JP2010092456A - External authentication device, use authorization information server, information processing system, authentication method, use authorization information management method, program, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable a user to use an electronic device connected to any network by authenticating the electronic device by a corresponding external authenticatin device in an organization having a plurality of networks to each of which one external authentication device and a plurality of electronic devices (such as MFPs) are connected, etc. <P>SOLUTION: The external authentication device 5 determines whether use authorization information (the one in which user information is associated with device information of the MFP) including user information read by an IC card reader is stored in a memory, when the use authorization information is not stored, transmits a use authorization information acquisition request including the user information to other external authentication device 15 via a user authentication information server 100, when the corresponding use authorization information is acquired from the external authentication device 15 via the use authorization information server 100, stores the use authorization information in the memory, displays device information in the use authorization information, and when the device information is selected by external instructions, transmits a starting request to an MFP corresponding to the device information. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an external authentication device for authenticating a user of each of a plurality of electronic devices (image forming devices, etc.), and usage authority information of the user of each electronic device capable of communicating with each of the plurality of external authentication devices. Use authority information server to manage, information processing system including the external authentication apparatus and the use authority information server, an authentication method in the external authentication apparatus, a use authority information management method in the use authority information server, the external authentication apparatus, and The present invention relates to each program for realizing each necessary function (function related to the present invention) for each computer that controls the above-mentioned use authority information server, and to each computer-readable recording medium that records each program.

The authentication system of the image forming apparatus determines whether the user is authorized to use the image forming apparatus based on the use authority information of the image forming apparatus when the user tries to use the image forming apparatus. To do.
For example, the use restriction management device described in Patent Document 1 restricts the use of a plurality of image forming apparatuses connected via a network. Therefore, when user information is input from each image forming apparatus, the use restriction management apparatus is used. Based on the user information, an external authentication device (authentication server) is inquired about the user's use authority, and based on the result, whether or not the user is appropriate is notified to the image forming apparatus that is the user information transmission source. ing.

  In addition, when the user authority of the image forming apparatus is authenticated in order to make it easier to make settings related to the authority to use the image forming apparatus used in an organization having a plurality of branches. First, the user is authenticated using the use authority information inside the image forming apparatus, and if the user cannot be authenticated using the use authority information, the user is authenticated via an external network such as the Internet. An authentication system is also known in which access is performed and authentication is performed using use authority information stored therein (see Patent Document 2).

In such an authentication system, when the authentication cannot be executed inside the image forming apparatus, if the external network for communication with the authentication server is down or the authentication server has failed, the authentication server There is a problem that access cannot be performed and authentication using the usage right information stored therein cannot be executed.
On the other hand, in the above-described organization, there is a case where a network in which one authentication server and a plurality of image forming apparatuses are connected is provided for each branch or each business unit.
In such a case, since authentication is performed in units of branches, business units, etc., there is no problem that authentication cannot be performed due to an external network going down or an authentication server failure. In other words, it is possible to reduce the risk that the authentication becomes impossible when the external network goes down during the authentication of the user of the image forming apparatus or when the authentication server fails.

  However, in the case described above, the following new problem arises. For example, when an image forming apparatus connected to a network corresponding to each business unit is used, a user is authenticated using an authentication server connected to the same network as the image forming apparatus. Therefore, when a user who belongs to a business unit moves to another business unit, the user's usage authority information is not stored in the authentication server connected to the destination network. The image forming apparatus connected to the cannot be used.

  The present invention has been made in view of the above points. In an organization or the like having a plurality of networks each connected with one external authentication device and a plurality of electronic devices, which network the user connects to It is another object of the present invention to make it possible to use an electronic device that has been authenticated by a corresponding external authentication device.

  In order to achieve the above object, the present invention provides an external authentication device, a usage authority information server, an information processing system including the external authentication device and the usage authority information server shown in the following (1) to (15), An authentication method in an external authentication device, a usage authority information management method in the usage authority information server, a program to be executed by each computer that controls the external authentication device and the usage authority information server, and each program recorded therein Each computer-readable recording medium is provided.

(1) An external authentication device that has first communication means for communicating with a plurality of electronic devices and authenticates a user of each electronic device, the external authentication device and other external authentication devices Second communication means that communicates with the usage authority information server that manages the usage authority information of each electronic device that can communicate with each other, and the user information of each electronic device that can be transmitted to the external authentication device And authority information storage means for associating and storing device information of each electronic device as usage authority information, user information reading means for reading user information, and a user read by the user information reading means Usage authority information presence / absence determining means for determining whether or not usage authority information including information is stored in the usage authority information storage means (performing user authentication), and usage authority including the read user information. When it is determined that the information is stored in the use authority information storage unit by the use authority information presence / absence determination unit (user authentication is successful), the device information in the use authority information is notified. 1 and the use authority information including the read user information is determined not to be stored in the use authority information storage means by the use authority information presence / absence determining means (user authentication is In the case of failure), a usage authority information acquisition request transmitting means for transmitting a usage authority information acquisition request including the user information to the usage authority information server and a usage authority information acquisition request from the usage authority information server are received. The usage authority information including the user information in the usage authority information acquisition request received by the usage authority information acquisition request receiving means. First usage authority information processing means for reading from the authority information storage means and transmitting it to the usage authority information server and deleting the usage authority information from the usage authority information storage means; and usage authority information from the usage authority information server Usage authority information acquisition means for acquiring information, second usage authority information processing means for additionally storing the usage authority information acquired by the usage authority information acquisition means in the usage authority information storage means, and the acquired usage authority A second device information notifying unit for notifying device information in the information; a device information selecting unit for selecting the device information notified by the first or second device information notifying unit by an external instruction; and the device. There is provided activation request transmission means for transmitting an activation request to an electronic device corresponding to the device information selected by the information selection means.

(2) Use authority to manage use authority information of users of electronic devices each having communication means for communicating with a plurality of external authentication apparatuses in (1) and capable of communicating with each of the plurality of external authentication apparatuses. Management information storage that is an information server and stores the external authentication device information of each external authentication device and the user information of the user of each electronic device that can communicate with each external authentication device as management information in association with each other Means, a usage authority information acquisition request receiving means for receiving a usage authority information acquisition request from each of the external authentication devices, and a destination of the usage authority information acquisition request received by the usage authority information acquisition request receiving means. Transmission destination determination means for determining from among the external authentication devices based on the user information in the authority information acquisition request and the management information stored in the management information storage means, and the transmission destination determination From the use authority information acquisition request transmission means for transmitting the received use authority information acquisition request to the transmission destination determined by the stage, and from the transmission destination of the use authority information acquisition request transmitted by the use authority information acquisition request transmission means Use authority information acquisition means for acquiring the use authority information, and when the use authority information is acquired by the use authority information acquisition means, among the pieces of management information stored in the management information storage means, the use authority Change the external authentication device information corresponding to the transmission destination of the transmitted use right information acquisition request in the management information including the user information in the information to the external authentication device information corresponding to the transmission source of the use right information acquisition request And an information processing means for transmitting the acquired use authority information to the transmission source.

(3) In the external authentication apparatus of (1), additional storage permission / non-permission determining means for determining whether or not the acquired use authority information can be additionally stored in the use authority information storage means, and the acquired use authority information Is read out from the use authority information storage means, the predetermined use authority information stored in the use authority information storage means is read out and the use authority information server is read out. And third usage authority information processing means for storing the acquired usage authority information in the usage authority information storage means instead of the usage authority information.

(4) In the external authentication device of (3), each use authority information stored in the use authority information storage means is added with a storage date and time that is the date and time when the use authority information is stored. When the use authority information is stored in the use authority information storage means, a storage date and time update means for updating the storage date and time added to the use authority information to the current date and time is provided, and the predetermined use authority information is The usage authority information to which the oldest storage date / time is added among the usage authority information stored in the usage authority information storage means is used.

(5) In the external authentication device of (3), the last use date and time which is the date and time when the corresponding user last used the external authentication device for each use right information stored in the use right information storage unit. Is added, and the use authority information including the read user information is determined to be stored in the use authority information storage unit by the use authority information presence / absence determination unit, the use authority Of the usage authority information stored in the information storage means, the last used date and time added to the usage authority information including the user information read by the user information reading means is used as the read user information. If it is determined by the use authority information presence / absence determining means that the use authority information is not stored in the use authority information storage means, the second or third A last use date and time update means for updating the last use date and time added to the use right information stored in the use right information storage means by the use right information processing means to the current date and time, and the predetermined use right information is The use authority information to which the oldest last use date is added among the use authority information stored in the use authority information storage means.

(6) In the external authentication device of (3), each usage authority information stored in the usage authority information storage means is added with a usage count which is the number of times the corresponding user has used the external authentication device. When the use authority information including the read user information is determined to be stored in the use authority information storage unit by the use authority information presence determination unit, the use authority information storage unit Among the usage authority information stored in the user information, the usage number added to the usage authority information including the user information read by the user information reading means is used, and the usage authority including the read user information is used. If it is determined by the use authority information presence / absence determining means that the information is not stored in the use authority information storage means, the second or third use authority information processing is performed. Use number increment means for incrementing the number of uses added to the use authority information stored in the use authority information storage means by the means, and the predetermined use authority information is stored in the use authority information storage means. The usage authority information is added with the least number of times of use among the stored usage authority information.

(7) In the external authentication device of (3), each usage authority information stored in the usage authority information storage means has a usage priority that is a priority with which a corresponding user can use the external authentication device. The predetermined use authority information is used as the use authority information to which the lowest use priority is added among the respective use authority information stored in the use authority information storage means. .

(8) Use of users of electronic devices each having communication means for communicating with a plurality of external authentication devices according to any one of (3) to (7) and capable of communicating with each of the plurality of external authentication devices. A usage authority information server that manages authority information, and manages the external authentication device information of each external authentication device and the user information of each electronic device user that can communicate with each external authentication device in association with each other Management information storage means for storing information, usage authority information storage means for storing usage authority information, usage authority information acquisition request receiving means for receiving usage authority information acquisition requests from the external authentication devices, and the usage authority The transmission destination of the use authority information acquisition request received by the information acquisition request reception means is based on the user information in the use authority information acquisition request and each management information stored in the management information storage means. A transmission destination determination means for determining from among the external authentication devices, a usage authority information acquisition request transmission means for transmitting the received usage authority information acquisition request to the transmission destination determined by the transmission destination determination means, When the usage authority information acquisition unit acquires the usage authority information from the transmission destination of the usage authority information acquisition request transmitted by the usage authority information acquisition request transmission unit, and when the usage authority information is acquired by the usage authority information acquisition unit The external authentication device corresponding to the transmission destination of the transmitted use right information acquisition request in the management information including the user information in the use right information among the pieces of management information stored in the management information storage unit First information processing means for changing the information to external authentication device information corresponding to the transmission source of the usage authority information acquisition request, and transmitting the acquired usage authority information to the transmission source; After the obtained usage authority information is transmitted by the first information processing means, the usage authority information receiving means for receiving the usage authority information from the transmission destination, and the usage authority received by the usage authority information receiving means Second information processing means for storing information in the use authority information storage means and deleting management information including user information in the use authority information among the management information stored in the management information storage means Are provided.

(9) In the external authentication device of (1), the user information reading means is a means for reading the user information of the user together with the user's attached information. Attached usage authority information storage means that associates and stores user attachment information and device information of each electronic device as usage authority information, and is read by the user information reading means by the usage authority information acquisition request transmission means. Whether or not the usage authority information including the auxiliary information read by the user information reading means is stored in the auxiliary usage authority information storage means when the transmission of the usage right information acquisition request including the user information fails. Attached usage authority information presence / absence judging means for determining whether or not the usage authority information including the read attached information is the above-mentioned attached usage authority information existence judgment A third device information notifying unit for notifying device information in the use authority information when it is determined by the means to be stored in the attached use authority information storage unit (user authentication is successful); It is provided.

