JP2013218474A - Information processing service - Google Patents

Abstract

PROBLEM TO BE SOLVED: To solve the problem that when each information processing service performs information processing in accordance with individual processing requests, and records the logs with respect to data input from the other information processing service, it is not possible to audit those logs in association.SOLUTION: An information processing service is configured to, when receiving input data from the other information processing service, issue and transmit input identification information for identifying the input data to the other information processing service, and to associate the input identification information with the log of the information processing corresponding to the input data for storage. Furthermore, the information processing service is configured to accept an auditing request including the input identification information from the other information processing service, and makes the other information processing service audit the log of the information processing associated with the input identification information.

Description

  The present invention relates to an information processing service that records a log when information processing is performed, and more specifically, in conjunction with other information processing services, logs related to logs possessed by other information processing services are transferred to other information processing services. The present invention relates to an information processing service that enables a service to be audited.

  In recent years, information processing services for realizing various functions have been provided on the Internet. Among such services, there are services that cooperate with each other and services that cooperate with a digital multifunction peripheral (hereinafter referred to as MFP) in a network such as an in-house LAN. As an example, there is a form in which a document management service that submits a document in response to a document acquisition request from the print service and a print service that prints the submitted document in response to a request from the MFP cooperate.

  However, when services or services and devices are linked, operation logs related to the linked processing are recorded separately for each service or device. For this reason, when an operation log is to be audited for the purpose of confirming whether there is information leakage or unauthorized operation, it is necessary to audit the log separately for each service or device. Furthermore, when auditing, the logs managed by each could not be associated with each other.

  On the other hand, a method of associating a log of processing performed by the MFP with a log of processing performed by the web application server has been invented (see, for example, Patent Document 1). In the method described in Japanese Patent Application Laid-Open No. H10-228707, a server that receives a processing request from the MFP issues session identification information for the processing request. Then, the server device manages the log of processing executed in response to the processing request and the identification information in association with each other. Further, the MFP acquires the identification information from the server, and manages the log of the processing executed by the MFP in response to the processing request and the identification information in association with each other. At the time of the audit, each log was associated based on the associated identification information.

JP 2010-130349 A

  In the above-described link form between the print service and the document management service, an input log that the document management service performs in response to a request from the print service and a print log that the print service performs in response to a request from the MFP are: Each service will be recorded separately. At this time, since the processes such as submission and printing are not performed by a single processing request, the method of Patent Document 1 cannot associate the logs of those processes. In other words, when each information processing service processes information according to an individual processing request and records the log for data input from another information processing service, the logs cannot be associated. It was. For this reason, the information processing service cannot cause other information processing services to audit logs related to the logs possessed by other information processing services.

  The present invention has been made in order to solve the above-described problems, and an object of the present invention is to allow an information processing service to log information processing logs for data input from other information processing services. It is to provide a mechanism for auditing in association with logs held by.

  In order to solve the above-described problems, the present invention is an information processing service that records a log when information processing is performed and receives input data from another information processing service, and receives input from the other information processing service. Input data recording means for generating input identification information for identifying data, transmitting the input identification information to the other information processing service, and recording the input identification information and the input data in association with each other (302, S606, S607), a log recording unit (304, S609) for generating an information processing log for the input data and recording it in association with the input identification information; and receiving the input identification information from the other information processing service Log transmission means (3) for transmitting at least a part of the information processing log associated with the received input identification information to the other information processing service; 5, S612) and it was information processing service (300), characterized in comprising a.

  According to the present invention, an information processing service can cause another information processing service to audit a log of information processing for data input from another information processing service in association with a log included in the other information processing service. Become. Therefore, other information processing services can centrally audit information processing logs related to the data.

1 is an overall view of a system including a server group that provides an information processing service of the present invention. It is a block diagram which shows the internal structure of each server of a server group. It is a figure which shows the software structure of the whole system. It is an example of the submission data preserve | saved at a submission data storage part. It is an example of the job log data preserve | saved at a job log memory | storage part. 6 is a flowchart illustrating an operation when a print service receives a processing request. 10 is a diagram illustrating a software configuration of a print service in Embodiment 2. FIG. It is an example of the cooperation information preserve | saved at a cooperation information storage part. It is a flowchart which shows operation | movement of a service cooperation reception part. 12 is a flowchart illustrating detailed steps of job log generation / storage processing in the second embodiment.

  The best mode for carrying out the present invention will be described below with reference to the drawings.

Example 1
First, a first embodiment of the present invention will be described.

  FIG. 1 is a network configuration diagram of the entire system according to the present invention. In FIG. 1, reference numeral 101 denotes a print service, and reference numeral 102 denotes a server group that provides a document management service. Reference numeral 110 denotes an MFP, and 120 denotes a PC. Reference numeral 150 denotes the Internet, and reference numeral 160 denotes a LAN such as a corporate network. There may be a plurality of MFPs 110 and PCs 120.

