JP2008134856A - Authentication system and authentication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system for limiting the available function of an image forming apparatus to a user even when the function restriction information of each user is not written in an intermediate authentication server. <P>SOLUTION: This authentication system is configured by connecting an image forming apparatus 1, a plurality of authentication servers 21 and 22 for performing user authentication based on authentication information and an intermediate authentication server 3 through a network 4. The intermediate authentication server 3 is provided with a registration means 34 for registering an available function of an image forming apparatus set for every authentication server; an instruction means 31 for instructing the execution of authentication to the authentication server; and a transmission means 36 for transmitting the authentication result and information about the available function corresponding to the authentication server which has succeeded in authentication to the image forming apparatus. The image forming apparatus 1 is provided with a control means 11 for controlling the use permission/inhibition of the functions based on the authentication result transmitted from the intermediate authentication server 3 and the information about the available function. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an authentication system and an authentication method for permitting a user to use an image forming apparatus such as an MFP (Multi Function Peripherals) which is a multifunction digital multi-function peripheral.

  As an authentication system for permitting a user to use an image forming apparatus, conventionally, an external authentication server connected to the image forming apparatus via a network is provided, and the authentication information input by the user who has accessed the image forming apparatus is authenticated. There is known a system in which an image is transmitted to a server, authenticated by an authentication server, and the result is returned to an image forming apparatus. In addition, an authentication server is installed for each of a plurality of departments.

  By the way, in order to ensure the security of image data and to manage the use of the image forming apparatus, the functions that can be used in the image forming apparatus are restricted for each user. In such a case, if the image forming apparatus is provided with function restriction information for each user, the number of usable users is limited to the number of users that can be managed by the image forming apparatus.

  In addition, when a plurality of image forming apparatuses are introduced in a plurality of departments and users of each department use each image forming apparatus, it is necessary to register the users of each department in each of the image forming apparatuses. Occurs.

  Therefore, a system has been proposed in which one intermediate server is installed and user information such as restriction information of each user is held in the intermediate authentication server, and user authentication is performed by the authentication server.

  By the way, for example, there may be restrictions on the functions that can be used by the image forming apparatus between regular employees and temporary employees. In such a case, it is very complicated to write the function restriction information for each user in the intermediate authentication server.

Patent Document 1 discloses a technique for assigning permission / prohibition of a print function for each client when collecting data to a POP server.
JP 2004-145488 A

  However, the technique described in Patent Document 1 does not use an intermediate authentication server. For this reason, in the case where restrictions are placed on the functions that can be used by the image forming apparatus between a regular employee and a temporary employee, It does not provide means for eliminating the complexity of writing function restriction information for each user in the authentication server.

  The present invention has been made in view of such circumstances, and restricts the functions that can be used by the image forming apparatus to the user without writing the function restriction information for each user in the intermediate authentication server. An object of the present invention is to provide an authentication system and an authentication method.

The above problem is solved by the following means.
(1) An authentication system in which an image forming apparatus, a plurality of authentication servers that perform user authentication based on authentication information, and an intermediate authentication server are connected via a network. Registration means in which usable functions of the image forming apparatus set for each server are registered; instruction means for instructing the authentication server to execute authentication based on authentication information input to the image forming apparatus; A transmission unit configured to transmit information about an authentication result and an available function corresponding to an authentication server that has been successfully authenticated among the plurality of authentication servers, to the image forming apparatus, wherein the image forming apparatus includes the intermediate authentication server An authentication system comprising control means for controlling whether or not a function is permitted based on an authentication result and information on available functions transmitted from .
(2) The intermediate authentication server instructing the execution of authentication to the authentication server registered in the registration unit as a usable function of the use request function specified by the user among the plurality of authentication servers. The described authentication system.
(3) A step of causing any one of the plurality of authentication servers to perform user authentication based on the authentication information input to the image forming apparatus, and the authentication result and the authentication set for each authentication server succeeded. Transmitting information about the usable function corresponding to the authentication server to the image forming apparatus, and controlling whether to use the function of the image forming apparatus based on the authentication result and the information about the usable function; An authentication method comprising:
(4) The authentication system according to item 3 above, wherein among the plurality of authentication servers, an authentication server in which a use request function designated by a user is set as an available function is executed.