(10) In the external authentication device according to (9), the user information storing means for storing user information and the use including the user information read by the user information reading means by the use authority information acquisition request transmitting means. Communication between user information storage control means for storing the user information read by the user information reading means in the user information storage means when the transmission of the authority information acquisition request fails, and the external authentication device Communication availability determination means for determining whether communication is possible, and when the communication availability determination means determines that communication with the external authentication device is possible, user information is stored in the user information storage means. A user information presence / absence determining means for determining whether or not the user authority information acquisition request transmitting means stores user information in the user information storage means. If it is determined by the use's information presence determining means also is for transmitting the use permission information acquisition request including the user information to said usage rights information server.

(11) In the external authentication device of (9), when it is determined that the usage authority information including the read auxiliary information is stored in the auxiliary usage authority information storage unit by the auxiliary usage authority information existence determination unit In addition, among the read attached information, attached information presence / absence judging means for judging whether or not there is attached information that is not stored in the attached use authority information storage means,
When the auxiliary information presence / absence determining means determines that there is auxiliary information that is not stored in the auxiliary usage authority information storage means, among the read auxiliary information, the auxiliary usage authority information storage means stores the auxiliary information. Provided with auxiliary information storage control means for storing additional auxiliary information in the auxiliary use authority information storage means, and communication enable / disable determining means for determining whether or not communication with the external authentication device is possible. In addition, when it is determined by the communication availability determination unit that communication with the external authentication device is possible, it is determined whether or not attached information that does not constitute use authority information is stored in the attached use authority information storage unit. A means for determining, and the accessory information that does not constitute the usage authority information is attached to the usage authority information acquisition request transmitting means by the accessory information presence / absence determining means. Means for transmitting a use right information acquisition request including the attached information to the use right information server when it is determined that the second use right information processing means is stored. , If the usage authority information acquired by the usage authority information acquisition means is a usage authority information acquisition request including the attached information transmitted by the usage authority information acquisition request transmission means, the acquired usage Means for additionally storing authority information in the attached use authority information storage means is provided.

(12) In the external authentication device according to any one of (9) to (11), the attached information is theme information indicating a product theme related to a user.
(13) In the external authentication device of any one of (9) to (11), the attached information is organization information indicating an organization to which the user belongs.
(14) In the external authentication device according to any one of (9) to (11), the attached information is position information indicating a position to which the user belongs.
(15) In the external authentication device of any one of (9) to (11), the attached information is business information indicating the business content of the user.

(16) In the external authentication device according to any one of (9) to (11), the auxiliary use authority information storage unit includes a plurality of types of auxiliary information of users of electronic devices that can transmit to the external authentication device and the external authentication device. Means for associating and storing device information of each electronic device as use authority information, provided with priority order storage means for storing priorities corresponding to the plurality of types of attached information, and including the attached use authority information presence / absence judging means When the use authority information acquisition request including the read user information by the use authority information acquisition request transmission means fails to be transmitted, the priority is read with reference to each priority order in the priority storage means. Among the plural types of attached information corresponding to the user information, the use authority information including the attached information is recorded in the attached use authority information storage means in order from the attached information having the highest priority. It is obtained by the means for determining whether or not it is.

(17) In the usage authority information server of (2), the external authentication device information of each external authentication device and the attached information of all users of each electronic device that can communicate with each external authentication device are associated and managed When the usage right information acquisition request received by the usage right information acquisition request receiving means includes auxiliary information, the usage right information including the auxiliary information is stored in the auxiliary management information storage. Use authority information transmitting means for reading out from the means and transmitting to the transmission source of the received use authority information acquisition request.

(18) A plurality of external authentication devices of (1) and communication means for communicating with each of the external authentication devices, and use authority information of users of the respective electronic devices that can communicate with each of the external authentication devices. An information processing system comprising a use authority information server to be managed, wherein the use authority information server uses external authentication device information of each external authentication device and each electronic device capable of communicating with each external authentication device. Management information storage means for associating and storing user information of a user as management information, usage authority information acquisition request receiving means for receiving a usage authority information acquisition request from each of the external authentication devices, and acquisition of the usage authority information The transmission destination of the usage authority information acquisition request received by the request receiving means is based on the user information in the usage authority information acquisition request and the management information stored in the management information storage means. A transmission destination determination means for determining from among the external authentication devices, a usage authority information acquisition request transmission means for transmitting the received usage authority information acquisition request to the transmission destination determined by the transmission destination determination means, When the usage authority information acquisition unit that acquires the usage authority information from the transmission destination of the usage authority information acquisition request transmitted by the usage authority information acquisition request transmission unit and the usage authority information is acquired by the usage authority information acquisition unit In addition, among the pieces of management information stored in the management information storage means, external authentication corresponding to the transmission destination of the transmitted use right information acquisition request in the management information including the user information in the use right information First information processing means for changing device information to external authentication device information corresponding to a transmission source of the use authority information acquisition request, and transmitting the acquired use authority information to the transmission source; It is those provided.

(19) Use authority information for managing use authority information of a user of each electronic device capable of communicating with the first communication means that communicates with each of the plurality of electronic devices, and the external authentication device and other external authentication devices. Use authority for storing second communication means for communicating with the server, user information of the user of each electronic device capable of communicating with the external authentication device, and device information of each electronic device in association with each other. An authentication method in an external authentication device for authenticating a user of each electronic device having information storage means and user information reading means for reading user information and capable of communicating with the external authentication device, Use authority information presence / absence determination step for determining whether or not the use authority information including the user information read by the user information reading means is stored in the use authority information storage means, and the read When it is determined that the use authority information including the user information is stored in the use authority information storage unit by the use authority information presence / absence determination step, the first device that notifies the device information in the use authority information When it is determined that the use authority information including the device information notification step and the read user information is not stored in the use authority information storage unit by the use authority information presence determination step, the user information A usage authority information acquisition request transmitting step for transmitting to the usage authority information server, a usage authority information acquisition request receiving step for receiving a usage authority information acquisition request from the usage authority information server, Read usage authority information including the user information in the usage authority information acquisition request received by the usage authority information acquisition request receiving process from the usage authority information storage means. First usage authority information processing step for transmitting the usage authority information to the usage authority information server and deleting the usage authority information from the usage authority information storage means; and usage authority information for acquiring the usage authority information from the usage authority information server An acquisition step, a second usage authority information processing step for additionally storing the usage authority information acquired in the usage authority information acquisition step in the usage authority information storage means, and device information in the acquired usage authority information. The second device information notifying means for notification, the device information selecting step for selecting the device information notified by the first or second device information notifying step by an external instruction, and the device information selecting step are selected. And an activation request transmission step of transmitting an activation request to the electronic device corresponding to the device information.

(20) Communication means for communicating with a plurality of external authentication devices according to (1), external authentication device information for each of the plurality of external authentication devices, and users of each electronic device that can communicate with each external authentication device Management information storage means for storing management information in association with each other's user information, and a usage authority information server for managing usage authority information of users of the respective electronic devices that can communicate with the external authentication devices. In the usage authority information management method in the above, the usage authority information acquisition request receiving step for receiving the usage authority information acquisition request from each of the external authentication devices, and the usage authority information acquisition received by the usage authority information acquisition request receiving step The transmission destination of the request is determined from the external authentication devices based on the user information in the use authority information acquisition request and the management information stored in the management information storage means. Transmitted by the transmission destination determination step, the usage authority information acquisition request transmission step for transmitting the received usage authority information acquisition request to the transmission destination determined by the transmission destination determination step, and the usage authority information acquisition request transmission step. Stored in the management information storage means when the usage authority information acquisition step for acquiring the usage authority information from the transmission destination of the usage authority information acquisition request and the usage authority information acquired by the usage authority information acquisition step. Among the management information, the external authentication device information corresponding to the transmission destination of the transmitted usage authority information acquisition request in the management information including the user information in the usage authority information is transmitted. An external information processing apparatus corresponding to the original, and an information processing step of transmitting the acquired use authority information to the transmission source.

(21) Use authority information for managing the first communication means for communicating with each of the plurality of electronic devices and the user authority information of each electronic device that can communicate with the external authentication device and the other external authentication devices. Use authority for storing second communication means for communicating with the server, user information of the user of each electronic device capable of communicating with the external authentication device, and device information of each electronic device in association with each other. A computer having an information storage means and a user information reading means for reading user information, and controlling the external authentication apparatus for authenticating a user of each electronic device capable of communicating with the external authentication apparatus; Use authority information presence / absence determination function for determining whether or not the use authority information including the user information read by the person information reading means is stored in the use authority information storage means, and the read When it is determined that the use authority information including the user information is stored in the use authority information storage unit by the use authority information presence / absence determination function, first information for informing device information in the use authority information is notified. When it is determined that the device authority information function and the usage authority information including the read user information are not stored in the usage authority information storage unit by the usage authority information presence / absence determination function, the user information A usage authority information acquisition request transmission function for transmitting a usage authority information acquisition request including the usage authority information acquisition request to the usage authority information server, a usage authority information acquisition request reception function for receiving a usage authority information acquisition request from the usage authority information server, Read usage authority information including the user information in the usage authority information acquisition request received by the usage authority information acquisition request receiving function from the usage authority information storage means. First usage authority information processing function for transmitting the usage authority information to the usage authority information server and deleting the usage authority information from the usage authority information storage means, and usage authority information for acquiring the usage authority information from the usage authority information server An acquisition function, a second use authority information processing function for additionally storing the use authority information acquired by the use authority information acquisition function in the use authority information storage unit, and device information in the acquired use authority information. Selected by the second device information notification function to be notified, the device information selection function for selecting the device information notified by the first or second device information notification function by an external instruction, and the device information selection function. This is a program for realizing an activation request transmission function for transmitting an activation request to an electronic device corresponding to the device information.

(22) A computer-readable recording medium on which the program of (21) is recorded.
(23) Communication means for communicating with a plurality of external authentication devices in (1), external authentication device information for each of the plurality of external authentication devices, and users of each electronic device that can communicate with each of the external authentication devices Management information storage means for storing management information in association with each other's user information, and a usage authority information server for managing usage authority information of users of the respective electronic devices that can communicate with the external authentication devices. A use authority information acquisition request reception function for receiving a use authority information acquisition request from each of the external authentication devices, and a transmission destination of the use authority information acquisition request received by the use authority information acquisition request reception function. Transmission destination determination based on the user information in the use authority information acquisition request and each management information stored in the management information storage means , A usage authority information acquisition request transmission function for transmitting the received usage authority information acquisition request to the destination determined by the transmission destination determination function, and a usage authority transmitted by the usage authority information acquisition request transmission function The usage authority information acquisition function for acquiring the usage authority information from the transmission destination of the information acquisition request, and each management stored in the management information storage means when the usage authority information is acquired by the usage authority information acquisition means Among the information, external authentication device information corresponding to the transmission destination of the transmitted usage authority information acquisition request in the management information including the user information in the usage authority information corresponds to the transmission source of the usage authority information acquisition request This is a program for realizing an information processing function for changing to external authentication device information to be transmitted and transmitting the acquired use authority information to the transmission source.
(24) A computer-readable recording medium on which the program of (23) is recorded.

Here, for example, each external authentication device and usage authority information server that constitute the information processing system according to the present invention execute the following operations.
Each external authentication device has usage authority information including user information read by the user information reading means as usage authority information storage means (user information of the user of each electronic device that can be transmitted to the external authentication apparatus and The device information of each electronic device is stored in association (stored as usage authority information) (uses user authentication), and includes the read user information. When the authority information is stored in the use authority information storage means (authentication is successful), the device information in the use authority information is notified, and when the notified device information is selected by an instruction from the outside, An activation request is transmitted to the electronic device corresponding to the selected device information.
On the other hand, when the usage authority information including the read user information is not stored in the usage authority information storage unit (authentication has failed), the usage authority information acquisition request including the user information is used as the usage authority information. Send to server.

When the usage authority information server receives the usage authority information acquisition request from the external authentication device, the usage authority information acquisition request is sent to the user information in the usage authority information acquisition request and the management information storage means (each external authentication Based on each management information stored in the management information), the external authentication device information of the device and the user information of the user of each electronic device that can communicate with each external authentication device in association with each other. Then, it discriminates from each of the external authentication devices, and transmits the received use authority information acquisition request to the determined transmission destination.
The external authentication device that has received the usage authority information acquisition request reads the usage authority information including the user information in the usage authority information acquisition request from the usage authority information storage means, and transmits it to the usage authority information server. The authority information is deleted from the use authority information storage means.

