JP2007304804A - Document data processing apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent confidential information leakage even when document data for printing out a confidential document is leaked itself. <P>SOLUTION: A document data processing apparatus executes a first processing of displaying on a display part an image of a document represented by document data described in a predetermined page description language according to the document data, a second processing of, when an area to be kept confidential on the document displayed on the display part is specified by an operation part, identifying a command for outputting an object included in the area, and a third processing of inserting a command to make invisible the object in the document data output by the command identified by the second processing and a command to read form data with a written command to cancel the invisibility, just before the identified command in the document data, to generate new document data, and generating the form data. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a technique for preventing leakage of confidential information, and more particularly to a technique for preventing leakage of confidential information due to outflow of document data for printing out a document.

2. Description of the Related Art In recent years, image forming apparatuses that can prevent leakage of confidential information by imposing appropriate restrictions on the printout of documents containing confidential information (hereinafter referred to as confidential documents) have been generally proposed (for example, patents). Reference 1).
Japanese Patent Laid-Open No. 9-282463

By the way, in an image forming apparatus, it is common to print out a document indicated by the document data in accordance with document data described in a page description language (hereinafter referred to as PDL) such as PostScript. Even if the target is a confidential document, there is no change. For this reason, if the document data itself is leaked, it is impossible to prevent the printout from being executed according to the document data, and the entire content of the confidential document is printed out as it is (that is, the confidential information). Will leak).
The present invention has been made in view of the above problems, and provides a technique capable of preventing leakage of confidential information even if document data itself for printing out a confidential document leaks out. The purpose is to do.

  In order to solve the above problems, the present invention includes a display unit, an operation unit, and a control unit, and the control unit represents the document data according to document data described in a predetermined page description language. A first process for displaying an image of a document on the display unit, and an object included in the region when a region to be classified with respect to the document displayed on the display unit is designated by the operation unit A second process for specifying a command for outputting the command, a command for invisibility of the object output by the command specified in the second process for the document data, and a command for releasing the invisibility. A command for reading out the form data in which the command is written is inserted immediately before the specified command of the document data to generate new document data. To provide a document data processing apparatus characterized by executing a third process of generating over data, the.

  In a more preferred aspect, an image forming apparatus that performs print output according to the document data for the new document data generated in the third process is determined in advance, and the control unit In the third process, when form data paired with the new document data is generated, an identifier for uniquely identifying the image forming apparatus is embedded in the form data.

  Moreover, in another preferable aspect, the control unit can use the form data in the third process or the form data that can be used as the form data generated in the third process. It is characterized by writing data indicating a period.

  In another preferable aspect, when a plurality of areas to be kept secret are designated for the document displayed on the display unit, the control unit performs the second operation for each of the plurality of areas. And the third process is executed.

  In another aspect of the present invention, a first process for causing the computer device to display an image of a document represented by the document data on the display unit according to the document data described in a predetermined page description language, A second process for specifying a command for outputting an object included in the area when the operation section designates an area that should be kept secret with respect to the document displayed on the display section; The document data includes a command for invisibility of an object output by the command specified in the second process, and a command for reading out form data in which a command for canceling the invisibility is written. And generating a new document data by inserting it immediately before the specified command, and executing a third process for generating the form data. It may provide a program for causing the. When distributing such a program, it may be distributed by writing in a computer-readable recording medium, or by downloading via a telecommunication line such as the Internet.

  According to the present invention, it is possible to prevent leakage of confidential information even if document data itself for printing out a confidential document leaks out.

(A: Principle of the present invention)
First, the principle of the present invention will be described with reference to the drawings.
FIG. 1A is a diagram showing an example of general document data described in PDL, and FIG. 1B is an example of a document printed out in accordance with the document data shown in FIG. FIG. The document data shown in FIG. 1A is configured by arranging a plurality of types of commands in a predetermined arrangement order according to PDL rules. For example, the document data shown in FIG. 1A includes eight types of commands: JobStart, PageStart, SetColor, SetFont, SetCursor, Text, PageEnd, and JobEnd.

