JP2013097653A - Information processing device, authentication system and authentication program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information processing device, an authentication system and an authentication program which can reduce labor of information management used for apparatus use authentication.SOLUTION: An authentication server 100 which requests use authentication by transmitting authentication device information acquired from a connected authentication device 214b, and is connected to an electronic apparatus 200 for controlling use of functions on the basis of an authentication result replied from a transmission destination comprises communication means 13 which performs communication with the electronic apparatus 200 and authentication means 14 which performs the use authentication of the electronic apparatus 200. The communication means 13 receives the authentication device information from the electronic apparatus 200 and accepts a use authentication request. The authentication means 14 determines use authority applied to the electronic apparatus 200 on the basis of the authentication device information received by the communication means 13. The communication means 13 transmits the authentication result including the user authority determined by the authentication means 14 to the electronic apparatus 200 and replies to the accepted use authentication request.

Description

  The present invention relates to a technique for performing use authentication of an electronic device.

  For example, Patent Document 1 discloses a technique in which an authentication server performs user authentication using user information stored in a card and device information of an image processing apparatus. With such a technique, the function use is controlled in the image processing apparatus.

However, in the conventional method, the management work of information used for usage authentication is complicated.
For example, when it is desired to apply different usage rights for each image processing device to the same user, it is necessary to manage the user, the image processing device, and the usage rights to be applied in association with each other, and the work is complicated. . Also, as disclosed in Patent Document 1, when managing a user and an image processing apparatus in association with each other, if the device configuration is changed due to new introduction, replacement, or removal, the user and the image It is necessary to relink the processing apparatus, and the work is complicated. Thus, in use authentication using device information, it takes time to manage the information used.

  The present invention has been proposed in view of the above-described problems of the prior art, and it is an object of the present invention to provide an information processing apparatus, an authentication system, and an authentication program that can reduce the trouble of information management used for device use authentication.

  In order to achieve the above object, the information processing apparatus according to the present invention requests use authentication by transmitting authentication device information acquired from an authentication device connected to the own device, and obtains an authentication result returned from the transmission destination. Based on an electronic device that controls the use of a function, an information processing apparatus connected by a predetermined data transmission path, a communication unit that communicates with the electronic device, an authentication unit that performs usage authentication of the electronic device, The communication means receives the authentication device information from the electronic device and accepts a use authentication request, and the authentication means is applied to the electronic device based on the authentication device information received by the communication means. The communication means transmits an authentication result including the use authority determined by the authentication means to the electronic device and responds to the accepted use authentication request. And features.

  ADVANTAGE OF THE INVENTION According to this invention, the information processing apparatus, authentication system, and authentication program which can reduce the effort of the information management used for apparatus utilization authentication can be provided.

It is a figure which shows the structural example of the authentication system which concerns on the 1st Embodiment of this invention. It is a figure which shows the hardware structural example of the authentication server which concerns on the 1st Embodiment of this invention. It is a figure which shows the hardware structural example of the image processing apparatus which concerns on the 1st Embodiment of this invention. It is a figure which shows the structural example of the authentication function which concerns on the 1st Embodiment of this invention. It is a figure which shows the example of data of the device management information which concerns on the 1st Embodiment of this invention. It is a flowchart which shows the process sequence example of the authentication which concerns on the 1st Embodiment of this invention. It is a figure which shows the example of data of the device management information which concerns on the modification of this invention. It is a flowchart which shows the process sequence example (the 1) in the authentication server which concerns on the modification of this invention. It is a figure which shows the data transition example (the 1) of the device management information which concerns on the modification of this invention. It is a figure which shows the data transition example (the 2) of the device management information which concerns on the modification of this invention. It is a figure which shows the data transition example (the 3) of the device management information which concerns on the modification of this invention. It is a flowchart which shows the process sequence example (the 2) in the authentication server which concerns on the modification of this invention. It is a figure which shows the data transition example (the 4) of the device management information which concerns on the modification of this invention. It is a figure which shows the data transition example (the 5) of the device management information which concerns on the modification of this invention. It is a figure which shows the data transition example (the 6) of the device management information which concerns on the modification of this invention. It is a figure which shows the structural example of the authentication function which concerns on the 2nd Embodiment of this invention. It is a figure which shows the example of data of the user management information which concerns on the 2nd Embodiment of this invention. It is a figure which shows the example of a screen of the control setting which concerns on the 2nd Embodiment of this invention. It is a flowchart which shows the example of a process sequence in the authentication server which concerns on the 2nd Embodiment of this invention. It is a flowchart which shows the example of an application right application processing procedure which concerns on the 2nd Embodiment of this invention. It is a figure which shows the structural example (the 1) of the authentication function which concerns on the modification of this invention. It is a figure which shows the structural example (the 2) of the authentication function which concerns on the modification of this invention.

  DESCRIPTION OF EMBODIMENTS Hereinafter, preferred embodiments of the present invention (hereinafter referred to as “embodiments”) will be described in detail with reference to the drawings.

[First Embodiment]
<System configuration>
FIG. 1 is a diagram illustrating a configuration example of an authentication system 1 according to the present embodiment.
In FIG. 1, one or a plurality of image processing apparatuses 200 ₁ to 200 _n (hereinafter collectively referred to as “image processing apparatus 200”) and an authentication server 100 are connected to a predetermined data transmission path N (for example, “LAN: Local Area Network”). )) Is shown as an example of a system configuration.

  The image processing apparatus 200 is an electronic device having an image processing function including printing, and is a printer, an MFP (Multifunction Peripheral), or the like. The authentication server 100 is an information processing apparatus having an authentication function that manages the use authority of the functions of the image processing apparatus 200 and performs the use authentication of the image processing apparatus 200.

  Upon receiving a usage authentication instruction from a user via an authentication device connected to the image processing apparatus 200, the image processing apparatus 200 transmits authentication information including the authentication device information to the authentication server 100 and requests usage authentication. . In response to this, the authentication server 100 performs use authentication of the image processing apparatus 200 based on the received authentication information, and responds with the use authority of the function of the image processing apparatus 200 as an authentication result. As a result, the image processing apparatus 200 controls the function use (permission / non-permission) of the function of the own apparatus according to the responded use authority, and displays an operation screen based on the control result.

  As described above, the authentication system 1 according to the present embodiment can provide an authentication service that performs use authentication of the image processing apparatus 200.

<Hardware configuration>
《Authentication server》
FIG. 2 is a diagram illustrating a hardware configuration example of the authentication server 100 according to the present embodiment.
As shown in FIG. 2, the authentication server 100 includes an input device 101, a display device 102, an external I / F 103, a RAM (Random Access Memory) 104, a ROM (Read Only Memory) 105, a CPU (Central Processing Unit) 106, a communication. An I / F 107, an HDD (Hard Disk Drive) 108, and the like are provided and are connected to each other via a bus B.

  The input device 101 includes a keyboard and a mouse, and is used to input each operation signal to the authentication server 100. The display device 102 includes a display and the like, and displays a processing result by the authentication server 100.

  The communication I / F 107 is an interface that connects the authentication server 100 to a network. As a result, the authentication server 100 can perform data communication with another device (image processing apparatus) via the communication I / F 107.

  The HDD 108 is a non-volatile storage device that stores programs and data. The stored programs and data include an OS (Operating System) that is basic software for controlling the entire apparatus, and application software that provides various functions on the OS. The HDD 108 manages stored programs and data by a predetermined file system and / or DB (Data Base).

  The external I / F 103 is an interface with an external device. The external device includes a recording medium 103a. Thereby, the authentication server 100 can read and / or write to the recording medium 103a via the external I / F 103. The recording medium 103a includes a floppy (trademark or registered trademark) disk, a CD (Compact Disk), a DVD (Digital Versatile Disk), an SD memory card, a USB memory (Universal Serial Bus memory), and the like. is there.

  The ROM 105 is a nonvolatile semiconductor memory (storage device) that can retain internal data even when the power is turned off. The ROM 105 stores programs and data such as BIOS (Basic Input / Output System), OS settings, and network settings that are executed when the authentication server 100 is activated. The RAM 104 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The CPU 106 is an arithmetic device that realizes control and mounting functions of the entire apparatus by reading programs and data from the storage device (for example, “HDD” and “ROM”) onto the RAM and executing processing.