  According to the invention described in (1), the usable functions of the image forming apparatus set for each of the plurality of authentication servers are registered in the intermediate authentication server, and the authentication server corresponding to the authentication server that has succeeded in authentication is registered. Information about available functions is transmitted to the image forming apparatus. Then, the image forming apparatus controls whether to use the function based on the information about the usable function transmitted from the intermediate authentication server. In other words, since an image forming apparatus usable function is set for each authentication server that performs user authentication, for example, to restrict the functions of the image forming apparatus between a regular employee and a temporary employee, an authentication server for a regular employee and a temporary employee are used. It is only necessary to divide the authentication server for authentication and set function restrictions for each authentication server. Therefore, it is not necessary to write function restriction information for each user in the intermediate authentication server.

  According to the invention described in item (2) above, the intermediate authentication server executes authentication on the authentication server registered in the registration unit as a usable function of the use request function specified by the user among the plurality of authentication servers. Therefore, there is no need to cause a plurality of authentication servers to perform authentication in order.

  According to the invention described in (3) above, since the usable function of the image forming apparatus is set for each authentication server that performs user authentication, the function restriction on users can be performed by separating the users to be authenticated for each authentication server. This eliminates the need to write function restriction information for each user in the intermediate authentication server.

  According to the invention described in (4) above, the intermediate authentication server instructs the authentication server in which the use request function specified by the user is set as an available function among the plurality of authentication servers. Therefore, it is not necessary to cause a plurality of authentication servers to perform authentication in order.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 is a configuration diagram of an authentication system according to an embodiment of the present invention. In this authentication system, an image forming apparatus 1 comprising an MFP, a plurality of (in this embodiment, two) external authentication servers 21 and 22 and an intermediate authentication server 3 are connected via a network 4 such as a LAN (Local Area Network). Connected.

  The authentication servers 21 and 22 perform user personal authentication, and have authentication information storage units 211 and 221 in which personal authentication information is stored.

  The intermediate authentication server 3 sends the authentication information transmitted from the image forming apparatus 1 to the authentication server 21 or 22 to instruct the execution of authentication, or receives the authentication result from the authentication servers 21 and 22 that have performed authentication. get. In the intermediate authentication server 3, usable functions of the image forming apparatus 1 set for each of the authentication servers 21 and 22 are registered.

  FIG. 2 is a block diagram illustrating a configuration of the image forming apparatus 1.

  In FIG. 2, the image forming apparatus 1 includes the above-described MFP, and includes a CPU 11, a ROM 12, a RAM 13, a scanner unit 14, a storage unit 15, a printer unit 16, an operation panel 17, and a network controller (NIC). 18 is provided.

  In addition to the overall control of the entire image forming apparatus 1, the CPU 11 transmits authentication data input by the user to the intermediate authentication server 3 or the authentication result transmitted from the intermediate authentication server 3 in this embodiment. And control the operation of the device based on available functions.

  The ROM 12 is a memory for storing an operation program of the CPU 11 and the like.

  The RAM 13 is a memory that provides a work area when the CPU 11 operates based on an operation program.

  The scanner unit 14 is a reading unit that reads an image of a document placed on a document table (not shown) and outputs image data.

  The storage unit 15 is configured by a nonvolatile storage device such as a hard disk drive (HDD). The storage unit 15 stores image data of the original read by the scanner unit 4.

  The printer unit 16 prints image data of a document read by the scanner unit 14, print data from a user terminal, and the like according to an instructed mode.

  The operation panel 17 is used for various input operations, and includes a display unit made of liquid crystal or the like, a start key, a numeric keypad unit, and the like.

  The network controller 18 controls communication with the intermediate authentication server 3 on the network 3 and other external devices such as user terminals.

  FIG. 3 is a block diagram showing the configuration of the intermediate authentication server 3.

  The intermediate authentication server 3 includes a CPU 31, a ROM 32, a RAM 33, a storage unit 34, an input device 35, a network controller (NIC) 36, and the like.

  In addition to the overall control of the intermediate authentication server 3, the CPU 31 transmits authentication data transmitted from the image forming apparatus 1 to the authentication / authentication servers 21 and 22 in this embodiment to execute authentication. The authentication server 21 that performs authentication, receives the authentication result transmitted from the authentication servers 21 and 22, or performs authentication based on the usable function of the image forming apparatus 1 set for each of the authentication servers 21 and 22. , 22 is specified, or information on the authentication result and the specified available function is transmitted to the image forming apparatus 1.

  The ROM 32 is a memory for storing an operation program of the CPU 31 and the like.

  The RAM 33 is a memory that provides a work area when the CPU 31 operates based on an operation program.