Here, each command included in the document data shown in FIG.
The JobStart command and JobEnd command in FIG. 1A are commands that indicate the start and end of print output. A PageStart command and a PageEnd command in FIG. 1A are commands indicating page separation, and printing for one page is performed by various commands described between the PageStart command and the PageEnd command. Note that the document data illustrated in FIG. 1A is document data that defines a one-page document illustrated in FIG. 1B, and therefore only one block is defined by the PageStart command and the PageEnd command. Although it is included, the document data corresponding to a document composed of a plurality of pages includes the above described blocks for each page.

  The SetColor command in FIG. 1A is a command for designating a character color for printing out. In FIG. 1A, the case where the character color is designated as “black” is exemplified. The SetFont command in FIG. 1A is a command for designating the font type and font size for printout. In FIG. 1A, the font type is “Mincho” and the font size is “14 points”. The case of specifying "" is illustrated. Note that the SetColor command and SetFont command are pages where the end of the page is represented by the PageEnd command unless the character color, font type, and font size are changed again by these commands before reaching the PageEnd command. Inside, the values specified by these commands are maintained.

The SetCursor command in FIG. 1A is a cursor at the coordinate position specified as its argument (coordinate position in plane coordinates with the upper left corner of the document as the origin, the main scanning direction as the X axis, and the sub scanning direction as the Y axis). This is a command for designating the writing position of a character string or image by moving. The Text command in FIG. 1A is a command indicating that the character string specified as the argument of the Text command is written with the cursor position at the time of execution of the Text command as the writing position. This is a command for writing the character string with the character color specified by the preceding SetColor command and the font type and font size specified by the preceding SetFont command.
In FIG. 1A, the case where the document data is configured by combining the above eight types of commands has been described. However, there are commands for specifying a paper size when performing print output and commands for drawing graphics. Needless to say, it may be included.

Some PDLs support commands called LoadForm commands in addition to the various commands described above. Here, the LoadForm command is a command for reading out the form data prepared separately from the document data body and executing the command described in the form data, according to the combination of the document data and the form data. This is a command used when causing the image forming apparatus to execute print output.
In the present invention, by using this LoadForm command, the above-mentioned problem (that is, it is possible to prevent leakage of confidential information even when the document data itself for printing out the confidential document is leaked). It has been solved. Hereinafter, the mechanism of the present invention for preventing confidential leakage by using the LoadForm command will be described.

2A is a diagram showing an example of document data according to the present invention, and FIG. 2B is an example of form data (named “Form01”) that forms a pair with the document data. FIG.
The document data shown in FIG. 2 (a) is different from the document data shown in FIG. 1 (a) in that it precedes a command described in bold italics (that is, a Text command instructing printout of a non-public information part). And a LoadColor command that precedes the LoadForm command and a SetColor command that designates the character color as “white (that is, the background color of the paper)”. On the other hand, the form data shown in FIG. 2B includes a SetColor command for designating the character color to “black”.

Generally, when an image forming apparatus cannot access the form data specified by the argument of the LoadForm command when interpreting and executing the LoadForm command (for example, when the image forming apparatus has not received the form command). The LoadForm command is ignored.
For example, when the image forming apparatus receives both the document data shown in FIG. 2A and the form data shown in FIG. 2B, the image forming apparatus uses the SetColor command described in the form data. After the character color is set to “black” by execution, the printout of the “private information part” is executed. Therefore, when the image forming apparatus receives both the document data shown in FIG. 2A and the form data shown in FIG. 2B, the document shown in FIG. 3A is printed out. Become.

  On the other hand, when the image forming apparatus receives only the document data shown in FIG. 2A, the LoadForm command described in the document data is ignored, so the character color is set to “white”. In this state, the “non-public information part” is printed out. Here, since the character color set at the time of printing out the “private information part” is the same as the background color of the printing paper, the “private information part” can be printed out in a recognizable state. No (see FIG. 3B).