  As described above, the authentication server 100 according to the present embodiment can provide various information processing services including device usage authentication by the above hardware configuration.

<Image processing device>
FIG. 3 is a diagram illustrating a hardware configuration example of the image processing apparatus 200 according to the present embodiment.
As shown in FIG. 3, the image processing apparatus 200 includes a controller 210, an operation panel 220, a plotter 230, a scanner 240, and the like, which are connected to each other via a bus B.

  The operation panel 220 includes a display unit and an input unit, and provides various types of information such as device information to the user and accepts various user operations such as operation settings and operation instructions. The plotter 230 includes an image forming unit and forms an output image on a sheet. Examples of a method for forming an output image include an electrophotographic process and an ink jet method. The scanner 240 optically reads a document and generates a read image.

  The controller 210 includes a CPU 211, a storage device 212, a communication I / F 213, an external I / F 214, and the like, which are connected to each other via a bus B.

  The CPU 211, the communication I / F 213, and the external I / F 214 are the same as the CPU 106, the communication I / F 107, and the external I / F 103 provided in the authentication server 100. The storage device 212 stores and holds programs and various data (for example, “image data”). The storage device 212 includes a RAM 104, a ROM 105, an HDD 108, and the like.

  As described above, the image processing apparatus 200 according to the present embodiment can provide an image processing service including printing with the above hardware configuration.

  Note that the image processing apparatus 200 according to the present embodiment can read the authentication device 214b via the external I / F 214. The authentication device 214b includes an apparatus that can read an electronic recording medium (for example, an “IC card (Integrated Circuit card)”) that holds information (authentication information) in a predetermined storage area in a contact / non-contact manner. Therefore, the image processing apparatus 200 according to the present embodiment can acquire information necessary for device usage authentication.

<Authentication function>
An authentication function according to the present embodiment will be described.
In the authentication system 1 according to the present embodiment, the image processing apparatus 200 acquires authentication device information from the authentication device 214b connected (detected connection) to the image processing apparatus 200, and transmits the acquired authentication device information to the authentication server 100. , Request usage authentication. Based on the received authentication device information, the authentication server 100 acquires use authority information of the image processing apparatus 200 managed in association with the authentication device information. The authentication server 100 determines the usage authority to be applied to the image processing apparatus 200 based on the acquired usage authority information. The authentication server 100 transmits an authentication result including the determined use authority and responds to the use authentication request. The image processing apparatus 200 controls the function usage according to the usage authority included in the received authentication result. The authentication system 1 according to the present embodiment has such an authentication function.

  Conventionally, in the use authentication using device information of the image processing apparatus 200, for example, when it is desired to control the use authority for each device or when the device configuration is changed, management of information used for use authentication is complicated. .

  Therefore, the authentication server 100 according to the present embodiment has a mechanism for managing the authentication authority 214b connected to the image processing apparatus 200 and the right to use the functions of the image processing apparatus 200 in association with each other.

  Accordingly, the authentication system 1 according to the present embodiment provides an environment in which use authentication of the image processing apparatus 200 can be performed using information that does not depend on the image processing apparatus 200. As a result, in the authentication system 1 according to the present embodiment, it is possible to reduce the labor of information management used for device usage authentication.

The configuration and operation of the authentication function according to this embodiment will be described below.
FIG. 4 is a diagram illustrating a configuration example of the authentication function according to the present embodiment.
As shown in FIG. 4, the authentication function according to the present embodiment includes a UI (User Interface) control unit 11, an information management unit 12, a device communication unit 13, an authentication unit 14, an authentication device communication unit 21, and an authentication server communication unit 22. And a UI control unit 23.

  The UI control unit 11, the information management unit 12, the device communication unit 13, and the authentication unit 14 are functional units included in the authentication server 100. The authentication device communication unit 21, the authentication server communication unit 22, and the UI control unit 23 are functional units included in the image processing apparatus 200.

  As described above, the authentication function according to the present embodiment is realized by the cooperative operation of the functional units included in each device.

<Image processing device>
The authentication device communication unit 21 is a functional unit that communicates with the authentication device 214b. The authentication device communication unit 21 detects the authentication device 214b connected to the image processing apparatus 200 via the external I / F 214. When the authentication device communication unit 21 receives an instruction for use authentication from the user via the detected authentication device 214b (when an authentication IC card is read), the authentication device communication unit 21 reads the authentication device information (authentication device identifier) from the authentication device 214b. Specific information).

  The authentication server communication unit 22 is a functional unit that communicates with the authentication server 100. The authentication server communication unit 22 communicates with the authentication server 100 via the communication I / F 213. The authentication server communication unit 22 transmits authentication information including the authentication device information acquired by the authentication device communication unit 21 to the authentication server 100 and requests usage authentication. As a result, the authentication server communication unit 22 receives the authentication result returned from the authentication server 100. Specifically, when the authentication server 100 authenticates the function use, it receives a use right (use right value indicating permission / non-permission of function use) applied to the image processing apparatus 200. On the other hand, if the authentication server 100 does not authenticate the function use, an error notification indicating that the authentication has not been received is received.

  The UI control unit 23 is a functional unit that controls a UI including an operation screen. Based on the authentication result received by the authentication server communication unit 22, the UI control unit 23 controls use / non-permission of the function of the own device, and displays an operation screen based on the control result. Specifically, according to the usage authority received from the authentication server 100, the GUI (Graphical UI) of the usage permission function is displayed, and the GUI of the usage non-permission function (use prohibition function) is hidden. Further, based on the error notification received from the authentication server 100, the error content (authentication error) is displayed.

  As described above, the image processing apparatus 200 controls the use of the function of the image processing apparatus 200 according to the use authority included in the authentication result returned from the authentication server 100 in response to the use authentication request.

《Authentication server》
The UI control unit 11 is a functional unit that controls a UI including an operation screen. The UI control unit 11 displays, as an operation screen, a GUI that accepts an input value that associates an authentication device 214b connected to the image processing apparatus 200 and a function use authority of the image processing apparatus 200.

  The information management unit 12 is a functional unit that manages the authentication authority 214b connected to the image processing apparatus 200 and the authority to use the functions of the image processing apparatus 200 in association with each other. The information management unit 12 accesses the device management information holding unit 90 by a predetermined data operation, and manages device management information in which the authentication device 214b is associated with the usage authority. The device management information holding unit 90 corresponds to a predetermined storage area of a storage device provided in the authentication server 100.

Here, device management information will be described.
FIG. 5 is a diagram illustrating a data example of the device management information 90D according to the present embodiment.
As illustrated in FIG. 5, the device management information 90D includes one or a plurality of information sets in which information items such as authentication device identification and use authority are associated with each other, and the information sets are managed in units of authentication devices.

  The [authentication device identification] item is an item that holds authentication device identification information for identifying the authentication device 214b connected to the image processing apparatus 200. The item value includes an identifier (authentication) uniquely assigned to the authentication device 214b. Device ID). The “use authority” item is an item for holding use authority information in which the use authority of the function of the image processing apparatus 200 is set, and the item value includes a use authority value (use permission / non-permission for each function). Permission: “○” / Disapproval: “×”).

  Returning to the description of FIG. The information management unit 12 sets and registers each information item value of the device management information 90D as follows. When the information management unit 12 receives a setting / registration instruction from the UI control unit 11, the information management unit 12 accesses the device management information holding unit 90 and uses the input value received at the time of the setting / registration instruction as a corresponding information item of the referenced device management information 90D. Set / register value. Specifically, the input value corresponding to the authentication device 214b is set and registered in the [authentication device identification] item value. Also, an input value corresponding to the use right of the function of the image processing apparatus 200 is set and registered in the [use right] item value.

  The information management unit 12 updates each information item value of the device management information 90D as follows. Upon receiving an update instruction from the UI control unit 11, the information management unit 12 accesses the device management information holding unit 90 and updates the corresponding information item value of the referenced device management information 90D with the input value received at the time of the update instruction. . Specifically, the [authentication device identification] item value is updated with an input value corresponding to the authentication device 214b. In addition, the [use authority] item value is updated with an input value corresponding to the use authority of the function of the image processing apparatus 200.