  FIG. 2 is a block diagram showing an internal configuration of each server forming the server groups 101 and 102.

  The control unit 210 including the CPU 211 controls the operation of each server in the server group 101. The CPU 211 reads out control programs stored in the ROM 212 and the HDD 214 and executes various control processes such as reading control and transmission control. The RAM 213 is used as a temporary storage area such as a main memory or work area for the CPU 211. The HDD 214 stores various programs and data.

  The network I / F 215 connects the control unit 210 to the network and transmits / receives information to / from another device on the network.

  Reference numeral 216 denotes a bus that connects blocks in the control unit 210.

  FIG. 3 is a diagram showing a software configuration example of the entire system according to the present invention.

  Reference numeral 300 denotes a print service provided by the server group 101. A detailed software configuration example inside the print service 300 will be described later.

  Reference numeral 320 denotes a document management service provided by the server group 102. The document management service 320 has a function of storing and managing document files, and accepts document acquisition and document registration requests from users mainly through the web browser 330. Further, it has a function of recording an operation performed on a document as an operation log. In particular, when processing a document acquisition request from the print service 300, a submission ID (described later) passed from the print service 300 is provided. ) In association with the log of the process. Further, the document management service 320 has a function of accepting an audit request from the user via the web browser 330 and presenting an operation log recorded for the designated document to the user. When the operation log of the document to be audited includes an operation log for a document acquisition request from the print service 300, the document management service 320 uses the submission ID associated with the log to request an audit request to the print service 300. To obtain the related operation log. Then, the document management service 320 presents the operation log acquired from the print service 300 and the operation log held by the document management service 320 to the user.

  Reference numeral 330 denotes a web browser that operates on the PC 120. The web browser 330 accesses the print service 300 and the document management service 320 and displays a GUI (Graphical User Interface) provided by each service. When the user operates the displayed GUI, the web browser 330 makes a processing request to each service.

  A print application 340 operates on the MFP 110. The print application 340 accesses the print service 300 in accordance with a user operation, acquires a list of submitted documents that can be printed by the user, and displays it on the operation panel of the MFP 110. When the user selects a document to be printed on the operation panel, the print application 340 sends a print request for the selected document to the print service 300 to acquire print data, and the print data is printed by the MFP 110. To do.

  Next, a software configuration of the print service 300 that cooperates with the document management service 320 will be described.

  The request processing unit 301 of the print service 300 receives requests from the document management service 320, the web browser 330 on the PC 120, the print application 340 on the MFP 110, and the like. When the request processing unit 301 receives the authentication request, the request processing unit 301 interprets the user ID and password for identifying the user included in the request, collates with the information in the customer information storage unit 311, and Check if you are a legitimate user. The request processing unit 301 passes the received processing request to the submission processing unit 302 or the print processing unit 303 as necessary.

  When the request processing unit 301 receives, from the web browser 330 or the like, a submission request for submitting a document that the document management service 320 has, the submission processing unit 302 obtains a document from the document management service 320. Make a request and get a document. The acquired document is included in the input data as an input document and stored in the input data storage unit 312. An example of the submitted data is shown in FIG. In FIG. 4, the submission ID is identification information issued by the submission processing unit 302 in order to identify the submission data. This submission ID is issued when a document acquisition request is made, is included in the document acquisition request, and is passed to the document management service 320. The submission source identification information is information for identifying the document management service of the submission source, and in the present embodiment, a fully qualified domain name (hereinafter referred to as FQDN) is used. . However, the present invention is not particularly limited as long as it can identify the document management service of the submission source, such as an IP address or URL. The document data is binary data of the input document.

  The print processing unit 303 operates when the request processing unit 301 receives a print request from the print application 340, and reads the input data specified by the print request from the input data storage unit 312. Then, the print processing unit 303 generates print data from the document data included in the read submission data, and transmits the print data to the print application 340.

  The job log generation unit 304 generates a print job log for the print request and stores it in the job log storage unit 313. An example of the job log is shown in FIG. In FIG. 5, the job log ID is identification information for identifying the job log, and is issued by the job log generation unit 304. The printer, the printing device, and the printing date and time are respectively the name of the user who performed printing, the name of the printing device, and the date and time when the print request was made, and these information are obtained from the print processing unit 303 by the job log generation unit 304. receive. The image data is binary data obtained by the job log generation unit 304 receiving print data from the print processing unit 303 and converting it into an image format that can be easily audited later. The submission ID is a submission ID of submission data to be printed, and is also received by the job log generation unit 304 from the print processing unit 303.

  The job log auditing unit 305 operates when the request processing unit 301 receives an audit request from the document management service 320, and searches the job log storage unit 313 for a job log associated with the specified submission ID. To the document management service 320.

