Network system, access-support server, processing device, and communication agent device

This application is based on Japanese patent application No. 2013-093239 filed on Apr. 26, 2013, the contents of which are hereby incorporated by reference.

1. Field of the Invention

The present invention relates to a technology for communication between two devices located in different networks.

2. Description of the Related Art

Recent years have seen the widespread use of a technology by which two devices located in different networks operate in cooperation with each other to provide users with service.

For example, a technology comes into widespread use in which a personal computer located in a corporate Local Area Network (LAN) and a web server located in an Application Service Provider (ASP) network cooperate with each other to deliver information such as news via the Internet.

In general, the LAN is provided with a firewall. Such a firewall is so set that access from an external device to a device in the LAN is restricted more tightly than access from a device in the LAN to an external device.

In order for a user to obtain information from a web server, he/she needs to have access to the web server from a personal computer of the LAN to establish a session. In usual settings for a firewall, access from a web server to a personal computer of the LAN is prohibited in many cases.

To cope with this, the following method has been proposed. A managed device, a managing device for managing the managed device, and a relay server are connected to the Internet. The managed device has access to the relay server to obtain from the server first transfer information to be transferred to the managed device, or, sends to the relay server second transfer information to be transferred to the managing device. The managing device has access to the relay server to obtain the second transfer information from the relay server, or, to send the first transfer information to the relay server (Japanese Laid-open Patent Publication No. 2002-082792). Stated differently, both the managed device and the managing device save information to be sent to the other end of communication to the relay server. Then, each of the managed device and the managing device has access to the relay server to download therefrom information that has been sent to the device itself.

The method described in Japanese Laid-open Patent Publication No. 2002-082792 enables communication between the managed device and the managing device independently of a firewall.

However, data sent and received between the managed device and the managing device always pass through the relay server. Therefore, increase in communication puts more loads onto the relay server.

The present invention has been achieved in light of such an issue, and an object thereof is to perform communication via a firewall with loads put onto a relay server reduced as compared with conventional methods.

According to one aspect of the present invention, a network system includes a first device configured to perform specific processing; a second device configured to cause the first device to perform the specific processing; and a server configured to support the second device in having access to the first device. The first device includes a first session establishing portion configured to have access to the server and to establish a first session between the first device and the server, the second device includes an address information transmission portion configured to send, to the server, address information indicating an address of the second device, the server includes a transfer portion configured to transfer the address information through the first session to the first device, and the first device further includes a second session establishing portion configured to have access to the second device based on the address information and to establish a second session between the first device and the second device.

These and other characteristics and objects of the present invention will become more apparent by the following descriptions of preferred embodiments with reference to drawings.

FIG. 1 is a diagram showing an example of the overall configuration of an application system.

FIG. 2 is a diagram showing an example of the over all configuration of a LAN.

FIG. 3 is a diagram showing an example of the hardware configuration of an image forming apparatus.

FIG. 4 is a diagram showing an example of the hardware configuration of a device managing server and a full-time connection server.

FIG. 5 is a diagram showing an example of the functional configuration of each device of an application system.

FIG. 6 is a diagram showing an example of a device management table.

FIG. 7 is a diagram showing an example as to how information is conveyed for a setup.

FIG. 8 is a flowchart depicting an example of the flow of setup processing.

FIG. 9 is a diagram showing an example as to how information is conveyed for a case where an application server and an image forming apparatus work in coordination with each other.

FIG. 10 is a flowchart depicting an example of the flow of processing for a case where an application server and an image forming apparatus work in coordination with each other.

FIG. 11 is a diagram showing an example of the functional configuration of each device of an application system.

FIG. 12 is a diagram showing an example as to how information is conveyed for a setup.

FIG. 13 is a diagram showing an example as to how information is conveyed for a case where an application server and an image forming apparatus work in coordination with each other.

FIG. 14 is a diagram showing an example of a device management table.

FIG. 15 is a flowchart depicting an example of the flow of processing for a case where an application server and an image forming apparatus work in coordination with each other.

FIG. 16 is a diagram showing an example of the functional configuration of each device of an application system.

FIG. 17 is a diagram showing an example as to how information is conveyed for a setup.

FIG. 18 is a diagram showing an example as to how information is conveyed for a case where an application server and an image forming apparatus work in coordination with each other.

FIG. 19 is a flowchart depicting an example of the flow of processing for a case where an application server and an image forming apparatus work in coordination with each other.

FIG. 20 is a diagram showing an example of the functional configuration of each device of an application system.

FIG. 21 is a diagram showing an example as to how information is conveyed for a setup.

FIG. 22 is a diagram showing an example of a communication session table.

FIG. 23 is a diagram showing an example as to how information is conveyed for a case where an application server and an image forming apparatus work in coordination with each other.

FIG. 24 is a flowchart depicting an example of the flow of processing for a case where an application server and an image forming apparatus work in coordination with each other.

FIG. 25 is a flowchart depicting an example of the flow of processing for a case where an application server and an image forming apparatus work in coordination with each other.

FIG. 26 is a diagram showing an example of a device management table.

FIG. 27 is a diagram showing an example as to how information is conveyed for a case where an application server and an image forming apparatus work in coordination with each other.

FIG. 28 is a diagram showing an example as to how information is conveyed for a case where an application server and an image forming apparatus work in coordination with each other.

First Embodiment

FIG. 1 is a diagram showing an example of the overall configuration of an application system 5 . FIG. 2 is a diagram showing an example of the overall configuration of a LAN 50 . FIG. 3 is a diagram showing an example of the hardware configuration of an image forming apparatus 1 A. FIG. 4 is a diagram showing an example of the hardware configuration of a device managing server 2 A and a full-time connection server 2 B. FIG. 5 is a diagram showing an example of the functional configuration of each device of the application system 5 .

Referring to FIG. 1 , the application system 5 is configured of at least one Local Area Network (LAN) 50 , the device managing server 2 A, the full-time connection server 2 B, at least one application server 3 A, at least one terminal 3 B, a communication line 4 , and so on. In the application system 5 , the devices work in conjunction with one another for a variety of application processes.

Hereinafter, the LANs 50 are sometimes referred to as a “LAN 50 a ”, “LAN 50 b ”, . . . , and so on to distinguish one from another. Likewise, the application servers 3 A are sometimes referred to as an “application server 3 Aa”, “application server 3 Ab”, . . . , and so on to distinguish one from another. Further, the terminals 3 B are sometimes referred to as a “terminal 3 Ba”, “terminal 3 Bb”, . . . , and so on to distinguish one from another.

The devices of the LAN 50 , the device managing server 2 A, the full-time connection server 2 B, the application server 3 A, and the terminal 3 B are capable of performing communication through the communication line 4 . Examples of the communication line 4 are the Internet, a dedicated line, and a public line.

Referring to FIG. 2 , the LAN 50 is configured of at least one image forming apparatus 1 A, at least one terminal 1 B, a hub 1 C, a firewall 1 D, a router 1 E, and so on.

The image forming apparatus 1 A is an image processing apparatus that is generally called a “Multi-Functional Peripheral (MFP)” or a “multifunction device”. The image forming apparatus 1 A is an apparatus into which functions such as copying, PC printing, faxing, scanning, and box function are consolidated.

The PC printing function is to print an image onto paper based on image data received from the terminal 1 B.

According to the box function, a storage area called a “box” or “personal box” is allocated to each user. The box function enables each user to save image data and so on to his/her storage area and to manage the same therein. The box corresponds to a “folder” or “directory” in a personal computer.