  As described above, the authentication server 100 includes the authentication device 214b and the image processing apparatus 200 that are connected to the image processing apparatus 200, which is a target device for use authentication, by an administrator or the like based on the operation policy of the authentication system 1. The function use authority is set in advance in association with each other.

  The device communication unit 13 is a functional unit that communicates with the image processing apparatus 200. The device communication unit 13 communicates with the image processing apparatus 200 via the communication I / F 107. When the device communication unit 13 receives authentication information including authentication device information from the image processing apparatus 200 (authentication server communication unit) and receives a request for use authentication, the device communication unit 13 instructs the authentication unit 14 described later to execute use authentication. At this time, the device communication unit 13 passes the authentication information including the received authentication device information to the authentication unit 14. As a result, the device communication unit 13 transmits the authentication result received from the authentication unit 14 described later to the image processing apparatus 200 (authentication server communication unit). Specifically, when the authentication unit 14 authenticates the function use, the use authority applied to the image processing apparatus 200 is received and transmitted. On the other hand, if the authentication unit 14 has not authenticated the function use, it receives and transmits an error content indicating that the function has not been authenticated.

  The authentication unit 14 is a functional unit that performs use authentication of the image processing apparatus 200. Upon receiving the usage authentication execution instruction from the device communication unit 13, the authentication unit 14 accesses the device management information holding unit 90, refers to the device management information 90D based on the authentication information including the received authentication device information, Use authentication of the function of the processing apparatus 200 is performed. Based on the authentication device identification information of the received authentication device information, the authentication unit 14 specifies the corresponding information set of the referenced device management information 90D. The authentication unit 14 determines the usage authority to be applied to the image processing apparatus 200 based on the usage authority information of the specified information set. Specifically, the authentication unit 14 determines a function that permits use / a function that does not permit use of the functions of the image processing apparatus 200. Based on the determination result, the authentication unit 14 generates an authentication result including the usage authority to be applied, passes the generated authentication result to the device communication unit 13, and instructs a response to the usage authentication request source.

  At this time, the authentication unit 14 authenticates function use and permits / denies function use when one or more use permission values are set in the [use right] item value of the specified information set. Generate an authentication result including the usage authority value that controls. On the other hand, the authentication unit 14 does not authenticate the use of the function and includes an error value indicating the error content when the use disapproval value is set in all the [use authority] item values of the specified information set. Generate results. Further, the authentication unit 14 does not authenticate the function use even when the corresponding information set of the referenced device management information 90D cannot be specified based on the authentication device identification information of the received authentication device information.

  As described above, the authentication server 100 responds to the use authentication request from the image processing apparatus 200 with an authentication result including a use authority value that controls permission / denial of function use.

  As described above, the authentication function according to the present embodiment is realized by the above-described functional units operating in cooperation. Note that each of the functional units described above includes a program (software that implements an authentication function) installed (installed) in each device that constitutes the system 1 and a storage device (“HDD” or “ROM”) by an arithmetic device (CPU). ) To the memory (RAM), and the following processing is executed in each device.

  Detailed operation of the authentication function according to the present embodiment (cooperation operation of the functional unit group) will be described with reference to a flowchart showing a processing procedure.

  FIG. 6 is a flowchart illustrating an example of an authentication processing procedure according to the present embodiment. (A) shows processing executed by the image processing apparatus 200, and (B) shows processing executed by the authentication server 100.

<Main processing of image processing device>
As shown in FIG. 6A, in the image processing apparatus 200, when the authentication device communication unit 21 receives a usage authentication instruction from a user via the authentication device 214b connected to the image processing apparatus 200 ( (Step S101: YES), authentication device information including authentication device identification information is acquired from the authentication device 214b (step S102).

  In response to the acquisition of the authentication device information, the image processing apparatus 200 causes the authentication server communication unit 22 to send authentication information including the authentication device information acquired by the authentication device communication unit 21 to the authentication server 100 via the communication I / F 213. Transmit and request for usage authentication (step S103).

  As a result, the image processing apparatus 200 waits until receiving an authentication result including a use authority (a use authority value for controlling permission / non-permission of function use) from the authentication server 100 (step S104: NO).

  When the authentication server communication unit 22 receives the authentication result from the authentication server 100 (step S104: YES), the image processing apparatus 200 passes the received authentication result to the UI control unit 23 and instructs control of the operation screen.

  When the UI control unit 23 receives an operation screen control instruction, the image processing apparatus 200 determines whether or not use authentication has been performed based on the received authentication result (step S105).

  When the UI control unit 23 determines that the use authentication has been made (step S105: YES), the image processing apparatus 200 controls use permission / non-permission of the function of the image processing apparatus according to the use authority received at the time of the control instruction ( Step S106).

  As a result, in the image processing apparatus 200, the UI control unit 23 displays an operation screen based on the control result (updates display content: step S107). At this time, the UI control unit 23 displays the GUI of the use permission function and hides the GUI of the use disapproval function.

  In addition, when the UI control unit 23 determines that the use authentication has not been performed (step S105: NO), the image processing apparatus 200 displays an error content (authentication error).

<Main processing of the authentication server>
As illustrated in FIG. 6B, in the authentication server 100, the device communication unit 13 receives authentication information including authentication device information from the image processing apparatus 200 (authentication server communication unit) via the communication I / F 107. When a request for use authentication is received (step S201: YES), the received authentication information is passed to the authentication unit 14 to instruct execution of use authentication.

  When the authentication unit 14 accepts the usage authentication execution instruction, the authentication server 100 accesses the device management information holding unit 90 (step S202), and based on the authentication device identification information of the authentication device information including the received authentication information. The device management information 90D is referred to (step S203).

  The authentication server 100 determines whether or not the corresponding device management information 90D exists in the referred device management information 90D (a corresponding information set has been identified) (Step S204), and the authentication server 100 determines whether or not the corresponding device management information 90D exists. Use authentication of the function of 200 is performed.

  As a result, when the authentication unit 14 determines that the corresponding device management information 90D exists (step S204: YES), the authentication server 100 determines the image based on the usage authority information of the corresponding device management information 90D (identified information set). For the functions of the processing apparatus 200, a function that permits use / a function that does not permit use is determined (step S205).

  In the authentication server 100, the authentication unit 14 generates an authentication result (an authentication result including the usage authority to be applied) according to the usage authority determined (step S206). At this time, when one or more use permission values are set in the [use authority] item value of the specified information set, the authentication unit 14 authenticates the function use, and permits / disallows the function use. Generate an authentication result including the usage authority value to be controlled.

  For example, when the authentication unit 14 refers to the device management information 90D shown in FIG. 5 based on the authentication device identification information “123” of the authentication device information received from the device communication unit 13, the authentication result is obtained as follows. Generate. The authentication unit 14 authenticates the function use since one or more use authority values “◯” are set in the [use authority] item value of the specified information set. The authentication unit 14 determines the print and copy functions as functions that permit use, and determines the scan and fax functions as functions that do not permit use. Based on the determination result, the authentication unit 14 uses permission values (print: “◯”, copy: “◯”, scan: “×”) for controlling permission / scan of use of the print and copy functions and non-permission of use of the fax function. , Fax: “×”). The authentication unit 14 does not authenticate the use of the function and indicates an error content when the use non-permitted value “×” is set in all the [use authority] item values of the specified information set. Generate authentication result including. The authentication unit 14 passes the authentication result generated in this way to the device communication unit 13 and instructs a response to the use authentication request source.

  When the device communication unit 13 receives the response instruction, the authentication server 100 transmits the received authentication result (use authority value for controlling permission / non-permission of function use) to the image processing apparatus 200 (authentication server communication unit). (Step S207).

  Further, when the authentication unit 14 determines that the corresponding device management information 90D does not exist (step S204: NO), the authentication server 100 performs authentication including an error value indicating that function use has not been authenticated (authentication error). A result is generated, passed to the device communication unit 13, and an error notification to the usage authentication request source is instructed.

  When the device communication unit 13 receives the notification instruction, the authentication server 100 transmits the received authentication result (authentication error) to the image processing apparatus 200 (authentication server communication unit) (step S208).

