include part or all of the functions realized by the printing devices  14 - 16  and  24 - 26  and the print control devices  11 - 13  and  21 - 23 .  
     Other Exemplary Embodiment  
      Furthermore, software program code for realizing the functions of the above-described exemplary embodiments can be supplied, via a storage medium (or a recording medium), to a system or an apparatus including various devices to be actuated. A computer (or CPU or MPU) in the system or the apparatus can read the program code stored in the storage medium and can execute the readout program.  
      In this case, the program code read out from the storage medium can realize the functions of the exemplary embodiments. The equivalents of programs can be used if they possess comparable functions. Accordingly, when the functions or processes of the exemplary embodiments are realized by a computer, the program code installed in the computer and the recording medium storing the program are used to implement the present invention.  
      In other words, the present invention encompasses a computer program that can realize the functions or processes of the exemplary embodiments or any recording medium that can store the program. In this case, the type of program can be any one of object code, interpreter program, and OS script data. A recording medium supplying the program can be selected from any one of a flexible disk, a hard disk, an optical disk, a magneto-optical disk, an MO, a CD-ROM, a CD-R, a CD-RW, a magnetic tape, a nonvolatile memory card, a ROM, and a DVD (DVD-ROM, DVD-R).  
      In other words, the present invention encompasses a computer program that can realize the functions or processes of the exemplary embodiments or any recording medium that can store the program.  
      The method for supplying the program includes accessing a home page on the Internet using the browsing function of a client computer, when the home page allows each user to download the computer program of the present invention, or compressed files of the programs having automatic installing functions, to a hard disk or other recording medium of the user.  
      Furthermore, the program code constituting the programs of the present invention can be divided into a plurality of files so that respective files are downloadable from different home pages. Namely, the present invention encompasses WWW servers or FTP servers that allow numerous users to download the program files so that the functions or processes of the present invention can be realized on their computers.  
      Furthermore, not only the functions of the above-described exemplary embodiment can be realized by a computer that executes the programs, but also an operating system (OS) running on the computer can execute part or all of the actual processing based on instructions of the programs.  
      Furthermore, the program code read out of a storage medium can be written into a memory of a function expansion board equipped in a computer or into a memory of a function expansion unit connected to the computer. In this case, based on an instruction of the program, a CPU provided on the function expansion board or the function expansion unit can execute part or all of the processing so that the functions of the above-described exemplary embodiments can be realized.  
      While the present invention has been described with reference to exemplary embodiments, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. The scope of the following claims is to be accorded the broadest interpretation so as to encompass all modifications, equivalent structures and functions.  
      This application claims priority from Japanese Patent Application No. 2005-323950 filed Nov. 8, 2005, which is hereby incorporated by reference herein in its entirety.