Referring to FIG. 3 , the image forming apparatus 1 A is configured of a Central Processing Unit (CPU) 10 a , a Random Access Memory (RAM) 10 b , a Read Only Memory (ROM) 10 c , a large-capacity storage 10 d , a touch-sensitive panel display 10 e , an operation key panel 10 f , a Network Interface Card (NIC) 10 g , a modem 10 h , a scanner unit 10 i , a printing unit 10 j , and so on.

The touch-sensitive panel display 10 e displays, for example, a screen for presenting messages to a user, a screen for allowing a user to input commands or information, a screen for showing the results of processing executed by the CPU 10 a and so on. The touch-sensitive panel display 10 e sends a signal indicating a touched position to the CPU 10 a.

The operation key panel 10 f is a so-called hardware keyboard, and is provided with a numeric keypad, a start key, a stop key, and a function key.

The NIC 10 g performs communication with other devices in accordance with a protocol such as Transmission Control Protocol/Internet Protocol (TCP/IP) or an upper protocol. Examples of the upper protocol are Hypertext Transfer Protocol (HTTP), HTTP over transport layer Security (HTTPS), eXtensible Messaging and Presence Protocol (XMPP), and Simple Network Management Protocol (SNMP).

The modem 10 h sends and receives image data with a facsimile terminal in accordance with a protocol such as G3.

The scanner unit 10 i optically reads an image recorded on a sheet of paper placed on a platen glass, and generates image data thereof.

The printing unit 10 j prints, onto paper, an image captured by the scanner unit 10 i and an image received from other devices.

The ROM 10 c or the large-capacity storage 10 d stores, therein, software for implementing the foregoing functions such as copying. Each of the image forming apparatuses 1 A, at least, of the LAN 50 A has a gateway program 1 AP 1 (see FIG. 5 ) stored therein. The gateway program 1 AP 1 is a program which enables a device provided outside the LAN 50 to have access to the image forming apparatus 1 A. The gateway program 1 AP 1 implements a gateway portion. The mechanism thereof is described later. The gateway program 1 AP 1 is loaded into the RAM 10 b , and executed by the CPU 10 a . The large-capacity storage 10 d is, for example, a hard disk drive or a Solid State Drive (SSD).

Hereinafter, the image forming apparatuses 1 A are sometimes referred to as an “image forming apparatus 1 Aa 1 ”, “image forming apparatus 1 Aa 2 ”, “image forming apparatus 1 Ab 1 ”, “image forming apparatus 1 Ab 2 ”, . . . , and so on to distinguish one from another, as shown in FIG. 1 .

The terminal 1 B (refer to FIG. 2 ) is a device for a user to remotely use the foregoing functions of the image forming apparatus 1 A. In short, the terminal 1 B is a client of the image forming apparatus 1 A. The user is also capable of using the functions of the image forming apparatus 1 A through operation on a device external to the LAN 50 . The mechanism thereof is described later. Examples of the terminal 1 B are a personal computer, a tablet computer, and a smartphone.

The router 1 E is operable to connect the LAN 50 to another network such as the Internet.

The firewall 1 D is provided between the hub 1 C and the router 1 E. The firewall 1 D is operable to monitor communication performed by the devices of the LAN 50 , and prevent attacks from outside the LAN 50 and unauthorized access. In particular, in this embodiment, the firewall 1 D severely restricts access from outside the LAN 50 . In some cases, the functions of the firewall 1 D are equipped in the router 1 E.

The image forming apparatus 1 A, the terminal 1 B, and the firewall 1 D are connected to the hub 1 C.

The configuration discussed above makes it possible to perform communication between the devices of the LAN 50 , and also to perform communication between the devices of the LAN 50 and a device external thereto under certain restrictions. The LAN 50 may be a Virtual Private Network (VPN).

Referring back to FIG. 1 , the device managing server 2 A and the full-time connection server 2 B both mediate access from a device external to the LAN 50 to the image forming apparatus 1 A.

In particular, the device managing server 2 A manages information on each of the image forming apparatuses 1 A of each of the LANs 50 . The full-time connection server 2 B is capable of keeping connection with the image forming apparatus 1 A.

As shown in FIG. 4 , each of the device managing server 2 A and the full-time connection server 2 B is configured of a CPU 20 a , a RAM 20 b , a ROM 20 c , a large-capacity storage 20 d , a USB interface board 20 e , a graphic board 20 f , an NIC 20 g , and so on.

The USB interface board 20 e is a user interface to connect an input device such as a keyboard or a pointing device to the device managing server 2 A or the full-time connection server 2 B.

The graphic board 20 f generates an image signal and outputs the image signal to the display unit. Thereby, an image is displayed on the display unit.

The NIC 20 g performs communication with another device in accordance with a protocol such as TCP/IP.

The ROM 20 c or the large-capacity storage 20 d stores, therein, a program for implementing the foregoing functions. The program is loaded into the RAM 20 b , and is executed by the CPU 20 a . In particular, the ROM 20 c or the large-capacity storage 20 d of the device managing server 2 A stores, therein, a device management program 2 AP 1 (see FIG. 5 ). The ROM 20 c or the large-capacity storage 20 d of the full-time connection server 2 B stores, therein, a full-time connection program 2 BP 1 .

Referring back to FIG. 1 , the application server 3 A applies the functions of the image forming apparatus 1 A to provide a variety of service. For example, the application server 3 A causes the image forming apparatus 1 A to print a document created by a user. The application server 3 A also causes the terminal 3 B to display an address book registered in the image forming apparatus 1 A.

The hardware configuration of the application server 3 A is basically the same as that of each of the device managing server 2 A and the full-time connection server 2 B. However, a ROM or a large-capacity storage of the application server 3 A stores, therein, application software 3 PS (see FIG. 5 ) for the service. The ROM or the large-capacity storage of the application server 3 A also stores, therein, an access program 3 AP 1 for access to the image forming apparatus 1 A. These programs are loaded into the RAM and are executed by the CPU.

The terminal 3 B is a device for the user to be given the foregoing service provided by the application server 3 A and the image forming apparatus 1 A. Stated differently, the terminal 3 B is a client of the application server 3 A and the image forming apparatus 1 A. Examples of the terminal 3 B are a personal computer, a tablet computer, and a smartphone.

The description goes onto a mechanism according to which the application server 3 A has access to the image forming apparatus 1 A, and the application server 3 A and the image forming apparatus 1 A work in conjunction with each other to provide service to a user.

The foregoing programs of the devices implement the functions shown in FIG. 5 . The gateway program 1 AP 1 implements the functions of a device managing portion 101 , a full-time connection portion 102 , a device connection request receiving portion 103 , a communication session portion 104 , a device-specific interface 105 , and so on.

The device management program 2 AP 1 implements the functions of a device information managing portion 201 and a device connection request sending and receiving portion 202 .

The full-time connection program 2 BP 1 implements the functions of a full-time connection portion 251 and a device connection request sending and receiving portion 252 .

The access program 3 AP 1 implements the functions of an application-specific interface 301 , a device connection request portion 302 , and a communication session portion 303 .

Hereinafter, processing by the individual portions shall be described, the description being broadly divided into setup processing and processing for providing an external user with service.

[Setup Processing]

FIG. 6 is a diagram showing an example of a device management table 2 TL 1 . FIG. 7 is a diagram showing an example as to how information is conveyed for a setup. FIG. 8 is a flowchart depicting an example of the flow of setup processing.