<Summary>
As described above, according to the authentication system 1 according to the present embodiment, the image processing apparatus 200 acquires the authentication device information from the authentication device 214b connected to the own device (detected connection) by the authentication device communication unit 21. To do. The image processing apparatus 200 transmits the acquired authentication device information to the authentication server 100 by the authentication server communication unit 22 and requests usage authentication.

  In response to this, the authentication server 100 receives the authentication device information by the device communication unit 13, and the image processing apparatus managed by the authentication unit 14 in association with the authentication device information based on the received authentication device information. 200 usage authority information is acquired. The authentication unit 14 determines the usage authority to be applied to the image processing apparatus 200 based on the acquired usage authority information. The authentication server 100 transmits an authentication result including the determined use authority by the device communication unit 13 and responds to the use authentication request.

  As a result, the image processing apparatus 200 receives the authentication result by the authentication server communication unit 22, and controls the function use by the UI control unit 23 according to the use authority included in the authentication result.

  Accordingly, the authentication system 1 according to the present embodiment can provide an environment in which use authentication of the image processing apparatus 200 can be performed using information that does not depend on the image processing apparatus 200. Therefore, even when it is desired to control the usage authority for each device or when the device configuration is changed, it is possible to reduce the labor of information management used for device usage authentication. Specifically, when it is desired to control the usage authority for each device, it is only necessary to connect the authentication device 214b for which the usage authority is set by the authentication server 100 to each image processing apparatus to which the usage authority is applied. Further, when the device configuration is changed, it is only necessary to connect the authentication device 214b to the newly introduced image processing apparatus 200 or the replaced image processing apparatus 200.

[Modification]
For example, in the authentication system 1, there may be a case where it is desired to manage the connection relationship (application relationship of usage authority) between the authentication device 214b and the image processing apparatus 200 in system operation and maintenance work. In such a case, for example, when the connection destination of the authentication device 214b is changed by changing the device configuration, or when a plurality of authentication devices 214b are connected to one device, the administrator handles the connection relationship between the two devices. It is complicated to manage by work.

  Therefore, in this modification, a technique is proposed in which device management information 90D including information related to the image processing apparatus 200 (applicable device for use authority) corresponding to the connection destination of the authentication device 214b is managed to perform use authentication.

  Thereby, in this modification, the connection relationship (application relationship of the use authority) between the authentication device 214b and the image processing apparatus 200 can be automatically managed, and an environment where the use authentication of the image processing apparatus 200 can be performed can be provided. .

  Hereinafter, only matters different from the above-described embodiment will be described, and the same items will be denoted by the same reference numerals, and the description thereof will be omitted.

First, device management information 90D according to this modification will be described.
FIG. 7 is a diagram illustrating a data example of the device management information 90D according to the present modification.
As illustrated in FIG. 7, the device management information 90 </ b> D according to this modification is associated with each information item including the connection destination identification in addition to the authentication device identification and the usage authority.

  The [connection destination identification] item is an item that holds connection destination identification information for identifying the connection destination of the authentication device 214b, and the item value includes an identifier (device ID) of the image processing apparatus 200 corresponding to the connection destination.

  When the device communication unit 13 receives authentication information including authentication device identification information and connection destination identification information from the image processing apparatus 200 (authentication server communication unit) and accepts a request for use authentication, the device communication unit 13 causes the authentication unit 14 to perform use authentication. Instruct execution. At this time, the device communication unit 13 passes the received authentication information including the authentication device identification information and the connection destination identification information to the authentication unit 14.

  Based on the received authentication information, the authentication unit 14 performs use authentication of the function of the image processing apparatus 200 and instructs the information management unit 12 to execute information registration / update / delete / update. At this time, the authentication unit 14 passes the received authentication device information and connection destination identification information to the information management unit 12.

  The information management unit 12 registers / updates / deletes / updates the device management information 90D according to the information registration / update / delete / update instruction, and manages the connection relationship between the authentication device 214b and the image processing apparatus 200. There are mainly two methods for managing the device management information 90D (data operation method). Specifically, based on the authentication device identification information, it manages the connection destination identification information to be associated (connection management method based on the authentication device), and manages the authentication device identification information to be associated based on the connection destination identification information. (Connection relation management method based on the connection destination).

  Below, the cooperation operation | movement of the information management part 12 and the authentication part 14 is demonstrated using the process example performed by the authentication server 100 at the time of use authentication request reception.

<< Main processing of authentication server: Part 1 >>
FIG. 8 is a flowchart illustrating a processing procedure example (part 1) in the authentication server 100 according to the present modification. In this processing, a processing example of a connection relationship management method based on the authentication device 214b is shown.

  As illustrated in FIG. 8, the device communication unit 13 receives authentication information including authentication device identification information and connection destination identification information from the image processing apparatus 200 (authentication server communication unit) via the communication I / F 107 and uses it. When an authentication request is received (step S301: YES), the received authentication information is passed to the authentication unit 14 to instruct execution of usage authentication.

  Upon receiving the usage authentication execution instruction, the authentication unit 14 accesses the device management information holding unit 90 (step S302), and refers to the device management information 90D based on the authentication device identification information including the received authentication information (step S302). Step S303).

  The authentication unit 14 determines whether or not the corresponding device management information 90D exists in the referred device management information 90D (step S304), and performs use authentication of the function of the image processing apparatus 200.

  If the authentication unit 14 determines that the device management information 90D exists (step S304: YES), the connection destination identification information is registered in the device management information 90D in association with the authentication device identification information ( It is determined whether or not a [connection destination identification] item value has a set value) (step S305).

  When the authentication unit 14 determines that the connection destination identification information is not registered in association with the authentication device identification information ([connection destination identification] item value is NULL) (step S305: NO), the authentication unit 14 receives the authentication request. The authentication device identification information and the connection destination identification information are passed to the information management unit 12 and an instruction to execute information registration is given.

  Upon receiving the information registration execution instruction, the information management unit 12 accesses the device management information holding unit 90, refers to the device management information 90D based on the received authentication device identification information, and determines the received connection destination identification information as Registration is performed in association with the authentication device identification information (step S306).

A specific data operation performed at this time will be described with reference to FIG.
FIG. 9 is a diagram showing a data transition example (part 1) of the device management information 90D according to the present modification. FIG. 9 shows an example in which the information management unit 12 receives authentication device identification information “456” and connection destination identification information “MFP-X” from the authentication unit 14 at the time of information registration instruction.

  First, as shown in FIG. 9A, the information management unit 12 specifies the corresponding information set R of the referenced device management information 90D based on the received authentication device identification information “456”. Next, as shown in FIG. 9B, the information management unit 12 registers the value “MFP-X” of the received connection destination identification information in the [connection destination identification] item value of the specified information set R. .

  Thus, in this modification, the connection relationship when the registered authentication device 214b is connected to the newly introduced image processing apparatus 200 is automatically registered.

  Returning to the description of FIG. When the authentication unit 14 accepts the information registration completion from the information management unit 12, the authentication unit 14 gives the function / usage to permit the use to the function of the image processing apparatus 200 based on the use authority information of the corresponding device management information 90D. A function that is not permitted is determined (step S307).

  The authentication unit 14 generates an authentication result according to the determined use authority (step S308), passes the generated authentication result to the device communication unit 13, and instructs a response to the use authentication request source.

  When the device communication unit 13 receives the response instruction, the authentication server 100 transmits the received authentication result to the image processing apparatus 200 (authentication server communication unit) (step S309).

  If the authentication unit 14 determines that the corresponding device management information 90D does not exist (step S304: NO), the authentication unit 14 generates an authentication result indicating that the function use has not been authenticated, and passes the result to the device communication unit 13 for use authentication. Instruct error notification to the request source.

  Upon receiving the notification instruction, the device communication unit 13 transmits the received authentication result (authentication error) to the image processing apparatus 200 (authentication server communication unit) (step S310).

  If the authentication unit 14 determines that the connection destination identification information is registered in association with the authentication device identification information ([connection destination identification] item value is not NULL) (step S305: YES), the corresponding device management It is determined whether or not the registered connection destination identification information matches the received connection destination identification information in the information 90D (step S311).

  If the authentication unit 14 determines that the registered connection destination identification information matches the received connection destination identification information (step S311: YES), the authentication unit 14 proceeds to the process of step S307. That is, the authentication unit 14 does not instruct the information management unit 12 to execute information registration, and generates an authentication result based on the usage authority information of the corresponding device management information 90D.