As described above, in the present invention, a command (for example, character color is applied to the document data for executing the printout of the confidential document to the “private information portion” (that is, the confidential information portion) is made invisible. SetColor command (set to “white” (background color)) and LoadForm command to read the form data in which the command to cancel the invisible processing is written immediately before the command related to the print output of the “private information part” By writing, even if the document data is leaked, leakage of confidential information is prevented.
The above is the principle of the present invention that prevents the leakage of confidential information using the LoadForm command.

(B: Configuration)
FIG. 4 is a block diagram illustrating a configuration example of the document data processing apparatus 10 according to an embodiment of the present invention.
The document data processing apparatus 10 converts general document data described in PDL (for example, the document data shown in FIG. 1A) into document data according to the present invention and forms a pair with the document data. It has a function that makes it easy to create data (that is, form data in which a command for canceling the above-described invisibility processing is written). Specifically, it has the configuration shown in FIG. is doing.

As shown in FIG. 4, the document data processing apparatus 10 includes a control unit 110, a display unit 120, an operation unit 130, a communication interface (hereinafter “IF”) unit 140, a storage unit 150, and a component between these components. It has a bus 160 that mediates data exchange.
The control unit 110 is, for example, a CPU (Central Processing Unit), and centrally controls the operation of each unit of the document data processing apparatus 10 by executing a program stored in the storage unit 150.

  The display unit 120 includes, for example, a liquid crystal panel and a drive circuit thereof (all are not shown). The display unit 120 displays various screens for prompting the user to use the document data processing apparatus 10 under the control of the control unit 110. The operation unit 130 is configured by a pointing device such as a keyboard or a mouse provided with a plurality of operators such as a numeric keypad and a cursor key (not shown). When the user who has viewed the screen displayed on the display unit 120 operates the above various controls and makes some input, the operation unit 130 is data (hereinafter referred to as operation content data) representing the operation content of the operation unit. ) To the control unit 110, and the operation content is transmitted to the control unit 110.

  The communication IF unit 140 is connected to a communication network such as a LAN (Local Area Network), for example. The communication IF unit 140 receives data transmitted via the communication network and delivers it to the control unit 110, while This is for sending the transferred data to the communication network. The communication IF unit 140 functions as an input unit for inputting the document data to be processed (for example, the document data shown in FIG. 1A) to the document data processing apparatus 10, and the communication IF unit 140 shown in FIG. It functions as an output means for outputting the processing result by the document data processing apparatus 10 such as the document data shown or the form data shown in FIG. In the present embodiment, the case where the input of the document data to be processed and the output of the document data and the form data as the processing results are performed via the communication network has been described. However, a floppy (registered trademark) disk, a DVD, or the like Of course, the above input / output may be performed via a computer-readable recording medium.

  As shown in FIG. 4, the storage unit 150 includes a volatile storage unit 150a and a nonvolatile storage unit 150b. The volatile storage unit 150a is, for example, a RAM (Random Access Memory), and is used as a work area by the control unit 110 operating according to a control program described later. On the other hand, the nonvolatile storage unit 150b is, for example, a hard disk. The non-volatile storage unit 150b converts the processing characteristic of the document data processing apparatus according to the present invention (that is, converts the document data described in PDL into the document data according to the present invention and makes a pair with the document data. A control program for causing the control unit 110 to execute processing for generating form data to be stored is stored. The nonvolatile storage unit 150 b also stores document data input via the communication IF unit 140.

The above is the configuration of the document data processing apparatus 10.
As described above, the configuration of the document data processing apparatus 10 according to the present embodiment is the same as the configuration of a general computer apparatus, and the characteristic features of the document data processing apparatus according to the present invention are the above-described control functions. This is realized by operating the control unit 110 according to a program (that is, a software module).

(C: Operation)
Next, confidential document data generation processing performed by the control unit 110 of the document data processing apparatus 10 according to the control program will be described with reference to the drawings. In the operation example described below, it is assumed that the power (not shown) of the document data processing apparatus 10 is already turned on, and the control unit 110 operates according to the control program. In the following, it is assumed that the document data shown in FIG. 1A is input via the communication IF unit 140, and only this document data is stored in the nonvolatile storage unit 150b as the document data to be processed.

