JP2013004035A - Authentication system, image formation device, authentication server, processing method for authentication system and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a mechanism which makes utilization of an image formation device more efficient when authentication cannot be performed by an authentication server, while reducing the amount of authentication information stored in the image formation device.SOLUTION: An authentication server performs the steps of: storing an authentication history in which authenticated user information is associated with image formation device information of an image formation device from which a user authentication request has been issued, in response to the user authentication request from the image formation device; generating an authentication table storing the image formation device information from which the user authentication request has been issued for each piece of user information, according to the authentication history, for each image formation device of a distribution destination; and distributing the authentication table to the image formation device. The image formation device stores the authentication table, issues an authentication request of the user information in response to reception of the user information and performs local authentication using the authentication table when the authentication cannot be performed by the authentication request.

Description

  The present invention relates to an authentication system, an image forming apparatus, an authentication server, an authentication system processing method, and a program for using the image forming apparatus.

  In recent years, with the heightened awareness of security in offices, security related to multifunction devices, which are information input / output units, has been required, and the concept of “authentication” has been applied to multifunction devices as well as PCs. It was.

  Here, for authentication, an authentication method using an IC card is preferred in the market because of its high usability. In general, this system uses an IC card authentication server that manages association between a card number and user information. Conventionally, a user registered in the IC card authentication server can log in to all multifunction devices of this system. However, in recent years, from the viewpoint of security, it is desired to log in from a multifunction device that is not normally used. There are many requests that there is no.

  To cope with this, MFPs are managed on a group basis on the IC card authentication server, user information and group information are linked, and at the time of IC card authentication, login is permitted only for MFPs in groups where login is permitted. The so-called device group concept has been considered.

  On the other hand, there is a concern that the above system cannot log in when the IC card authentication server is down. In response to this, as shown in Patent Document 1, there is a mechanism that allows an MFP to log in even when the IC card authentication server is down by holding an authentication table in the MFP.

JP 2009-182671 A

  As described above, there is a mechanism for performing IC card authentication in the multifunction device in order to enable login to the multifunction device when the IC card authentication server is down. However, in this method, it is necessary to create and distribute the authentication table held by the IC card authentication server for every device group or for each device group, and security concerns have been pointed out from the market.

  In general, when the IC card authentication server is down, there are many voices that it is sufficient to be able to authenticate with a multi-function device that is frequently used.

  Therefore, an object of the present invention is to create an authentication table for authentication in the image forming apparatus according to an authentication history for logging in to the image forming apparatus, and distribute the authentication table to the image forming apparatus. An object of the present invention is to provide a mechanism for improving the efficiency of use of an image forming apparatus when authentication by an authentication server is not possible while reducing authentication information held in the forming apparatus.

  In order to achieve the object of the present invention, an authentication system including an authentication server for storing user information for performing user authentication and an image forming apparatus when logging in to the image forming apparatus, wherein the authentication server includes the image server. In response to a user authentication request from the forming apparatus, an authentication history storage unit that stores the authenticated user information and an authentication history in which the image forming apparatus information of the image forming apparatus that has made the user authentication request is associated; For each of the image forming apparatuses, an authentication table creating means for creating an authentication table recording image forming apparatus information requested for user authentication for each user information according to the authentication history, and transmitting the authentication table to the image forming apparatus The image forming apparatus includes: an authentication table storage unit that stores the authentication table; and a user information reception unit. And authentication request means for requesting authentication of the user information, and local authentication means for authenticating using an authentication table stored in the authentication table storage means when authentication is not performed by the authentication request. It is characterized by that.

  The image forming apparatus may further include a display unit that displays image forming apparatus information to which the authenticated user can log in when the local authentication unit authenticates the image forming apparatus.

  The authentication table creation means deletes user information that does not include authentication medium information used for authentication from user information in which the image forming apparatus information to be distributed by the distribution means is not recorded.

  The authentication server stores a device group defining a group of image forming apparatuses, and the authentication table creating unit creates an authentication table for each device group.

  Authentication information held in the image forming apparatus by creating an authentication table for authentication in the image forming apparatus in accordance with the authentication history for logging in to the image forming apparatus and distributing the authentication table to the image forming apparatus The use of the image forming apparatus can be made more efficient when authentication by the authentication server is impossible.

