JP2009043132A - Image processing apparatus and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To easily add or change an additional function etc. concerning authentication function, while the authentication function that can be used easily from a terminal device without modifying an authentication module of an image processing apparatus. <P>SOLUTION: An interface module 12c is provided between an application 51 of a terminal device 2 and an authentication module 14 of an image processing complex machine 1. A user ID and a password inputted from the application 51 are transferred to the authentication module 14 through the interface module 12c, and the authentication module 14 authenticates a user by comparing the transferred user ID and password and stored user information. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an image processing apparatus and program, such as a digital copying machine, a printer, and an image processing complex machine, and more particularly to an image processing apparatus and program for performing authentication processing.

  Currently, a program development language Java (registered trademark) that can easily develop programs that operate on various platforms (a kind of application program interface) is widely used.

  In response to this trend, a software development kit (called JSDK) for developing a Java application program is also provided, and the JSDK application program developed with the kit is operated on the image processing apparatus. A platform has also been proposed.

  On the other hand, in recent years, the need for information security has been increasing, so that an increasing number of image processing apparatuses are equipped with an authentication function that can set permission for use such as copying, printing, image reading, and facsimile communication for each user. (For example, refer to Patent Document 1).

  In this patent document 1, in an image processing apparatus equipped with a plurality of application programs, a plurality of functions are displayed at the time of use, and when one or a plurality of functions are selected as the functions to be used, use restriction means Receives the authentication result from the authentication means, and permits the use of one or more selected functions based on the result.

When an authentication function of an image processing apparatus (for example, a printer) is used with a personal computer or the like as a terminal device, the driver software is provided with a communication function for authentication on the terminal device side.
JP 2004-122778 A

However, in the prior art, when an authentication function such as an image processing apparatus is used from a terminal device, since the terminal device side is realized by providing the driver software with a communication function for authentication, communication for authentication is performed. When driver software that does not have a function is used, there is a problem that an image processing apparatus having an authentication function cannot be used even if it is supported by the application program (for example, document processing or spreadsheet program) of the terminal device. It was.
In addition, if you try to add not only the terminal device but also the communication function related to authentication with application programs in the image processing device and the additional function related to authentication such as password change, the authentication module of the image processing device is modified. There was a problem that the impact would be widespread and would be a significant risk correction.

  The present invention is intended to solve such problems of the prior art, and in an image processing apparatus having an authentication function, the authentication function can be easily used from a terminal device without correcting the authentication module of the image processing apparatus. An object of the present invention is to provide an image processing apparatus that can easily add and change additional functions related to an authentication function.

  The invention according to claim 1 is an image processing apparatus comprising an authentication module that authenticates a user by comparing a user ID and password input from an application program with stored user information. An interface module that mediates data exchange with the module is provided, and the application program and the authentication module communicate with each other via the interface module to perform an authentication process.

  According to a second aspect of the present invention, in the image processing apparatus according to the first aspect, communication between the application program and the interface module is performed using a TCP / IP socket, and the application program is transmitted via a network. It is an application program of a connected terminal device.

  According to a third aspect of the present invention, in the image processing apparatus according to the second aspect, communication between the application program and the interface module is encrypted.

  According to a fourth aspect of the present invention, in the image processing apparatus according to the first aspect, communication between the authentication module and the interface module is performed using a domain socket.

  According to a fifth aspect of the present invention, in the image processing apparatus according to any one of the first to fourth aspects, the interface module stops the authentication processing in a set time zone.

  According to a sixth aspect of the present invention, in the image processing apparatus according to any one of the first to fourth aspects, the interface module transmits the authentication information by e-mail when the authentication process is completed. .

  According to a seventh aspect of the present invention, in the image processing apparatus according to any one of the first to fourth aspects, the interface module writes a log of authentication information to a file when the authentication process is completed. And

  According to an eighth aspect of the present invention, in the image processing apparatus according to the sixth or seventh aspect, the authentication information includes login or logout time, user information, and used socket information.

  According to a ninth aspect of the present invention, in the image processing apparatus according to any one of the first to fourth aspects, the interface module emits a sound upon a predetermined event during the authentication process.

  A tenth aspect of the present invention is a program for causing an image processing apparatus according to any one of the first to ninth aspects to function.