  FIG. 5 is a flowchart showing a flow of confidential document data generation processing performed by the control unit 110 operating according to the control program. As shown in FIG. 5, the control unit 110 first reads out document data to be processed from the nonvolatile storage unit 150b, and displays an operation screen including an image of a document printed out according to the document data. (Step SA100). In the present embodiment, a case where only one document data to be processed is stored in the nonvolatile storage unit 150b will be described. However, when a plurality of document data is stored in the nonvolatile storage unit 150b. The user may be allowed to select which of the plurality of document data is to be processed. This is because an identifier (for example, a document name or a file name) uniquely identifying each document data stored in the nonvolatile storage unit 150b is displayed in a list on the display unit 120 and a processing target is selected by the user. You can make it.

  FIG. 6 is a diagram illustrating an example of an operation screen displayed on the display unit 120 in step SA100. As apparent from FIG. 6, the operation screen displays the area 610 for displaying the image of the document to be processed and the execution of the conversion processing characteristic of the present invention to the control unit 110. An execution button B1 for instructing is included. The user who visually recognizes the operation screen shown in FIG. 6 moves the mouse cursor 620 to the image displayed on the area 610 by operating the pointing device of the operation unit 130, and makes it invisible in order to maintain confidentiality. An operation for designating a range (for example, an operation for designating an upper left corner and a lower right corner of a range to be invisible), an operation for selecting the execution button B1, and the like can be executed. The contents of various operations performed by the user in this way are transmitted to the control unit 110 by passing operation content data indicating the operation contents from the operation unit 130 to the control unit 110. For example, as shown in FIG. 6, when an operation for designating a range where confidentiality should be maintained is performed, coordinate data indicating the upper left corner and the lower right corner of the range is delivered to the control unit 110 as the operation content data. When the execution button B1 is selected, operation content data indicating that the execution button B1 has been selected is delivered to the control unit 110. Upon receiving the operation content data from the operation unit 130, the control unit 110 writes and stores the operation content data in the volatile storage unit 150a.

If the user performs any operation by appropriately operating the operation unit 130 in a state where the operation screen illustrated in FIG. 6 is displayed on the display unit 120, the control unit 110 determines that the operation performed by the user is “confidential”. It is determined whether or not the “designation of the range to be held and the instruction to execute the conversion process” (step SA110). If the determination result is “Yes”, the process after step SA120 is executed and vice versa. On the other hand, if the determination result is “No”, the present conversion process is terminated without executing the processes after step SA120.
In this operation example, it is assumed that a range surrounded by a dotted line in FIG. 6 is designated as a range where the confidentiality should be maintained, and then the execution button B1 is selected. For this reason, in this operation example, the determination result of step SA110 is “Yes”, and the processing after step SA120 is executed. In this operation example, in order to designate the above range, the upper left corner and the lower right corner of the range are designated by the mouse, and the coordinates of the upper left corner when the upper left corner of the document is the origin (0, 0) are ( x3, y3: where x3 <x2 and y3 <y2), and the coordinates of the lower right corner are (x4, y4: where x4> x2 and y4> y2).

  In step SA120, which is subsequently executed when the determination result in step SA110 is "Yes", among the commands constituting the document data to be processed, an object (for example, a character string) included in the processing target area. Command to output (object or image object). Specifically, the control unit 110 includes, for each SetCursor command described in the document data to be processed, the coordinate position specified by the argument is included in the range specified to be invisible. And an output command (for example, a Text command) subsequent to the SetCursor command determined to be included is specified as a target command for invisibility processing. In this operation example, since x3 <x2 <x4 and y3 <y2 <y4, in the document data shown in FIG. 1A, following the SetCursor command for positioning the cursor to (x2, y2). An output command to be executed (that is, Text (private information part)) is specified as an invisible target.