  If the authentication unit 14 determines that the registered connection destination identification information does not match (mismatch) with the received connection destination identification information (step S311: NO), the received connection destination identification information is included in the device management information 90D. It is determined whether it is registered (step S312).

  If the authentication unit 14 determines that the received connection destination identification information is not registered in the device management information 90D (step S312: NO), the authentication unit 14 manages the authentication device identification information and the connection destination identification information received when the authentication request is received. The information is passed to the unit 12 and an instruction to update information is given.

  Upon receiving the information update execution instruction, the information management unit 12 accesses the device management information holding unit 90, refers to the device management information 90D based on the received authentication device identification information, and uses the received connection destination identification information as The connection destination identification information registered in association with the authentication device identification information is updated (overwritten) (step S313).

A specific data operation performed at this time will be described with reference to FIG.
FIG. 10 is a diagram illustrating a data transition example (part 2) of the device management information 90D according to the present modification. FIG. 10 shows an example in which the information management unit 12 receives authentication device identification information “123” and connection destination identification information “MFP-X” from the authentication unit 14 at the time of an information update instruction.

  First, as shown in FIG. 10A, the information management unit 12 specifies the corresponding information set R of the referenced device management information 90D based on the received authentication device identification information “123”. Next, as shown in FIG. 10 (B), the information management unit 12 sets the [connection destination identification] item value “MFP-A” of the specified information set R to the received connection destination identification information value “MFP- Overwrite with X ".

  As described above, in this modification, the connection relationship when the registered authentication device 214b connected to the device before replacement is connected to the image processing apparatus 200 after device replacement is automatically updated.

  Returning to the description of FIG. Upon receiving the information update completion from the information management unit 12, the authentication unit 14 proceeds to the process of step S307.

  If the authentication unit 14 determines that the received connection destination identification information is registered in the device management information 90D (step S312: YES), the authentication unit 14 uses the authentication device identification information and the connection destination identification information received when the authentication request is received. The information is transferred to the information management unit 12 to instruct execution of information deletion / update.

  Upon receiving the information deletion / update execution instruction, the information management unit 12 accesses the device management information holding unit 90, refers to the device management information 90D based on the received connection destination identification information, and receives the received connection destination identification information. The registered connection destination identification information that coincides with is deleted (step S314).

  When the information deletion is completed, the information management unit 12 proceeds to the process of step S313. That is, the information management unit 12 updates (overwrites) the connection destination identification information registered in association with the authentication device identification information with the received connection destination identification information.

A specific data operation performed at this time will be described with reference to FIG.
FIG. 11 is a diagram illustrating a data transition example (part 3) of the device management information 90D according to the present modification. FIG. 11 shows an example in which the information management unit 12 receives authentication device identification information “234” and connection destination identification information “MFP-B” from the authentication unit 14 at the time of information deletion / update instruction. Yes.

  First, as shown in FIG. 11A, the information management unit 12 specifies the corresponding information set Ra of the referenced device management information 90D based on the received connection destination identification information “MFP-B”. Next, as illustrated in FIG. 11B, the information management unit 12 deletes the “connection destination identification” item value “MFP-B” of the identified information set Ra.

  As shown in FIG. 11A, the information management unit 12 identifies the corresponding information set Rb of the referenced device management information 90D based on the received authentication device identification information “234”. Next, as shown in FIG. 11 (B), the information management unit 12 sets the [connection destination identification] item value “MFP-A” of the specified information set Rb to the value “MFP- Overwrite with B ".

  As described above, in this modification, the connection relationship when the registered authentication device 214b connected to another device is connected to the image processing apparatus 200 after the device replacement is automatically updated.

  Returning to the description of FIG. When the authentication unit 14 receives information deletion / update completion from the information management unit 12, the authentication unit 14 proceeds to the process of step S307.

  As described above, in the connection relationship management method based on the authentication device 214b, the usage authority assigned to the authentication device 214b can be applied to the image processing apparatus 200 after the device configuration change.

<< Main processing of authentication server: Part 2 >>
FIG. 12 is a flowchart illustrating a processing procedure example (part 2) in the authentication server 100 according to the present modification. This processing shows a processing example of a connection relationship management method based on a connection destination (image processing apparatus).

  As illustrated in FIG. 12, the device communication unit 13 receives authentication information including authentication device identification information and connection destination identification information from the image processing apparatus 200 (authentication server communication unit) via the communication I / F 107 and uses it. When an authentication request is received (step S401: YES), the received authentication information is passed to the authentication unit 14 to instruct execution of usage authentication.

  Upon receiving the usage authentication execution instruction, the authentication unit 14 accesses the device management information holding unit 90 (step S402), and refers to the device management information 90D based on the connection destination identification information including the received authentication information (step S402). Step S403).

  The authentication unit 14 determines whether or not the corresponding device management information 90D exists in the referred device management information 90D (step S404), and performs use authentication of the function of the image processing apparatus 200.

  If the authentication unit 14 determines that the corresponding device management information 90D exists (step S404: YES), the authentication device identification information is registered in the corresponding device management information 90D in association with the connection destination identification information ([[ It is determined whether or not there is a setting value in the [authentication device identification] item value (step S405).

  When the authentication unit 14 determines that the authentication device identification information is not registered in association with the connection destination identification information ([authentication device identification] item value is NULL) (step S405: NO), the authentication unit 14 receives the authentication request. The authentication device identification information and the connection destination identification information are passed to the information management unit 12 and an instruction to execute information registration is given.

  Upon receiving the information registration execution instruction, the information management unit 12 accesses the device management information holding unit 90, refers to the device management information 90D based on the received connection destination identification information, and determines the received authentication device identification information as Registration is made in association with the connection destination identification information (step S406).

A specific data operation performed at this time will be described with reference to FIG.
FIG. 13 is a diagram showing a data transition example (part 4) of the device management information 90D according to the present modification. FIG. 13 shows an example in which the information management unit 12 receives authentication device identification information “456” and connection destination identification information “MFP-X” from the authentication unit 14 at the time of information registration instruction.

  First, as shown in FIG. 13A, the information management unit 12 specifies the corresponding information set R of the referenced device management information 90D based on the received connection destination identification information “MFP-X”. Next, as illustrated in FIG. 13B, the information management unit 12 registers the value “456” of the received authentication device identification information in the [authentication device identification] item value of the identified information set R.

  As described above, in this modification, the connection relationship when the new authentication device 214b is connected to the image processing apparatus 200 of the existing device to which the authentication device 214b is not connected is automatically registered.

  Returning to the description of FIG. When the authentication unit 14 accepts the information registration completion from the information management unit 12, the authentication unit 14 gives the function / usage to permit the use to the function of the image processing apparatus 200 based on the use authority information of the corresponding device management information 90 </ b> D. A function that is not permitted is determined (step S407).

  The authentication unit 14 generates an authentication result according to the determined usage authority (step S408), passes the generated authentication result to the device communication unit 13, and instructs a response to the usage authentication request source.

  When the device communication unit 13 receives the response instruction, the authentication server 100 transmits the received authentication result to the image processing apparatus 200 (authentication server communication unit) (step S409).

  If the authentication unit 14 determines that the corresponding device management information 90D does not exist (step S404: NO), the authentication unit 14 generates an authentication result indicating that the function use has not been authenticated, and passes the result to the device communication unit 13 for use authentication. Instruct error notification to the request source.

  Upon receiving the notification instruction, the device communication unit 13 transmits the received authentication result (authentication error) to the image processing apparatus 200 (authentication server communication unit) (step S410).

  If the authentication unit 14 determines that the authentication device identification information is registered in association with the connection destination identification information (the [authentication device identification] item value is not NULL) (step S405: YES), the corresponding device management It is determined whether the registered authentication device identification information in the information 90D matches the received authentication device identification information (step S411).

If the authentication unit 14 determines that the registered authentication device identification information matches the received authentication device identification information (step S411: YES), the authentication unit 14 proceeds to the process of step S407. That is, the authentication unit 14 does not instruct the information management unit 12 to execute information registration, and generates an authentication result based on the usage authority information of the corresponding device management information 90D.
If the authentication unit 14 determines that the registered authentication device identification information does not match the received authentication device identification information (step S411: NO), the received authentication device identification information is registered in the device management information 90D. It is determined whether or not (step S412).