  According to the present invention, it is possible to easily use an authentication function from a terminal device without modifying an authentication module of the image processing apparatus, and to easily add or change an additional function related to the authentication function. A device can be provided.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. However, the components, types, combinations, shapes, relative positions, and the like described in this embodiment are not intended to limit the scope of this description to only that unless otherwise specified, but are merely one embodiment. Absent.
In this embodiment, unless otherwise specified, an application program can be executed as an image processing apparatus, and a digital copier having a function such as a facsimile or a printer (hereinafter referred to as an image processing complex machine) is taken as an example. Explained.

(First embodiment)
FIG. 1 is a block diagram showing a software configuration of a main part of the image processing multifunction peripheral according to the first embodiment of the present invention. As shown in the figure, the software has a hierarchical structure, and various application programs 11 such as a JSDK application program 11a (hereinafter referred to as JSDK application 11a) written in Java, a virtual application service program 12 (hereinafter referred to as VAS12). ), Interface modules (hereinafter referred to as IFM) 12a and 12c, a service layer 13, an operating system 16 (hereinafter referred to as OS 16), a JSDK platform 17, and the like.
Here, the VAS 12 is a program interface when the JSDK application 11 a uses the program of the service layer 13.

  The OS 16 uses, for example, UNIX (registered trademark) compatible with multitask processing, has a function of executing each program shown in FIG. 1 in parallel as a process, and means for exchanging data between programs (IPC: Inter Process Communication) is also provided. The application program 11 written in the non-Java language including the CSDK application 11 does not require the VAS 12 even when using the program of the service layer 13, and can directly refer to the program of the service layer 13.

As the application program 11, in addition to the JSDK application 11a, a copy application program written in a non-Java language such as C language, a printer application program, a scanner application program, and the like are provided.
The service layer 13 includes a plurality of lower function modules that are called from various application programs 11 and provide basic functions. The service module 13 includes an authentication module (CCS) 14 and a network communication service module (NCS). And a delivery service module (DCS: Delivery Control Service) for delivering mail. For example, the authentication module 14 is a module having a function of authenticating whether the user is a registered user based on the input user ID and password. A user directory module 15 (UCS: User directory Control Service) is a module that holds a list of functions that can be used by each user and determines whether or not the application program 11 can be used for each user.

  The IFM 12a and the IFM 12c are interface modules at the same level as the VAS 12, the IFM 12a is a program interface when the JSDK application 11a uses the service layer 13 program, and the IFM 12c uses the service layer 13 program from the terminal application program. Program interface. The IFM 12a can also be used from the application program 11 written in a non-Java language. Details will be described later.

  Conventionally, when an additional function related to authentication is added, the authentication module 14 of the service layer 13 is modified. However, since the module of the service layer 13 is used by many application programs, the scope of influence by the modification reaches a wide range of application programs, and the scale of the modification becomes large. In the present embodiment, addition of a function or the like can be easily realized by correcting a small module.

FIG. 2 is a block diagram illustrating a hardware configuration of a main part of the image processing multifunction peripheral according to the present embodiment. As shown in the figure, the image processing complex machine of this embodiment includes a control unit 21, an operation panel 22, an image reading unit 23, a printing unit 24, a facsimile control unit (FCU) 25, and the like as hardware. The operation panel 22 is provided with a speaker (or buzzer) (not shown).
In the control unit 21, a CPU 31 that controls the entire image processing complex machine and executes various applications according to a program (software), a ROM 32 that stores a part of the program and fixed data, a program and data RAM 33 for temporarily storing data, ASIC 34, which is a dedicated LSI composed of various circuits such as contour enhancement and color balance adjustment, card reader 35 for reading data in IC card 40, its interface 36, and various interfaces 37 (37a, 37b, 37c, 37d), a hard disk device (HDD) 38, and the like. The NB 39 is a bridge for connecting the CPU 31 and the PCI bus.
If a sound source board is connected to the PCI bus and a sound notification or the like is output using a speaker disposed on the operation panel 22, an electronic sound with a change can be generated.