  Next, the control unit 110 performs a command for invisibility of the object printed out by the command specified in step SA120, and a LoadForm command for reading out the form data for releasing the invisibility by the command, New document data is generated by inserting it immediately before the command specified in step SA120 (step SA130), and form data in which a command for canceling the invisibility is written as the form data is generated (step SA140). ). Specifically, control unit 110 inserts SetColor (white) as a command for invisibility of the object printed out by the command specified in step SA120, and a command for canceling the invisibility. Form data written with SetColor (black) is generated, and a LoadForm command for reading the form data is inserted immediately after the command for invisibility. As a result, new document data shown in FIG. 2A and form data shown in FIG. 2B are generated.

  Then, the control unit 110 outputs the document data generated in step SA130 and the form data generated in step SA140 to the image forming apparatus (not shown) via the communication IF unit 140 (step SA150). The forming apparatus executes print output according to the document data and the form data. As a result, the document shown in FIG. 3A is printed out from the image forming apparatus.

  As described above, according to the document data processing apparatus 10 according to the present embodiment, even if only the document data shown in FIG. 2A is leaked and printed out according to the document data, FIG. The document shown in (b) will be printed out, and confidential leakage will be prevented.

(D: Modification)
Although one embodiment of the present invention has been described above, it goes without saying that the following modifications may be added to the embodiment.
(1) In the above-described embodiment, the case has been described in which the character information that is designated to be kept secret is made invisible by changing the character color of the character information to the background color. Set the font size of the specified character information to “0” using the SetFont command, and release the invisibility using form data written with the SetFont command specifying a value other than 0 as the font size. May be.
In addition, as shown in bold italics in FIG. 7, when overlapping objects to be output, a SetROPMode command indicating that the object to be output later is overwritten, and a range designated to be invisible The form data shown in FIG. 7B is generated as the form data for generating the document data by inserting the DrawRect command indicating that it is painted with the color specified by the preceding SetColor and releasing the invisibility. (If the objects are output in a superimposed manner, the form data in which the command to output the exclusive OR of the two and the DrawRect command indicating that the same range as the range to be painted by the DrawRect command is filled are written ) May be used. According to such document data and form data, for example, when the image forming apparatus receives both of them, the document shown in FIG. 8A is printed out, and the document data shown in FIG. In the case where only the print output is performed, the document shown in FIG. 8B is printed out. As described above, according to the aspect of making invisible with the DrawRect command, it is possible to make a graphic object or an image object invisible in addition to a character string object.

(2) In the above-described embodiment, the case where there is one output command to be invisible has been described. However, when a plurality of ranges designated to be invisible are designated, the processing of step SA120 to step SA140 described above is executed for each range, and a plurality of output commands are executed as shown in FIG. Document data that has been subjected to invisibility processing and form data (see FIG. 9B) for canceling each invisibility processing may be generated.
Further, as described above, in the aspect of performing invisibility for each of a plurality of output commands, utilizing the fact that invisibility cannot be canceled for output commands that do not have paired form data, It becomes possible to flexibly set a security level corresponding to the position of each of a plurality of users who print out using the same document data. For example, the document data shown in FIG. 9A and the form data Form02 shown in FIG. 9B are distributed to a user who is a general employee (that is, as shown in FIG. 10B for a general employee). The document data shown in FIG. 9 (a) and the form data Form01 and Form02 shown in FIG. 9 (b) are distributed to the section manager (that is, for the section manager). The security level can be flexibly set by disclosing both the level 1 part and the level 2 part as shown in FIG.