When the usage authority information server acquires the usage authority information from the transmission destination of the received usage authority information acquisition request, among the management information stored in the management information storage means, the user information in the usage authority information Change the external authentication device information corresponding to the transmission destination of the transmitted use authority information acquisition request to the external authentication device information corresponding to the transmission source of the use authority information acquisition request. Send the acquired usage rights information.
When each external authentication device acquires usage authority information from the usage authority information server in response to a usage authority information acquisition request to the usage authority information server, each external authentication device additionally stores the acquired usage authority information in the usage authority information storage means. In addition, when the device information in the acquired use authority information is notified and the notified device information is selected by an instruction from the outside, an activation request is transmitted to the electronic device corresponding to the selected device information.

  According to the present invention, in an organization or the like having a plurality of networks in which one external authentication device and a plurality of electronic devices are connected to each other, use of each electronic device connected to each network is used. A use authority information server that manages authority information is provided, and the external authentication apparatus and the use authority information server operate as described above, so that the external authentication apparatus corresponding to the electronic device on the network that the user wants to use is provided. Since the user authority information can be easily transferred, the electronic device connected to any network can be used after being authenticated by the corresponding external authentication device.

It is a conceptual diagram which shows the example of a network structure of the information processing system using the external authentication apparatus and usage authority information server which are 1st Embodiment which is this invention. It is a block diagram which shows the hardware structural example of the external authentication apparatus 5 of FIG. It is a block diagram which shows the hardware structural example of the use authority information server 100 of FIG. It is a figure for demonstrating the part in connection with this invention of the information processing system shown in FIG. It is a flowchart which shows the 1st example of the starting process concerning this invention by the external authentication apparatuses 5 and 15 of FIG. 1, and the use authority information server 100.

It is a flowchart which similarly shows the 2nd example of starting control concerning this invention. It is a figure for demonstrating the part in connection with this invention in the information processing system of 2nd Embodiment of this invention. It is a flowchart which shows the 3rd example of the starting process concerning this invention by the external authentication apparatus 15 of FIG. FIG. 7 is a flowchart showing an example of processing when the external authentication device 15 of FIG. 1 becomes connectable to the usage authority information server 100.

Hereinafter, embodiments for carrying out the present invention will be specifically described with reference to the drawings.
[First Embodiment]
First, the configuration of an information processing system that uses an external authentication device and a usage authority information server according to a first embodiment of the present invention will be described with reference to FIG.
FIG. 1 is a conceptual diagram showing a network configuration example of the information processing system.
This information processing system includes each electronic device of a business division (may be a department such as a branch) A, each electronic device of a business division B, and a use authority information server 100.

In the business division A, a plurality of digital multifunction peripherals (hereinafter referred to as “MFPs”) 1 to 3 as electronic devices, an external authentication device 5 for authenticating those users, and a proxy server in consideration of security. And a firewall 9 configured by the above. These electronic devices are connected via the LAN 10 (other network may be used), but by serial connection conforming to the RS-485 standard, parallel connection conforming to the SCSI (Small Computer System Interface) standard, etc. You may go.
The external authentication device 5 can communicate with the usage authority information server 100 via the firewall 9 on the LAN 10 and the Internet (or another external network such as a public line) 200.

The business unit B includes, as electronic devices, a plurality of MFPs 11 to 13, an external authentication device 15 for authenticating those users, and a firewall 19 constituted by a proxy server. These electronic devices are connected via the LAN 20 (other network may be used), but as with the business unit A, serial connection based on the RS-485 standard, parallel connection based on the SCSI standard, etc. You may go by.
The external authentication device 15 can communicate with the usage authority information server 100 via the firewall 19 on the LAN 20 and the Internet 200.

  Each of the external authentication devices 5 and 15 reads user information for identifying the MFP user (hereinafter, also simply referred to as “user”) recorded on the IC card by the IC card reader. The activation request is transmitted to the MFP having the use authority, and the control at that time will be described in detail later. The user information may be read by biometric authentication or the like. User information can also be input by a PIN code or the like from an external terminal such as a PC (personal computer) (not shown).

The MFPs 1 to 3 are image forming apparatuses having various functions such as a scan function, a copy function, and a fax (FAX) function. The MFPs 1 to 3 are communicably connected to the external authentication device 5 via the LAN 10 and are activated from the external authentication device 5. When the request is received, it is activated so that it can be used by the user, and the user is authenticated by shifting from the “inoperable state” to the “operable state”.
The MFPs 11 to 13 are image forming apparatuses similar to the MFPs 1 to 3, and are communicably connected to the external authentication apparatus 15 via the LAN 20, and can be used by the user when receiving an activation request from the external authentication apparatus 15. User authentication is realized by starting the system so that it is possible and shifting from the “inoperable state” to the “operable state”.

In addition to MFPs, other image forming apparatuses such as analog copying machines, digital copying machines, and fax machines, or image reading apparatuses such as scanner devices, network home appliances, vending machines, medical equipment, power supply devices, air conditioners, etc. Various electronic devices such as systems, measuring systems for gas, water, electricity, etc., AV equipment, game equipment, etc. can also be used.
The usage authority information server 100 uses the usage authority information of the users of the MFPs 1 to 3 that can communicate with the external authentication device 5 of the business unit A and the MFPs 11 to 13 that can communicate with the external authentication device 15 of the business unit B, respectively. Manage user usage rights information. This usage authority information server 100 also has a function as a proxy server.

Next, the configuration of the external authentication device 5 in FIG. 1 will be described with reference to FIG. Since the external authentication device 15 has the same configuration, its illustration and description are omitted.
FIG. 2 is a block diagram illustrating a hardware configuration example of the external authentication device 5.
The external authentication device 5 includes a control unit 51, an IC card reader 52, a display 53, and a display operation unit 54.
The control unit 51 includes a CPU 61, SDRAM 62, flash ROM 63, and LAN interface (LAN / I / F) 64. These are used for reading a user ID, which is user information for identifying the users of the MFPs 1 to 3, and authenticating the user.

  The CPU 61 is a central processing unit for controlling the entire external authentication device 5, reads necessary programs (software) and information from the flash ROM 63, stores (stores) them in the SDRAM 62, executes the programs, and executes the IC By controlling the card reader 52, display 53, LAN interface 64, etc., user information reading means, use authority information presence / absence determination means, first device information notification means, use authority information acquisition request, which are functions related to the present invention, are provided. Sending means, usage authority information acquisition request receiving means, first usage authority information processing means, usage authority information acquisition means, second usage authority information processing means, second device information notification means, device information selection means, activation request Transmission means, additional storage availability determination means, third usage authority information processing means, storage date update means, last use date Updating means, and can function as a usage count in decrement means.

  The SDRAM 62 is a readable / writable memory used as a program memory for storing a program executed by the CPU 61, an information memory for storing various information such as use authority information described later, a work memory used when the CPU 61 performs processing, and the like. is there. The SDRAM 62 can function as a usage authority information storage unit together with the flash ROM 63.

  The flash ROM 63 is a non-volatile semiconductor memory that stores programs executed by the CPU 61 and various types of information. Instead of the flash ROM 63, other nonvolatile semiconductor memory such as an EEPROM or a memory card or a nonvolatile recording medium such as an HDD (hard disk device) can be used together with the fixed ROM. Further, in addition to the flash ROM 63, a non-volatile recording medium such as a fixed ROM or HDD can be added.

  The LAN interface 64 is communication means (first and second communication means) that performs interface control with the MFPs 1 to 3 connected to the LAN 10. This is used to transmit an activation request to the MFP for which the authenticated user has usage authority. In addition, when the usage authority information of the user who intends to use the external authentication device 5 is not stored in the external authentication device, a request for acquiring the usage authority information of the user is transmitted to the usage authority information server 100. used. These communications are realized by secure communications such as SSL (Secure Socket Layer) communications.

The IC card reader 52 is means for reading a user ID (user information) recorded on the IC card.
The external authentication device 5 reads (acquires) the user ID from the IC card reader 52 and uses it based on the user ID and “each use authority information” as shown in Table 1 stored in the SDRAM 62. The device information (device information) of the MFP to which the user (owner of the IC card in which the read user ID is recorded) has the use authority is searched from the device information of each MFP 1 to 3.

  Each usage authority information includes device information (hereinafter also simply referred to as “device information”) for identifying an MFP (MFP usable by each user) having the usage authority for each user, and each user uses A list of upper limit values (hereinafter also simply referred to as “print upper limit frequency”) of the number of possible prints (copying, etc.) is shown in a list. In the example of Table 1, user IDs are used to identify each user. “123”, “456”, “MFP1,” “MFP2,” “MFP3,” which are device information for identifying each of the MFPs 1 to 3 that can be used by each user, and printing that can be used by each user. The upper limit numbers “100” and “500” are associated with each other.

The display 53 is a display unit that displays various types of information. This display 53 is used to display a list of device information of MFPs for which the user has authority to use.
The display operation unit 54 is an operation means for operating a screen displayed on the display 53. For example, when the user selects an MFP that the user wants to use from a list of device information of the MFP displayed on the display 53, the display operation unit 54 is operated. used. The display operation unit 54 can function as a device information selection unit.

Instead of the display 53 and the display operation unit 54, an integrated display and its operation unit such as a touch panel may be used.
In this embodiment, the user brings his / her IC card into contact with the IC card reader 52 and reads the user ID recorded on the IC card. Although the ID can be read, it is also possible to read (accept) the user ID by inputting the user ID with a PIN code or the like by an operation on the display operation unit 54.

Next, the configuration of the usage authority information server 100 in FIG. 1 will be described with reference to FIG. Note that a description of the function as a proxy server is omitted.
FIG. 3 is a block diagram illustrating a hardware configuration example of the usage authority information server 100.
The usage authority information server 100 includes a CPU 101, a ROM 102, an SDRAM 103, an HDD (hard disk device) 104, and a network interface (hereinafter “interface” is referred to as “I / F”) 105.

  The CPU 101 is a central processing unit for managing and controlling the entire usage authority information server 100. The CPU 101 reads out necessary programs and information from the HDD 104, stores them in the SDRAM 102, executes the programs, and sets up the network I / F 105. By controlling, usage authority information acquisition request receiving means, transmission destination determining means, usage authority information acquisition request transmitting means, usage authority information acquiring means, information processing means (first information processing means, The second information processing means) and the function of use authority information receiving means can be achieved.

The ROM 102 is a read-only storage unit (memory) that stores a fixed program executed by the CPU 101.
The SDRAM 103 is a readable / writable memory used as a program memory for storing a program executed by the CPU 101, an information memory for storing various information such as management information described later, a work memory used when the CPU 101 performs processing, and the like. . The SDRAM 103, together with the HDD 104, can function as management information storage means and usage authority information storage means.

The HDD 104 is a nonvolatile storage medium that stores programs executed by the CPU 101 and various types of information. Note that a nonvolatile semiconductor memory such as a flash ROM, an EEPROM, a memory card, or the like can be used instead of or in addition to the HDD 104.
The network I / F 105 is a communication unit for communicating with the external authentication device 5 of the business unit A and the external authentication device 15 of the business unit B via the Internet 200.

  When the usage authority information server 100 receives the usage authority information acquisition request from the external authentication device 5 of the business division A or the external authentication device 15 of the business division B via the Internet 200, the usage authority information server 100 determines the transmission destination of the usage authority information acquisition request. Based on the user information in the usage right information acquisition request and “each management information” as shown in Table 2 stored in the SDRAM 103, the external authentication devices 5 and 15 are determined, and the determined transmission destination The received usage authority information acquisition request is transmitted via the Internet 200. This can be realized, for example, by transmitting a use authority information acquisition request as a response to periodic polling (transmission request inquiry) from the determined external authentication device of the transmission destination.

  Each management information is obtained by associating external authentication device information of each external authentication device 5 and 15 with user information of a user of each MFP that can communicate with each external authentication device 5 and 15. It is possible to know which external authentication device the user of each MFP is using. In the example of Table 2, “123”, “456”, “789”, which are user IDs for identifying each user, and external authentication device information of the external authentication device used by each user. “External authentication device 5” and “external authentication device 15” are associated with each other.