Next, the relationship between programs when using the authentication module in the service layer 13 from the JSDK application 11a will be described. FIG. 3 is a diagram showing a data flow between programs when the authentication module 14 in the service layer 13 is used from the JSDK application 11a.
In the present embodiment, as shown in the figure, an interface module IFM 12a capable of transmitting and receiving commands and messages is provided between the JSDK application 11a and the authentication module 14. The IFM 12a receives a command for authentication from the JSDK application 11a and delivers it to the authentication module 14, and also delivers an authentication result message from the authentication module 14 to the JSDK application 11a.
By interposing the IFM 12a, various measures can be taken without changing the authentication module 14. Since the main function of the IFM 12a is only an intermediary function for command passing, it is small-scale and therefore easy to modify. Therefore, as will be described later, it is possible to easily realize an authentication process when accessing the image processing multifunction peripheral from an application program in the terminal device. Further, additional functions at the time of authentication (for example, mail transmission to the device manager, logging, buzzer sound output, etc.) can be easily performed by modifying the IFM 12a without directly modifying the authentication module 14 itself. .
The IFMs 12a and 12c are in the same layer as the application interface (VAS12), and the image processing multifunction peripheral according to the present embodiment has both the VAS 12 and the IFM 12 as program interfaces for the service layer 13. Note that the VAS 12 is a basic part of an API (Application Program Interface), and corrections to the VAS 12 are usually made by a software supplier and cannot be corrected by a general software developer. .

FIG. 4 is a diagram for explaining data exchange between programs. In the present embodiment, the domain socket of the OS 16 is used for communication between the JSDK application 11a and the interface module 12a. This domain socket is a kind of socket that is a mechanism for two programs to exchange data, and exchanges data via a file on the file system of the OS 16. Note that the file name of the file in which the data to be transferred is recorded is described in a command to be transferred between programs.
With this configuration, the JSDK application 11a can freely customize the authentication parameter in the JSDK application 11a when passing the authentication parameter to the interface module IFM 12a. For example, as shown in FIG. 5, the image processing multifunction peripheral 1 acquires user information from the IC card 40, authenticates with the authentication server 6 using the user information, and uses the authentication parameters acquired from the authentication server 6. Ask the IFM 12a for authentication. At first glance, since the authentication is completed in the authentication server 6, it seems that there is no need to perform the authentication process once again in the image processing multifunction peripheral 1. However, it is not necessary to put a password in the IC card 40, and the password only needs to be acquired from the authentication server 6, so that safety for security is improved.

Next, an authentication process sequence of the JSDK application 11a and the authentication module 14 via the interface module IFM 12a in the login process will be described. The same applies to the login process from the application program 11 written in a non-Java language.
FIG. 6 is a sequence diagram illustrating an authentication process of the JSDK application 11a, the IFM 12a, and the authentication module 14 in the login process. This sequence diagram shows the processing of other related programs centered on the processing of the IFM 12a in association with time series, and when a plurality of programs move in synchronization, it is easier to understand than creating a flowchart individually. Hereinafter, the process will be described with reference to FIG.
(1) One JSDK application 11a transmits a login request command to the IFM 12a. At this time, the JSDK application 11a does not accept any input except for the part related to the processing of this sequence.
(2) Thereby, the IFM 12 a transmits the login request command to the authentication module 14.

(3) The authentication module 14 transmits a parameter request command to the IFM 12a to request a parameter for authentication.
(4) Thereby, the IFM 12a transmits the parameter request command to the JSDK application 11a.
(5) The JSDK application 11a acquires a user ID, a password, and the like as parameters from the inserted IC card 40 or an external authentication server, and transmits the parameters to the IFM 12a.
(6) Thereby, the IFM 12a transmits the parameter to the authentication module 14.

(7) The authentication module 14 performs authentication using the received parameters.
(8) As a result, if the authentication is successful, the authentication module 14 transmits a login success message to the IFM 12a. On the other hand, if the authentication fails, the authentication module 14 transmits a login failure message to the IFM 12a.
(9) Thereby, the IFM 12a transmits a login success or login failure message to the JSDK application 11a.

  When the authentication is successful by login, the user uses the desired application program 11 to execute printing of a document, for example, and logs out when printing is completed. Note that the difference between the command and the message used in the above description is only distinguished by human convenience, and is a character string between programs.

Next, a logout processing sequence is shown in FIG. 7, and the processing sequence will be described with reference to FIG.
(11) The JSDK application 11a transmits a logout request command to the interface module IFM 12a.
(12) Thereby, the IFM 12 a transmits the logout request command to the authentication module 14.
(13) If the logout is successful, the authentication module 14 transmits a logout success message to the IFM 12a. If logout fails, a logout failure message is transmitted to the IFM 12a.

(14) The IFM 12a transmits a logout success or logout failure message to the JSDK application 11a.
In the sequence shown in FIGS. 6 and 7, the JSDK application 11a communicates with the IFM 12a via the JSDK platform 17.