It is a system configuration figure showing an example of the composition of the security system in this embodiment. 2 is a hardware configuration diagram of an information processing apparatus applicable to a client PC 100 and an IC card authentication server 200. FIG. 2 is a block diagram illustrating a hardware configuration of a multifunction machine 300. FIG. 2 is a functional block diagram of a client PC 100, an IC card authentication server 200, and a multifunction machine 300. FIG. It is a flowchart which shows an example of an IC card authentication process. 6 is a flowchart illustrating an example of an authentication table synchronization process for transmitting an authentication table from an IC card authentication server to a multifunction peripheral. 5 is a flowchart regarding authentication processing (local authentication) using a synchronization authentication table in a multifunction peripheral. It is a figure which shows an example of the authentication table memorize | stored in the IC card authentication server. It is a figure which shows an example of the device group / user relation table memorize | stored in the IC card authentication server. 6 is a diagram illustrating an example of a device group / multifunction peripheral-related table stored in an IC card authentication server 200. FIG. It is a figure which shows an example of the setting file memorize | stored in the IC card authentication server. It is a figure which shows an example of the authentication log | history file memorize | stored in the IC card authentication server. It is a figure which shows an example of the various tables produced with the IC card authentication server. 5 is a diagram illustrating an example of an IC card authentication screen displayed on the multifunction peripheral 300. FIG. 6 is a diagram illustrating an example of an IC card authentication error screen displayed on the multifunction machine 300. FIG. 6 is a diagram illustrating an example of an authentication failure screen displayed on the multifunction peripheral 300. FIG. 6 is a diagram illustrating an example of an authentication success screen displayed on the MFP 300. FIG.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a system configuration diagram showing an example of the configuration of the security system using a multifunction machine 300, an IC card reader 500, an IC card authentication server 200 (hereinafter referred to as an authentication server 200), and a client PC 100 according to the present invention.

  The MFP 300 is connected to the authentication server 200 and the client PC 100 via the LAN 400 so as to be communicable. The information of the IC card read by the IC card reader 500 is authenticated by the authentication server 200, and the authentication result is transmitted to the multi function device 300. Further, the authentication server 200 stores the authentication result as a history, and creates an authentication table to be distributed to the MFP 300 according to the authentication result.

  In addition, the multi-function device 300 can store print data transmitted from the client PC 100, and can select desired print data of the authenticated user and execute printing.

  The system shown in FIG. 1 is an authentication system including an authentication server that stores user information for user authentication and an image forming apparatus when logging into the image forming apparatus.

  Hereinafter, the hardware configuration of the information processing apparatus applicable to the client PC 100 and the authentication server 200 illustrated in FIG. 1 will be described with reference to FIG.

  In FIG. 2, reference numeral 2001 denotes a CPU that comprehensively controls each device and controller connected to the system bus 2004. Further, the ROM 2003 or the external memory 2011 is necessary to realize a BIOS (Basic Input / Output System) or an operating system program (hereinafter referred to as an OS) which is a control program of the CPU 2001, and a function executed by each server or each PC. Various programs are stored.

  Reference numeral 2002 denotes a RAM that functions as a main memory, work area, and the like of the CPU 2001. The CPU 2001 implements various operations by loading a program or the like necessary for execution of processing from the ROM 2003 or the external memory 2011 to the RAM 2002 and executing the loaded program.

  An input controller 2005 controls input from a keyboard (KB) 2009 or a pointing device such as a mouse (not shown). A video controller 2006 controls display on a display device such as a CRT display (CRT) 2010. In FIG. 2, although described as CRT2010, the display may be not only a CRT but also other display such as a liquid crystal display. These are used by clients as needed.

  A memory controller 2007 is connected to the hard disk (HD), flexible disk (FD), or PCMCIA card slot for storing a boot program, various applications, font data, user files, editing files, various data, etc. via an adapter. The access to the external memory 2011 such as a compact flash (registered trademark) memory is controlled.

  A communication I / F controller 2008 is connected to and communicates with an external device via a network (for example, the LAN 400 shown in FIG. 1), and executes communication control processing in the network. For example, communication using TCP / IP is possible.