The part (characteristic part) related to this invention of the information processing system (authentication system) of the first embodiment configured as described above will be described with reference to FIG.
FIG. 4 is a diagram for explaining a portion related to the present invention of the information processing system shown in FIG.
Authentication by this information processing system is started when a user inputs a user ID to the external authentication device 5 using an IC card or the like.
At this time, if the usage authority information of the user exists in the external authentication device 5, the activation request is transmitted as it is from the external authentication device 5 to the usable image forming device, and the image forming device can be used.

This information processing system is characterized in that the usage authority information of the user does not exist in the external authentication device.
For example, a user “456” who normally uses the external authentication device 5 connected to the LAN 10 of the business unit A moves to the business unit B and uses the external authentication device 15 connected to the LAN 20. In this case, the external authentication device 15 transmits a usage authority information acquisition request of the user “456” to the usage authority information server 100, and the usage authority information server 100 that has received the request transmits each management authority stored therein. Based on the information, it is determined that the usage authority information of the user “456” is stored in the external authentication device 5, and a usage authority information acquisition request for the user “456” is transmitted to the external authentication device 5.

Since the usage authority information of the user “456” obtained as a result is stored in the external authentication device 15 via the usage authority information server 100, the user “456” intends to use the external authentication device 15 thereafter. In this case, it is not necessary to communicate with the usage authority information server 100, and authentication is possible.
As a result, when the user tries to use the external authentication device in which his / her use authority information is not stored, if the user can communicate with the use authority information server 100 only for the first authentication, the use authority information server 100 is used in the subsequent authentication. Therefore, the risk of being unable to authenticate when the external network is down can be reduced as compared with the case of communicating with the usage authority information server every time authentication is performed.

Hereinafter, each example (first to fifth examples) of processing according to the present invention by the information processing system according to the first embodiment configured as described above will be specifically described with reference to FIGS. To do.
[First embodiment]
First, a first embodiment will be described with reference to FIGS.
FIG. 5 is a flowchart showing a first example of activation processing according to the present invention by the external authentication devices 5 and 15 and the usage authority information server 100 of FIG.
Here, “each usage authority information” shown in Table 1 is stored in the SDRAM 62 of the external authentication device 5, and “each usage authority information” shown in Table 3 is stored in the SDRAM 62 of the external authentication device 15. To do.

In step S1, when the user makes his / her IC card contact the IC card reader 52 and reads the user ID recorded on the IC card in step S1, the external authentication device 5 reads the user ID from the IC card reader 52 in step S2. The user ID is read.
In step S3, it is determined whether or not the usage authority information including the user ID read from the IC card reader 52 is stored in the SDRAM 62, and the usage authority information including the read user ID is stored in the SDRAM 62. If it is stored, the process proceeds to step S4 to create a list of device information in the use authority information.

In other words, each use authority information (see Table 1) stored in the SDRAM 62 is searched with the read user ID (compare each use authority information with the user ID), and the user grants the use authority. A list of device information of MFPs that can be used (available MFPs) is created. For example, when the user ID read from the IC card reader 52 is “123”, the user ID “123” is searched for each usage authority information shown in Table 1, and the user has the usage authority. A list of “MFP1, MFP3” is created as a list of MFP device information.
Then, by displaying the created device information list on the display 53, the device information list is presented (notified) to the user.

  Next, the process proceeds to step S5, and when the user selects the device information of the MFP that the user wants to use from the device information displayed on the display 53, the operation on the display operation unit 54 is instructed by the user. Proceeding to S6, the device information of the MFP that the user wants to use is selected, and an activation request is transmitted to the MFP. In the example in which the user ID read from the IC card reader 52 is “123”, an activation request is transmitted to the MFP in order to select the device information of the MFP 1 or 3. This communication is realized through the LAN 10 and using SSL as a communication protocol to realize secure communication.

  The MFP that has received the activation request from the external authentication device 5 is activated so as to be usable by the user, and shifts from the “inoperable state” to the “operable state” to authenticate the user. Realize. This is realized by changing the operation panel (operation unit) of the MFP from an inoperable state to an operable state.

  On the other hand, the external authentication device 15 also performs the processing of steps S1 to S3 sequentially as in the case of the external authentication device 5, but the usage authority information including the user ID read from the IC card reader 52 is not stored in the SDRAM 62. For example, when the read user ID is “456”, the usage authority information including the user ID is not stored in the SDRAM 62, so the process proceeds to step S7, and the use including the read user ID is performed. An authority information acquisition request is transmitted to the usage authority information server 100. This communication is performed via the LAN 10, the firewall 9, and the Internet 200, and secure communication is realized by using SSL as a communication protocol.

  When the usage authority information server 100 proceeds to step S8 and receives the usage authority information acquisition request from the external authentication device 5, the usage authority information acquisition destination (the user's current external authentication device) is sent to the usage authority information acquisition request. Based on the user ID for which acquisition is requested and each management information (see Table 2) stored in the SDRAM 103, the external authentication devices 5 and 15 are determined. In the example in which the user ID read from the IC card reader 52 is “456”, the usage authority information including the user ID is stored in the external authentication device 5, so the usage authority information received from the external authentication device 15. The transmission destination of the acquisition request is determined as the external authentication device 5.

Then, it progresses to step S9 and waits for the regular poll from the external authentication apparatus 5. FIG. Note that the external authentication devices 5 and 10 periodically poll the usage authority information server 100.
When the usage authority information server 100 receives regular polling from the external authentication device 5, the usage authority information server 100 proceeds to step S 10 and transmits the usage authority information acquisition request received from the external authentication device 15 to the external authentication device 5 as a response.

  Upon receiving the use authority information acquisition request from the use authority information server 100, the external authentication device 5 proceeds to step S11, reads out the use authority information including the user ID in the use authority information acquisition request from the SDRAM 62, and uses the authority. The information is transmitted to the information server 100 and the usage authority information is deleted from the SDRAM 62. In the example in which the user ID read from the IC card reader 52 of the external authentication device 15 is “456”, the usage authority information is searched using the user ID “456” as a key, and the usage ID including the user ID “456” is used. The authority information is read from the SDRAM 62 and transmitted to the use authority information server 100. At the same time, the usage authority information including the user ID “456” transmitted to the usage authority information server 100 is deleted from the SDRAM 62 as shown in FIG. This process is also reflected in the flash ROM 63.

  When the usage authority information server 100 acquires the usage authority information from the external authentication apparatus 5 that is the transmission destination of the usage authority information acquisition request received from the external authentication apparatus 15, the process proceeds to step S <b> 12, and each management stored in the SDRAM 103. Of the information (see Table 2), the external authentication device that is the transmission source of the received use authority information acquisition request for the external authentication device information of the external authentication device 5 in the management information including the user ID in the use authority information It is changed (updated) to 15 external authentication device information. This process is also reflected in the HDD 104. In the example in which the user ID read from the IC card reader 52 of the external authentication device 15 is “456”, the external authentication device information corresponding to the user ID “456” is “external authentication” as shown in FIG. “Device 5” is changed to “External authentication device 15”. Then, the acquired use authority information is transmitted to the external authentication device 15.

When the external authentication device 15 acquires the usage authority information from the usage authority information server 100 in response to the usage authority information acquisition request to the usage authority information server 100, the external authentication device 15 proceeds to step S 13 and stores the acquired usage authority information in the SDRAM 62. Store additional. In the example in which the user ID read from the IC card reader 52 is “456”, the usage authority information corresponding to the user ID “456” is additionally stored in the SDRAM 62 as shown in FIG. This process is also reflected in the flash ROM 63.
Next, proceeding to step S4, a list of device information in the usage authority information acquired from the usage authority information server 100 is created.

That is, each use authority information stored in the SDRAM 62 is searched with the read user ID, and a list of device information of MFPs (usable MFPs) for which the user has use authority is created. In the example in which the user ID read from the IC card reader 52 is “456”, the user ID “456” is searched for each use authority information, and a list of device information of MFPs for which the user has use authority is obtained. , A list of “MFP1, MFP2” is created.
Then, by displaying the created device information list on the display 53, the device information list is presented to the user.
The subsequent processing is the same as the case of the user “123” described above.

  For convenience of explanation, as can be seen from FIG. 4, the device information of the MFP 1 on the business unit A side and the MFP 11 on the business unit B side are both “MFP1”, the MFP 2 on the business unit A side, and the business unit B side. Each piece of device information of the MFP 12 is “MFP 2”. Therefore, the device information “MFP1, MFP2” displayed on the display 53 of the external authentication device 15 on the business unit B side indicates the MFP 11 and MFP 12 on the business unit B side.

  According to the first embodiment, each MFP connected to each network in an organization or the like having a plurality of networks each connected with one external authentication device and a plurality of MFPs (image forming devices). The usage authority information server for managing the usage authority information of each user is provided, and the external authentication device and the usage authority information server operate as described above, thereby corresponding to the MFP on the network that the user wants to use. Since the user authority information can be easily transferred to the external authentication device, any MFP connected to any network can be used by authenticating with the corresponding external authentication device. In addition, if the user's usage authority information is not stored in the external authentication device, by transferring the user's usage authority information to the external authentication device currently used by the user, When the user uses the target external authentication device from the next time onward, authentication can be executed without going through the Internet (external network).

[Second Embodiment]
Next, a second embodiment will be described with reference to FIG.
FIG. 6 is a flowchart showing a second example of the activation processing according to the present invention by the external authentication devices 5 and 15 and the usage authority information server 100 of FIG.
In the second embodiment, in the same process as the first embodiment, when the use authority information is stored one after another in the external authentication device, the process when the amount of use authority information that can be stored is exceeded There is a feature.

In the second embodiment, it is assumed that the usage authority information server 100 stores usage authority information in the SDRAM 103 in addition to the management information including the user's external authentication device information. The use authority information is user use authority information that is not stored in any of the external authentication devices 5 and 15, and is stored in advance in accordance with an instruction from an external terminal such as a PC (not shown).
Further, when each of the external authentication devices 5 and 15 stores the use authority information in the SDRAM 62, for example, as shown in Table 4, a storage date and time that is the date and time when the use authority information is stored is added to the use authority information. To do.

Hereinafter, processing when the user “789” performs authentication using the external authentication device 5 will be described with reference to FIG. Assume that the SDRAM 62 of the external authentication device 5 stores the usage authority information shown in Table 4, for example.
The external authentication device 5 makes the IC card reader 52 contact the IC card reader 52 in step S21 and reads the user ID “789” recorded on the IC card. In step S22, the external authentication device 5 reads the IC card. The user ID “789” is read from the reader 52.

Next, the process proceeds to step S23, where it is determined whether or not the usage authority information including the user ID “789” read from the IC card reader 52 is stored in the SDRAM 62. In this example, the usage authority information is the SDRAM 62. In step S27, the use authority information acquisition request including the read user ID “789” is transmitted to the use authority information server 100.
Unlike the first embodiment, the usage authority information server 100 that has received the usage authority information acquisition request for the user ID “789” assigns the user ID “789” included in the usage authority information acquisition request in step S28. It is determined whether or not corresponding external authentication device information is stored in the SDRAM 103.

  If the external authentication device information corresponding to the user ID “789” is not stored in the SDRAM 103, the process proceeds to step S29, and the usage authority information including the user ID “789” is assigned to which external authentication device. Is also stored, and management information in which the user ID “789” is associated with the external authentication device information “external authentication device 5” that is the transmission source of the use authority information acquisition request including the user ID “789” is added to the SDRAM 103. Then, the usage authority information including the user ID “789” is read from the SDRAM 103 and transmitted to the external authentication device 5, and the transmitted usage authority information is deleted from the SDRAM 103.