(Second Embodiment)
As a communication method between the JSDK application 11a and the IFM 12a, it is also possible to use a TCP / IP socket that is common in a LAN or the Internet, instead of the OS16 domain socket. In this embodiment, an example in which a TCP / IP socket is used between an application program and an interface module will be described.
With this TCP / IP socket, communication is performed by specifying an IP address and a port number in the network. Therefore, as shown in FIG. 8, the application program may be in the external terminal device 2, and in this case, the user of the terminal device 2 can execute the application program 51 in the terminal device 2 in the image processing MFP 1. It is possible to receive user authentication by communicating with the interface module IFM 12c.
Since the terminal device 2 and the image processing multifunction device 1 are connected via a network such as a LAN, the risk of illegal intrusion increases, but the image processing multifunction device 1 is installed away from the image processing multifunction device 1. It can be used and convenience is improved.

  FIG. 9 illustrates an example in which a personal computer (PC) 3 is used as an external terminal device to log in to the image processing multifunction device 1 and perform authentication after being authenticated by the authentication module 14 in the image processing multifunction device 1. FIG. The operation flow of this example will be described with reference to FIG. Note that the sequence when the IFM 12c and the authentication module 14 in the image processing multifunction device 1 transmit and receive commands is basically the same as the sequence shown in FIGS.

(21) The application program in the PC 3 communicates with the interface module 12c by TCP / IP, is authenticated by the authentication module 14, and logs in to the image processing MFP 1 (for details, refer to the sequence shown in FIG. Basically the same).
(22) After login, the application program in the PC 3 causes the image processing MFP 1 to execute printing via the driver in the PC 3.
(23) After printing, the application program in the PC 3 communicates with the authentication module 14 by communicating with the interface module 12c using TCP / IP, and logs out of the image processing MFP 1 (details are shown in FIG. 7). Basically the same as the sequence).

In this way, even if the print driver in the PC 3 does not have a function of communicating with the image processing multifunction device 1 and receiving authentication, printing can be performed with the use permission of the image processing multifunction device 1 from the PC 3. It becomes possible. Further, at that time, it is possible to cope with only the modification of the interface module (IFM) without modifying the authentication module itself.
When the above-described communication between the JSDK application 11a and the IFM 12a in the image processing multifunction device is performed using a domain socket, the JSDK application 11a for communication with the IFM 12a can be easily modified, and the communication path can be determined by image processing. Since it is limited to the file system of the multifunction device, high security can be maintained.

(Third embodiment)
The third embodiment is an example in which the management PC 3a, which is an external terminal device, manages function restrictions of a plurality of image processing apparatuses.
In the third embodiment, as in the second embodiment, login is performed using the authentication module 14 in each image processing apparatus. After logging in, the PC 3a can perform function restrictions on a plurality of image processing apparatuses from a remote location.
FIG. 10 is a diagram illustrating an example of a system configuration according to the third embodiment. The management PC 3a can log in to the image processing multifunction peripherals 1 (1a, 1c) and the printer 5 connected to the same LAN via the IFM 12c. The authentication module 14 authenticates whether the login is by the device administrator, and permits the login if the authentication is successful. Thereafter, for example, an administrator menu of the IFM 12c is displayed, and a command from the apparatus administrator is executed.
As an example of the operation, for the copying machine 1a, a predetermined time zone is set to an unusable state, and other time zones are set to an available state. Suppose that is disabled. If the authentication function is turned on / off by specifying the time zone in the IFM 12c of each image processing apparatus, the image is displayed while the authentication function is turned off without any change to the authentication module 14. Usage restrictions can be applied to the processing multifunction peripherals 1 (1a, 1c) and the printer 5.
As described above, according to the present embodiment, the function of arbitrarily setting and managing the operation state of each image processing apparatus can be realized by modifying the interface module.

(Fourth embodiment)
FIG. 11 is a diagram illustrating an example of a system configuration according to the fourth embodiment of the present invention. Here, the authentication module 14 of the image processing multifunction device 1 is used with the mobile device 4 (for example, a mobile phone or PDA) having a TCP / IP socket communication function as an external terminal device. As a result, if an application program for authentication is installed in the mobile device 4 that is usually carried around, such as a mobile phone or a PDA, the authentication processing is performed from the mobile device 4 as in the second embodiment, and the image processing composite The functions of the machine 1 can be used to perform print output and image data acquisition.