  Note that the CPU 2001 enables display on the CRT 2010 by executing outline font rasterization processing on a display information area in the RAM 2002, for example. Further, the CPU 2001 enables a user instruction with a mouse cursor (not shown) on the CRT 2010.

  Various programs that operate on the hardware are recorded in the external memory 2011, and are executed by the CPU 2001 by being loaded into the RAM 2002 as necessary.

  Next, the hardware configuration of the controller unit that controls the multifunction peripheral 300 as the information processing apparatus of the present invention will be described with reference to FIG.

  FIG. 3 is a block diagram illustrating a hardware configuration example of the controller unit 5000 of the multifunction machine 300.

  In FIG. 3, a controller unit 5000 is connected to a scanner 5015 functioning as an image input device and a printer 5014 functioning as an image output device, and a local area network such as the LAN 400 shown in FIG. By connecting to a public line (WAN) such as ISDN, image data and device information are input and output.

  As shown in FIG. 3, the controller unit 5000 includes a CPU 5001, a RAM 5006, a ROM 5002, an external storage device (hard disk drive (HDD)) 5007, a network interface (Network I / F) 5003, a modem (Modem) 5004, an operation unit interface ( Operation unit I / F) 5005, external interface (external I / F) 5009, image bus interface (IMAGE BUS I / F) 5008, raster image processor (RIP) 5010, printer interface (printer I / F) 5011, scanner interface (Scanner I / F) 5012, an image processing unit 5013, and the like.

  A CPU 5001 is a processor that controls the entire system.

  A RAM 5006 is a system work memory for the CPU 5001 to operate, and is a program memory for recording a program and an image memory for temporarily storing image data.

  The ROM 5002 stores a system boot program and various control programs.

  An external storage device (hard disk drive HDD) 5007 stores various programs for controlling the system, image data, and the like.

  An operation unit interface (operation unit I / F) 5005 is an interface unit with the operation unit (UI) 5018, and outputs image data to be displayed on the operation unit 5018 to the operation unit 5018.

  The operation unit I / F 5005 serves to transmit information (for example, user information) input by the system user from the operation unit 5018 to the CPU 5001. Note that the operation unit 5018 includes a display unit having a touch panel, and various instructions can be given by a user pressing (touching with a finger or the like) a button displayed on the display unit.

  A network interface (Network I / F) 5003 is connected to a network (LAN) and inputs / outputs data.

  A modem (MODEM) 5004 is connected to a public line and inputs / outputs data such as FAX transmission / reception.

  An external interface (external I / F) 5009 is an interface unit that accepts external inputs such as USB, IEEE 1394, printer port, and RS-232C. In the present embodiment, a card reader for reading an IC card required for authentication is used. 500 is connected.

  Then, the CPU 5001 can control reading of information from the IC card by the card reader 500 via the external I / F 5009, and can acquire information read from the IC card. Note that the storage medium is not limited to an IC card, and any storage medium that can identify a user may be used. In this case, identification information for identifying the user is stored in the storage medium. This identification information may be a production number of the storage medium or a user code given by the user within the company.

The above devices are arranged on the system bus.

  On the other hand, an image bus interface (IMAGE BUS I / F) 5008 is a bus bridge that connects a system bus 5016 and an image bus 5017 that transfers image data at high speed and converts a data structure.

  The image bus 5017 is configured by a PCI bus or IEEE1394. The following devices are arranged on the image bus 5017.

  A raster image processor (RIP) 5010 develops, for example, vector data such as a PDL code into a bitmap image.

  A printer interface (printer I / F) 5011 connects the printer 5014 and the controller unit 5000, and performs synchronous / asynchronous conversion of image data.

  A scanner interface (scanner I / F) 5012 connects the scanner 5015 and the controller unit 5000, and performs synchronous / asynchronous conversion of image data.

  An image processing unit 5013 corrects, processes, and edits input image data, and performs printer correction, resolution conversion, and the like on print output image data. In addition to this, the image processing unit 5013 performs rotation of image data and compression / decompression processing such as JPEG for binary image data and JBIG, MMR, MH for binary image data.

  A scanner 5015 connected to the scanner I / F 5012 illuminates an image on paper as a document and scans it with a CCD line sensor, thereby converting it into an electrical signal as raster image data. The original paper is set on the tray of the original feeder, and when the apparatus user gives a reading start instruction from the operation unit 5018, the CPU 5001 gives an instruction to the scanner, and the feeder feeds the original paper one by one to read the original image. I do.

  A printer 5014 connected to the printer I / F 5011 is a part that converts raster image data into an image on paper. The method is an electrophotographic method using a photosensitive drum or a photosensitive belt, and ink is supplied from a micro nozzle array. There is an ink jet method for ejecting and printing an image directly on a sheet, but any method may be used. The printing operation is started in response to an instruction from the CPU 5001. Note that the printer unit 5014 has a plurality of paper feed stages so that different paper sizes or different paper orientations can be selected, and has a paper cassette corresponding thereto.

  An operation unit 5018 connected to the operation unit I / F 5005 includes a liquid crystal display (LCD) display unit. A touch panel sheet is affixed on the LCD and displays a system operation screen. When a displayed key is pressed, the position information is transmitted to the CPU 5001 via the operation unit I / F 5005. The operation unit 5018 includes, for example, a start key, a stop key, an ID key, a reset key, and the like as various operation keys.

  Here, the start key of the operation unit 5018 is used when starting a document image reading operation. There are green and red LEDs in the center of the start key, and indicates whether or not the start key can be used depending on the color. The stop key of the operation unit 5018 serves to stop the operation being performed. The ID key of the operation unit 5018 is used when inputting the user ID of the user. The reset key is used when initializing settings from the operation unit 5018.

  A card reader 500 connected to the external I / F 5009 reads information stored in an IC card (for example, Sony FeliCa (registered trademark)) under the control of the CPU 5001, and reads the read information to the external I / F 5009. The CPU 5001 is notified via F5009.

  Next, functions of the client PC 100, the authentication server 200, and the MFP 300 according to the present invention will be described with reference to FIG.

  FIG. 4 is a block diagram showing a schematic configuration of a system according to the embodiment of the present invention. The system according to the embodiment of the present invention has a configuration in which a client PC 100, an authentication server 200, and a multifunction machine 300 are connected via a predetermined LAN 400 (communication medium) capable of bidirectional communication. A card reader 500 is connected to the multifunction device 300.

  Since the operation flow between the respective functions will be described later, an explanation of functional block diagrams described in various terminals will be given here.

  First, functions of the client PC 100 will be described. The print data generation unit 150 on the client PC 100 can generate print data (job) based on the data received from the application program, and can transmit the print data to the MFP 300 or the like.

  Next, functions of the authentication server 200 will be described. The MFP communication unit 250 on the authentication server 200 transmits / receives an authentication request to / from the MFP 300 and transmits an authentication table for synchronization.

  The authentication table management unit 251 on the authentication server 200 accesses an authentication table managed in the authentication server, searches for user information associated with the card number or user name and password requested for authentication, and returns an authentication result.

  The device group management unit 252 on the authentication server 200 manages the device group / user related table file and the device group / multifunction peripheral related table file managed in the authentication server, and the received authentication request is authenticated in the device group management. Judge whether to allow or not.

  The synchronization processing control unit 253 on the authentication server 200 controls generation and distribution of the synchronization authentication table.

  Next, functions of the multifunction machine 300 will be described. The card reader control unit 350 on the multifunction device 300 acquires card information (manufacturing number) held over the card reader 500.

  The authentication server communication unit 351 on the multifunction machine 300 transmits and receives an authentication request with the authentication server 200 and receives a synchronization authentication table.

  The authentication table management unit 352 on the MFP 300 accesses the synchronization authentication table managed in the MFP, searches for user information associated with the card number or user name and password requested for authentication, and returns an authentication result. .

  It is assumed that the authentication unit 353 on the multifunction device 300 permits the use of the multifunction device by using the user information when the overall authentication system is successfully controlled and authenticated.

  Next, detailed description of processing in the present embodiment will be described using the flowcharts of FIGS.

  FIG. 5 is a flowchart showing an example of the IC card authentication process in the embodiment of the present invention.

  Note that authentication processing using the synchronization authentication table in the multifunction peripheral that fails to communicate with the authentication server is described in FIG.

  In step S100, the authentication unit 353 of the MFP 300 displays an IC card authentication screen (FIG. 14).

  In step S101, the card reader control unit 350 of the multifunction machine 300 transmits a card reading start command to the card reader. That is, a polling start instruction command for reading the IC card is sent to the card reader.