The device information managing portion 201 of the device managing server 2 A stores and manages the device management table 2 TL 1 as shown in FIG. 6 . The device management table 2 TL 1 has records showing a device identifier 6 A, an account code 6 B, and a device name 6 C for each of the image forming apparatuses 1 A connected to the full-time connection server 2 B. The device identifier 6 A is identification (ID) for identifying the corresponding image forming apparatus 1 A. The device name 6 C is a product name or model number of the corresponding image forming apparatus 1 A. The account code 6 B is described later.

The device managing portion 101 of the image forming apparatus 1 A stores and manages the device identifier 6 A and the device name 6 C of the subject image forming apparatus 1 A.

In order that a device external to the LAN 50 has access to the image forming apparatus 1 A, it is necessary that the subject image forming apparatus 1 A is connected to the full-time connection server 2 B and a record for the subject image forming apparatus 1 A is registered in the device management table 2 TL 1 .

The description goes on to the connection and registration processing on the image forming apparatus 1 Aa 1 with reference to FIGS. 7 and 8 .

The full-time connection portion 102 of the image forming apparatus 1 Aa 1 sends a full-time connection request 6 D to the full-time connection server 2 B at a predetermined time, e.g., at a time when the image forming apparatus 1 Aa 1 is turned ON and the operating system starts (encircled number 1 of FIG. 7 , and Step # 701 of FIG. 8 ). A connection request is thereby made to the full-time connection server 2 B.

When receiving the full-time connection request 6 D (Step # 711 ), the full-time connection portion 251 of the full-time connection server 2 B newly issues an account necessary for the image forming apparatus 1 Aa 1 to be continuously connected to the full-time connection server 2 B (Step # 713 ), provided that the full-time connection portion 251 has received the full-time connection request 6 D from the image forming apparatus 1 Aa 1 for the first time (Yes in Step # 712 ). Hereinafter, the account is referred to as a “full-time connection account”. The full-time connection account is given an account code 6 B for distinguishing the full-time connection account from other full-time connection accounts, and a password 6 E for authentication. The full-time connection portion 251 sends the account code 6 B and the password 6 E to the image forming apparatus 1 Aa 1 (encircled number 2 , and Step # 714 ).

When the image forming apparatus 1 Aa 1 has already had a full-time connection account, the full-time connection portion 102 sends the account code 6 B and the password 6 E together with the full-time connection request 6 D to the full-time connection server 2 B in Step # 701 .

Strictly speaking, the full-time connection account is issued for each gateway portion. The gateway portion is provided in the image forming apparatus 1 A having the gateway program 1 AP 1 installed thereon. The image forming apparatus 1 Aa 1 therefore has the gateway portion. The image forming apparatus 1 A onto which the gateway program 1 AP 1 is not installed is described later.

The full-time connection portion 251 uses the account code 6 B and the password 6 E which are received from the image forming apparatus 1 Aa 1 or are newly issued thereto to establish a session (connection) between the full-time connection server 2 B and the image forming apparatus 1 Aa 1 (encircled number 3 , Steps # 715 and # 704 ). Thereby, tunneling is completed. The session is preferably established by a known method. The password 6 E may be used for verification as to the identity of the image forming apparatus 1 Aa 1 . The connection is maintained in principle. Stated differently, the connection is so-called full-time connection.

When the image forming apparatus 1 Aa 1 has connected to the full-time connection server 2 B for the first time (Yes in Step # 702 ), the full-time connection portion 102 stores the account code 6 B and the password 6 E received from the full-time connection server 2 B into the device managing portion 101 (encircled number 4 , and Step # 703 ).

The full-time connection portion 102 then sends, as the device information, the device identifier 6 A, the account code 6 B, and the device name 6 C to the device managing server 2 A (encircled number 5 , and Step # 705 ). The device identifier 6 A, the account code 6 B, and the device name 6 C are received/sent through a tunnel, i.e., encapsulated in accordance with a protocol of the tunnel and received/sent.

When receiving the device identifier 6 A, the account code 6 B, and the device name 6 C from the image forming apparatus 1 Aa 1 (Step # 721 ), the device information managing portion 201 of the device managing server 2 A registers, as one record, the device identifier 6 A, the account code 6 B, and the device name 6 C into the device management table 2 TL 1 (see FIG. 6 ) (Step # 722 ).

When the session between the image forming apparatus 1 Aa 1 and the full-time connection server 2 B is disconnected, the full-time connection server 2 B informs the device managing server 2 A accordingly. The device information managing portion 201 may delete the record of the image forming apparatus 1 Aa 1 from the device management table 2 TL 1 .

The device-specific interface 105 is an interface for the operating system of the image forming apparatus 1 A or for the application software 3 PS. The full-time connection portion 102 may obtain the device identifier 6 A and the device name 6 C from the operating system through the device-specific interface 105 .

[Processing for Providing an External User with Service]

FIG. 9 is a diagram showing an example as to how information is conveyed for a case where the application server 3 A and the image forming apparatus 1 A work in coordination with each other. FIG. 10 is a flowchart depicting an example of the flow of processing for a case where the application server 3 A and the image forming apparatus 1 A work in coordination with each other.

The user operates his/her terminal 3 B to get service from the image forming apparatus 1 A and the application server 3 A.

The application-specific interface 301 of the application server 3 A is an interface between the application software 3 PS and the device connection request portion 302 /communication session portion 303 . As described later, the device connection request portion 302 controls communication with the device managing server 2 A, and the communication session portion 303 controls communication with the image forming apparatus 1 A. Therefore, the application-specific interface 301 is an interface between the application software 3 PS and the device managing server 2 A/image forming apparatus 1 A. The concrete role of the application-specific interface 301 is described in order.

The description is provided below with reference to FIGS. 9 and 10 by taking an example in which the image forming apparatus 1 Aa is caused to print a document prepared by the user who operates the terminal 3 Ba to use the application software 3 PS 1 of the application server 3 Aa. The application software 3 PS 1 is application software to create a document or chart through a web browser. This type of software which causes a server to perform processing via a web browser is generally called a “web application” or “cloud application”.

For example, the user starts a web browser of the terminal 3 Ba at a business destination to have access to the application software 3 PS 1 of the application server 3 Aa.

The user creates a document and selects, from among the list, an image forming apparatus 1 A which is to be used to print out the document. In this example, the user selects the image forming apparatus 1 Aa 1 installed in his/her office. The application software 3 PS 1 preferably obtains the list from the application-specific interface 301 and presents the list to the user (encircled numbers 1 and 2 of FIG. 9 ). As data for the list, the device identifier 6 A and the device name 6 C of each of the image forming apparatuses 1 A are preferably obtained from the device managing server 2 A regularly and registered into the application-specific interface 301 .

When the application-specific interface 301 is informed of the selection (encircled number 3 , and # 731 of FIG. 10 ), the device connection request portion 302 sends a device connection request 6 G to the device managing server 2 A; thereby makes a request to connect to the image forming apparatus 1 Aa 1 (encircled numbers 4 and 5 , and Step # 732 ). At this time, address information 6 F and the device identifier 6 A of the selected image forming apparatus 1 A (image forming apparatus 1 Aa 1 in this example) are also sent to the device managing server 2 A. The address information 6 F is a Uniform Resource Locator (URL) for the image forming apparatus 1 Aa 1 to have access to the application software 3 PS 1 . The URL includes an address (domain name) of the application server 3 Aa, an identifier of a web page, an identifier (job ID) of a job to be executed by the application server 3 Aa and the image forming apparatus 1 Aa 1 , and a port number of a listen port. An example of the URL is as follows: “https://www.example.com/print_service?job_id=j00123:60001”. As the listen port, unused port is used from among ports within a predetermined region. As the job ID, a unique ID is issued.