(3) In the embodiment described above, the case where the leakage of confidential information is prevented by using the form data has been described. However, various security restrictions can be imposed on the form data to further improve the security. Specifically, for each form data, an image forming apparatus that can use the form data is determined in advance, and an identifier (for example, the image) that uniquely identifies the image forming apparatus that can use the form data for each form data. When the form data is read by the LoadForm command, the identifier that is written in the form data and the image data that is going to use the form data are written. If the identifiers of the devices are different from each other, the LoadForm command may be abnormally terminated. In this way, even if document data and form data paired with the document data are leaked, the document corresponding to the document data in an apparatus other than the image forming apparatus predetermined for the form data. It is possible to avoid printing out the entire contents of. Also, the threshold data indicating the number of times the form data can be used and the counter data counted up each time the form data is used are embedded, and the value indicated by the counter data reaches the value indicated by the threshold data. After that, the image forming apparatus may be provided with a mechanism for forcibly deleting the form data, and the period data indicating the period in which the form data can be used is embedded in the form data. A mechanism for forcibly deleting form data whose data period has passed may be provided on the image forming apparatus side.

(4) In the above-described embodiment, a control program for causing the CPU to execute a conversion process characteristic of the document data processing apparatus according to the present invention is stored in advance in the nonvolatile storage unit 150b of the document data processing apparatus 10. Explained the case. However, it is a matter of course that the control program is installed in a general computer device and the same function as that of the document data processing device 10 is given to the computer device. When the control program is distributed, the program may be written and distributed on a computer-readable recording medium such as a CD-ROM (Compact Disk-Read Only Memory), or the Internet. Each of the above programs may be distributed by downloading via a telecommunication line.
Further, in the above-described embodiment, functions characteristic to the document data processing apparatus 10 according to the present invention (that is, a function for specifying an output command to be invisible processing, a command for making the output target invisible by the output command invisible) And a function for inserting a LoadForm command for reading out the form data for releasing the invisibility, and a function for generating the form data) are realized by software modules (that is, the control unit is operated according to the control program). However, it goes without saying that the document data processing apparatus according to the present invention may be configured by combining the hardware modules having these functions so as to operate according to the flowchart shown in FIG. It is.

It is a figure which shows an example of the document printed out according to the document data described by PDL, and the document data. It is a figure which shows an example of the document data which concerns on this invention, and form data which becomes a pair with the document data. It is a figure which shows an example of the document printed out according to the document data based on this invention. 1 is a block diagram illustrating a configuration example of a document data processing apparatus 10 according to an embodiment of the present invention. 4 is a flowchart showing a flow of confidential document data generation processing performed by the control unit 110 of the document data processing apparatus 10. 6 is a diagram showing an example of an operation screen displayed on the display unit 120 of the document data processing apparatus 10. FIG. It is a figure which shows an example of the document data which concerns on a modification (1), and form data which becomes a pair with the document data. It is a figure which shows an example of the document printed out according to the document data concerning a modification (1). It is a figure which shows an example of the document data which concerns on a modification (2), and form data which becomes a pair with the document data. It is a figure which shows an example of the document printed out according to the document data concerning a modification (2).

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 ... Document data processing apparatus 110 ... Control part 120 ... Display part 130 ... Operation part 140 ... Communication IF part 150 ... Storage part 150a ... Volatile storage part 150b ... Nonvolatile storage part 160 ... Bus .

Claims (4)

A display unit;
An operation unit;
A control unit,
The controller is
First processing for displaying an image of a document represented by the document data on the display unit in accordance with the document data described in a predetermined page description language;
A second process for specifying a command for outputting an object included in the area when an area to be confidential to the document displayed on the display unit is designated by the operation unit;
A command for invisibility of the object output by the command specified in the second processing of the document data, and a command for reading out the form data in which a command for releasing the invisibility is written Is inserted immediately before the specified command of the document data to generate new document data, and a third process for generating the form data is executed. For new document data generated in the third process, an image forming apparatus that performs printout in accordance with the document data is determined in advance.
The controller is
The identifier for uniquely identifying the image forming apparatus is embedded in the form data when generating the form data paired with the new document data in the third process. Document data processing device. The controller is
In the third process, data indicating the number of times that the form data can be used or a period in which the form data can be used is written in the form data generated in the third process. Item 2. The document data processing apparatus according to Item 1. When a plurality of areas to be kept secret are designated for the document displayed on the display unit, the control unit performs the second process and the third process for each of the plurality of areas. The document data processing apparatus according to claim 1, wherein the document data processing apparatus is executed.

Images