  The storage unit 34 is configured by a nonvolatile storage device such as a hard disk drive (HDD). In the storage unit 34, usable functions of the image forming apparatus 1 set for the respective authentication servers 21 and 22 are registered, and other various data are stored.

  The input device 35 is used for various input operations and includes a keyboard and a mouse.

  The network controller 36 controls communication with the image forming apparatus 1 and the authentication servers 21 and 22 on the network 4.

  Next, an authentication method in the authentication system shown in FIG. 1 will be described.

  In this embodiment, as shown in FIG. 4, usable functions (function restriction information) of the image forming apparatus 1 are registered in the storage unit 34 of the intermediate authentication server 3 for each of the authentication servers 21 and 22. To do. That is, the authentication server 21 can use original reading, printing, e-mail transmission, SMB transmission, FTP transmission, and facsimile transmission functions, and the authentication server 22 can use only original reading and printing functions. It is set to be possible.

  Information exchange between the image forming apparatus 1, the intermediate authentication server 3, and the authentication servers 21 and 22 in this state will be described with reference to the sequence diagram of FIG.

  First, when a user inputs authentication information to the image forming apparatus 1 and makes an authentication request, an authentication request including the authentication information is transmitted from the image forming apparatus 1 to the intermediate authentication server 3, and further from the intermediate authentication server, for example, an authentication server 21 is transmitted.

  The authentication server 21 performs user authentication based on the authentication information, and returns the result to the intermediate authentication server 3.

  If the authentication by the authentication server 21 is successful, the intermediate authentication server 3 holds information about the authentication server 21 that has been successfully authenticated. Then, the authentication success is transmitted to the image forming apparatus 1. The image forming apparatus 1 that has received the request requests the intermediate authentication server 3 for function restriction information about the user who has been successfully authenticated. The intermediate authentication server 3 confirms the authenticated authentication server 21 and refers to the registration information of available functions shown in FIG. 4, and the image forming apparatus 1 set for the authentication server 21 can be used. Confirm the function. In this example, as described above, it is the authentication server 21 that has authenticated, and this server can use the functions of document reading, printing, e-mail transmission, SMB transmission, FTP transmission, and facsimile transmission. ing. For this reason, the intermediate authentication server 3 informs the image forming apparatus 1 that each function of document reading, printing, e-mail transmission, SMB transmission, FTP transmission, and facsimile transmission can be used as a response to the function restriction information. respond.

  Upon receiving this response, the CPU 11 of the image forming apparatus 1 permits the user to use the functions of document reading, printing, e-mail transmission, SMB transmission, FTP transmission, and facsimile transmission.

  FIG. 6 is a sequence diagram showing information exchange between the image forming apparatus 1, the intermediate authentication server 3, and the authentication servers 21 and 22 when the authentication server 21 fails authentication and the authentication server 22 succeeds. It is.

  First, when a user inputs authentication information to the image forming apparatus 1 and makes an authentication request, an authentication request including the authentication information is transmitted from the image forming apparatus 1 to the intermediate authentication server 3, and further from the intermediate authentication server to the authentication server 21. Sent to.

  The authentication server 21 performs user authentication based on the authentication information, and returns the result to the intermediate authentication server 3.

  If the authentication information about the user corresponding to the authentication server 21 does not exist and the authentication fails, an authentication failure is returned from the authentication server 21 to the intermediate authentication server 3.

  Receiving this, the intermediate authentication server 3 next transmits an authentication request to the authentication server 22. When the authentication by the authentication server 22 is successful and a message to that effect is returned, the intermediate authentication server 3 holds information about the authentication server 22 that has been successfully authenticated. Then, the authentication success is transmitted to the image forming apparatus 1. The image forming apparatus 1 that has received the request requests the intermediate authentication server 3 for function restriction information about the user who has been successfully authenticated. The intermediate authentication server 3 confirms the authentication server 22 that has performed the authentication, and refers to the registration information of available functions shown in FIG. 4 to enable the use of the image forming apparatus 1 set for the authentication server 22. Confirm the function. In this example, as described above, the authentication is performed by the authentication server 22, and this server can use only the function of reading and printing the document. Therefore, the intermediate authentication server 3 responds to the image forming apparatus 1 that the document reading and printing functions can be used as a response to the function restriction information.

  Receiving this response, the CPU 11 of the image forming apparatus 1 permits the user to use only the document reading and printing functions.