  The customer information storage unit 311 stores user information managed by the print service 300, and has information such as a user ID and an authentication password.

  Next, the operation when the print service 300 receives a processing request will be described with reference to the flowchart of FIG. Each step shown in the flowchart of FIG. 6 is realized by the operation of each processing unit of the print service 300 shown in FIG. 3 when the CPU 211 of the server group 101 executes a control program.

  In step S601, the request processing unit 301 receives a processing request from the document management service 102, the MFP 110, or the PC 102, and determines the content.

  If the processing request is an authentication request including authentication information for the print service 300 including the user ID and password, the processing moves to step S602. When the processing request is an input request including authentication information for the print service 300, authentication information for the document management service 320, a URL of the document management service 320, and a document ID of the document on the document management service 320. In step S605, the process proceeds to step S605. If the processing request is an audit request including authentication information for the print service 300 and a submission ID, the processing transitions to step S611. When the processing request is other than the above, the request processing unit 301 determines whether the session identification information included in the processing request matches the session identification information temporarily stored as the authenticated session. If they match, GUI information corresponding to the request source is returned. At this time, if the request source is the print application 340, the request processing unit 301 causes the print application 340 to display a list of documents submitted by the authenticated user. Then, by causing the user to select a document to be printed from the list, the request processing unit 301 receives a print request including the submission ID of the selected document. At this time, the process transitions to step S608.

  If there is no session identification information in the processing request or does not match the temporarily stored session identification information, the request processing unit 301 once returns an authentication login screen to the request source, and the user operation Receives an authentication request sent by accepting.

[Processing for authentication requests]
In step S602, the request processing unit 301 compares the user ID and password included in the received authentication request with information in the customer information storage unit 311 to determine whether there is a match. If there is a match, the process transitions to step S604. If there is no match, the process transitions to step S603.

  In step S603, the request processing unit 301 responds to the request source with the result of the authentication NG, and ends the processing for the authentication request.

  In step S604, the request processing unit 301 responds to the request source with the result of the authentication OK and the session identification information used in the subsequent communication, and ends the processing for the authentication request. This session identification information is temporarily stored in order for the request processing unit 301 to identify whether a subsequent processing request has been authenticated. The request source includes this session identification information in subsequent processing requests.

[Processing for trafficking requests]
In step S605, the submission processing unit 302 extracts the FQDN from the document acquisition address of the document management service 102 included in the received submission request, issues a submission ID, and is initialized with the information. Generate input data.

  In step S606, the submission processing unit 302 uses the authentication information for the document management service 102 included in the received submission request, the document ID to be acquired, and the issued submission ID, to use the document management service 102. A document acquisition request is made. At this time, the purpose of transmitting the submission ID to the document management service 102 is to associate the submission ID with the document acquisition request log of the document management service 102 and to specify the submission ID when auditing the print service 101. Because.

  In step S607, the submission processing unit 302 stores the document data acquired from the document management service 102 as an input document in the input data storage unit 312 by including it in the input data initialized in step S605. Ends processing for the request.

[Processing for print requests]
In step S608, the print processing unit 303 reads out the input data having the input ID specified in the print request from the input data storage unit 312 and generates print data from the document data included in the input data. In addition to the submission ID, the print request includes setting information of the MFP in which the print application 340 is operating, print setting information, and the like. At least a part of the request is output by the job log generation unit 304. Recorded in the job log.

  In step S609, the job log generation unit 304 receives information included in the print request, print data, and submission ID from the print processing unit 303, and generates a job log. The generated job log is stored in the job log storage unit 313 in association with the submission ID.

  In step S610, the print processing unit 303 transmits the print data generated in step S608 to the requesting MFP 110, and the process for the print request ends.

[Processing for audit requests]
In step S <b> 611, the job log auditing unit 305 searches the submitted data storage unit 312 for submitted data having the submitted ID specified in the audit request.

  In step S612, the job log audit unit 305 transmits the job log searched in step S611 to the document management service 102 that is the request source, and ends the processing for the audit request.

  As described above, in this embodiment, when the print service obtains a submitted document from the document management service, the submission ID is passed to the document management service, and the submission ID is displayed in the print log of the submitted document. Was related. Then, the submission ID is received from the document management service, and the document management service is made to audit the print log associated with the submission ID. As a result, the processing log for the input document recorded by the document management service and the processing log for the input document recorded by the print service can be associated with each other so that the document management service can perform a centralized audit. It becomes possible.

(Example 2)
Next, a second embodiment of the present invention will be described. In the second embodiment, the print service negotiates with the document management service in advance on the standard of the log to be recorded, records the log accordingly, and causes the document management service to audit the log.

  The second embodiment is the same as the first embodiment except for the software configuration of the print service 300 shown in FIG. 3 of the first embodiment and the operation of the job log generation unit 304. Only a certain part will be described.