On the other hand, if the external authentication device information corresponding to the user ID “789” is stored in the SDRAM 103, the process proceeds to step S30, and the transmission destination of the received use authority information acquisition request is set in the use authority information acquisition request. Based on the user ID and each management information (see Table 2) stored in the SDRAM 103, the external authentication devices 5 and 15 are discriminated, but the external authentication device information corresponding to the user ID “789” is determined. Since the usage authority information including the user ID “789” is stored in the external authentication device 15 shown, in the example of Table 2, the user is sent to the external authentication device 15 in the same manner as in the first embodiment. A use authority information acquisition request including the ID “789” is transmitted (steps S31 and S32).
The subsequent processing of the external authentication device 15 and the processing of the usage authority information server 100 (steps S33 and S34) that have received the usage authority information acquisition request are substantially the same as those in the first embodiment, and thus the description thereof is omitted.

Here, in the second embodiment, compared to the first embodiment, when the external authentication device 5 acquires the use authority information of the user from the use authority information server 100, the amount of use authority information that can be stored in the SDRAM 62 is exceeded. There is a feature in the processing when it is.
Using the above-described example of authentication of the user “789”, the external authentication device 5 proceeds to step S35 when acquiring the usage authority information including the user ID “789” from the usage authority information server 100, It is determined whether usage authority information can be additionally stored in the SDRAM 62.

  If the usage authority information including the acquired user ID “789” can be additionally stored in the SDRAM 62, the process proceeds to step S36, and the usage authority information including the acquired user ID “789” is additionally stored in the SDRAM 62. If it cannot be additionally stored in the SDRAM 62, the process proceeds to step S37, where predetermined use authority information stored in the SDRAM 62 is read and transmitted to the use authority information server 100, and the user ID obtained above is used instead of the use authority information. Use authority information including “789” is newly stored in the SDRAM 62. In the second embodiment, since the storage date and time is added to each usage authority information stored in the SDRAM 62 as shown in Table 4, the following processing is performed.

  That is, referring to the storage date and time added to each usage authority information stored in the SDRAM 62, the usage including the user ID “456” to which the oldest storage date and time is added among the usage authority information. The authority information (predetermined usage authority information) is read and transmitted to the usage authority information server 100, the usage authority information including the ID “456” is deleted, and the acquired user ID “789” is included instead. The usage authority information is newly stored in the SDRAM 62. At this time, the storage date and time added to the stored use authority information is updated to the current date and time.

The usage authority information server 100 that has received the usage authority information including the user ID “456” from the external authentication device 5 proceeds to step S38, and simultaneously stores the usage authority information including the user ID “456” in the SDRAM 103. The management information including the external authentication device information corresponding to the user ID “456” stored in the SDRAM 103 is deleted.
The processing in the external authentication device 5 in steps S24 to S26 when the external authentication device information corresponding to the user ID read from the IC card reader 52 is stored in the SDRAM 103 is the same as that in the first embodiment. Description is omitted.

  As described above, in addition to the same effect as that of the first embodiment, it is possible to obtain an effect that the external authentication device can be used even when the number of MFP users exceeds the limit of the external authentication device. .

[Third embodiment]
Next, a third embodiment will be described with reference to FIG.
The third embodiment is different from the second embodiment only in the processing when the amount of use authority information that can be stored in the external authentication apparatus is exceeded.
In the third embodiment, when each of the external authentication devices 5 and 15 stores the usage authority information in the SDRAM 62, for example, as shown in Table 5, the corresponding user last used the external authentication device. A certain last use date shall be added.

The use authority information transmitted to the use authority information server 100 in step S37 in FIG. 6 is different from that of the second embodiment.
For example, when the external authentication device 5 newly stores use authority information including the user ID “789” in the SDRAM 62, the last use date and time added to each use authority information stored in the SDRAM 62 is referred to. The usage authority information (predetermined usage authority information) including the user ID “123” to which the oldest last usage date is added is read out from the usage authority information and transmitted to the usage authority information server 100. The usage authority information including the ID “123” is deleted, and instead the usage authority information including the acquired user ID “789” is newly stored in the SDRAM 62. At this time, the last use date and time added to the stored use authority information is updated to the current date and time.

Even when the external authentication device information corresponding to the user ID read from the IC card reader 52 is stored in the SDRAM 103, the last use date and time added to the use authority information including the user ID “789”. Update to the current date and time.
As described above, in addition to the same effects as those of the second embodiment, the usage authority information from the external authentication apparatus to the usage authority information server is deleted because it is deleted from the usage authority information of the user who has not used the external authentication apparatus for a long time. It is also possible to obtain an effect that the number of acquisition requests is reduced and the external authentication device can be used efficiently.

[Fourth embodiment]
Next, a fourth embodiment will be described with reference to FIG.
The fourth embodiment is different from the second and third embodiments only in the processing when the amount of use authority information that can be stored in the external authentication apparatus is exceeded.
In the fourth embodiment, when each of the external authentication devices 5 and 15 stores the usage authority information in the SDRAM 62, for example, as shown in Table 6, the usage is the number of times the corresponding user has used the external authentication device. The number of times (number of used counters) shall be added.

The use authority information transmitted to the use authority information server 100 in step S37 in FIG. 6 is different from the second and third embodiments.
For example, when the external authentication device 5 newly stores use authority information including the user ID “789” in the SDRAM 62, the number of use counters added to each use authority information stored in the SDRAM 62 is referred to. The usage authority information (predetermined usage authority information) including the user ID “456” to which the smallest usage counter number is added among the usage authority information is read and transmitted to the usage authority information server 100, and The usage authority information including the ID “456” is deleted, and instead the usage authority information including the acquired user ID “789” is newly stored in the SDRAM 62. At this time, the usage counter number added to the stored usage authority information is incremented (+1).

Even when external authentication device information corresponding to the user ID read from the IC card reader 52 is stored in the SDRAM 103, the number of usage counters added to the usage authority information including the user ID “789”. Is incremented (+1).
In this way, in addition to the same effects as in the second embodiment, the usage authority information acquisition request from the external authentication apparatus to the usage authority information server is deleted from the usage authority information from the user with a small amount of use of the external authentication apparatus. The number of times can be reduced, and the external authentication apparatus can be used efficiently.

[Fifth embodiment]
Next, a fifth embodiment will be described with reference to FIG.
The fifth embodiment is different from the second to fourth embodiments only in the processing when the amount of use authority information that can be stored in the external authentication device is exceeded.
In the fifth embodiment, when each of the external authentication devices 5 and 15 stores the use authority information in the SDRAM 62, for example, as shown in Table 7, the priority is such that the corresponding user can use the external authentication device. Use priority is added. This use priority can be set in advance from an external terminal such as a PC.

The usage authority information transmitted to the usage authority information server 100 in step S37 of FIG. 6 is different from that of the second to fourth embodiments.
For example, when the external authentication device 5 newly stores usage authority information including the user ID “789” in the SDRAM 62, the usage priority level added to each usage authority information stored in the SDRAM 62 is referred to. The usage authority information (predetermined usage authority information) including the user ID “123” to which the lowest usage priority is added among the usage authority information is read and transmitted to the usage authority information server 100, and The usage authority information including the ID “123” is deleted, and instead the usage authority information including the acquired user ID “789” is newly stored in the SDRAM 62.

  As described above, in addition to the same effects as those of the second embodiment, the usage authority information is acquired from the external authentication device to the usage authority information server because the usage authority information is deleted from the user having a preset usage priority. It is also possible to obtain an effect that the number of requests is reduced and the external authentication device can be used efficiently.

[Second Embodiment]
Next explained is the second embodiment of the invention. Each configuration of the information processing system according to the second embodiment, the external authentication device and the usage authority information server constituting the information processing system is substantially the same as that of the first embodiment described above, and therefore FIGS. 1 to 3 are used again. .
In the first embodiment (first to fifth examples) described above, the use authority information server 100 cannot receive the use authority information acquisition request due to a failure of the external network or a failure of the use authority information server. If the user cannot be authenticated, the user cannot be authenticated. Therefore, in the second embodiment, processing that can authenticate the user is performed even in such a case.

  The second embodiment is different from the first embodiment in that each of the external authentication devices 5 and 15 shown in FIG. 1 uses usage authority information (for example, corresponding to information attached to a user who has used the external authentication device). 2 (see Table 8) is also stored in the SDRAM 62 of FIG. 2 (read from the flash ROM 63), and the usage authority information (for example, see Table 9) corresponding to the information attached to all users by the usage authority information server 100 is also included. It is stored in the SDRAM 103 of FIG. 3 (read from the HDD 104). Therefore, the SDRAM 62 and the flash ROM 63 function as usage authority information storage means, attached usage authority information storage means, and user information storage means, and the SDRAM 103 and HDD 104 serve as management information storage means, usage authority information storage means, and attachment. Each of them can function as a management information storage unit.

  Here, “attached information” refers to theme information indicating the product theme (hereinafter also referred to as “related theme” or “theme”) related to the user, organization information indicating the organization to which the user belongs, and usage. Information associated with the user himself, such as job title information indicating the job title to which the user belongs, job information indicating the user's work content, etc., and “use authority information corresponding to the attached information” is, for example, “business division A In this case, the MFP 1 and the MFP 2 can be used by the members belonging to the user, not the MFP use authority that the individual user has, but the MFP use authority information that the user belongs to.

  For example, the external authentication device 5 includes the attached information read together with the user ID that is the user information of the user from the IC card reader 52 and theme information “theme” that is attached information as shown in Table 8 stored in the SDRAM 62. 3 ”, the device information of the MFP that can be used by the user (the owner of the IC card in which the read user ID is recorded) is included in the device information of each MFP 1-3. You can search from.

  In the case of the second embodiment, the CPU 61 of the external authentication devices 5 and 15 executes the program stored in the SDRAM 62 from the flash ROM 63 and controls the IC card reader 52, the display 53, the LAN interface 64, etc. User information reading means, use authority information presence / absence determination means, first device information notification means, use authority information acquisition request transmission means, use authority information acquisition request reception means, first use authority information processing, which are functions related to the invention Means, usage authority information acquisition means, second usage authority information processing means, second device information notification means, device information selection means, activation request transmission means, additional storage availability determination means, third usage authority information processing means, Storage date and time update means, last use date and time update means, use frequency increment means, attached use authority information presence / absence determination means, third machine Information notifying means, the user information storage control unit, a communication determination unit, user information presence determining means, can serve as additional information presence determining means, and auxiliary information storage control unit.

  In addition, the CPU 101 of the usage authority information server 100 executes a program stored in the SDRAM 103 from the HDD 104 and controls the network I / F 105, so that the usage authority information acquisition request receiving means and the transmission destination, which are functions related to the present invention, are transmitted. Discriminating means, usage authority information acquisition request transmission means, usage authority information acquisition means, information processing means (first information processing means, second information processing means), usage authority information reception means, and usage authority information transmission means Can fulfill the function.

The part related to this invention of the information processing system (authentication system) in 2nd Embodiment comprised in this way is demonstrated using FIG.
FIG. 7 is a diagram for explaining a part related to the present invention of the information processing system according to the second embodiment.
Authentication by this information processing system is started when a user inputs a user ID and attached information to the external authentication device 5 using an IC card or the like.

  At this time, if the user's use authority information exists in the external authentication device 5 or does not exist, the same processing as in the first embodiment is performed, but the user's use authority information is stored in the external authentication device 5. If the usage authority information acquisition request does not exist and is transmitted to the usage authority information server 100, the usage authority information acquisition request is caused by a failure of the Internet 200 as an external network (external network failure) or a failure of the usage authority information server 100. If the use authority information acquisition request cannot be received by the use authority information server 100, the user cannot be authenticated.

A feature of this information processing system is that even if transmission of a use authority information acquisition request to the use authority information server 100 fails, a process capable of authenticating the user is performed.
For example, a user “456” who normally uses the external authentication device 5 connected to the LAN 10 of the business unit A moves to the business unit B and tries to use the external authentication device 15 connected to the LAN 20. If the external authorization device 15 cannot connect to the usage authority information server 100 due to an external network failure or the like, the external authentication device 15 internally uses the attached information of the user “456” read from the IC card or the like. Refer to the usage rights information corresponding to the stored accessory information.

In this case, the user “456” has the related theme “theme 3” as the accessory information, and the usage authority information corresponding to the “theme 3” is stored in the external authentication device 15. Information can be used for authentication.
Thereby, even when the first authentication cannot be performed in the information processing system (authentication system) due to a network failure or a failure of the use authority information server 100, the user can be authenticated.

At the same time, the external authentication device 15 stores the accessory information for which the usage authority information is not stored in the external authentication device 15 among the accessory information of the user “456”.
Thereafter, when the external network failure or the like is resolved and the external authentication device 15 becomes connectable to the usage authority information server 100, a usage authority information acquisition request of the user “456” is transmitted to the usage authority information server 100. In addition, a usage authority information acquisition request regarding the usage authority information corresponding to the auxiliary information not yet stored in the external authentication device 15 among the auxiliary information of the user “456” is transmitted.

The external authentication device 15 acquires the usage authority information corresponding to the additional information of the user “456” from the usage authority information server 100 and then stores the usage authority information corresponding to the additional information of the user “456” therein. By doing so, it becomes possible to carry out authentication including the use authority information in the authentication of the user after the next time.
Hereinafter, each example (sixth to eighth examples) of processing according to the present invention by the information processing system of the second embodiment configured as described above will be specifically described with reference to FIGS. To do.

[Sixth embodiment]
First, a sixth embodiment will be described with reference to FIGS. Here, a case where the user “456” authenticates with the external authentication device 15 (however, it is assumed that only the use authority information of the user “789” is stored in the external authentication device 15) is external. Other users can authenticate with the authentication device 15, and of course, each user can authenticate with the other external authentication device 5.

FIG. 8 is a flowchart showing a third example of the activation processing according to the present invention by the external authentication device 15 of FIG. 1, and the processing by the use authority information server 100 and the external authentication device 5 is omitted. This activation process is obtained by adding a new process to each process described with reference to FIG. Of course, the new process can be added to each process described with reference to FIG.
Here, “each usage authority information” shown in Table 1 is stored in the SDRAM 62 of the external authentication device 5, and “each usage authority information” shown in Table 3 is stored in the SDRAM 62 of the external authentication device 15. To do.

  In this information processing system (authentication system), when the user “456” who normally uses the external authentication device 5 tries to use another external authentication device 15, the user ID is assigned to the external authentication device 15. Since the use authority information corresponding to “456” is not stored, the external authentication device 15 uses secure communication such as SSL to the use authority information server 100 and includes the user ID “456”. Send an information acquisition request.

  That is, in step S51, the external authentication device 15 causes the user to contact his / her IC card with the IC card reader 52 to read the user ID and attached information recorded on the IC card. The user ID and attached information are read from the IC card reader 52.

In step S53, it is determined whether or not the usage authority information including the user ID read from the IC card reader 52 is stored in the SDRAM 62. When the read user ID is “456”, the process proceeds to step S53. Since the usage authority information including the user ID is not stored in the SDRAM 62, the process proceeds to step S57, and the usage authority information acquisition request including the read user ID is transmitted to the usage authority information server 100.
Thereafter, in step S58, it is determined whether the transmission of the usage authority information acquisition request to the usage authority information server 100 has succeeded or failed.

That is, although illustration is omitted, in response to the transmission of the usage authority information acquisition request to the usage authority information server 100, a response indicating that the usage authority information acquisition request has been received from the usage authority information server 100 is received within a predetermined time. If it is determined that the use authority information acquisition request has been successfully transmitted, it is determined that transmission of the use authority information acquisition request has failed if the response cannot be received within a predetermined time.
When the use authority information acquisition request has been successfully transmitted, the use authority information server 100 performs the processes in steps S8 to S12 described with reference to FIG. When the transmission of the usage authority information acquisition request fails, the external authentication device 15 performs the process of step S59.

In the information processing system according to the second embodiment, when the external authentication device 15 transmits a usage authority information acquisition request including the user ID “456” to the usage authority information server 100, the transmission fails. There are features.
Therefore, in step S59, the user ID read from the IC card reader 52 (the user ID included in the usage authority information acquisition request that failed to be transmitted to the usage authority information server 100) is used as the usage authority information acquisition request. Stored in the SDRAM 62 as the user ID for which transmission failed. This process is also reflected in the flash ROM 63.

Thereafter, the process proceeds to step S60, and it is determined whether or not the usage authority information including the attached information is stored in the SDRAM 62 using the attached information read together with the user ID “456” from the IC card reader 52 as a key.
Here, theme information indicating a product theme related to the user is used as the attached information, and the use authority information of the image forming apparatus that can be used in each theme is used as the use authority information corresponding to the attached information. The information attached to the user “456” is shown in Table 10 and FIG. 7A, and the information attached to the user “789” is shown in Table 11 and FIG. 7C. There is each.

In the external authentication device 15, usage authority information including attached information of a user who has used the external authentication device 15 (= user “789”) is stored in the SDRAM 62. The accessory information of the user “789” is the theme information “Theme 3” here. The attached information of the user “456” is the theme information “theme 2” and “theme 3” here.
In this case, the external authentication device 15 uses theme information “theme 2” and “theme 3”, which are accessory information read from the IC card reader 52 together with the user ID “456” as keys.

  When the usage authority information stored in the SDRAM 62 is searched, usage authority information including theme information “theme 3”, which is additional information of the user “789”, is stored. It is determined that the usage authority information including the attached information read together with the ID “456” is stored in the SDRAM 62, and the process proceeds to step S62, where the usage authority information including the theme information “theme 3” is used by the user “456”. Used as authority information (use authority information corresponding to the read user ID “456”). In this case, the user “456” can use the MFP 13.

  Next, the process proceeds to step S63, where it is determined whether there is any additional information not stored in the SDRAM 62 among the read additional information. If not, the process proceeds to step S54, but an example of additional information of the user "456" Then, since the theme information “Theme 2” is not stored in the SDRAM 62, the process proceeds to Step S 64, and after the theme information “Theme 2” is stored in the SDRAM 62 among the read attached information (this process is also performed in the flash ROM 63. The process proceeds to step S54.

  In step S60, if it is determined that the usage authority information including the read attached information is not stored in the SDRAM 62, the preset default usage authority information stored in the SDRAM 62 is used as the user's usage authority. Used as information (use authority information corresponding to the read user ID). The default use authority information can be preset and stored in the flash ROM 63 by an instruction by an operation on the display operation unit 54 or the like.

FIG. 9 is a flowchart showing an example of processing when the external authentication device 15 of FIG. 1 becomes connectable (communication) with the usage right information server 100.
For example, when the external authentication device 15 cannot connect to the usage authority information server 100 as described above, the external authentication device 15 performs a connection test periodically until it can connect to the usage authority information server 100 in the next step S71. It is determined whether or not connection to the usage authority information server 100 is possible (communication with the usage authority information server 100 is possible).

If the connection to the usage authority information server 100 becomes possible, the process proceeds to step S72.
It is determined whether or not the SDRAM 62 stores a user ID that failed to transmit the usage authority information acquisition request. If the user ID is stored, the usage authority information acquisition request including the user ID is used. By transmitting to the information server 100 and receiving the response, the usage authority information including the user ID is stored in the SDRAM 62. This process is also reflected in the flash ROM 63. A method for realizing communication with the usage authority information server 100 when a usage authority information acquisition request is transmitted to the usage authority information server 100 and a response is received is the same as in the first embodiment. And in the other external authentication apparatus 5, each process of step S8-S12 demonstrated by FIG. 5 is performed.

  When the usage authority information is acquired from the usage authority information server 100 in response to the usage authority information acquisition request to the usage authority information server 100, the process proceeds to step S77, and the acquired usage authority information is additionally stored in the SDRAM 62. In the example in which the user ID read from the IC card reader 52 is “456”, the usage authority information corresponding to the user ID “456” is additionally stored in the SDRAM 62 as shown in FIG. This process is also reflected in the flash ROM 63.

  On the other hand, if it is determined in step S72 that the user ID that failed to transmit the use authority information acquisition request is not stored in the SDRAM 62, or after performing the process of step S77, the process proceeds to step S73, and the external authentication device 15 is stored in the SDRAM 62 that is not included in the use authority information (attachment information for which the use authority information is not acquired from the use authority information server 100) among the accessory information of the user who has used 15 If the attached information is stored, the process proceeds to step S74, a use authority information acquisition request including the attached information is transmitted to the use authority information server 100, and the use authority information obtained as a result is transmitted. In step S75, it is additionally stored in the SDRAM 62. This process is also reflected in the flash ROM 63.

In the case of the user “456” as an example so far, the usage authority information corresponding to the theme information “theme 2” as the accessory information is not stored in the SDRAM 62, and a usage authority information acquisition request including the accessory information is issued. The usage authority information server 100 that has received the usage authority information acquisition request for transmission to the usage authority information server 100 is attached to all users as shown in FIG. 7B stored in the SDRAM 103 in step S78. The corresponding use authority information is searched from the use authority information including the information using the requested theme information “theme 2” as a key, and the searched use authority information is returned to the external authentication device 15.
The external authentication device 15 acquires the use authority information and additionally stores it in the SDRAM 62.

  In the sixth embodiment, the theme information indicating the product theme related to the user is used as the user's attached information. However, the organization information indicating the organization to which the user belongs (hereinafter also referred to as “affiliation information”). , Job title information indicating the job title to which the user belongs, or job information indicating the user's job content can also be used.

  Thus, in addition to the effect similar to 1st Embodiment (any one of the 1st-5th Example), the effect shown below can be acquired. In other words, when the external authentication apparatus performs authentication according to an instruction from the user of the MFP, the user information of the user is not stored internally, and the external network is down or the usage authority information server (authentication server) Authentication information (in the user's attached information) instead of the usage authority information (authentication information) corresponding to the user information of the user when the communication of the usage authority information server cannot be established. Since the MFP user can be authenticated by the corresponding use authority information), the period during which the user cannot use the MFP can be further shortened.

User-attached information includes theme information that indicates the product theme that the user is involved in, organizational information that indicates the organization to which the user belongs, position information that indicates the position to which the user belongs, or work that indicates the work contents of the user If there is information and the theme information indicating the product theme with which the user is involved is used, authentication can be performed with the use authority information corresponding to the product theme of the user.
If the organization information indicating the organization to which the user belongs is used, authentication can be performed with the use authority information corresponding to the user's affiliation.

If the post information indicating the post to which the user belongs is used, authentication can be performed with the use right information corresponding to the post of the user.
If the business information indicating the business content of the user is used, authentication can be performed with the usage authority information corresponding to the business of the user.

[Seventh embodiment]
Next, a seventh embodiment will be described with reference to FIGS.
The processing of the seventh embodiment is substantially the same as the processing of the sixth embodiment described with reference to FIGS. 8 and 9, but differs slightly in the following points. That is, each of the external authentication devices 5 and 15 sets a priority corresponding to each of a plurality of types of attached information stored in the SDRAM 62 in advance according to an instruction by an operation on the display operation unit 54 and stores the priority in the flash ROM 63. I can leave. The priority order corresponding to each of the attached information is as shown in Table 12, for example. Hereinafter, the priority order is used.

  Each of the external authentication devices 5 and 15 that failed to transmit the usage authority information acquisition request refers to each priority stored in the SDRAM 62 in step S60 of FIG. Using the types of attached information (plural types of attached information corresponding to the user ID) as a key, the usage authority information including the attached information is stored in the SDRAM 62 sequentially from the attached information having the highest priority among the attached information. It is determined whether or not it has been done.

  In the case of the example shown in FIGS. 7A to 7D, the external authentication device 15 uses the affiliation information (shown in Table 10 which is attached information of the user “456” and FIG. 7A). Organization information) "Affiliation A", post information "Group Leader", theme information "Theme 2", "Theme 3", business information "Development", firstly, belonging information "Affiliation A" with the highest priority is used as a key Perform authentication processing. That is, it is determined whether or not the usage authority information including the affiliation information “affiliation A” is stored in the SDRAM 62. However, since the use authority information including the affiliation information “affiliation A” is not stored, authentication processing is performed using the theme information “theme 2” and “theme 3” having the next highest priority as keys.

That is, it is determined whether usage authority information including theme information “theme 2” or “theme 3” is stored in the SDRAM 62. In this case, since the use authority information including “theme 3” of the theme information “theme 2” or “theme 3” is stored, the process proceeds to step S62, and the use authority information is transferred to the user “456”. Used as usage authority information.
If the usage authority information including the theme information “theme 2” or “theme 3” is not stored in the SDRAM 62, an authentication process is performed with the business information “development” having the next highest priority as a key, Thereafter, the same processing is performed.

  Further, the external authentication device 15 reads from the IC card reader 52 the attached information of the use authority information stored in the SDRAM 62 is attached information of the user “789” shown in Table 11 and FIG. In the example where the user's plural types of attached information are the attached information of the user “456” shown in Table 10 and FIG. 7A, the theme information “Theme 2”, the belonging information “Affiliation A”, Since the post information “group leader” and the business information “development” are not stored in the SDRAM 62, the theme information “theme 2”, the affiliation information “of the attached information read from the IC card reader 52 in step S 64 of FIG. “Affiliation A”, post information “group leader”, and business information “development” are stored in the SDRAM 62 (this process is also reflected in the flash ROM 63).

  Further, in the case of the user “456”, usage authority information corresponding to theme information “theme 2”, organization information “affiliation A”, job title information “group leader”, and business information “development”, which are auxiliary information, is SDRAM 62. The use authority information server 100 that has received the use authority information acquisition request transmits the use authority information acquisition request that is not stored in the access authority information server and includes the attached information to the use authority information server 100. Perform the process shown.

That is, the requested theme information “theme 2”, affiliation information “affiliation A”, among the usage authority information including the attached information of all users as shown in FIG. The corresponding usage authority information is retrieved using the post information “group leader” and the business information “development” as keys, and the retrieved usage authority information is returned to the external authentication device 15.
The external authentication device 15 acquires each use authority information and additionally stores it in the SDRAM 62 as shown in FIG.

  In this way, in addition to the same effects as in the sixth embodiment, by handling a plurality of pieces of attached information with priorities set as user attached information, each of the external authentication devices is based on the set priorities. The effect that the user can be authenticated can also be obtained.

[Program related to this invention]
This program transmits to a computer (CPU) that controls the external authentication device, user information reading means, use authority information presence / absence determination means, first device information notification means, and use authority information acquisition request, which are functions related to the present invention. Means, usage authority information acquisition request receiving means, first usage authority information processing means, usage authority information acquisition means, second usage authority information processing means, second device information notification means, device information selection means, activation request transmission Means for determining whether additional storage is possible, third use authority information processing means, storage date update means, last use date update means, use count increment means, attached use authority information presence / absence determination means, third device information notification means, Functions as user information storage control means, communication availability determination means, user information presence / absence determination means, auxiliary information presence / absence determination means, and auxiliary information storage control means The CPU that controls the information server includes a use authority information acquisition request receiving unit, a transmission destination determining unit, a use authority information acquisition request transmitting unit, a use authority information acquiring unit, an information processing unit (first information) that are functions related to the present invention. The processing means, the second information processing means), the use authority information receiving means, and the use authority information transmitting means are programs for realizing the functions, respectively. Such effects can be obtained.

Such a program may be stored in a storage means such as a ROM, a flash ROM, or an HDD provided in the external authentication device and the usage authority information server from the beginning, but a CD-ROM or a flexible disk as a recording medium, MO, CD-R, CD-RW, DVD + R, DVD + RW, DVD-R, DVD-RW, DVD-RAM, EEPROM, memory card, and other non-volatile recording media (memory) can also be provided. . The program recorded in the non-volatile recording medium is installed in the external authentication device and the usage authority information server and executed by the CPU, or the CPU reads out the program from the non-volatile recording medium and executes the program. The procedure can be executed.
Furthermore, it is also possible to download and execute an external device that is connected to a network and includes a recording medium that records the program, or an external device that stores the program in the storage unit.

  As is apparent from the above description, according to the present invention, since the user authority information can be easily transferred to the external authentication device corresponding to the electronic device on the network that the user wants to use, which network is connected to Even an electronic device can be used after being authenticated by a corresponding external authentication device. Therefore, it is possible to provide an external authentication device and a use authority information server for easily and reliably using electronic devices on the network that the user wants to use.

1-3: MFP 5: External authentication device 10: LAN 51: Control unit 52: IC card reader 53: Display 54: Display operation unit 61, 101: CPU 62, 103: SDRAM 63: Flash ROM
64: LAN interface 102: ROM 104: HDD
105: Network I / F

JP 2007-164621 A JP 2006-319459 A

Claims (24)

An external authentication device for authenticating a user of each electronic device, comprising first communication means for communicating with each of a plurality of electronic devices,
Second communication means for communicating with a use authority information server that manages use authority information of users of the respective electronic devices that can communicate with the external authentication device and other external authentication devices;
User authority information storage means for storing user information of users of electronic devices that can be transmitted with the external authentication device and device information of the electronic devices in association with each other and used as authority information;
User information reading means for reading user information;
Use authority information presence / absence determining means for determining whether or not use authority information including user information read by the user information reading means is stored in the use authority information storage means;
When the use authority information including the read user information is determined to be stored in the use authority information storage unit by the use authority information presence / absence determination unit, the device information in the use authority information is notified. First device information notifying means,
When the use authority information including the read user information is determined not to be stored in the use authority information storage unit by the use authority information presence determination unit, the use authority information including the user information is acquired. Usage authority information acquisition request transmission means for transmitting a request to the usage authority information server;
Usage authority information acquisition request receiving means for receiving a usage authority information acquisition request from the usage authority information server;
The usage authority information including the user information in the usage authority information acquisition request received by the usage authority information acquisition request receiving unit is read from the usage authority information storage unit and transmitted to the usage authority information server. First usage authority information processing means for deleting the usage authority information storage means,
Usage authority information acquisition means for acquiring usage authority information from the usage authority information server;
Second usage authority information processing means for additionally storing the usage authority information acquired by the usage authority information acquisition means in the usage authority information storage means;
Second device information notifying means for notifying device information in the acquired use right information;
Device information selection means for selecting the device information notified by the first or second device information notification means according to an external instruction;
An external authentication apparatus, comprising: an activation request transmission unit that transmits an activation request to an electronic device corresponding to the device information selected by the device information selection unit. A use authority information server that has communication means for communicating with each of the plurality of external authentication devices according to claim 1 and manages use authority information of users of each electronic device that can communicate with each of the plurality of external authentication devices. Because
Management information storage means for storing external authentication device information of each external authentication device and user information of a user of each electronic device that can communicate with each external authentication device in association with each other, and storing it as management information;
Usage authority information acquisition request receiving means for receiving usage authority information acquisition requests from the external authentication devices;
Based on the user information in the usage authority information acquisition request and the management information stored in the management information storage means, the transmission destination of the usage authority information acquisition request received by the usage authority information acquisition request receiving means. A destination discriminating means for discriminating among the external authentication devices;
Use authority information acquisition request transmission means for transmitting the received use authority information acquisition request to the transmission destination determined by the transmission destination determination means;
Usage authority information acquisition means for acquiring usage authority information from the transmission destination of the usage authority information acquisition request transmitted by the usage authority information acquisition request transmission means;
When the usage authority information is acquired by the usage authority information acquisition unit, the transmission in the management information including the user information in the usage authority information among the management information stored in the management information storage unit The external authentication device information corresponding to the transmission destination of the obtained use authority information acquisition request is changed to the external authentication device information corresponding to the transmission source of the use authority information acquisition request, and the acquired use authority information is transmitted to the transmission source. A use authority information server comprising an information processing means for transmitting. The external authentication device according to claim 1,
Additional storage enable / disable determining means for determining whether or not the acquired use authority information can be additionally stored in the use authority information storage means;
When it is determined that the acquired use authority information cannot be additionally stored in the use authority information storage unit by the additional storage permission determination unit, predetermined use authority information stored in the use authority information storage unit is stored. And a third usage authority information processing unit that reads and transmits the usage authority information to the usage authority information server, and stores the acquired usage authority information in the usage authority information storage unit instead of the usage authority information. External authentication device. The external authentication device according to claim 3,
Each use authority information stored in the use authority information storage means is added with a storage date and time that is the date and time when the use authority information is stored,
A storage date and time updating means for updating the storage date and time added to the usage authority information to the current date and time when the usage authority information is stored in the usage authority information storage means;
The external authentication apparatus, wherein the predetermined use authority information is use authority information to which the oldest storage date / time is added among the use authority information stored in the use authority information storage unit. The external authentication device according to claim 3,
Each use authority information stored in the use authority information storage means is added with a last use date and time which is the date and time when the corresponding user last used the external authentication device,
When it is determined that the usage authority information including the read user information is stored in the usage authority information storage unit by the usage authority information presence determination unit, the usage authority information is stored in the usage authority information storage unit. The usage authority information including the read user information includes the last use date and time added to the usage authority information including the user information read by the user information reading means. When it is determined by the use authority information presence / absence determining means that it is not stored in the use authority information storage means, the use stored in the use authority information storage means by the second or third use authority information processing means Provide last use date and time update means to update the last use date and time added to the authority information to the current date and time respectively,
The external authentication apparatus, wherein the predetermined use authority information is use authority information to which the oldest last use date is added among the use authority information stored in the use authority information storage unit. The external authentication device according to claim 3,
Each use authority information stored in the use authority information storage means is added with the number of uses, which is the number of times the corresponding user has used the external authentication device,
When it is determined that the usage authority information including the read user information is stored in the usage authority information storage unit by the usage authority information presence determination unit, the usage authority information is stored in the usage authority information storage unit. The usage authority information including the read user information indicates the usage count added to the usage authority information including the user information read by the user information reading means. Use authority stored in the use authority information storage means by the second or third use authority information processing means when it is determined by the authority information presence / absence determination means that it is not stored in the use authority information storage means A use number increment means is provided to increment the number of uses added to the information,
The external authentication apparatus, wherein the predetermined use authority information is use authority information to which a minimum use frequency is added among the use authority information stored in the use authority information storage unit. The external authentication device according to claim 3,
Each use authority information stored in the use authority information storage means is added with a use priority which is a priority with which the corresponding user can use the external authentication device,
The external authentication apparatus, wherein the predetermined use authority information is use authority information to which the lowest use priority is added among the use authority information stored in the use authority information storage unit. Use authority of the user of each electronic device which has a communication means which each communicates with several external authentication apparatus as described in any one of Claims 3 thru | or 7, and can each communicate with each said external authentication apparatus A usage rights information server for managing information,
Management information storage means for storing external authentication device information of each external authentication device and user information of a user of each electronic device that can communicate with each external authentication device in association with each other, and storing it as management information;
Usage authority information storage means for storing usage authority information;
Usage authority information acquisition request receiving means for receiving usage authority information acquisition requests from the external authentication devices;
Based on the user information in the usage authority information acquisition request and the management information stored in the management information storage means, the transmission destination of the usage authority information acquisition request received by the usage authority information acquisition request receiving means. A destination discriminating means for discriminating among the external authentication devices;
Usage authority information acquisition request transmission means for transmitting the received usage authority information acquisition request to the transmission destination determined by the transmission destination determination means;
Usage authority information acquisition means for acquiring usage authority information from the destination of the usage authority information acquisition request transmitted by the usage authority information acquisition request transmission means;
When the use authority information is acquired by the use authority information acquisition unit, the transmission in the management information including the user information in the use authority information among the management information stored in the management information storage unit The external authentication device information corresponding to the transmission destination of the obtained use authority information acquisition request is changed to the external authentication device information corresponding to the transmission source of the use authority information acquisition request, and the acquired use authority information is transmitted to the transmission source. First information processing means for transmitting;
After the obtained use authority information is transmitted by the first information processing means, use authority information receiving means for receiving use authority information from the transmission destination;
The usage authority information received by the usage authority information receiving unit is stored in the usage authority information storage unit, and the user information in the usage authority information is stored among the management information stored in the management information storage unit. An external authentication apparatus, comprising: a second information processing unit that deletes management information included therein. The external authentication device according to claim 1,
The user information reading means is means for reading the user information of the user together with the attached information of the user,
Attached use authority information storage means for storing the attached authority information of each electronic device that can be transmitted to the external authentication device and the device information of each electronic device in association with each other and used as authority information,
When transmission of the usage authority information acquisition request including the user information read by the user information reading means by the usage authority information acquisition request transmitting means fails, the attached information read by the user information reading means is Attached use authority information presence / absence determining means for determining whether or not use authority information including is stored in the attached use authority information storage means;
When the usage authority information including the read auxiliary information is determined to be stored in the auxiliary usage authority information storage unit by the auxiliary usage authority information presence / absence determination unit, the device information in the usage authority information is notified. An external authentication apparatus comprising a third device information notifying unit. The external authentication device according to claim 9, wherein
User information storage means for storing user information;
User information read by the user information reading means when the use right information acquisition request including the user information read by the user information reading means by the use right information acquisition request sending means fails. User information storage control means for storing the information in the user information storage means,
Communication enable / disable determining means for determining whether or not communication with the external authentication device is possible;
User information presence / absence determining means for determining whether or not user information is stored in the user information storage means when the communication enable / disable determining means determines that communication with the external authentication device is possible; Provided,
The use authority information acquisition request transmitting means includes the use authority information including the user information even when the user information storage means determines that the user information is stored by the user information presence / absence determining means. An external authentication apparatus that transmits an acquisition request to the use authority information server. The external authentication device according to claim 9, wherein
When it is determined that the usage authority information including the read auxiliary information is stored in the auxiliary usage authority information storage unit by the auxiliary usage authority information presence / absence determination unit, of the read auxiliary information, Attached information presence / absence determining means for determining whether there is attached information that is not stored in the attached use authority information storage means,
When the auxiliary information presence / absence determining means determines that there is auxiliary information that is not stored in the auxiliary usage authority information storage means, among the read auxiliary information, the auxiliary usage authority information storage means stores the auxiliary information. Ancillary information storage control means for storing in the adjunct use authority information storage means no auxiliary information,
Communication enable / disable determining means for determining whether or not communication with the external authentication device is possible;
The auxiliary information presence / absence determining means stores auxiliary information that does not constitute use authority information in the auxiliary use authority information storage means when it is determined by the communication availability determination means that communication with the external authentication device is possible. Means for determining whether or not
The use authority information acquisition request transmission unit is configured to determine that the attached information that does not constitute the use authority information is stored in the attached use authority information storage unit by the attached information presence / absence determining unit. A means for transmitting a use authority information acquisition request including the information to the use authority information server,
The second usage authority information processing means is for a usage authority information acquisition request in which the usage authority information acquired by the usage authority information acquisition means includes ancillary information transmitted by the usage authority information acquisition request transmission means. In this case, the external authentication apparatus has means for additionally storing the acquired use authority information in the attached use authority information storage means. The external authentication device according to any one of claims 9 to 11,
The external authentication apparatus, wherein the attached information is theme information indicating a product theme related to a user. The external authentication device according to any one of claims 9 to 11,
The external authentication apparatus, wherein the attached information is organization information indicating an organization to which a user belongs. The external authentication device according to any one of claims 9 to 11,
The external authentication apparatus, wherein the attached information is post information indicating a post to which the user belongs. The external authentication device according to any one of claims 9 to 11,
The external authentication apparatus, wherein the attached information is business information indicating a business content of a user. The external authentication device according to any one of claims 9 to 11,
The accessory usage authority information storage means is a means for storing a plurality of types of accessory information of users of electronic devices that can be transmitted to the external authentication device and device information of the electronic devices as usage authority information in association with each other. Yes,
Providing a priority storage means for storing the priority corresponding to each of the plurality of types of attached information;
The attached use authority information presence / absence determining means is configured to determine each priority in the priority order storage means when transmission of the use authority information acquisition request including the read user information by the use authority information acquisition request transmission means fails. With reference to the order, among the plurality of types of attached information corresponding to the read user information, the use authority information including the attached information is sequentially stored in the attached use authority information storage unit from the attached information having the highest priority. An external authentication apparatus, characterized in that it is means for determining whether or not it is stored. In the usage authority information server according to claim 2,
Attached management information storage means for storing, as management information, external authentication device information of each external authentication device and associated information of all users of each electronic device that can communicate with each external authentication device in association with each other,
When the usage authority information acquisition request received by the usage authority information acquisition request receiving means includes auxiliary information, the usage authority information including the auxiliary information is read from the auxiliary management information storage means and the received usage authority information is received. A usage authority information server, comprising: usage authority information transmission means for transmitting to an acquisition request transmission source. A plurality of external authentication devices according to claim 1 and communication means for communicating with each of the external authentication devices, respectively, and managing usage authority information of users of each electronic device that can communicate with each of the external authentication devices. An information processing system comprising a usage right information server,
In the usage right information server,
Management information storage means for storing external authentication device information of each external authentication device and user information of a user of each electronic device that can communicate with each external authentication device in association with each other, and storing it as management information;
Usage authority information acquisition request receiving means for receiving usage authority information acquisition requests from the external authentication devices;
Based on the user information in the usage authority information acquisition request and the management information stored in the management information storage means, the transmission destination of the usage authority information acquisition request received by the usage authority information acquisition request receiving means. A destination discriminating means for discriminating among the external authentication devices;
Use authority information acquisition request transmission means for transmitting the received use authority information acquisition request to the transmission destination determined by the transmission destination determination means;
Usage authority information acquisition means for acquiring usage authority information from the transmission destination of the usage authority information acquisition request transmitted by the usage authority information acquisition request transmission means;
When the usage authority information is acquired by the usage authority information acquisition unit, the transmission in the management information including the user information in the usage authority information among the management information stored in the management information storage unit The external authentication device information corresponding to the transmission destination of the obtained use authority information acquisition request is changed to the external authentication device information corresponding to the transmission source of the use authority information acquisition request, and the acquired use authority information is transmitted to the transmission source. An information processing system comprising first information processing means for transmitting. A first communication means for communicating with each of a plurality of electronic devices and a use authority information server for managing use authority information of users of the respective electronic devices that can communicate with the external authentication device and other external authentication devices. Second authority means for storing, user authority information storage means for associating and storing user information of users of each electronic device communicable with the external authentication apparatus and device information of each electronic apparatus as use authority information And an authentication method in the external authentication device for authenticating the user of each electronic device that can communicate with the external authentication device, comprising user information reading means for reading user information,
A use authority information presence / absence determining step for determining whether or not use authority information including user information read by the user information reading means is stored in the use authority information storage means;
When it is determined that the usage authority information including the read user information is stored in the usage authority information storage unit by the usage authority information presence / absence determination step, the device information in the usage authority information is notified. A first device information notifying step to perform,
When the usage authority information including the read user information is determined not to be stored in the usage authority information storage unit by the usage authority information presence determination step, the usage authority information including the user information is acquired. A use authority information acquisition request transmission step for transmitting a request to the use authority information server;
A usage authority information acquisition request receiving step for receiving a usage authority information acquisition request from the usage authority information server;
The usage authority information including the user information in the usage authority information acquisition request received by the usage authority information acquisition request receiving step is read from the usage authority information storage means and transmitted to the usage authority information server, and the usage authority information A first use authority information processing step of deleting from the use authority information storage means;
A usage authority information acquisition step of acquiring usage authority information from the usage authority information server;
A second usage authority information processing step of additionally storing the usage authority information acquired by the usage authority information acquisition step in the usage authority information storage unit;
Second device information notifying means for notifying device information in the acquired use right information;
A device information selection step of selecting the device information notified by the first or second device information notification step according to an instruction from the outside;
An authentication method comprising: an activation request transmission step of transmitting an activation request to an electronic device corresponding to the device information selected in the device information selection step. Communication means for communicating with each of a plurality of external authentication devices according to claim 1, external authentication device information of each of the plurality of external authentication devices, and use of each electronic device user capable of communicating with each of the external authentication devices Management information storage means for storing management information in association with user information, and use in a usage authority information server for managing usage authority information of users of electronic devices that can communicate with the external authentication devices. An authority information management method,
A use authority information acquisition request receiving step for receiving a use authority information acquisition request from each of the external authentication devices;
Based on the user information in the usage authority information acquisition request and the management information stored in the management information storage means, the transmission destination of the usage authority information acquisition request received by the usage authority information acquisition request reception step. A transmission destination determination step of determining from each of the external authentication devices;
A usage authority information acquisition request transmission step for transmitting the received usage authority information acquisition request to the transmission destination determined by the transmission destination determination step;
A usage authority information acquisition step for acquiring usage authority information from a transmission destination of the usage authority information acquisition request transmitted by the usage authority information acquisition request transmission step;
The transmission in the management information including the user information in the usage authority information among the management information stored in the management information storage means when the usage authority information is acquired in the usage authority information acquisition step The external authentication device information corresponding to the transmission destination of the obtained use authority information acquisition request is changed to the external authentication device information corresponding to the transmission source of the use authority information acquisition request, and the acquired use authority information is transmitted to the transmission source. An information processing step for transmitting the information. A first communication means for communicating with each of a plurality of electronic devices and a use authority information server for managing use authority information of users of the respective electronic devices that can communicate with the external authentication device and other external authentication devices. Second authority means for storing, user authority information storage means for associating and storing user information of users of each electronic device communicable with the external authentication apparatus and device information of each electronic apparatus as use authority information And a computer for controlling an external authentication device for authenticating a user of each electronic device capable of communicating with the external authentication device, having user information reading means for reading user information,
Use authority information presence / absence determination function for determining whether or not use authority information including user information read by the user information reading means is stored in the use authority information storage means;
When it is determined that the use authority information including the read user information is stored in the use authority information storage unit by the use authority information presence / absence determination function, the device information in the use authority information is notified. A first device information notification function,
When the use authority information including the read user information is determined not to be stored in the use authority information storage unit by the use authority information presence determination function, the use authority information including the user information is acquired. A usage authority information acquisition request transmission function for transmitting a request to the usage authority information server;
A usage authority information acquisition request receiving function for receiving a usage authority information acquisition request from the usage authority information server;
The usage authority information including the user information in the usage authority information acquisition request received by the usage authority information acquisition request receiving function is read from the usage authority information storage means and transmitted to the usage authority information server, and the usage authority information A first usage authority information processing function for deleting the usage authority information from the usage authority information storage means;
A usage authority information acquisition function for acquiring usage authority information from the usage authority information server;
A second usage authority information processing function for additionally storing the usage authority information acquired by the usage authority information acquisition function in the usage authority information storage unit;
A second device information notifying function for notifying device information in the acquired use right information;
A device information selection function for selecting device information notified by the first or second device information notification function according to an external instruction;
A program for realizing an activation request transmission function for transmitting an activation request to an electronic device corresponding to the device information selected by the device information selection function.   A computer-readable recording medium on which the program according to claim 21 is recorded. Communication means for communicating with each of a plurality of external authentication devices according to claim 1, external authentication device information of each of the plurality of external authentication devices, and use of each electronic device user capable of communicating with each of the external authentication devices Management information storage means for associating and storing user information as management information, and controlling a usage authority information server that manages usage authority information of users of electronic devices that can communicate with the external authentication devices. To the computer
A use authority information acquisition request reception function for receiving a use authority information acquisition request from each external authentication device;
The transmission destination of the usage authority information acquisition request received by the usage authority information acquisition request receiving function is based on the user information in the usage authority information acquisition request and each management information stored in the management information storage means. A destination discrimination function for discriminating among the external authentication devices;
A use authority information acquisition request transmission function for transmitting the received use authority information acquisition request to the transmission destination determined by the transmission destination determination function;
A usage authority information acquisition function for acquiring usage authority information from a transmission destination of the usage authority information acquisition request transmitted by the usage authority information acquisition request transmission function;
When the usage authority information is acquired by the usage authority information acquisition unit, the transmission in the management information including the user information in the usage authority information among the management information stored in the management information storage unit The external authentication device information corresponding to the transmission destination of the obtained use authority information acquisition request is changed to the external authentication device information corresponding to the transmission source of the use authority information acquisition request, and the acquired use authority information is transmitted to the transmission source. A program for realizing the information processing function to be transmitted.   A computer-readable recording medium on which the program according to claim 23 is recorded.

Images