  As described above, the provision of the interface modules IFM 12a and IFM 12c makes it possible to easily modify or add an additional function related to the authentication function, thereby enabling effective use of the image processing apparatus.

Confidentiality can be ensured by encrypting data transferred to the interface module. In this case, the IFM 12a and IFM 12c may perform encryption / decryption before transmission / reception of commands.
The IFM 12a and IFM 12c are authentication sequences (for example, login / logout time, user information such as user ID and affiliation, socket information, socket communication, socket communication method of TCP / IP) in the sequence shown in FIGS. If there is, it is better to record the IP address etc. in the log file as log information. Further, the log information may be notified to the administrator of the image processing apparatus by e-mail. As a result, the device manager can grasp the usage status for each user.

Further, the IFM 12a and the IFM 12c may be modified so that a beep sound or an electronic sound is generated when login fails or when various commands fail. Accordingly, it is possible to notify the surroundings that a function requiring authentication has been in a restriction release state and a restriction state.
The reason why various additional functions can be provided in this way is that, in each embodiment, an interface module is provided separately from the authentication module 14, and this interface module can be easily modified.

FIG. 2 is a block diagram illustrating a software configuration of main parts of the image processing multifunction peripheral according to the first embodiment of the present invention. 1 is a block diagram illustrating a hardware configuration of a main part of an image processing multifunction peripheral according to a first embodiment of the present invention. It is a figure which shows the data flow between programs at the time of using the authentication module 14 in the service layer 13 from the JSDK application 11a. FIG. 3 is a diagram illustrating data exchange between programs of the image processing multifunction peripheral according to the first embodiment of the present invention. It is a figure explaining the example of the authentication process in the image processing multifunction peripheral concerning the 1st Embodiment of this invention. It is a sequence diagram which shows the authentication process of the JSDK application 11a, IFM12a, and the authentication module 14 in the login process of the image processing multifunction peripheral concerning the 1st Embodiment of this invention. It is a sequence diagram which shows the authentication process of the JSDK application 11a, IFM12a, and the authentication module 14 in the logout process of the image processing multifunction peripheral concerning the 1st Embodiment of this invention. It is explanatory drawing which shows the data flow between the image processing multifunction peripheral concerning the 2nd Embodiment of this invention, and a terminal device. FIG. 10 is a diagram illustrating an example in which printing is performed after being authenticated by an authentication module in an image processing multifunction peripheral according to a second embodiment of the present invention. It is a figure explaining the example of the system configuration | structure concerning the 3rd Embodiment of this invention. It is a figure explaining the example of the system configuration | structure concerning the 4th Embodiment of this invention.

Explanation of symbols

1 Image processing multifunction device 2 Terminal device 3 Personal computer (PC)
4 Mobile device 5 Printer 6 Authentication server 11, 51 Application program 12a, 12c Interface module (IFM)
14 Authentication Module (CCS)
15 User Directory Module (UCS)
16 Operating system (OS)
21 Control Unit 22 Operation Panel 23 Image Reading Unit 24 Printing Unit 40 IC Card

Claims (10)

  In an image processing apparatus provided with an authentication module that authenticates a user by comparing a user ID and password input from an application program with stored user information, mediating data transfer between the application program and the authentication module An image processing apparatus comprising: an interface module configured to perform authentication processing through communication between the application program and the authentication module via the interface module.   2. The communication between the application program and the interface module is performed using a TCP / IP socket, and the application program is an application program of a terminal device connected via a network. The image processing apparatus described.   The image processing apparatus according to claim 2, wherein communication between the application program and the interface module is encrypted.   The image processing apparatus according to claim 1, wherein communication between the authentication module and the interface module is performed using a domain socket.   The image processing apparatus according to claim 1, wherein the interface module stops the authentication process during a set time period.   5. The image processing apparatus according to claim 1, wherein the interface module transmits authentication information by e-mail when the authentication process is completed. 6.   The image processing apparatus according to claim 1, wherein the interface module writes a log of authentication information to a file when the authentication process is completed.   8. The image processing apparatus according to claim 6, wherein the authentication information includes login or logout time, user information, and used socket information.   The image processing apparatus according to claim 1, wherein the interface module emits a sound at a predetermined event during the authentication process.   The program for functioning as an image processing apparatus of any one of Claims 1 thru | or 9.

Images