  FIG. 7 is a diagram illustrating a software configuration example of the print service 300 according to the second embodiment. In FIG. 7, the same reference numerals are used for portions that are the same as those in FIG. 3 of the first embodiment, and description thereof is omitted.

  When the request processing unit 301 receives a service cooperation request including service identification information and log standard information from the document management service 320, the service cooperation reception unit 306 determines whether to accept the request. The determination is made based on whether or not the log standard specified by the log standard information included in the service cooperation request is a log standard that can be acquired by the print service 300. When accepting the request, the service cooperation receiving unit 306 stores information of the document management service 320 that accepts the cooperation in the cooperation information storage unit 314 as service cooperation information. An example of service cooperation information is shown in FIG. In FIG. 8, service identification information is information for identifying a linked document management service, and is the same as the submission source identification information in the first embodiment, and a description thereof will be omitted. The log standard has a plurality of patterns depending on the type of attribute recorded as a log, the expression format of the attribute, and the like, and has unique identification information for each pattern. In this embodiment, this identification information is used as log standard information.

  The operation of the service cooperation receiving unit 306 will be described with reference to the flowchart of FIG. Each step shown in the flowchart of FIG. 9 is realized by the CPU 211 of the server group 101 executing a control program.

  In step S <b> 901, the service cooperation reception unit 306 determines whether the log standard specified by the log standard information included in the service cooperation request is a log standard that can be acquired by the print service 300. If the log standard is acquirable, the process proceeds to step S903. If the log cannot be acquired, the process proceeds to step S902.

  In step S902, the service cooperation reception unit 306 returns a response indicating that log cooperation is not established to the document management service 320, and ends the process for the service cooperation request.

  In step S903, the service cooperation receiving unit 306 associates the service identification information included in the service cooperation request with the log standard information, and stores it in the cooperation information storage unit 314.

  In step S904, the service cooperation reception unit 306 returns a log cooperation establishment response to the document management service 320, and ends the process for the service cooperation request.

  Next, details of the operation of the job log generation unit 304 in the second embodiment (processing corresponding to step S609 in FIG. 6) will be described using the flowchart in FIG.

  In step S <b> 1001, the job log generation unit 304 acquires the submission source identification information of the submission data stored in the submission data storage unit 312 based on the submission ID passed from the print processing unit 303.

  In step S <b> 1002, the job log generation unit 304 determines whether service cooperation information having service identification information that matches the submission source identification information acquired in step S <b> 1001 exists in the cooperation information storage unit 314. If there is matching service cooperation information, the process proceeds to step S1003. If there is no matching service cooperation information, the processing in the job log generation unit 304 ends.

  In step S <b> 1003, the job log generation unit 304 acquires log standard information of service cooperation information having service identification information that matches the submission source identification information acquired in step S <b> 1001 from the cooperation information storage unit 314. Then, the job log generation unit 304 generates a job log based on the log standard of the acquired log standard information.

  In step S1004, the job log generation unit 304 stores the job log generated in step S1001 in association with the submission ID passed from the print processing unit 303 in the job log storage unit 313, and the job log generation unit 304 performs processing. Ends.

  As described above, in this embodiment, the print service determines the log standard to be recorded in advance with the document management service, and records the print log based on the standard. The print service responds to the audit request from the document management service with the log information recorded based on the log standard determined in advance. As a result, the print service can be linked to various document management services with different auditable log specifications.

  In the second embodiment, the print service is described as receiving a request specifying a log standard from the document management service. First, a list of log standards that can be handled by the print service is returned as a response. A method of allowing the document management service to select from among them may be used.

  In the first embodiment and the second embodiment, the print service and the document management service are used as information processing services, but a service that provides other functions such as a scan service or a form service may be used.

300 Print Service 302 Submission Processing Unit 304 Job Log Generation Unit 305 Job Log Auditing Unit 306 Service Linkage Accepting Unit

Claims (2)

An information processing service that records a log when performing information processing and accepts input data from other information processing services,
Input identification information for identifying input data received from another information processing service is generated, the input identification information is transmitted to the other information processing service, and the input identification information and the input data are recorded in association with each other. Input data recording means (302, S606, S607);
Log recording means (304, S609) for generating a log of information processing for the input data and recording it in association with the input identification information;
Log transmission means for receiving the input identification information from the other information processing service and transmitting at least a part of the information processing log associated with the received input identification information to the other information processing service ( 305, S612),
An information processing service (300) comprising: Of the plurality of log standards that define the items to be recorded and the data format, which log standard is to be recorded is determined with the other information processing service, and the determined log standard is determined based on the other information. Log standard determining means (306) for recording in association with the identification information of the processing service,
The log recording means (304, S1003, S1004) records a log based on the log standard recorded by the log standard determining means;
The information processing service (300) according to claim 1, characterized in that: