JP2009213010A - Communication terminal device, communication establishment control method, communication establishment control program and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a communication terminal device, communication establishment control method, communication establishment control program and recording medium for safely and efficiently establishing connections with a plurality of counter communication terminal devices. <P>SOLUTION: A multifunction peripheral 1 generates association information 402 by combining host identification information CHID, connection device identification information CDID and a connection key CK as association information 402 required for establishing a communication connection with a host device and stores the generated association information in a secondary storage device such as a portable storage medium 400, an authentication information check mechanism section 301 performs user authentication processing based on inputted user information, and a communication mechanism section 303 selects association information 402 suitable for establishing a connection of the communication from a plurality of association information 402 items in the secondary storage device on the basis of a result of the user authentication and uses the selected association information 402 to establish the communication with the host device. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a communication terminal device, a communication establishment control method, a communication establishment control program, and a recording medium, and in particular, a communication terminal device that establishes a connection with a plurality of counterpart communication terminal devices safely and efficiently, and communication establishment control The present invention relates to a method, a communication establishment control program, and a recording medium.

  2. Description of the Related Art In recent years, information processing apparatuses such as personal computers, composite apparatuses, and copying apparatuses handle various data (image data and the like), have a general-purpose interface, and can be used by connecting various devices externally. Therefore, how to establish confidentiality (security) of data has become an important issue.

  In particular, when wireless communication is used as a connection form, it is important to ensure data security. As a communication method having a security function when connecting by such wireless communication, a security association has been conventionally used. The method using is used. In this security association method, generally, a security parameter index (SPI), an IP destination address, and a security protocol (AH or ESP) identifier are uniquely identified. In other words, in the security association method, association information that can be understood only between each other with the other party to be connected is stored in both devices, and this association information is exchanged and shared before starting communication so that secure communication is possible. A path is established (see Patent Document 1).

JP 2007-089159 A

  However, in the conventional security association method, association information to be used is used when establishing a communication path. This association information is only for the host device to be connected, such as a printer. The shared device is required to be used by information processing apparatuses such as a plurality of computers, and a plurality of hosts are connected to one device. Therefore, each time a connection is made to a different host apparatus, the association is performed. It is necessary to change the information, and in order to establish a communication path by a safe and appropriate association, a function to select the association information safely and efficiently is necessary. In order to establish security safely and efficiently, There was a need for improvement.

  Therefore, an object of the present invention is to provide a communication terminal device, a communication establishment control method, a communication establishment control program, and a recording medium that establish a communication path safely and efficiently.

  The present invention is based on user authentication based on the input of predetermined user authentication information for use thereof, and when establishing a communication connection with a communication partner apparatus on condition of exchange of predetermined communication establishment authentication information. Communication establishment authentication information necessary for establishing communication connection with the communication partner apparatus, partner identification information for identifying the communication partner apparatus, own apparatus identification information for identifying the own apparatus, and the own apparatus The communication establishment authentication information combined with the shared identification information shared with the communication partner apparatus is generated, stored in the communication establishment authentication information storage means, and the input user information and the authentication stored in the predetermined user authentication information storage means User authentication processing is performed based on the user authentication information for the communication, and based on the user authentication result, a plurality of communication establishment authentication information stored in the communication establishment authentication information storage means Select the appropriate said communication establishing authentication information in connection establishment, and using said communication establishing authentication information selected by the selection process and characterized in that the communication establishment process between the communication destination apparatus.

  In addition, the present invention may be characterized in that the communication establishment authentication information is generated using information that can be used in common between different communication terminal devices as the own device identification information.

  Furthermore, the present invention may be characterized in that the user authentication information is stored together with the communication establishment authentication information in a communication establishment authentication information storage unit that is externally attached so as to be detachable and has portability.

  In addition, the present invention is characterized in that the communication establishment authentication information and / or the user authentication information is encrypted and stored in a communication establishment authentication information storage unit that is externally attached and detachable and has portability. Also good.

  Further, according to the present invention, the communication establishment authentication information is generated using successful user authentication in the user authentication processing and using information that can be commonly used between different communication terminal devices as the self device identification information. Of these, the communication establishment authentication information may be selected on condition that at least one of them is satisfied.

  Further, the present invention selects the communication establishment authentication information on the condition that the communication establishment authentication information is generated using identification information unique to the communication terminal apparatus as the own apparatus identification information. It may be a feature.

  In addition, the present invention may be characterized in that the communication establishment authentication information is generated on the condition that user authentication is successful in the user authentication process.

  According to the present invention, as communication establishment authentication information necessary for establishing a communication connection with a communication partner device, partner identification information for identifying the communication partner device, self device identification for identifying the device Generate communication establishment authentication information combining information and shared identification information shared between the own device and the communication partner device, save it in the communication establishment authentication information storage means, and perform user authentication processing based on the input user information Based on the user authentication result, the communication establishment authentication information appropriate for establishing the communication connection is selected from a plurality of communication establishment authentication information stored in the communication establishment authentication information storage means, and selected in the selection process. Since the communication establishment processing with the communication partner device is performed using the communication establishment authentication information, the communication establishment is performed safely and efficiently even when connecting to a plurality of communication partner devices. Can Thereby improving the usability.

  Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In addition, since the Example described below is a suitable Example of this invention, various technically preferable restrictions are attached | subjected, However, The scope of the present invention limits this invention especially in the following description. As long as there is no description of the effect, it is not restricted to these aspects.

  1 to 6 are diagrams illustrating an embodiment of a communication terminal device, a communication establishment control method, a communication establishment control program, and a recording medium according to the present invention. FIG. 1 illustrates the communication terminal device, the communication establishment control according to the present invention. It is a principal block block diagram of the compound apparatus 1 to which an embodiment of a method, a communication establishment control program, and a recording medium is applied.

  In FIG. 1, although not shown, the composite apparatus 1 is connected to a host apparatus such as a plurality of computers by a wired, wireless, particularly wireless network such as a LAN (Local Area Network) and the Internet. When connecting to a memory device or the like (communication partner device), security is ensured by securing an association described later.

  As shown in FIG. 1, the hardware of the multifunction device 1 is configured as a block, and includes a controller board 10, an operation unit 30, a fax control unit 31, a plotter 32, a scanner 33, and other hardware resources 34. I have.

  The controller board 10 includes a CPU (Central Processing Unit) 11, a system memory (hereinafter referred to as MEM-P) 12, a north bridge (hereinafter referred to as NB) 13, an ASIC (Application Specific Integrated Circuit) 14, and a local memory (hereinafter referred to as “memory”). , MEM-C) 15, hard disk device (hereinafter referred to as HDD) 16, serial bus 17, NIC (Network Interface Card) 18, USB (Universal Serial Bus) I / F 19, WUSB (Wireless Universal Serial Bus) 20 , IEEE (Institute of Electrical and Electronic Engineers) 802.11b I / F 21, IEEE 1394 I / F 22, USB host 23, memory card I / F 24, and the like.

  The operation unit 30 is connected to the ASIC 14 of the controller board 10, and the fax control unit 31, the plotter 32, the scanner 33, and other hardware resources 34 are connected to the ASIC 14 of the controller board 10 via a PCI (Peripheral Component Interconnect) bus 40. It is connected.

In the controller board 10, the MEM-C 15 and the HDD 16 are connected to the ASIC 14, and the CPU 11 and the ASIC 14 are connected via the NB 13 of the CPU chip set. As described above, when the CPU 11 and the ASIC 14 are connected via the NB 13, it is possible to cope with a case where the interface of the CPU 11 is not disclosed. Each interface from the NB 13 and the serial bus 17 to the memory card I / F 24 is connected by a PCI bus 42. The ASIC 14 and the NB 13 are not connected to the PCI bus but via an AGP (Accelerated Graphics Port) 41. Connected to improve performance.

  Although not shown, a communication line such as a public line (PN) is connected to the fax control unit 31, and the fax control unit 31 realizes G3 and G4 facsimile transmission and facsimile reception functions. That is, at the time of fax transmission, the composite apparatus 1 performs image processing read by the scanner 33 and performs necessary image processing by the ASIC 14, and then transfers the image data to the fax control unit 31. Perform data conversion and send by facsimile. In addition, when receiving a fax, the multifunction device 1 receives facsimile data from an external facsimile device or the like via a communication line by the fax control unit 31 and converts it into image data, and prints it on a sheet by a plotter 32. Save in the HDD 16.

  The NB 13 is a bridge for connecting the CPU 11, the MEM-P 12, each I / F from the serial bus 17 to the memory card I / F 24 and the ASIC 14, and the MEM-P 12 is used as a drawing memory or the like of the composite apparatus 1. It is memory. The MEM-C 15 is a memory used as a copy image buffer and a code buffer.

  Various devices such as a ROM (Read Only Memory) and a RAM (Random Access Memory) are connected to the serial bus 17.

  The NIC 18 is connected to a network to which other network devices such as another composite device 1 and a host device are connected, and the NIC 18 communicates with other network devices such as other composite devices and host devices via the network.

  The ASIC 14 is an image processing application IC (Integrated Circuit) having hardware elements for image processing, and the HDD 16 stores image data, document data, programs, font data, and forms. It is a storage for performing etc.

  The HDD 16 is a large-capacity auxiliary storage device, and various programs and data necessary for realizing the function as the composite device 1, for example, a basic program of the composite device 1 and a communication establishment for realizing a communication establishment control method described later. Stores control programs and various information.

  A USB device that communicates by connecting to the multifunction device 1 is connected to the USB I / F 19 by wire, and the USB I / F 19 performs an interface with the USB device.

  The WUSB 20 communicates with a host device or the like having a USB terminal function in accordance with the wireless USB standard. As will be described later, in particular, the composite apparatus 1 appropriately establishes communication in wireless communication using the WUSB 20 with a host apparatus having a USB terminal function.

  The IEEE 802.11b I / F 21 communicates with a host device or the like by wireless communication, and the IEEE 1394 I / F 22 communicates with a host device or the like by wire.

  A USB memory 43 is detachably connected to the USB host 23, and the USB host 23 has a function of controlling a physical / electrical I / F for communicating with the USB memory 43 and a function of controlling a USB protocol. And communicate with the USB memory 43. Note that the USB host 23 may have a WUSB function, and the USB memory 43 may similarly have a wireless USB function, and may be USB connected wirelessly.

  The memory card I / F 24 is connected to a memory card 44 such as a compact flash memory (registered trademark), a memory stick (MS), smart media, and an IC card. The memory card I / F 24 stores data to the memory card 44. An interface for writing and reading data from the memory card 44 is performed.

  The operation unit 30 includes various operation keys, a display, and the like, receives input operations from the various operation keys by the operator, and displays various information on the display to the operator. In particular, the operation unit 30 performs an input operation of user information or the like in a communication establishment process described later.

  The plotter 32 records and outputs an image on a sheet based on image data to be printed by a predetermined printing method, for example, an electrophotographic method. The plotter 32 is not shown in the case of an electrophotographic system, but is necessary for recording and outputting image data on a sheet by an electrophotographic system using a laser, for example, a photoconductor, an optical writing unit, a developing unit, a charging unit. And a cleaning unit, etc., operate the optical writing unit according to image data and control signals to form an electrostatic latent image on the photosensitive member, and supply the toner to the photosensitive member by the developing unit for development. To form a toner image. The plotter 32 feeds the paper between the photosensitive member and the transfer unit from the paper feeding unit via the paper conveyance path, transfers the toner image on the photosensitive member to the paper, and the paper on which the toner image is transferred. Is transferred to the fixing unit and heated and pressurized by the fixing unit to fix the toner image on the paper, thereby printing out the image on the paper. Further, the plotter 32 performs a black and white printing function and a color printing function separately.

  The scanner 33 performs main scanning and sub-scanning on the document image, reads the document image at a predetermined resolution, and acquires image data.

  The other hardware resources 34 are external hardware and the like.

  The composite device 1 is stored in the hard disk 16 or a ROM (not shown), and the CPU 11 executes a basic program of the composite device 1 that operates on an operation system (hereinafter referred to as OS) and a communication establishment control program described later. Thus, a functional module as shown in FIG. 2 is constructed.

  That is, the composite apparatus 1 includes a ROM, an EEPROM (Electrically Erasable and Programmable Read Only Memory), an EPROM, a flash memory, a flexible disk, a CD-ROM (Compact Disc Read Only Memory), a CD-RW (Compact Disc Rewritable), a DVD ( A communication establishment control program for executing the communication establishment control method of the present invention recorded on a recording medium readable by an information identification device such as a digital video disk (SD), a secure digital (SD) card, or a magneto-optic disc (MO). It is constructed as a communication terminal device that executes a communication establishment control method for safely and efficiently establishing communication with a plurality of host devices, which will be described later, by being read and introduced into the ROM or hard disk 16. This communication establishment control program is a computer-executable program written in a legacy programming language such as assembler, C, C ++, C #, Java (registered trademark), or an object-oriented programming language, and is stored in the recording medium. And can be distributed.

  The composite apparatus 1 is configured with functional modules as shown in FIG. 2 by executing the basic program and the communication establishment control program, and an operating system (hereinafter referred to as OS) such as UNIX (registered trademark). An application module layer 110, a service module layer 120, and a hardware layer 200 that are activated on 100. The application module layer 110 and the service module layer 120 are functionally connected by an API (Application Program Interface), and the OS 100 and the engine module layer 200 can exchange information through the engine I / F.

  The application module layer 110 includes programs for performing unique processes related to image formation such as copying, faxing, printers, scanners, and Web. The copying application 111, fax application 112, printer application 113, Web application 114, and the like. Is included.

  The service module layer 120 includes service modules such as a system control service 121, a fax control service 122, an engine control service 123, a memory control service 124, an operation unit control service 125, and a network control service 126.

  The service module layer 120 interprets the processing request from the application module layer 110 and generates a hardware resource 200 acquisition request.

  The hardware resource 200 includes the plotter engine 32, the scanner engine 33, and other hardware resources 34, and an engine control board 201 that secures and controls these hardware.

  The OS 100 executes the software of the application module layer 110 and the service module layer 120 in parallel as processes.

  The system control service 121 performs processes such as management of applications 111 to 114, control of the operation unit 30, system screen display, LED (Light Emitting Diode) display, management of hardware resources 200, interrupt application control, etc., and fax control. The service 122 is a module that realizes a facsimile function. The engine control service 123 is a module that controls the plotter engine 32, the scanner engine 33, and other hardware resources 34. In particular, the monochrome control mode and the color mode switching control of the plotter engine 32, the reading line density of the scanner engine 33, and the like. The operation mode is also controlled.

  The memory control service 124 is a module that performs memory control, and the operation unit control service 125 is a module that controls the operation panel 30.

  The network control service 126 provides a service that can be commonly used for applications that require network I / O, and distributes data received from the network side according to each protocol to each of the applications 111 to 126. Mediates when data from the applications 111 to 114 is transmitted to the network side. For example, the network control service 126 controls data communication with a network device connected via a network, for example, a host device.

  As shown in FIGS. 3 and 4, the composite apparatus 1 has a module configuration for executing communication establishment processing, and includes a user interface 300, an authentication information check mechanism unit 301, an authentication information table 302, communication A mechanism unit 303, an association information generation mechanism unit 304, an engine 305, and the like are provided, and the portable storage medium 400 is detachably connected via the user interface 300.

  FIG. 3 is a module diagram of a communication establishment related portion of the composite apparatus 1, and shows a flow of generating association information 402 and storing it in a portable storage medium (communication establishment authentication information storage means, user authentication information storage means) 400. ing. FIG. 4 is a module diagram of a related portion when operation control is performed according to the communication establishment level. For example, printing is performed using the flow of setting the association information 402 from the portable storage medium 400 to the composite apparatus 1 and the association information 402. It also shows the flow of limiting functions.

  3 and 4, a user interface 300 is used to operate / set various information such as input of user authentication information, input / output of association information 402, designation of a host device to be connected, and the like. A USB host 23 and a memory card I / F 24 that read and write user authentication information from a USB memory (including WUSB) 43, a memory card 44, and the like.

  The authentication information check mechanism unit (user authentication means) 301 performs user authentication with reference to the authentication information table 302 for user authentication information input from the user interface 300.

  The authentication information table 302 is stored in a secondary storage device, for example, a user authentication device such as the HDD 16 or the portable storage medium 400 or a RADIUS (Remote Authentication Dial-In User Services) existing in a network destination. , User authentication information 401 and association information 402 are registered. Note that when the authentication information table 302 is stored in the secondary storage device inside the multifunction apparatus 1, only the authentication information 402 may be included.

  The user authentication information 401 includes, for example, a user ID and a password (indicated in the portable storage medium 400 in FIGS. 3 and 4 as PASS), and tries to use the multifunction device 1 by connecting to the multifunction device 1. Input from the user interface 300 to authenticate the user of the host device.

  Association information (communication establishment authentication information) 402 is host identification information (partner) that is identification information (ID) for the composite device 1 to identify a host device that is connected to the composite device 1 and intends to use the composite device 1. Identification information) CHID, connection device identification information (self device identification information) CDID, which is an ID for the host device trying to use the composite device 1 to identify the composite device 1 to be used, both the composite device 1 and the host device It consists of a connection key (shared identification information) CK shared by.

  In normal use, the host identification information CDID is a unique value. However, the composite apparatus 1 of this embodiment can accept, for example, an ID common to models of communication terminal apparatuses such as a plurality of composite apparatuses 1 and an IC card. By generating the association information 402 using an ID unique to the portable storage medium 400, the association information 402 that can be used by devices other than the association device may be generated. Conversely, the association information 402 may be generated using identification information unique to the composite apparatus 1, for example, information generated from the network ID, serial number, etc. of the composite apparatus 1.

  When the user information input from the user interface 300 and the user authentication information 401 for authentication in the authentication information table 302 are compared and matched, the authentication information check mechanism unit 301 communicates with the communication mechanism unit 303 that the user authentication is successful. Notify the start of setting.

  The communication mechanism unit 303 requires the association information 402 to start communication with the host device, and generates the association information if the association information 402 does not exist in the secondary storage device (internal storage device or portable storage medium 400). The mechanism unit 304 is caused to generate association information 402. As the portable storage medium 400, a memory card 44 such as an IC card, a wired or wireless USB memory 43, or the like can be used.

  The association information generation mechanism unit (communication establishment authentication information generation unit) 304 generates association information 402 and sets it in the communication mechanism unit 303. The communication mechanism unit 303 stores the association information 402 in the secondary storage device (communication establishment). It is stored in a portable storage medium 400 or an internal storage device that is an authentication information storage means).

  The communication mechanism unit (communication establishment unit, selection unit) 303 uses the association information 402 to establish an association with the host device, establish a communication path, and perform communication with the host device.

  The engine 305 is a general term for the fax control unit 31, the printer engine 32, the scanner engine 33, and other hardware resources 34.

  Next, the operation of this embodiment will be described. The composite apparatus 1 according to the present exemplary embodiment performs association confirmation appropriately and efficiently when establishing communication with a plurality of host apparatuses by wire or wireless (for example, WUSB), particularly wirelessly and permitting use. .

  First, as shown in FIG. 3, the user of the host device inputs user authentication information to the user interface 300 in order to establish a connection with the composite device 1 (step S1). In inputting user authentication information from the user interface 300, for example, an authentication information input screen G1 as shown in FIG. 6 is displayed on the display of the operation panel 30. The user authentication information may be input by an operation input from the operation panel 30, or the user authentication information stored in the portable storage medium 400 such as the USB memory 43 or the memory card 44 is used as a USB host as the user interface 30. 23 or the memory card I / F 24 may be input. Note that the authentication information input screen G1 in FIG. 6 shows a state in which a user ID and password input field as user information and an input software keyboard are displayed.

  When the user authentication information is input from the user interface 300, the multifunction apparatus 1 passes the user authentication information to the authentication information check mechanism unit 301 (step S2), and the authentication information check mechanism unit 301 passes the user authentication information to the user interface 300. , User authentication is performed with reference to the authentication information table 302 stored in the secondary storage device (step S3).

  If the user authentication information 401 that matches the input user information is registered in the authentication information table 302, the authentication information check mechanism unit 301 indicates that the user authentication is successful, and the communication mechanism unit 303 indicates that the user authentication is successful. To start communication setting with the host device (step S4).

  The communication mechanism unit 303 requires the association information 402 in order to start communication with the host device. When the association information 402 does not exist in the secondary storage device, the association information generation mechanism unit 304 stores the association information 402. The association information generation mechanism unit 304 generates the association information 402 and sets it in the communication mechanism unit 303 (step S5).

  At this time, the association information generation mechanism unit 304 uses the host identification information CHID, which is identification information (ID) for identifying the host apparatus that intends to use the composite apparatus 1, as the association information 402, and the composite that the host apparatus uses. The connection device identification information CDID, which is an ID for identifying the device 1, and the connection key CK shared by both the composite device 1 and the host device are generated. This association information 402 includes the host identification information CDID. As described above, the association information 402 is generated using, for example, an ID common to the model of the composite apparatus 1 or an ID unique to the portable storage medium 400 such as an IC card, instead of a normal unique value. May be.

  When the association information 402 is generated in this way, the association information 402 can be used for a host device other than the host device that generated the association information 402 prior to establishment of communication.

  Conversely, in the association information 402, the association information 402 may be generated using identification information (for example, a network ID or the like) unique to the composite apparatus 1 as the host identification information CDID.

  In this way, unauthorized use of the composite apparatus 1 can be prevented more appropriately and reliably, and security can be further ensured.

  When the communication mechanism unit 303 receives the association information 402 from the association information generation mechanism unit 304, the communication mechanism unit 303 establishes communication with the host device using the association information 402, performs communication with the host device, and requests from the host device. Accordingly, various operations using the engine 305 are enabled (step S6). When the communication mechanism unit 303 succeeds in establishing communication using the association information 402 received from the association information generation mechanism unit 304, the communication mechanism unit 303 stores the association information 402 in the secondary storage device or the portable storage medium 400 shown in FIG. (Steps S7 and S8). When storing the user authentication information 401 and the association information 402 in a secondary storage device such as the portable storage medium 400, the user authentication information 401 and the association information 402 are encrypted and stored using a predetermined encryption method.

  Next, a case where the user establishes communication using the portable storage medium 400 in which the association information 402 is stored will be described with reference to FIG. Also in this case, the composite apparatus 1 displays the authentication information input screen G1 as shown in FIG. 6 on the display of the operation panel 30 as in FIG. 3, and when the user inputs the user authentication information, The authentication information is passed to the authentication information check mechanism unit 301 (step S2). When the authentication information check mechanism unit 301 receives the user authentication information from the user interface 300, the authentication information check mechanism unit 301 refers to the authentication information table 302 stored in the secondary storage device. Then, user authentication is performed (step S3).

  In this user authentication, as shown in FIGS. 3 and 4, when the user authentication information 401 is stored in the portable storage medium 400, the user interface 300 acquires the user authentication information 401. The authentication information check mechanism unit 301 performs user authentication.

  If the user authentication information 401 that matches the input user information is registered in the authentication information table 302, the authentication information check mechanism unit 301 indicates that the user authentication is successful, and the communication mechanism unit 303 indicates that the user authentication is successful. To start communication setting with the host device (step S4).

  Since the communication mechanism unit 303 requires the association information 402 to start communication with the host device, whether the association information 402 exists in the portable storage medium 400 that is a secondary storage device, for example, is possible. It is checked whether it exists in the portable storage medium 400 via the user interface 300, and if the association information 402 exists, the association information 402 is acquired from the portable storage medium 400 via the user interface 300 (step S9, S10).

  When the communication mechanism unit 303 acquires the association information 402 from the portable storage medium 400, the communication mechanism unit 303 establishes communication with the host apparatus using the association information 402 and communicates with the host apparatus. When a plurality of association information 402 exists, a selection screen as to which of the plurality of association information 402 is to be used is displayed on the display of the operation panel 30, and the association information 402 to be used by the user is displayed. Let them choose. As is apparent from the above procedure, the association selection screen for selecting the association information 402 is displayed only when the user authentication is successful, and the association information 402 can be selected.

  Then, when the association information 402 to be used is determined, the communication mechanism unit 303 establishes communication with the host device using the association information 402, communicates with the host device, and responds to a request from the host device. Thus, various operations using the engine 305 are enabled (step S6).

  As described above, the composite apparatus 1 according to the present embodiment uses the partner for identifying the host apparatus as the association information 402 that is communication establishment authentication information necessary for establishing a communication connection with the host apparatus that is a communication partner apparatus. The host identification information CHID that is the destination identification information, the connection device identification information CDID that is the own apparatus identification information for identifying the own apparatus, and the connection key CK that is the shared identification information shared between the composite apparatus 1 and the host apparatus are combined. The association information 402 is generated and stored in a secondary storage device such as the portable storage medium 400. The authentication information check mechanism unit 301 performs user authentication processing based on the input user information, and the communication mechanism unit 303 , Based on the user authentication result, from the plurality of association information 402 stored in the secondary storage device, Select the appropriate association information 402 in connection establishment, are communicating establishment processing with the host device by using the association information 402 the selected.

  Therefore, even when a plurality of host devices are connected by wireless such as wired or WUSB, it is possible to efficiently and appropriately establish communication, and to improve usability.

  Further, in the composite apparatus 1 according to the present embodiment, the association information generation mechanism unit 304 uses the information such as an ID that can be commonly used between communication terminal apparatuses such as different composite apparatuses as the host identification information CDID, and uses the association information 402 as the host identification information CDID. Is generated.

  Accordingly, the association information 402 can be diverted even in a communication terminal device such as a different composite device, and the labor for performing the association can be simplified and the usability can be improved.

  Furthermore, the composite device 1 according to the present embodiment is a secondary storage device such as a storage device built in the composite device 1 or a USB memory 43, a memory card 44, and the like that are externally attached and detachably attachable. A storage medium 400 is used.

  Therefore, it is possible to ensure wide use of the association information 402 while ensuring the safety of communication, and to store the association information 402 without being restricted by the capacity of the internal storage device. By using an IC card or the like as the next storage device, an existing authentication device such as an IC card authentication can be used as it is, and the usability can be improved at low cost.

  Further, the composite apparatus 1 of this embodiment uses a portable storage medium 400 as a secondary storage device, and stores user authentication information 401 along with association information 402.

  Therefore, input of user authentication information can be simplified, and usability can be further improved while ensuring safety.

  Furthermore, the composite apparatus 1 of the present embodiment encrypts the association information 402 and the user authentication information and stores them in the portable storage medium 400.

  Therefore, falsification and leakage of information can be prevented, and security can be further ensured.

  Further, the composite apparatus 1 of the present embodiment selects the association information 402 on the condition that the user authentication by the authentication information check mechanism unit 301 is successful, and sets it in the communication mechanism unit 303.

  Therefore, unauthorized use of the composite apparatus 1 can be prevented, and security can be further ensured.

  Furthermore, the composite apparatus 1 of the present embodiment is provided on the condition that the association information 402 is generated using information (ID) that can be used in common between communication terminal apparatuses such as different composite apparatuses 1 as the association information 402. The association information 402 is selected.

  Therefore, unauthorized use of the composite apparatus 1 can be prevented, and security can be further ensured.

  In addition, the composite apparatus 1 according to the present embodiment selects the association information 402 on the condition that the association information 402 is generated using identification information unique to the composite apparatus 1 as the association information 402.

  Therefore, unauthorized use of the composite apparatus 1 can be prevented more appropriately and reliably, and security can be further secured.

  Furthermore, in the composite apparatus 1 of the present embodiment, the association information generation mechanism unit 304 generates the association information 402 on the condition that the authentication information check mechanism unit 301 succeeds in user authentication.

  Therefore, unauthorized use of the composite apparatus 1 can be prevented, and security can be further ensured.

  In addition, the multifunction device 1 permits the use of the user who established the communication by the association information 402 from the host device (step S6). The information 402 may be provided with an authentication level for each user, and use restriction may be performed according to the authentication level. In this case, the composite device 1 has a plurality of types of operation functions that can be used by the host device such as a scanner function and a printer function by establishing a communication connection, and the association information generation function unit 304 uses the operation function usage level. Is generated. For example, in the printer function using the plotter 32, the black and white printing and the color printing are limited by the authentication level, the upper limit of the number of prints, the stapling possibility as the post-processing function, the double-sided printing possibility, etc. In the scanner function using the scanner 33, it is possible to set an upper limit of the number of continuously read sheets, a limit of reading line density, and the like.

  If it does in this way, utilization of an appropriate utilization level will be permitted by a user, utilization restriction can be carried out, and usability and security can be secured further.

  The invention made by the present inventor has been specifically described based on the preferred embodiments. However, the present invention is not limited to the above, and various modifications can be made without departing from the scope of the invention. Needless to say.

  For example, in the above description, the case where the communication terminal is the composite device 1 has been described. However, the communication terminal is not limited to the composite device, and is used by being connected to a host device such as a plurality of computers wirelessly or by wire. The present invention can be applied to printers, scanners, facsimile machines, copying machines, large-capacity memory devices, and the like.

  The present invention relates to a communication terminal device such as a printer, a scanner, a facsimile device, a copying device, and a large-capacity memory device that is used by being connected to a host device such as a plurality of computers wirelessly or by wire, a communication establishment control method, and a communication establishment control. It can be used for programs and recording media.

The principal part block block diagram of the hardware of the compound apparatus to which one Example of this invention is applied. The block block diagram of the principal function module of the composite apparatus of FIG. FIG. 3 is a module diagram of a communication establishment-related part accompanied by association information generation of the composite apparatus of FIG. 1. The module figure of the communication establishment related part using the association information of the portable storage medium of the composite apparatus of FIG. The figure which shows an example of the authentication information table which a composite apparatus utilizes for communication establishment. The figure which shows an example of the authentication information input screen displayed on a display by the communication establishment process of FIG.3 and FIG.4.

Explanation of symbols

1 Compound device 10 Controller board 11 CPU
12 System memory (MEM-P)
13 North Bridge (NB)
14 ASIC
15 Local memory (MEM-C)
16 Hard disk drive (HDD)
17 Serial bus 18 NIC
19 USB I / F
20 WUSB
21 IEEE 802.11b I / F
22 IEEE1394 I / F
23 USB host 24 Memory card I / F
30 Operation Unit 31 Fax Control Unit 32 Plotter 33 Scanner 34 Other Hardware Resources 40 PCI Bus 41 AGP
42 PCI bus 43 USB memory 44 Memory card 100 Operating system (OS)
110 Application Module Layer 111 Copy Application 112 Fax Application 113 Printer Application 114 Web Application 120 Service Module Layer 121 System Control Service 122 Fax Control Service 123 Engine Control Service 124 Memory Control Service 125 Operation Unit Control Service 126 Network Control Service 200 Hardware Layer 300 User interface 301 Authentication information check mechanism 302 Authentication information table 303 Communication mechanism 304 Association information generation mechanism 305 Engine 400 Portable storage medium 401 User authentication information 402 Association information G1 Authentication information input screen

Claims (19)