  FIG. 7 is a flowchart showing the operation of the intermediate authentication server 3 after receiving the authentication request from the image forming apparatus 1 until responding to the image forming apparatus 1 with authentication failure or authentication success.

  First, when an authentication request is received from the image forming apparatus 1 in step S01, it is determined whether or not an authentication server is registered in step S02. If not registered ("No registration" in step S02), an authentication failure is returned to the image forming apparatus 1 in step S03, and the process is terminated. If registered ("Registered" in step S02), information about the registration server is acquired in step S04, and an authentication request is transmitted to an arbitrary registration server in step S05.

  In step S06, an authentication response is received from the authentication server that has transmitted the authentication request. In step S07, it is determined whether the authentication is successful or unsuccessful. If authentication has failed (“failure” in step S07), it is determined in step S08 whether there are other registered authentication servers. If it does not exist (“No” in step S08), an authentication failure is returned to the image forming apparatus 1 in step S03, and the process ends.

  If another authentication server is registered (“Yes” in step S08), the process returns to step S02, and steps S02 to S08 are repeated until authentication is successful in step S07 or there are no registered servers in step S08. .

  On the other hand, if the authentication is successful in step S07 (“success” in step S07), information on the server for which authentication was successful is stored in step S09, and then the authentication success is returned to the image forming apparatus 1 in step S10.

  FIG. 8 is a flowchart showing the operation of the intermediate authentication server 3 until the function restriction information is returned to the image forming apparatus 1 after receiving the function restriction information request from the image forming apparatus 1.

  First, when a request for function restriction information is received from the image forming apparatus 1 in step S21, in step S22, information about the authentication server that has performed authentication of the user stored in step S09 in FIG. 7 is acquired.

  Next, in step S23, based on the acquired authentication server information, the usable functions (function restriction information) set in the server are determined. In step S24, the confirmed function restriction information is transmitted to the image forming apparatus 1.

  As described above, in this embodiment, the usable function of the image forming apparatus 1 set for each of the plurality of authentication servers 21 and 22 is registered in the intermediate authentication server 3, and corresponds to the authentication server that has been successfully authenticated. Information about the available functions to be transmitted is transmitted to the image forming apparatus 1, and the image forming apparatus 1 controls whether to use the functions based on the information about the available functions transmitted from the intermediate authentication server 3. That is, since the usable function of the image forming apparatus 1 is set for each authentication server that performs user authentication, for example, in order to restrict the functions of the image forming apparatus between regular employees and temporary employees, a plurality of authentication servers 21 and 22 are used. One of them is used as an authentication server for regular employees, and the other is used as an authentication server for temporary employees, and usable functions (function restrictions) for the respective authentication servers may be set and registered. Therefore, it is not necessary to write the function restriction information for each user in the intermediate authentication server 3. In addition, upon receiving an authentication request from the image forming apparatus 1, the intermediate authentication server 3 transmits authentication requests to the authentication servers 21 and 22 in order until the authentication is successful, and instructs the execution of the authentication. The trouble of specifying the authentication server can be saved.

  A configuration in which the user designates an authentication server may be used. Also in this case, it is necessary to determine the function restriction information based on the information of the authentication server that has been successfully authenticated.

  Next, another embodiment of the present invention will be described. In this embodiment, a case is shown in which a user designates a function requested to be used and makes an authentication request to the image forming apparatus 1.

  In this embodiment, as shown in FIG. 9, usable functions (function restriction information) of the image forming apparatus 1 are registered in the storage unit 34 of the intermediate authentication server 3 for each of the authentication servers 21 and 22. To do. That is, for the authentication server 21, functions of reading a document, e-mail transmission, SMB transmission, FTP transmission, and facsimile transmission can be used, and for the authentication server 22, only a document reading and printing function can be used. Is set.

  Information exchange between the image forming apparatus 1, the intermediate authentication server 3, and the authentication server 21 in this state will be described with reference to the sequence diagram of FIG.

  First, when a user designates a use request function and inputs authentication information to the image forming apparatus 1 to make an authentication request, the authentication request is transmitted from the image forming apparatus 1 to the intermediate authentication server 3.

  The intermediate authentication server 3 selects an authentication server that instructs authentication based on the use request function transmitted together with the authentication request and the usable function for each registered server. For example, when the use request function by the user is an e-mail transmission function, the authentication server 21 in which the function is set to be usable is selected.

  The intermediate authentication server 3 transmits an authentication request to the selected authentication server 21.