With the device managing server 2 A, when receiving the device identifier 6 A, the address information 6 F, and the device connection request 6 G (Step # 741 ), the device connection request sending and receiving portion 202 calls an account code 6 B corresponding to the device identifier 6 A from the device management table 2 TL 1 (see FIG. 6 ) (encircled number 6 , and Step # 742 ). The device connection request sending and receiving portion 202 then sends the device identifier 6 A, the account code 6 B, the address information 6 F, and the device connection request 6 G to the full-time connection server 2 B (encircled number 7 , and Step # 743 ).

With the full-time connection server 2 B, when receiving the device identifier 6 A, the account code 6 B, the address information 6 F, and the device connection request 6 G (Step # 751 ), the device connection request sending and receiving portion 252 finds out an image forming apparatus 1 A having a gateway portion corresponding to the requested device based on the account code 6 B (Step # 752 ). In this embodiment, the requested device, namely, the image forming apparatus 1 Aa 1 , is the image forming apparatus 1 A having the gateway portion.

The device connection request sending and receiving portion 252 sends the device identifier 6 A, the address information 6 F, and the device connection request 6 G to the image forming apparatus 1 A found out, i.e., the image forming apparatus 1 Aa 1 , via the tunnel for the session already established (see Steps # 704 and # 715 of FIG. 8 ) (encircled number 8 , and Step # 753 ). Stated differently, the device identifier 6 A, the address information 6 F, and the device connection request 6 G are encapsulated in accordance with a protocol of the tunnel, and the resultant is sent to the image forming apparatus 1 Aa 1 .

With the image forming apparatus 1 Aa 1 , when the device connection request receiving portion 103 receives the device identifier 6 A, the address information 6 F, and the device connection request 6 G (Step # 761 ), the communication session portion 104 has access to the application server 3 A based on the address information 6 F, and the communication session portion 104 and the communication session portion 303 of the application server 3 A establish a session between the application server 3 Aa and the image forming apparatus 1 Aa 1 (encircled number 9 , Steps # 733 and # 762 ). Thereby, tunneling is completed.

Data is sent and received between the application software 3 PS 1 of the application server 3 Aa and the operating system or the application software of the image forming apparatus 1 Aa 1 via the tunnel, the device-specific interface 105 , the communication session portion 104 , the application-specific interface 301 , and the communication session portion 303 (encircled number 10 , and Steps # 734 and # 763 ). For example, document data and data on print result are sent and received therebetween.

Data transmission to the application server 3 Aa is made to a port corresponding to a port number indicated in the address information 6 F. The data conforms to a protocol depending on service, i.e., TCP, User Datagram Protocol (UDP), SNMP, Line Printer daemon Protocol (LPR), or HTTP. The data is stored in a BODY section of HTTP or HTTPS, and is sent and received between the application server 3 Aa and the image forming apparatus 1 Aa 1 .

When necessary exchange of data is completed, the communication session portion 104 and the communication session portion 303 are disconnected from each other (Steps # 735 and # 764 ).

A case where the device identifier 6 A received by the image forming apparatus 1 Aa 1 does not correspond to the subject image forming apparatus 1 Aa 1 is discussed later.

According to the first embodiment, after the session between the image forming apparatus 1 A and the application server 3 A is established, processing by the device managing server 2 A and the full-time connection server 2 B is unnecessary. Accordingly, the communication between the application server 3 A and the image forming apparatus 1 A via the firewall 1 D can be performed with loads on the device managing server 2 A and the full-time connection server 2 B reduced as compared with the conventional system.

Second Embodiment

FIG. 11 is a diagram showing an example of the functional configuration of each device of the application system 5 . FIG. 12 is a diagram showing an example as to how information is conveyed for a setup. FIG. 13 is a diagram showing an example as to how information is conveyed for a case where the application server 3 A and the image forming apparatus 1 A work in coordination with each other. FIG. 14 is a diagram showing an example of a device management table 2 TL 2 . FIG. 15 is a flowchart depicting an example of the flow of processing for a case where the application server 3 A and the image forming apparatus 1 A work in coordination with each other.

In the first embodiment, the device managing server 2 A sends the device connection request 6 G to the image forming apparatus 1 A independently of the status of the image forming apparatus 1 A. According to the second embodiment, however, the device connection request 6 G is sent depending on the status of the image forming apparatus 1 A.

The overall configuration of the application system 5 according to the second embodiment is the same as that of the first embodiment shown in FIG. 1 . The overall configuration of the LAN 50 according to the second embodiment is also the same as that of the first embodiment shown in FIG. 2 .

The hardware configuration of each of the image forming apparatus 1 A, the device managing server 2 A, the full-time connection server 2 B, and the application server 3 A is also the same as those of the first embodiment shown in FIGS. 3 and 4 .

In the second embodiment, however, the ROM 10 c or the large-capacity storage 10 d of the image forming apparatus 1 A stores, therein, a gateway program 1 AP 2 instead of the gateway program 1 AP 1 . Further, the ROM 20 c or the large-capacity storage 20 d of the device managing server 2 A stores, therein, a device management program 2 AP 2 instead of the device management program 2 AP 1 .

The gateway program 1 AP 2 implements the functions of a device managing portion 121 , a full-time connection portion 122 , a device connection request receiving portion 123 , a communication session portion 124 , a device-specific interface 125 , and a device status managing portion 126 , all of which are shown in FIG. 11 . The device management program 2 AP 2 implements the functions of a device information managing portion 221 and a device connection request sending and receiving portion 222 .

The description goes on to processing by the individual portions shown in FIG. 11 . Description of points common to the first embodiment shall be omitted.

The setup processing is basically the same as that of the first embodiment. To be specific, the device managing portion 121 through the device-specific interface 125 of the image forming apparatus 1 A perform processing as shown in FIG. 12 in a manner similar to that of the device managing portion 101 through the device-specific interface 105 of the first embodiment (see FIG. 7 ).

The device status managing portion 126 obtains status information 6 J on the current status of the subject image forming apparatus 1 A via the device-specific interface 125 (encircled number 1 of FIG. 13 ), and sends the status information 6 J to the device managing server 2 A (encircled number 2 ). According to this embodiment, if the subject image forming apparatus 1 A stands ready to provide predetermined service to a device outside the LAN 50 , then the device status managing portion 126 sends, as the status information 6 J, active status information 6 J 1 indicating that the subject image forming apparatus 1 A is “active”. Otherwise, the device status managing portion 126 sends, as the status information 6 J, non-active status information 6 J 2 indicating that the subject image forming apparatus 1 A is “non-active”.

For example, the device status managing portion 126 sends the active status information 6 J 1 if the subject image forming apparatus 1 A connects to the Internet, the application software 3 PS for this service is started, and a certain resource for the service is ensured. The device status managing portion 126 sends the non-active status information 6 J 2 if the communication fails, the application software 3 PS is disabled, or a load on the subject image forming apparatus 1 A reaches a predetermined level or greater.

The device information managing portion 221 of the device managing server 2 A stores and manages the device management table 2 TL 2 as shown in FIG. 14 . The device management table 2 TL 2 has records showing a device identifier 6 A, an account code 6 B, a device name 6 C, and status information 6 J for each of the image forming apparatuses 1 A connected to the full-time connection server 2 B.

As with the case of the first embodiment, the device information managing portion 221 registers the device identifier 6 A, the account code 6 B, and the device name 6 C into the device management table 2 TL 2 in the same manner as that described with reference to FIGS. 7 and 8 .