  In step S102, the card reader enters the IC card reading state by receiving the card reader reading start command transmitted from the multifunction device in step S101.

  In step S103, the card reader detects that the IC card is held over and transmits a card event to the multi-function peripheral. This card event stores the card number held up. The card number may be a card manufacturing number stored in the IC card, or any number that can be arbitrarily stored in the IC card, a serial card name, etc., for identifying the user. May be.

  In step S104, the card reader control unit 350 of the multi-function device 300 receives a card event transmitted from the card reader.

  In step S105, the authentication unit 353 of the MFP 300 acquires a card number from the card event acquired in step S104.

  In step S <b> 106, the authentication server communication unit 351 of the MFP 300 transmits an authentication request including a card number (card information) to the authentication server 200. That is, it is an authentication request process for making an authentication request for user information in response to reception of user information (for example, a card number).

  In step S107, the MFP communication unit 250 of the authentication server 200 receives the authentication request transmitted in step S106.

  In step S108, the authentication table management unit 251 of the authentication server 200 acquires the authentication table shown in FIG. 8 managed in the authentication server.

  In step S109, the authentication table management unit 251 of the authentication server 200 determines whether the card information acquired in step S107 is registered in the authentication table acquired in step 108. If the card information is registered, the user name is extracted and then the process proceeds to step S110. If the card information is not registered, the process proceeds to step S119.

  In step S110, the device group management unit 252 of the authentication server 200 acquires the device group / user relation table shown in FIG. This device group / user association table is a table in which a device group and a user name that can be logged in with the device group are associated with each other and is registered in advance by an administrator.

  In step S111, the device group management unit 252 of the authentication server 200 acquires a list of device groups that can be logged in with the user name acquired in step S109 from the device group / user relation table acquired in step S110.

  In step S112, the device group management unit 252 of the authentication server 200 acquires the device group / multifunction peripheral-related table shown in FIG. 10 managed in the multi-function peripheral. This device group / multifunction peripheral table is a table showing which multifunction peripheral is associated with each device group, and is pre-registered by the administrator. Note that the device group / multifunction peripheral-related table shown in FIG. 10 is also stored in the authentication server 200.

  In step S113, the device group management unit 252 of the authentication server 200 determines whether the user who has registered the card in step S109 can log in to the multifunction peripheral. Specifically, when the authentication request is received in step S107, the IP address of the authentication request transmission source is acquired. Using this IP address, the device group of the multifunction device is acquired from the device group / multifunction device relation table acquired in step S112. It is determined whether or not the user can log in to this device group, that is, whether or not the device group that can be logged in by the user acquired in step S111 is included. If login is possible, the process proceeds to step S114. If login is impossible, the process proceeds to step S119.

  In step S114, the synchronization processing control unit 253 of the authentication server 200 acquires the authentication history file shown in FIG.

  In step S115, the synchronization processing control unit 253 of the authentication server 200 registers the history information of the user in the authentication history file acquired in step S114. The history information to be registered includes login date / time (authentication date / time), user name, and IP address of the device that has performed authentication. In other words, in response to a user authentication request from the image forming apparatus, the authentication history storage process stores an authentication history in which the authenticated user information is associated with the image forming apparatus information of the image forming apparatus that has made the user authentication request. .

  In step S116, the authentication table management unit 251 of the authentication server 200 acquires the user information registered in the authentication table acquired in step S108.

  In step S117, the authentication table management unit 251 of the authentication server 200 generates authentication success data including the user information acquired in step S116.

  In step S118, the synchronization processing control unit 253 of the authentication server 200 acquires the authentication history file shown in FIG.

  In step S119, if the user history information exists for the authentication history file acquired in step S118, the synchronization processing control unit 253 of the authentication server 200 deletes the information. The deletion target here is only when the user name and device group information match, and only the user name that matches only is not deleted.

  In step S120, the authentication table management unit 251 of the authentication server 200 generates authentication failure data.

  In step S121, the MFP communication unit 250 of the authentication server 200 transmits an authentication result (authentication success data or authentication failure data) to the MFP.

  In step S122, the authentication server communication unit 351 of the MFP 300 receives the authentication result transmitted from the authentication server.