  The authentication server 21 performs user authentication based on the authentication information, and returns the result to the intermediate authentication server 3. If the authentication is successful, the image forming apparatus 1 is responded to that effect and that the e-mail transmission function can be used.

  In this embodiment, the intermediate authentication server 3 only has to instruct the authentication server 21 among the plurality of authentication servers 21 and 22 that the use request function specified by the user is registered as an available function to execute authentication. This eliminates the need for having a plurality of authentication servers perform authentication in order.

  In selecting an authentication server, if the use request function specified by the user can be used by any authentication server, authentication may be instructed to each authentication server in turn.

  FIG. 11 shows the intermediate authentication server 3 in the embodiment shown in FIGS. 9 and 10 until the authentication request from the image forming apparatus 1 is received and the authentication failure or the authentication success is returned to the image forming apparatus 1. It is a flowchart which shows operation | movement.

  First, when a use request function and an authentication request are received from the image forming apparatus 1 in step S31, an authentication server to which the use request function is assigned as an available function is determined in step S32.

  Next, in step S33, an authentication request is made to the determined server, and in step S34, it is determined whether the authentication response from the authentication server is an authentication success or failure. If the authentication has failed (“failure” in step S34), the authentication failure is returned to the image forming apparatus 1 in step S35, and the process is terminated.

  If the authentication is successful (“success” in step S34), in step S36, a response is sent to the image forming apparatus 1 that the authentication is successful and that the use request function is available.

It is a block diagram of the authentication system which concerns on one Embodiment of this invention. 1 is a block diagram illustrating a configuration of an image forming apparatus. It is a block diagram which shows the structure of an intermediate authentication server. It is a table | surface which shows the registration information of the function which can be utilized for every authentication server registered into the intermediate authentication server. FIG. 4 is a sequence diagram illustrating exchange of information performed between an image forming apparatus, an intermediate authentication server, and an authentication server. FIG. 10 is another sequence diagram illustrating exchange of information performed between the image forming apparatus, the intermediate authentication server, and the authentication server. 6 is a flowchart showing an operation of the intermediate authentication server after receiving an authentication request from the image forming apparatus until responding to the image forming apparatus with authentication failure or authentication success. 6 is a flowchart illustrating an operation of the intermediate authentication server after receiving a request for function restriction information from the image forming apparatus until responding to the function restriction information to the image forming apparatus. It is a table | surface which concerns on other embodiment of this invention, and shows the registration information of the function which can be utilized for every authentication server registered into the intermediate authentication server. FIG. 4 is a sequence diagram illustrating exchange of information performed between an image forming apparatus, an intermediate authentication server, and an authentication server. FIG. 11 is a flowchart illustrating an operation of the intermediate authentication server after receiving an authentication request from the image forming apparatus and responding to authentication failure or authentication success to the image forming apparatus in the embodiment illustrated in FIGS. 9 and 10.

Explanation of symbols

1 Image forming device (MFP)
21, 22 Authentication server 3 Intermediate authentication server 4 Network 11 CPU
15 Memory 17 Operation Panel 18 Network Controller 31 CPU (Instruction Unit)
34 Storage unit (registration means)

Claims (4)

An authentication system in which an image forming apparatus, a plurality of authentication servers that perform user authentication based on authentication information, and an intermediate authentication server are connected via a network.
The intermediate authentication server is
A registration unit in which usable functions of the image forming apparatus set for each authentication server are registered;
Instruction means for instructing the authentication server to execute authentication based on authentication information input to the image forming apparatus;
A transmitting unit that transmits information about an authentication result and an available function corresponding to an authentication server that has been successfully authenticated among the plurality of authentication servers;
With
2. The authentication system according to claim 1, wherein the image forming apparatus includes a control unit that controls whether or not the function is permitted based on the authentication result and information on the available function transmitted from the intermediate authentication server.   The said intermediate | middle authentication server instruct | indicates execution of authentication to the authentication server registered into the said registration means as a usable function among the said some authentication servers as the utilization request | requirement function designated by the user. Authentication system. Causing any one of the plurality of authentication servers to perform user authentication based on authentication information input to the image forming apparatus;
Transmitting an authentication result and information about an available function corresponding to the authentication server set for each authentication server and successfully authenticated to the image forming apparatus;
Controlling whether to use the function of the image forming apparatus based on the authentication result and the information about the available function;
An authentication method characterized by comprising:   The authentication system according to claim 3, wherein among the plurality of authentication servers, an authentication server in which a use request function designated by a user is set as an available function is executed.

Images