Every time the status information 6 J is sent from the image forming apparatus 1 A, the device information managing portion 221 associates the status information 6 J with the corresponding image forming apparatus 1 A and registers the resultant into the device management table 2 TL 2 . If the status information 6 J of the corresponding image forming apparatus 1 A is already registered in the device management table 2 TL 2 , the old status information 6 J is deleted therefrom, and the new status information 6 J is registered therein.

In this way, the status information 6 J is updated in the device management table 2 TL 2 . For example, when the active status information 6 J 1 is sent from the image forming apparatus 1 Aa 1 , the status information 6 J of the image forming apparatus 1 Aa 1 in the device management table 2 TL 2 is updated with “active”. When the non-active status information 6 J 2 is sent from the image forming apparatus 1 Aa 1 , the status information 6 J of the image forming apparatus 1 Aa 1 is updated with “non-active”.

The flow of processing by the portions shown in FIG. 11 is described below with reference to FIGS. 13 and 15 by taking an example in which the image forming apparatus 1 Aa is caused to print a document prepared by the user who operates the terminal 3 Ba to use the application software 3 PS 1 of the application server 3 Aa. Note that the processing of encircled numbers 1 and 2 of FIG. 13 is performed independently of the processing of encircled numbers 3 - 16 .

The operation by the user is the same as that of the first embodiment. To be specific, the user starts a web browser of the terminal 3 Ba to have access to the application software 3 PS 1 of the application server 3 Aa. The user creates a document and selects the image forming apparatus 1 Aa 1 as a connection destination.

The application-specific interface 301 and the device connection request portion 302 of the application server 3 Aa perform processing for sending a request to the device managing server 2 A (encircled numbers 3 - 7 of FIG. 13 , and Steps # 771 and # 772 of FIG. 15 ). The processing is similar to that shown in encircled numbers 1 - 5 of FIG. 9 , and Steps # 731 and # 732 of FIG. 10 . In this way, the device identifier 6 A, the address information 6 F, and the device connection request 6 G of the image forming apparatus 1 Aa 1 are sent to the device managing server 2 A.

With the device managing server 2 A, when receiving the device identifier 6 A, the address information 6 F, and the device connection request 6 G (Step # 781 ), the device connection request sending and receiving portion 222 calls an account code 6 B and status information 6 J corresponding to the device identifier 6 A from the device management table 2 TL 2 (see FIG. 14 ) (encircled number 8 , and Step # 782 ).

If the status information 6 J indicates “non-active” (No in Step # 783 ), then the device connection request sending and receiving portion 222 sends, to the application server 3 Aa, a failure message 6 K saying that connection to the image forming apparatus 1 Aa 1 is impossible (encircled number 9 , and Step # 784 ). With the application server 3 Aa, the device connection request portion 302 receives the failure message 6 K (encircled number 10 , and Yes in Step # 773 ), the failure message 6 K is given through the application-specific interface 301 to the application software 3 PS 1 (encircled number 11 ), and then is transferred to the terminal 3 Ba (encircled number 12 , and Step # 774 ).

On the other hand, if the status information 6 J indicates “active” (Yes in Step # 783 ), then the device connection request sending and receiving portion 222 sends, to the full-time connection server 2 B, the device identifier 6 A, the account code 6 B, the address information 6 F, and the device connection request 6 G (encircled number 13 , and Step # 785 ).

The subsequent processing by the portions of the full-time connection server 2 B, the image forming apparatus 1 Aa 1 , and the application server 3 Aa is the same as that of the first embodiment. To be specific, the subsequent processing is the same as that described with reference to encircled numbers 8 - 10 of FIG. 9 , and Steps # 751 -# 753 , # 761 -# 764 , and # 733 -# 735 of FIG. 10 (encircled numbers 14 - 16 , Steps # 791 -# 793 , # 801 -# 804 , and # 775 -# 777 ). The processing enables communication between the image forming apparatus 1 Aa 1 and the application server 3 Aa through a tunnel.

According to the second embodiment, a request to an image forming apparatus 1 A which is not active can be stopped. This reduces unnecessary traffic and unnecessary processing by the full-time connection server 2 B.

In the foregoing example, the device managing server 2 A determines whether or not a request is made to the image forming apparatus 1 A. Instead of the device managing server 2 A, the application server 3 A may make the determination. In such a case, the device managing server 2 A provides the application server 3 A with the status information 6 J for each of the image forming apparatuses 1 A. With the application server 3 A, if the status information 6 J for the image forming apparatus 1 A selected by the user indicates “active”, then the device connection request portion 302 preferably sends the device identifier 6 A, the address information 6 F, and the device connection request 6 G to the device managing server 2 A. On the other hand, if the status information 6 J indicates “non-active”, then the transmission is stopped and the failure message 6 K is sent to the terminal 3 B.

Third Embodiment

FIG. 16 is a diagram showing an example of the functional configuration of each device of the application system 5 . FIG. 17 is a diagram showing an example as to how information is conveyed for a setup. FIG. 18 is a diagram showing an example as to how information is conveyed for a case where the application server 3 A and the image forming apparatus 1 A work in coordination with each other. FIG. 19 is a flowchart depicting an example of the flow of processing for a case where the application server 3 A and the image forming apparatus 1 A work in coordination with each other.

In the first and second embodiments, the application server 3 A establishes a session with the image forming apparatus 1 A without verifying the image forming apparatus 1 A. In the third embodiment, however, verification as to the identity of the image forming apparatus 1 A is performed, and after that, session therewith is established.

The overall configuration of the application system 5 according to the third embodiment is the same as that of each of the first and second embodiments shown in FIG. 1 . The overall configuration of the LAN 50 according to the third embodiment is also the same as that of each of the first and second embodiments shown in FIG. 2 .

The hardware configuration of each of the image forming apparatus 1 A, the device managing server 2 A, the full-time connection server 2 B, and the application server 3 A is the same as those of the first embodiment shown in FIGS. 3 and 4 .

In the third embodiment, however, the ROM 10 c or the large-capacity storage 10 d of the image forming apparatus 1 A stores, therein, a gateway program 1 AP 3 instead of the gateway program 1 AP 1 or 1 AP 2 . Further, the ROM or the large-capacity storage of the application server 3 A stores, therein, an access program 3 AP 3 instead of the access program 3 AP 1 .

The gateway program 1 AP 3 implements the functions of a device managing portion 131 , a full-time connection portion 132 , a device connection request receiving portion 133 , a communication session portion 134 , a device-specific interface 135 , and a certificate request portion 136 , all of which are shown in FIG. 16 . The access program 3 AP 3 implements the functions of an application-specific interface 331 , a device connection request portion 332 , a communication session portion 333 , and a certificate validity determination portion 334 .

The description goes on to processing by the individual portions shown in FIG. 16 . Description of points common to the first or second embodiment shall be omitted.

The setup processing is basically the same as that of each of the first and second embodiments. To be specific, the device managing portion 131 through the device-specific interface 135 of the image forming apparatus 1 A perform processing as shown in FIG. 17 in a manner similar to that of the device managing portion 101 through the device-specific interface 105 of the first and second embodiments (see FIGS. 7 and 12 ).

The flow of processing by the portions shown in FIG. 16 is described below with reference to FIGS. 18 and 19 by taking an example in which the image forming apparatus 1 Aa is caused to print a document prepared by the user who operates the terminal 3 Ba to use the application software 3 PS 1 of the application server 3 Aa.

The operation by the user is the same as that of each of the first and second embodiments. To be specific, the user starts a web browser of the terminal 3 Ba to have access to the application software 3 PS 1 of the application server 3 Aa. The user creates a document and selects the image forming apparatus 1 Aa 1 as a connection destination.