  In step S123, the authentication server communication unit 351 of the MFP 300 determines whether or not to acquire an authentication result from the authentication server in step S122. If the authentication result is acquired, the process proceeds to step S124. If not acquired, that is, if the communication with the authentication server fails, the process proceeds to step S300.

  In step S124, the authentication unit 353 of the MFP 300 analyzes the authentication result received in step S122, and determines whether the authentication is successful. If the authentication is successful, the process proceeds to step S125. If the authentication fails, the process proceeds to step S127.

  In step S125, the authentication unit 353 of the MFP 300 acquires user information from the authentication result acquired in step S122.

  In step S126, the authentication unit 353 of the multifunction device 300 logs in to the multifunction device using the user information acquired in step S125.

  In step S127, the authentication unit 353 of the MFP 300 displays the IC card authentication error screen shown in FIG.

  FIG. 6 is a flowchart illustrating an example of an authentication table synchronization process for transmitting an authentication table from the authentication server to the multifunction peripheral according to the embodiment of this invention. This processing is appropriately executed in accordance with an arbitrary timing or a request from the multifunction machine 300 and an instruction from the administrator.

  In step S200, the synchronization processing control unit 253 of the authentication server 200 acquires the authentication table shown in FIG. 8 managed in the authentication server.

  In step S201, the synchronization processing control unit 253 of the authentication server 200 acquires the device group / user relation table shown in FIG. 9 managed in the authentication server. That is, the authentication server stores a device group that defines a group of image forming apparatuses, acquires the device group, and creates an authentication table for each device group.

  In step S202, the synchronization processing control unit 253 of the authentication server 200 acquires a device group list from the device group / user relation table acquired in step S201. If there is a device group for which a synchronization authentication table has not been created in the acquired device group list, the process proceeds to step S203. If not, that is, if a synchronization authentication table has been created for all device groups, step S203 is performed. The process proceeds to S209.

  In step S203, the synchronization processing control unit 253 of the authentication server 200 acquires a device group No for which a synchronization authentication table has not been created from the device group / user association table acquired in step S201.

  In step S204, the synchronization processing control unit 253 of the authentication server 200 acquires a list of users associated with the device group No acquired in step S203 from the device group / user relation table acquired in step S201.

  In step S205, the synchronization processing control unit 253 of the authentication server 200 extracts only the user information acquired in step S204 from the authentication table acquired in step S200. (FIG. 13-1) That is, this is an authentication table divided for each device group.

  In step S206, the synchronization processing control unit 253 of the authentication server 200 acquires the setting file shown in FIG. 11 managed in the authentication server.

  In step S207, the synchronization processing control unit 253 of the authentication server 200 acquires the authentication history file shown in FIG. 12 managed in the authentication server.

  In step S208, the synchronization processing control unit 253 of the authentication server 200 acquires the user name from the synchronization authentication table shown in FIG. 13A created in step S205, and uses the user name to acquire the authentication acquired in step S207. The authentication history is acquired from the history file, and is added to the login-enabled MFP list in the authentication table for IP address synchronization that has been successfully authenticated. (Figure 13-2)

At this time, the authentication history file is searched using the contents of the setting file acquired in step S206. In the example shown in FIG. 11, the search target period of the authentication history file is 3 days.

  In step S209, the synchronization processing control unit 253 of the authentication server 200 acquires the device group / multifunction peripheral-related table shown in FIG. 10 managed in the authentication server.

  In step S210, the synchronization processing control unit 253 of the authentication server 200 acquires a multifunction device list from the device group / multifunction device relation table acquired in step S209, and whether there is a multifunction device for which the synchronization authentication table has not yet been transmitted. Judge whether or not. If there is an unsent MFP, the MFP information is acquired and the process proceeds to step S211. If there is no unsent MFP information, that is, if the synchronization authentication table has already been distributed to all the MFPs in the MFP list, the process ends.

  In step S <b> 211, the synchronization processing control unit 253 of the authentication server 200 acquires all device group numbers to which the MFPs that have not been transmitted in the authentication table acquired in step S <b> 210 belong.

  In step S212, the synchronization processing control unit 253 of the authentication server 200 acquires and merges all the synchronization authentication tables of the device group of the device group No acquired in step S211. In this merge, taking FIG. 13 as an example, since the MFPs scheduled to be transmitted this time are device group 1 and device group 2, the synchronization authentication tables for device group 1 and device group 2 in FIG. Is.