  If the authentication unit 14 determines that the received authentication device identification information is not registered in the device management information 90D (step S412: NO), the authentication unit 14 manages the authentication device identification information and the connection destination identification information received when the authentication request is received. The information is passed to the unit 12 and an instruction to update information is given.

  Upon receiving the information update execution instruction, the information management unit 12 accesses the device management information holding unit 90, refers to the device management information 90D based on the received connection destination identification information, and uses the received authentication device identification information, The authentication device identification information registered in association with the connection destination identification information is updated (overwritten / added) (step S413).

A specific data operation performed at this time will be described with reference to FIG.
FIG. 14 is a diagram showing a data transition example (No. 5) of the device management information 90D according to the present modification. FIG. 14 shows an example in which the information management unit 12 receives authentication device identification information “678” and connection destination identification information “MFP-A” from the authentication unit 14 at the time of an information update instruction.

  First, as shown in FIG. 14A, the information management unit 12 specifies the corresponding information set R of the referenced device management information 90D based on the received connection destination identification information “MFP-A”. Next, as shown in FIG. 14B, the information management unit 12 overwrites the [authentication device identification] item value “123” of the identified information set R with the value “678” of the received authentication device identification information. To do.

  As described above, in this modification, the connection relationship when the new authentication device 214b is connected to the image processing apparatus 200 of the existing device to which the authentication device 214b is already connected is automatically updated.

  Further, as illustrated in FIG. 14C, the information management unit 12 may add the value “678” of the received authentication device identification information to the [authentication device identification] item value of the specified information set R. .

  This is based on the assumption that a plurality of authentication devices 214b are connected to one image processing apparatus 200. Even in such a case, the connection relationship between the plurality of authentication devices 214b and the image processing apparatus 200 is assumed. It is automatically updated.

  Returning to the description of FIG. Upon receiving the information update completion from the information management unit 12, the authentication unit 14 proceeds to the process of step S407.

  If the authentication unit 14 determines that the received authentication device identification information is registered in the device management information 90D (step S412: YES), the authentication unit 14 uses the authentication device identification information and the connection destination identification information received when the authentication request is received. The information is transferred to the information management unit 12 to instruct execution of information deletion / update.

  When the information management unit 12 receives an instruction to execute information deletion / update, the information management unit 12 accesses the device management information holding unit 90, refers to the device management information 90D based on the received authentication device identification information, and receives the received authentication device identification information. The registered authentication device identification information that coincides with is deleted (step S414).

  When the information deletion is completed, the information management unit 12 proceeds to the process of step S413. That is, the information management unit 12 updates (overwrites) the authentication device identification information registered in association with the connection destination identification information with the received authentication device identification information.

A specific data operation performed at this time will be described with reference to FIG.
FIG. 15 is a diagram showing a data transition example (No. 6) of the device management information 90D according to the present modification. FIG. 15 shows an example in which the information management unit 12 receives authentication device identification information “234” and connection destination identification information “MFP-A” from the authentication unit 14 at the time of information deletion / update instruction. Yes.

  First, as shown in FIG. 15A, the information management unit 12 specifies the corresponding information set Ra of the referenced device management information 90D based on the received authentication device identification information “234”. Next, as illustrated in FIG. 15B, the information management unit 12 deletes the [authentication device identification] item value “234” of the identified information set Ra.

  As shown in FIG. 15A, the information management unit 12 identifies the corresponding information set Rb of the referenced device management information 90D based on the received connection destination identification information “MFP-A”. Next, as shown in FIG. 15B, the information management unit 12 overwrites the [authentication device identification] item value “123” of the identified information set Rb with the value “234” of the received authentication device identification information. To do.

  As described above, in this modification, the connection relationship when the registered authentication device 214b is connected to the image processing apparatus 200 of the existing device to which the authentication device 214b is already connected is automatically updated.

  Returning to the description of FIG. Upon receiving the information deletion / update completion from the information management unit 12, the authentication unit 14 proceeds to the process of step S407.

  As described above, in the connection relationship management method based on the connection destination, the usage authority assigned to the image processing apparatus 200 can be applied even when the authentication device 214b is switched.

  In this modification, it is possible to automatically manage the connection relationship (use authority application relationship) between the authentication device 214b and the image processing apparatus 200, and provide an environment in which the use authentication of the image processing apparatus 200 is possible.

[Second Embodiment]
In the above-described embodiment, the configuration has been described in which the use authority of the function of the connection destination image processing apparatus 200 is associated with the authentication device 214b and managed.

  Therefore, in the present embodiment, a technique for performing use authentication of the image processing apparatus 200 based on the use authority associated with the user and the use authority associated with the authentication device 214b is proposed.

  As a result, in this embodiment, at the time of device usage authentication, in addition to the application of usage rights in units of authentication devices, usage rights can be applied in units of user / user affiliation and information used for device usage authentication Management effort can be reduced.

  Hereinafter, only matters different from the above-described embodiment will be described, and the same items will be denoted by the same reference numerals, and the description thereof will be omitted.

<Authentication function>
FIG. 16 is a diagram illustrating a configuration example of the authentication function according to the present embodiment.
As shown in FIG. 16, the authentication function according to the present embodiment includes a user management information holding unit 80 and a control setting value holding unit 70 in addition to the device management information holding unit 90. , 70 is managed by the information management unit 12. Note that the user management information holding unit 80 and the control set value holding unit 70 correspond to a predetermined storage area of a storage device included in the authentication server 100, similarly to the device management information holding unit 90.

  The information management unit 12 manages the user / user affiliation and the use authority of the function of the image processing apparatus 200 in association with each other. The information management unit 12 accesses the user management information holding unit 80 by a predetermined data operation, and manages the user management information in which the user / user affiliation and the usage authority are associated with each other.

Here, the user management information will be described. The user management information is roughly divided into user information and affiliation information.
FIG. 17 is a diagram illustrating a data example of the user management information 80D according to the present embodiment.
As shown in FIG. 17 (A), the user information 80D ₁ of the user management information 80D, the user identification, belonging identification includes one or more information sets each information item is associated, such as use authority The information set is managed for each user.

  The [user identification] item is an item that holds user identification information for identifying a user, and the item value includes an identifier (user ID) uniquely assigned to the user. The [affiliation identification] item is an item that holds affiliation identification information for identifying the affiliation of the user, and the item value includes an identifier (affiliation ID) uniquely assigned to the affiliation. The “use authority” item is an item for holding use authority information in which the use authority of the function of the image processing apparatus 200 is set.

Returning to the description of FIG. Information management unit 12, the respective information item value of the user information 80D _1, set and registered in the following manner. Information management unit 12 accepts the setting and registration instruction from the UI control unit 11, user management and access information holding section 80, setting and registering an input value received at the time of instruction, referenced relevant user information 80D ₁ Set / register information item value. Specifically, an input value corresponding to the user / user's affiliation is set / registered in the [user identification] / [affiliation identification] item value. Also, an input value corresponding to the use right of the function of the image processing apparatus 200 is set and registered in the [use right] item value.

Further, the data management unit 12, the respective information item value of the user information 80D _1, is updated as follows. Information management unit 12 accepts an update instruction from the UI control unit 11 accesses the user management information holding unit 80, an input value received at the time of update instruction, the referenced user information 80D ₁ corresponding information item value Update. Specifically, the [user identification] / [affiliation identification] item value is updated with an input value corresponding to the user / user's affiliation. In addition, the [use authority] item value is updated with an input value corresponding to the use authority of the function of the image processing apparatus 200.

  As described above, in the authentication server 100, an administrator or the like sets in advance the usage authority for the functions of the target user for use authentication and the target device for use authentication based on the operation policy of the authentication system 1 and the like. Keep it.

Further, as shown in FIG. 17 (B), belonging information 80D ₂ of the user management information 80D may include one or more sets of information associated each information item, such affiliation identification and use authority, the information Sets are managed by affiliation unit.

  The [affiliation identification] item is an item that holds affiliation identification information for identifying the affiliation of the user. The “use authority” item is an item for holding use authority information in which the use authority of the function of the image processing apparatus 200 is set.