The application-specific interface 331 and the device connection request portion 332 of the application server 3 Aa perform processing for sending a request to the device managing server 2 A (encircled numbers 1 - 5 of FIG. 18 , and Steps # 811 and # 812 of FIG. 19 ). The processing is similar to that shown in encircled numbers 1 - 5 of FIG. 9 , and Steps # 731 and # 732 of FIG. 10 . In this way, the device identifier 6 A, the address information 6 F, and the device connection request 6 G of the image forming apparatus 1 Aa 1 are sent to the device managing server 2 A.

The device managing server 2 A and the full-time connection server 2 B perform processing for sending the device identifier 6 A, the account code 6 B, the address information 6 F, and the device connection request 6 G to the image forming apparatus 1 Aa 1 (encircled numbers 6 - 8 , Steps # 821 -# 823 , and # 831 -# 833 ). The processing is similar to that shown in encircled numbers 6 - 8 of FIG. 9 , Steps # 741 -# 743 , and # 751 -# 753 of FIG. 10 .

With the image forming apparatus 1 Aa 1 , when the device connection request receiving portion 133 receives the device identifier 6 A, the address information 6 F, and the device connection request 6 G (Step # 841 ), the certificate request portion 136 requests an electronic certificate 6 L from the device-specific interface 135 (encircled number 9 ), and obtains the same therefrom (encircled numbers 10 and 11 , and Step # 842 ). The device-specific interface 135 preferably obtains the electronic certificate 6 L from the operating system.

The communication session portion 134 has access to the application server 3 Aa based on the address information 6 F, and sends the electronic certificate 6 L to the application server 3 Aa (encircled numbers 12 and 13 , and Step # 843 ).

With the application server 3 Aa, when the communication session portion 333 receives the electronic certificate 6 L (Step # 813 ), the certificate validity determination portion 334 confirms whether or not the electronic certificate 6 L is valid, and thereby, checks the authenticity of the image forming apparatus 1 Aa 1 (encircled number 14 , and Step # 814 ). The result of check is sent as the determination result 6 M to the communication session portion 333 (encircled number 15 ).

In response to the receipt of the result, the communication session portion 333 performs the following processing depending on the determination result 6 M. To be specific, if the determination result 6 M indicates that the image forming apparatus 1 Aa 1 is not authentic (No in Step # 814 ), then the communication session portion 333 sends a failure message 6 N through the application-specific interface 331 to the application software 3 PS (encircled number 13 ). After that, the failure message 6 N is transferred to the terminal 3 Ba (encircled numbers 16 - 18 , and Step # 818 ).

On the other hand, if the determination result 6 M indicates that the image forming apparatus 1 Aa 1 is authentic (Yes in Step # 815 ), then the communication session portion 333 works in coordination with the communication session portion 134 , and a session between the image forming apparatus 1 Aa 1 and the application server 3 Aa is established (encircled number 19 , and Steps # 815 and # 844 ). In this way, tunneling is completed.

The foregoing processing enables communication between the image forming apparatus 1 Aa 1 and the application server 3 Aa through the tunnel. Data is sent and received therebetween (encircled number 20 , and Steps # 816 and # 845 ). When necessary communication is completed, the communication session portion 134 and the communication session portion 333 are disconnected from each other (Steps # 817 and # 846 ).

According to the third embodiment, it is possible to prevent a session from being established with a device impersonating the image forming apparatus 1 A, leading to the enhanced security.

The device managing server 2 A or the application server 3 A according to the third embodiment may use the mechanism of the second embodiment in which the device connection request 6 G and so on are transferred depending on the status of the image forming apparatus 1 A.

Fourth Embodiment

FIG. 20 is a diagram showing an example of the functional configuration of each device of the application system 5 . FIG. 21 is a diagram showing an example as to how information is conveyed for a setup. FIG. 22 is a diagram showing an example of a communication session table 2 TS 4 . FIG. 23 is a diagram showing an example as to how information is conveyed for a case where the application server 3 A and the image forming apparatus 1 A work in coordination with each other. FIGS. 24 and 25 are flowcharts depicting an example of the flow of processing for a case where the application server 3 A and the image forming apparatus 1 A work in coordination with each other.

In the first and third embodiments, the device managing server 2 A sends the device connection request 6 G to the image forming apparatus 1 A independently of the status of the image forming apparatus 1 A. According to the second embodiment, the device connection request 6 G is sent if the device managing server 2 A is active. According to the fourth embodiment, however, the device connection request 6 G is sent in accordance with the number of sessions of the device managing server 2 A.

The overall configuration of the application system 5 according to the fourth embodiment is the same as that of each of the first through third embodiments shown in FIG. 1 . The overall configuration of the LAN 50 according to the fourth embodiment is also the same as that of each of the first through third embodiments shown in FIG. 2 .

The hardware configuration of each of the image forming apparatus 1 A, the device managing server 2 A, the full-time connection server 2 B, and the application server 3 A is also the same as those of each of the first through third embodiments shown in FIGS. 3 and 4 .

In the fourth embodiment, however, the ROM 20 c or the large-capacity storage 20 d of the image forming apparatus 2 A stores, therein, a device management program 2 AP 4 instead of the device management program 2 AP 1 or 2 AP 2 . Further, the ROM or the large-capacity storage of the application server 3 A stores, therein, an access program 3 AP 4 instead of the access program 3 AP 1 or 3 AP 3 .

The device management program 2 AP 4 implements the functions of a device information managing portion 241 , a device connection request sending and receiving portion 242 , and a communication session management portion 243 , all of which are shown in FIG. 20 . The access program 3 AP 4 implements the functions of an application-specific interface 341 , a device connection request portion 342 , and a communication session portion 343 .

The description goes on to processing by the individual portions shown in FIG. 20 . Description of points common to the first, second, or third embodiment shall be omitted.

The setup processing is basically the same as that of each of the first through third embodiments. To be specific, the device managing portion 101 through the device-specific interface 105 of the image forming apparatus 1 A perform processing as shown in FIG. 21 . The device information managing portion 241 stores and manages the device management table 2 TL 1 (see FIG. 6 ) as with the case of the device information managing portion 201 (see FIG. 7 ) of the first embodiment.

The communication session portion 343 performs processing for establishing a session with the image forming apparatus 1 A, as with the communication session portion 303 of the first embodiment. In addition to this, the communication session portion 343 informs the device managing server 2 A of establishment/disconnection of the session with the image forming apparatus 1 A in the following manner.

When the session with the image forming apparatus 1 A is established, the communication session portion 343 sends, to the device managing server 2 A, session start information 6 P 1 together with the device identifier 6 A of the image forming apparatus 1 A (see encircled number 15 of FIG. 23 ). On the other hand, when the session with the image forming apparatus 1 A is disconnected, the communication session portion 343 sends, to the device managing server 2 A, session termination information 6 P 2 together with the device identifier 6 A of the image forming apparatus 1 A (see encircled number 17 of FIG. 23 ).

With the device managing server 2 A, the communication session management portion 243 stores and manages the communication session table 2 TS 4 , shown in FIG. 22 , indicating the device identifier 6 A and a session count 6 Q for each of the image forming apparatuses 1 A. The session count 6 Q is the number of sessions which are effective at the present time between the corresponding image forming apparatus 1 A and the application server 3 A. The default of the session count 6 Q is “0 (zero)”. The session count 6 Q is updated in the following manner.