  A communication terminal apparatus that uses a condition for exchanging predetermined communication establishment authentication information as a condition for establishing a communication connection with a communication partner apparatus, and that uses user authentication based on input of predetermined user authentication information as a condition for use. Information that combines the other party identification information for identifying the communication partner apparatus, the own apparatus identification information for identifying the own apparatus, and the shared identification information shared between the own apparatus and the communication partner apparatus as the establishment authentication information. Communication establishment authentication information generation means for generating communication establishment authentication information storage means for storing the communication establishment authentication information generated by the communication establishment authentication information generation means, and user authentication for storing user authentication information for authentication An information storage unit; a user for performing the user authentication process based on the input user information and the authentication user authentication information stored in the user authentication information storage unit; The authentication means, and a selection means for selecting the communication establishment authentication information appropriate for connection establishment of the communication from a plurality of communication establishment authentication information stored in the communication establishment authentication information storage means based on the user authentication result; And a communication establishment means for performing communication establishment processing with the communication partner apparatus using the communication establishment authentication information selected by the selection means.   2. The communication terminal according to claim 1, wherein the communication establishment authentication information generation unit generates the communication establishment authentication information by using information that can be commonly used between different communication terminal apparatuses as the self apparatus identification information. apparatus.   3. The communication establishment authentication information storage unit is a storage unit built in the communication terminal device or a storage unit that is externally attached in a detachable manner and has portability. Communication terminal device.   The communication establishment authentication information storage means is a storage means that is externally attached so as to be detachable and has portability, and the user authentication information is stored together with the communication establishment authentication information. The communication terminal device according to claim 2.   The communication terminal device includes an encryption unit that encrypts the communication establishment authentication information stored in a communication establishment authentication information storage unit that is externally attached so as to be attachable / detachable and / or the user authentication information. The communication terminal device according to claim 3 or 4, characterized in that   6. The communication terminal according to claim 1, wherein the selection unit selects the communication establishment authentication information on condition that the user authentication unit succeeds in the user authentication. apparatus.   The selection means selects the communication establishment authentication information on the condition that the communication establishment authentication information is generated using information that can be commonly used between different communication terminal apparatuses as the self apparatus identification information. The communication terminal device according to claim 1, wherein the communication terminal device is performed.   The selection means selects the communication establishment authentication information on the condition that the communication establishment authentication information is generated by using identification information unique to the communication terminal apparatus as the own apparatus identification information. The communication terminal device according to any one of claims 1 to 6.   9. The communication establishment authentication information generation unit generates the communication establishment authentication information on condition that the user authentication unit succeeds in the user authentication. The communication terminal device described.   The communication terminal device includes a plurality of types of operation functions that can be used by the communication partner device by establishing the communication connection, and the communication establishment authentication information generating unit assigns the use level of the operation function. The communication terminal device according to any one of claims 1 to 9, wherein communication establishment authentication information is generated.   A communication establishment control method in a communication terminal apparatus that uses a condition for exchanging predetermined communication establishment authentication information as a condition for establishing a connection for communication with a communication partner apparatus and that uses user authentication based on input of predetermined user authentication information The communication establishment authentication information includes partner identification information for identifying the communication partner device, host device identification information for identifying the host device, and sharing shared between the host device and the communication partner device. A communication establishment authentication information generation process for generating information combining identification information; a communication establishment authentication information storage process for storing the communication establishment authentication information generated by the communication establishment authentication information generation process in a communication establishment authentication information storage unit; User authentication processing for performing the user authentication processing based on the input user information and user authentication information for authentication stored in a predetermined user authentication information storage means. A selection process for selecting communication establishment authentication information appropriate for connection establishment of the communication from a plurality of communication establishment authentication information stored in the communication establishment authentication information storage unit based on the user authentication result; A communication establishment control method, comprising: performing communication establishment processing for performing communication establishment processing with the communication partner apparatus using the communication establishment authentication information selected in the selection processing.   12. The communication establishment authentication according to claim 11, wherein the communication establishment authentication information generation processing generates the communication establishment authentication information using information that can be commonly used between different communication terminal apparatuses as the self apparatus identification information. Control method.   12. The communication establishment authentication information storing process stores the user authentication information together with the communication establishment authentication information in a communication establishment authentication information storage unit that is externally attached and detachable and has portability. Item 13. The communication establishment control method according to Item 12.   The communication establishment authentication information storage process includes storing the communication establishment authentication information and / or the user authentication information in an encrypted communication establishment authentication information storage unit that is externally attached and detachable. The communication establishment control method according to any one of claims 11 to 13, characterized in that:   In the selection process, the user authentication process succeeds in user authentication, and the communication establishment authentication information is generated using information that can be used in common between different communication terminal apparatuses as the own apparatus identification information. The communication establishment control method according to any one of claims 11 to 14, wherein the communication establishment authentication information is selected on condition that at least one of them is satisfied. The selection process is characterized in that the communication establishment authentication information is selected on the condition that the communication establishment authentication information is generated using identification information unique to the communication terminal apparatus as the own apparatus identification information. The communication establishment control method according to any one of claims 11 to 14.   The communication establishment authentication information generation process generates the communication establishment authentication information on condition that user authentication is successful in the user authentication process. Communication establishment control method.   A communication establishment control program for causing a computer to execute the communication establishment control method according to any one of claims 11 to 17.   A computer-readable recording medium on which the communication establishment control program according to claim 18 is recorded.

Images