Returning to the description of FIG. Information management unit 12, the respective information item value of the affiliation information 80D _2, set and registered in the following manner. Information management unit 12 accepts the setting and registration instruction from the UI control unit 11 accesses the user management information holding unit 80, the relevant information of the affiliation information 80D ₂ to the input value received at the time of setting and registration instruction, referred Set / register the item value. Specifically, the input value corresponding to the affiliation is set and registered in the [affiliation identification] item value. Also, an input value corresponding to the use right of the function of the image processing apparatus 200 is set and registered in the [use right] item value.

Further, the data management unit 12, the respective information item value of the affiliation information 80D _2, is updated as follows. Information management unit 12 updates accepts an update instruction from the UI control unit 11 accesses the user management information holding unit 80, an input value received at the time of update instruction, the referenced affiliation information 80D ₂ corresponding information item value To do. Specifically, the [affiliation identification] item value is updated with an input value corresponding to the affiliation. In addition, the [use authority] item value is updated with an input value corresponding to the use authority of the function of the image processing apparatus 200.

  As described above, in the authentication server 100, an administrator or the like sets in advance the usage affiliation target affiliation and the usage authority of the function of the usage authentication target device in association with each other based on the operation policy of the authentication system 1 and the like. Keep it.

  Further, the UI control unit 11 displays a setting screen W as shown in FIG. 18, and an input value for controlling application of each use authority set in the device management information 90D and the user management information 80D at the time of device use authentication. Accept.

FIG. 18 is a diagram illustrating an example of a control setting screen according to the present embodiment.
FIG. 18 shows an example of a screen having a GUI that can set the priority order for applying each usage authority of the authentication device 214b, user, and affiliation, and a GUI that can set the usage authority to be applied when the usage authority overlaps. . Input values of various settings received via the setting screen W are managed by the information management unit 12.

  Returning to the description of FIG. When the UI control unit 11 receives various settings via the setting screen W, the UI control unit 11 passes the input value received at the time of setting reception to the information management unit 12 and instructs execution of information registration.

  When receiving the information registration instruction, the information management unit 12 accesses the control setting value holding unit 70 and holds the received input value as a setting control value.

  When the device communication unit 13 receives authentication information including authentication device information and user-related information from the image processing apparatus 200 (authentication server communication unit) and receives a request for use authentication, the device communication unit 13 executes use authentication in the authentication unit 14. Instruct. At this time, the device communication unit 13 passes the received authentication device identification information and user-related information to the authentication unit 14.

  Upon receiving the authentication instruction, the authentication unit 14 accesses the holding units 90, 80, and 70, acquires device management information 90D, user management information 80D, and control setting values based on the received authentication information. Based on the information / control setting value, the use authentication of the function of the image processing apparatus 200 is performed.

  Hereinafter, the operation of the authentication unit 14 will be described using a processing example executed by the authentication server 100 when a use authentication request is received.

<Main processing of the authentication server>
FIG. 19 is a flowchart illustrating an example of a processing procedure in the authentication server 100 according to the present embodiment.
As illustrated in FIG. 19, the device communication unit 13 receives authentication information including authentication device information and user-related information from the image processing apparatus 200 (authentication server communication unit) via the communication I / F 107, and uses authentication. Is received (step S501: YES), the received authentication information is passed to the authentication unit 14 to instruct execution of usage authentication.

  Upon receiving the usage authentication execution instruction, the authentication unit 14 accesses each of the holding units 90, 80, and 70 (step S502).

  The authentication unit 14 obtains, from the control setting value holding unit 70, a control setting value (application priority setting and application setting for duplication) that controls application of usage authority (step S503).

Authentication unit 14, based on the user identification information of the user-related information included authentication information received, referring to the user information 80D ₁ of the user management information 80D (step S504), the use authority information of a user Obtain (step S505). At this time, the authentication unit 14, based on the user identification information, specifies the corresponding data set of user information 80D ₁ referenced. The authentication unit 14 acquires use authority information of the specified information set.

Authentication unit 14, based on the affiliation identification information of the information set, by referring to affiliation information 80D ₂ of the user management information 80D (step S506), obtains the access authority information belongs (step S507). At this time, the authentication unit 14, based on the affiliation identification information, specifies the corresponding data set of affiliation information 80D ₂ referenced. The authentication unit 14 acquires use authority information of the specified information set.

  The authentication unit 14 refers to the device management information 90D based on the authentication device identification information of the authentication device information including the received authentication information (step S508), and acquires the use authority information of the authentication device 214b (step S509). At this time, the authentication unit 14 specifies the corresponding information set of the referenced device management information 90D based on the authentication device identification information. The authentication unit 14 acquires use authority information of the specified information set.

  The authentication unit 14 applies the set use authority to the function of the image processing apparatus 200 based on the acquired use authority information / control setting value, and determines a function that permits use / a function that does not permit use. (Step S510).

  The authentication unit 14 generates an authentication result according to the determined use authority (step S511), passes the generated authentication result to the device communication unit 13, and instructs a response to the use authentication request source.

  Upon receiving the response instruction, the device communication unit 13 transmits the received authentication result to the image processing apparatus 200 (authentication server communication unit) (step S512).

Below, the detailed process of step S510 is demonstrated.
《Use authority application processing》
FIG. 20 is a flowchart illustrating an example of a usage authority application processing procedure according to the present embodiment.
As illustrated in FIG. 20, the authentication unit 14 uses the authentication device 214b, the user, and each usage authority information (acquired usage authority information) according to the priority order setting to which the usage authority is applied based on the priority control setting value. ) Is specified in descending order of priority (step S601).

  The authentication unit 14 determines whether the usage authority information has been identified according to the priority order (step S602).

  If it is determined that the usage authority information could not be specified (step S602: NO), the authentication unit 14 determines all functions of the image processing apparatus 200 as functions that are not permitted to be used (step S603).

  On the other hand, if the authentication unit 14 determines that the usage authority information has been identified (step S602: YES), whether there are a plurality of identified usage authority information (a plurality of usage authorities with the same priority set). It is determined whether or not (step S604).

  If the authentication unit 14 determines that a plurality of specified use authority information does not exist (step S604: NO), the authentication unit 14 sets the set use authority for the function of the image processing apparatus 200 based on the specified use authority information. A function to be applied and a function that permits use / a function that does not permit use are determined (step S605).

  On the other hand, if the authentication unit 14 determines that there are a plurality of specified use authority information (step S604: YES), the application setting when the use authority is overlapped is “prohibited (not permitted)” based on the control setting value at the time of overlap. It is determined whether or not (step S606).

  If the authentication unit 14 determines that the application setting at the time of overlapping usage authority is “prohibited (non-permitted)” (step S606: YES), the authentication unit 14 uses the usage authority value for each function (based on the plurality of specified usage authority information). “○”: Permitted / “×”: Not permitted) is compared, and at least one function for which “prohibited (not permitted)” is set is determined as a function that does not permit use (step S607).

  On the other hand, if the authentication unit 14 determines that the application setting at the time of overlapping usage rights is “permitted” (step S606: NO), the usage right value for each function (“◯”) is determined based on the plurality of specified usage rights information. “: Permitted /“ × ”: Not permitted) are compared, and at least one function for which“ permitted ”is set is determined to be a function for which use is permitted (step S608).

<Summary>
As described above, according to the authentication system 1 according to the present embodiment, the image processing apparatus 200 acquires the authentication device information from the authentication device 214b connected to the own device (detected connection) by the authentication device communication unit 21. To do. The image processing apparatus 200 uses the authentication server communication unit 22 to transmit the acquired authentication device information and user-related information to the authentication server 100 and request usage authentication.

  In response to this, the authentication server 100 receives the authentication device information and the user related information by the device communication unit 13. The authentication server 100 uses the authentication unit 14 to acquire the use authority information of the image processing apparatus 200 based on the received authentication device information and user-related information. At this time, the authentication unit 14 uses the use authority information of the image processing apparatus 200 managed in association with the authentication device information and the use of the image processing apparatus 200 managed in association with the affiliation of the user / user. Get authority information. The authentication unit 14 determines the usage authority to be applied to the image processing apparatus 200 based on the usage authority information specified according to the control setting for controlling the application of the usage authority from the acquired usage authority information. The authentication server 100 transmits an authentication result including the determined use authority by the device communication unit 13 and responds to the use authentication request.