When receiving the session start information 6 P 1 and the device identifier 6 A from the application server 3 A, the communication session management portion 243 adds “1” to the session count 6 Q corresponding to the device identifier 6 A. When receiving the session termination information 6 P 2 and the device identifier 6 A, the communication session management portion 243 reduces, by “1”, the session count 6 Q corresponding to the device identifier 6 A.

The flow of processing by the portions shown in FIG. 20 is described below with reference to FIGS. 23, 24 , and 25 by taking an example in which the image forming apparatus 1 Aa is caused to print a document prepared by the user who operates the terminal 3 Ba to use the application software 3 PS 1 of the application server 3 Aa.

The operation by the user is the same as that of each of the first through third embodiments. To be specific, the user starts a web browser of the terminal 3 Ba to have access to the application software 3 PS 1 of the application server 3 Aa. The user creates a document and selects the image forming apparatus 1 Aa 1 as a connection destination.

The application-specific interface 341 and the device connection request portion 342 of the application server 3 Aa perform processing for sending a request to the device managing server 2 A (encircled numbers 1 - 5 of FIG. 23 , and Steps # 851 and 852 of FIG. 24 ). The processing is similar to that shown in encircled numbers 1 - 5 of FIG. 9 and Steps # 731 and # 732 of FIG. 10 . In this way, the device identifier 6 A, the address information 6 F, and the device connection request 6 G of the image forming apparatus 1 Aa 1 are sent to the device managing server 2 A.

With the device managing server 2 A, when receiving the device identifier 6 A, the address information 6 F, and the device connection request 6 G (Step # 861 ), the device connection request sending and receiving portion 242 calls an account code 6 B corresponding to the device identifier 6 A from the device management table 2 TL 2 (see FIG. 14 ) (encircled number 6 , and Step # 862 ), and calls a session count 6 Q corresponding to the device identifier 6 A from the communication session table 2 TS 4 (encircled number 7 , and Step # 863 ).

If the session count 6 Q is equal to or greater than a threshold TH 1 (Yes in Step # 864 ), then the device connection request sending and receiving portion 242 sends, to the application server 3 Aa, a failure message 6 R saying that connection to the image forming apparatus 1 Aa 1 is denied (encircled number 8 , and Step # 865 ). With the application server 3 Aa, when the device connection request portion 342 receives the failure message 6 R (Yes in Step # 853 ), the failure message 6 R is given through the application-specific interface 341 to the application software 3 PS 1 (encircled numbers 9 and 10 ), and is transferred to the terminal 3 Ba (encircled number 11 , and Step # 854 ).

On the other hand, if the session count 6 Q is smaller than the threshold TH 1 (No in Step # 864 ), then the device connection request sending and receiving portion 242 sends the device identifier 6 A, the account code 6 B, the address information 6 F, and the device connection request 6 G to the full-time connection server 2 B (encircled number 12 , and Step # 866 ).

The subsequent processing by the portions of the full-time connection server 2 B, the image forming apparatus 1 Aa 1 , and the application server 3 Aa is basically the same as that of the first embodiment. To be specific, the subsequent processing is basically the same as that described with reference to encircled numbers 8 - 10 of FIG. 9 , and Steps # 751 -# 753 , # 761 -# 764 , and # 733 -# 735 of FIG. 10 (encircled numbers 13 , 14 , and 16 , Steps # 881 -# 883 , # 891 -# 894 , # 855 , # 857 , and # 858 ). The processing enables communication between the image forming apparatus 1 Aa 1 and the application server 3 Aa through a tunnel.

Unlike the first embodiment, when the session is established, the communication session portion 343 sends, to the device managing server 2 A, the session start information 6 P 1 and the device identifier 6 A of the image forming apparatus 1 Aa 1 (encircled number 15 , and Step # 856 ).

Upon the transmission, the communication session management portion 243 adds “1” to the session count 6 Q of the image forming apparatus 1 Aa 1 in the communication session table 2 TS 4 (Steps # 867 and # 868 ).

When the session is disconnected, the communication session portion 343 sends, to the device managing server 2 A, the session start information 6 P 1 and the device identifier 6 A of the image forming apparatus 1 Aa 1 (encircled number 17 , and Step # 859 ).

Upon the transmission, the communication session management portion 243 subtracts “1” from the session count 6 Q of the image forming apparatus 1 Aa 1 in the communication session table 2 TS 4 (Steps # 869 and # 870 ).

According to the fourth embodiment, it is possible to cancel a request to the image forming apparatus 1 on which a certain level of load is placed.

In the foregoing example, the device managing server 2 A determines whether or not a request is made to the image forming apparatus 1 A. Instead of the device managing server 2 A, the application server 3 A may make the determination. In such a case, the application server 3 A preferably makes a record of the session count 6 Q for each of the image forming apparatuses 1 A. With the application server 3 A, if the session count 6 Q of the application server 3 A selected by the user is smaller than the threshold TH 1 , then the device connection request portion 342 sends the device identifier 6 A, the address information 6 F, and the device connection request 6 G to the device managing server 2 A. On the other hand, if the session count 6 Q is equal to or greater than the threshold TH 1 , then the transmission is stopped and the failure message 6 R is sent to the terminal 3 B.

The device managing server 2 A or the application server 3 A of the fourth embodiment may use the mechanism of the second embodiment in which the device connection request 6 G is transferred depending on the status of the image forming apparatus 1 A.

The image forming apparatus 1 A and the application server 3 A of the fourth embodiment may use the mechanism of the third embodiment in which the device connection request 6 G and so on are transferred in accordance with the result of authentication based on the electronic certificate 6 L.

[First Mechanism for Having Access to the Image Forming Apparatus 1 A Having No Gateway Portion]

FIG. 26 is a diagram showing an example of the device management table 2 TL 1 . FIG. 27 is a diagram showing an example as to how information is conveyed for a case where the application server 3 A and the image forming apparatus 1 A work in coordination with each other.

In the first through fourth embodiments, the application server 3 A has access to the image forming apparatus 1 A having a gateway portion. The description goes on to the mechanism in which the application server 3 A has access to the image forming apparatus 1 A having no gateway portion by taking an example of the first embodiment.

Both the image forming apparatus 1 Ab 1 and the image forming apparatus 1 Ab 2 are located in the LAN 50 b (see FIG. 1 ). The image forming apparatus 1 Ab 1 has a gateway portion, and the image forming apparatus 1 Ab 2 has no gateway portion. Accordingly, the image forming apparatus 1 Ab 2 performs communication with the application server 3 A by using the gateway portion of the image forming apparatus 1 Ab 1 .

As discussed earlier, the full-time connection portion 102 of the image forming apparatus 1 Ab 1 sends, as the device information on the image forming apparatus 1 Ab 1 , the device identifier 6 A, the account code 6 B, and the device name 6 C of the image forming apparatus 1 Ab 1 (see encircled number 5 of FIG. 7 ). The full-time connection portion 102 of the image forming apparatus 1 Ab 1 also sends, as the device information on the image forming apparatus 1 Ab 2 , the device identifier 6 A and the device name 6 C of the image forming apparatus 1 Ab 2 , and the account code 6 B of the image forming apparatus 1 Ab 1 .

The device information managing portion 201 of the device managing server 2 A registers device information on each of the image forming apparatus 1 Ab 1 and the image forming apparatus 1 Ab 2 into the device management table 2 TL 1 . As shown in FIG. 26 , records having the same account code 6 B are registered into the device management table 2 TL 1 because the gateway portion is shared by the image forming apparatus 1 Ab 1 and the image forming apparatus 1 Ab 2 . The device identifier 6 A may be a Media Access Control (MAC) address or an IP address.

The description goes onto the processing for a case where the application server 3 Aa has access to the image forming apparatus 1 Ab 2 with reference to FIG. 27 .

With the application server 3 Aa, when the user designates the image forming apparatus 1 Ab 2 , the device connection request portion 302 sends, to the device managing server 2 A, the device identifier 6 A, the address information 6 F, and the device connection request 6 G (encircled numbers 1 - 5 ). The device identifier 6 A is a device identifier of the image forming apparatus 1 Ab 2 , and the address information 6 F is a URL for the image forming apparatus 1 Ab 2 to have access to the application software 3 PS.

With the device managing server 2 A, when receiving the device identifier 6 A, the address information 6 F, and the device connection request 6 G, the device connection request sending and receiving portion 202 calls an account code 6 B corresponding to the device identifier 6 A from the device management table 2 TL 1 (see FIG. 26 ) (encircled number 6 ). Thereby, the account code of the image forming apparatus 1 Ab 1 is called as the account code 6 B. The device connection request sending and receiving portion 202 then sends the device identifier 6 A, the account code 6 B, the address information 6 F, and the device connection request 6 G to the full-time connection server 2 B (encircled number 7 ).

With the full-time connection server 2 B, when receiving the device identifier 6 A, the account code 6 B, the address information 6 F, and the device connection request 6 G, the device connection request sending and receiving portion 252 finds out an image forming apparatus 1 A having a gateway portion corresponding to the requested device based on the account code 6 B. In this example, the image forming apparatus 1 Ab 1 is identified as the image forming apparatus 1 A having a gateway portion.

The device connection request sending and receiving portion 252 sends the device identifier 6 A, the address information 6 F, and the device connection request 6 G to the image forming apparatus 1 A thus identified, i.e., the image forming apparatus 1 Ab 1 , through the tunnel for the session already established (encircled number 8 ).

With the image forming apparatus 1 Ab 1 , when the device connection request receiving portion 103 receives the device identifier 6 A, the address information 6 F, and the device connection request 6 G, the communication session portion 104 has access to the application server 3 A based on the address information 6 F, and the communication session portion 104 and the communication session portion 303 of the application server 3 A establish a session between the application server 3 Aa and the image forming apparatus 1 Ab 1 (encircled number 9 ). Thereby, tunneling is completed.

If the device identifier 6 A received is the device identifier 6 A of the image forming apparatus 1 Ab 1 , data is sent and received between the application software 3 PS of the application server 3 Aa and the operating system or the application software of the image forming apparatus 1 Ab 1 as discussed earlier in the first through fourth embodiments.

However, in this example, the device identifier 6 A is not the device identifier 6 A of the image forming apparatus 1 Ab 1 . Therefore, the device-specific interface 105 relays communication between the application server 3 Aa and the image forming apparatus 1 A corresponding to the device identifier 6 A, i.e., the image forming apparatus 1 Ab 2 (encircled number 10 ). Stated differently, the device-specific interface 105 transfers data sent from the application server 3 Aa to the image forming apparatus 1 Ab 2 , and vice versa.

This mechanism enables the image forming apparatus 1 A to work in coordination with the application server 3 A even if the image forming apparatus 1 A is not provided with a gateway portion because resources are in short, or the image forming apparatus 1 A is put on the market and cannot be modified.

The mechanism is also applicable to the image forming apparatuses 1 A of the second through fourth embodiments.

[Second Modification to Connection with the Image Forming Apparatus 1 A Having No Gateway Portion]

FIG. 28 is a diagram showing an example as to how information is conveyed for a case where the application server 3 A and the image forming apparatus 1 A work in coordination with each other.

A gateway portion may be provided in a device other than the image forming apparatus 1 A. In such a case, communication between the application server 3 A and the image forming apparatus 1 A may be performed through the gateway portion. The mechanism is described below by taking an example of the first embodiment.

All of the image forming apparatus 1 Ac 1 , the image forming apparatus 1 Ac 2 , and the terminal 1 Bc are located in a LAN 50 c (see FIG. 1 ). Neither the image forming apparatus 1 Ac 1 nor the image forming apparatus 1 Ac 2 has a gateway portion. Instead, the terminal 1 Bc has a gateway portion. To be specific, the terminal 1 Bc is provided with the device managing portion 101 , the full-time connection portion 102 , the device connection request receiving portion 103 , the communication session portion 104 , and the device-specific interface 105 , all of which are shown in FIG. 5 . Accordingly, the image forming apparatuses 1 Ac 1 and 1 Ac 2 perform communication with the application server 3 A by using the gateway portion of the terminal 1 Bc.

The device management table 2 TL 1 (see FIGS. 6 and 26 ) registers thereinto device information on each of the image forming apparatus 1 Ac 1 and the image forming apparatus 1 Ac 2 . The account code 6 B of each of the image forming apparatuses 1 Ac 1 and 1 Ac 2 is the account code of the gateway portion of the terminal 1 Bc.

The procedural steps of processing for the case where the application server 3 A has access to the image forming apparatus 1 Ac 1 or the image forming apparatus 1 Ac 2 are shown in FIG. 28 . The procedural steps are basically the same as those of FIG. 27 .

Even if there are no image forming apparatuses 1 A having a gateway portion in the LAN 50 , this mechanism enables the image forming apparatus 1 A to work in coordination with the application server 3 A.

The mechanism is also applicable to the image forming apparatuses 1 A of the second through fourth embodiments. The terminal 1 B may be a gateway-dedicated device, a so-called box.

In the foregoing embodiments and modifications thereof, the example is described in which the image forming apparatus 1 A and the application server 3 A are caused to work in coordination with each other. Instead of this, however, other devices may be used in combination with each other. For example, the present invention is also applicable to the case where the terminal 1 B and the application server 3 A are caused to work together, the case where the terminal 1 B and the terminal 3 B are caused to work in coordination, and the case where the terminal 1 B and the application server 3 A are caused to work in coordination.

In the foregoing embodiments and modifications thereof, the device managing server 2 A and the full-time connection server 2 B are used as intermediate devices provided between the application server 3 A and the image forming apparatus 1 A. Instead of the configuration, it is possible to use one device having the functions of the device managing server 2 A and the functions of the full-time connection server 2 B. Alternatively, the functions thereof may be distributed to three devices or more. Yet alternatively, the functions thereof may be implemented by a so-called cloud computer (cloud server).

In the foregoing embodiments and modifications thereof, the example is described in which the image forming apparatus 1 A is caused to print a document prepared by a user. The present invention is also usable to provide other service. Examples of the service are: service of make settings of the image forming apparatus 1 A remotely; service of providing an external device with a status of the image forming apparatus 1 A; service of using the terminal 3 B to refer to an address book stored in the image forming apparatus 1 A; service of using the application server 3 A to edit image data stored in the image forming apparatus 1 A; and service of printing the identical document by using a plurality of the image forming apparatuses 1 A. As discussed above, according to the application system 5 , it is possible to perform communication via a firewall with loads put onto a relay server reduced as compared with conventional methods.

It is to be understood that the configurations of the application system 5 , the image forming apparatus 1 A, the device managing server 2 A, the full-time connection server 2 B, and the application server 3 A, the constituent elements thereof, the content and order of the processing, the configuration of data, and the like can be appropriately modified without departing from the spirit of the present invention.

While example embodiments of the present invention have been shown and described, it will be understood that the present invention is not limited thereto, and that various changes and modifications may be made by those skilled in the art without departing from the scope of the invention as set forth in the appended claims and their equivalents.