  As a result, the image processing apparatus 200 receives the authentication result by the authentication server communication unit 22, and controls the function use by the UI control unit 23 according to the use authority included in the authentication result.

  As a result, the authentication system 1 according to the present embodiment can apply the usage authority by the user / user affiliation unit in addition to the usage authority by the authentication device unit at the time of device usage authentication. It is possible to reduce the labor of information management for use authentication.

  Up to this point, the above embodiment has been described. The “authentication function” according to the above embodiment is a code for each processing procedure described using the drawings in a programming language suitable for the operating environment (platform). The computerized program is implemented by an arithmetic device (CPU) included in each device (“authentication server” or “image processing device”) constituting the system 1.

  The program can be stored in a computer-readable recording medium 103a. Thereby, for example, in the case of the authentication server 100, the program can be installed in the authentication server 100 via the external I / F 103. Further, since the authentication server 100 includes the communication I / F 107, the program can be downloaded and installed using an electric communication line. The same applies to the image processing apparatus 200.

[Modification]
The authentication function according to the above embodiment may have the following functional configuration.
21 and 22 are diagrams illustrating configuration examples (parts 1 and 2) of the authentication function according to the present modification.
FIG. 21 shows a configuration example in which the image processing apparatus 200 has a single authentication function. In this case, the image processing apparatus 200 includes an information management unit 12, an authentication unit 14, an authentication device communication unit 21, a UI control unit 23, and a device management information holding unit 90. FIG. 22 shows a configuration example of an authentication function when the user management server 300 (user management information holding unit) and the authentication server 100 (authentication unit) operate in cooperation.

  Thus, even if it is a function structure shown in this modification, there can exist an effect similar to the said embodiment.

  Finally, the present invention is not limited to the requirements shown here, such as combinations of other elements with the shapes and configurations described in the above embodiments. With respect to these points, the present invention can be changed within a range that does not detract from the gist of the present invention, and can be appropriately determined according to the application form.

1 authentication system 11, 23 UI control unit 12 information management unit 13 device communication unit 14 Authentication unit 21 the authentication device communication unit 22 the authentication server communication unit 70 controls setting value holding unit 80 the user management information holding section _{(D 1:} User Information , D ₂ : Affiliation information)
90 Device management information holding unit (D: Device management information)
100 Authentication server (information processing device)
200 Image processing device (electronic equipment)

JP 2008-162171 A

Claims (12)

An electronic device that requests use authentication by transmitting authentication device information acquired from an authentication device connected to the own device and controls the use of functions based on an authentication result returned from the transmission destination, and a predetermined data transmission path An information processing apparatus connected by
Communication means for communicating with the electronic device;
An authentication means for performing use authentication of the electronic device,
The communication means receives the authentication device information from the electronic device, accepts a use authentication request,
The authentication unit determines a usage right to be applied to the electronic device based on the authentication device information received by the communication unit,
The information processing apparatus characterized in that the communication means transmits an authentication result including the use authority determined by the authentication means to the electronic device and responds to the accepted use authentication request. First holding means for holding device management information in which authentication device identification information for identifying the authentication device and use authority information indicating use authority of a function of the electronic device are associated with each other;
The communication means receives the authentication device information including the authentication device identification information from the electronic device,
The authentication unit refers to the device management information, and determines usage authority to be applied to the electronic device based on usage authority information associated with the received authentication device identification information. The information processing apparatus described. The first holding unit holds the device management information associated with the authentication device identification information, connection destination identification information for identifying the electronic device to which the authentication device is connected, and the use authority information.
Performing a data operation of the device management information, and having a management means for managing a connection relationship between the authentication device and the electronic device,
The communication means receives the authentication device identification information and the connection destination identification information from the electronic device,
The authentication means specifies the device management information including authentication device identification information received by the communication means,
The information processing apparatus according to claim 2, wherein the management unit registers the connection destination identification information received by the communication unit in the device management information specified by the authentication unit. The management means includes
When the connection destination identification information different from the connection destination identification information received by the communication means is registered in the device management information specified by the authentication means, the communication means has received the registered connection destination identification information. Update with connection destination identification information,
When connection destination identification information that matches the connection destination identification information received by the communication means is registered in the device management information held by the first holding means, the registered connection destination identification information is deleted, The information processing apparatus according to claim 3, wherein the connection destination identification information received by the communication unit is registered in the device management information specified by the authentication unit. The authentication unit specifies the device management information including connection destination identification information received by the communication unit,
5. The information processing apparatus according to claim 3, wherein the management unit registers the authentication device identification information received by the communication unit in the device management information specified by the authentication unit. The management means includes
When the authentication device identification information different from the authentication device identification information received by the communication unit is registered in the device management information specified by the authentication unit, the communication unit has received the registered authentication device identification information. Update with authentication device identification information,
If authentication device identification information that matches the authentication device identification information received by the communication means is registered in the device management information held by the first holding means, the registered authentication device identification information is deleted, 6. The information processing apparatus according to claim 5, wherein the authentication device identification information received by the communication unit is registered in the device management information specified by the authentication unit.   The management means includes authentication device identification information received by the communication means when authentication device identification information different from the authentication device identification information received by the communication means is registered in the device management information specified by the authentication means. The information processing apparatus according to claim 5, wherein the information processing apparatus is additionally registered. The communication means receives authentication device information and user related information acquired from the authentication device from the electronic device, accepts a use authentication request,
The authentication unit determines a usage right to be applied to the electronic device based on the authentication device information and user-related information received by the communication unit,
The communication means transmits an authentication result including the use authority determined by the authentication means to the electronic device and responds to the accepted use authentication request. The information processing apparatus according to item. First holding means for holding device management information in which authentication device identification information for identifying the authentication device and use authority information indicating use authority of a function of the electronic device are associated with each other;
User identification information for identifying a user / affiliation identification information for identifying a user's affiliation and user management information in which user authority information indicating the authority to use a function of the electronic device is associated with each other. Holding means,
The communication means receives, from the electronic device, the authentication device information including the authentication device identification information and the user related information including the user identification information / affiliation identification information,
The authentication means refers to the device management information, specifies usage authority information associated with the received authentication device identification information, refers to the user management information, and receives the received user identification information / affiliation identification information 9. The usage right information associated with the electronic device is determined, and the usage right to be applied to the electronic device is determined based on the usage right information specified according to a control setting for controlling application of the usage right. The information processing apparatus described in 1.   The said authentication means specifies the usage authority information with high priority according to the said control setting, and determines the usage authority applied to the said electronic device based on the specified usage authority information. Information processing device. An authentication system in which a computer authenticates use of an electronic device,
First communication means for communicating with the computer;
Acquisition means for acquiring authentication device information from an authentication device connected to the own device;
Control means for controlling the use of the function with respect to the function of the own device,
The first communication means transmits the authentication device information acquired by the acquisition means to the computer, requests usage authentication,
The control means controls the use of the function based on the authentication result received by the first communication means; and
The computer,
A second communication means for communicating with the electronic device;
Function as an authentication means for authenticating use of the electronic device,
The second communication means receives the authentication device information from the electronic device and accepts a use authentication request;
The authentication unit determines a usage right to be applied to the electronic device based on the authentication device information received by the second communication unit;
The second communication unit includes a program that transmits to the electronic device an authentication result including the usage authority determined by the authentication unit and executes the response so as to respond to the received usage authentication request. A featured authentication system. An electronic device that requests use authentication by transmitting authentication device information acquired from an authentication device connected to the own device and controls the use of functions based on an authentication result returned from the transmission destination, and a predetermined data transmission path An authentication program for computers connected by
The computer,
Communication means for communicating with the electronic device;
Function as an authentication means for authenticating use of the electronic device,
The communication means receives the authentication device information from the electronic device, accepts a use authentication request,
The authentication unit determines a usage right to be applied to the electronic device based on the authentication device information received by the communication unit,
An authentication program for causing the communication means to transmit an authentication result including the use authority determined by the authentication means to the electronic device and to execute a response to the accepted use authentication request.

Images