  In step S213, the synchronization processing control unit 253 of the authentication server 200 acquires the IP address of the MFP that has not been transmitted in the authentication table acquired in step 210. An unsent multifunction device means a multifunction device to be transmitted this time. In the present embodiment, a case where the synchronization authentication table is transmitted at 192.168.000.003 will be described as an example.

  In step S214, the synchronization processing control unit 253 of the authentication server 200 searches for the user information in the synchronization authentication table created in step S212, and the IP address (192.168 .. For the information not included in the user, the information necessary for login is deleted (FIG. 13-3). This allows users who have not logged in in the past to authenticate locally with the MFP and cannot log in, but can notify the user of MFPs that can log in, and do not hold unnecessary user information. Is possible.

  Specifically, the card number and the login-enabled MFP list are left, and other user information is deleted (at least the user name is deleted). That is, it is a process of deleting user information that does not include authentication medium information used for authentication from user information in which image forming apparatus information to be distributed is not recorded.

  In step S215, the MFP communication unit 250 of the authentication server 200 transmits the synchronization authentication table created in step S214 to the IP address acquired in step S213. That is, it is a distribution process for distributing the authentication table to the image forming apparatus.

  In step S216, the authentication server communication unit 351 of the multifunction machine 300 receives the synchronization authentication table sent from the authentication server.

  In step S217, the authentication table management unit 352 of the MFP 300 stores the synchronization authentication table received in step S216. That is, it is an authentication table storage process for storing the received authentication table.

  It should be noted that steps S200 to S214 are authentication table creation that creates an authentication table that records image forming apparatus information requested for user authentication for each user information in accordance with an authentication history for each image forming apparatus serving as a distribution destination. It is processing.

  FIG. 7 is a flowchart relating to authentication processing (local authentication) using the synchronization authentication table in the multifunction peripheral according to the embodiment of the present invention.

  In step S300, the authentication table management unit 352 of the multifunction device 300 acquires the synchronization authentication table stored in the multifunction device.

  In step S301, the authentication table management unit 352 of the MFP 300 determines whether the card number acquired in step S105 is registered in the synchronization authentication table acquired in step S300. If registered, the process proceeds to step S302. If not registered, the process proceeds to step S307. That is, it is a local authentication process in which authentication is performed using a stored authentication table when authentication is not performed by an authentication request.

  In step S302, the authentication table management unit 352 of the multifunction device 300 includes the IP address of the device (multifunction device) in the login-enabled multifunction device list among the information described in the user information hit in step S302. Determine whether or not. If it is included, the process proceeds to step S303, and if it is not included, the process proceeds to step S308.

  In step S303, the authentication table management unit 352 of the MFP 300 acquires the user information of the user hit in step S302.

  In step S304, the authentication unit 353 of the MFP 300 displays the intra-device authentication success screen shown in FIG. On this screen, a list of MFPs that can be logged in corresponding to the user information acquired in step S303 is displayed, and a list of MFPs that can log in to the user is shown. Note that the list of log-in capable MFPs may be configured to be displayed in accordance with a user instruction. That is, this is a display process for displaying image forming apparatus information that can be logged in by the authenticated user when authenticated by the local authentication process.

  In step S305, the authentication unit 353 of the MFP 300 determines whether the OK button on the intra-device authentication success screen has been pressed. If it has been pressed, the process proceeds to step S306.

  In step S306, the authentication unit 353 of the multifunction device 300 logs in to the multifunction device using the login information of the user acquired in step S303.

  In step S307, the authentication unit 353 of the MFP 300 displays the IC card authentication error screen shown in FIG.

  In step S308, the authentication unit 353 of the MFP 300 displays the in-device authentication failure screen illustrated in FIG. A list of MFPs that can be logged in described in the synchronization authentication table is displayed on the screen, and a list of MFPs that can log in to the user is displayed. That is, this is a display process for displaying image forming apparatus information that can be logged in by the authenticated user when authenticated by the local authentication process.

  As described above, according to the present embodiment, an authentication table for performing authentication in the multifunction peripheral (image forming apparatus) is created according to the authentication history for logging in to the multifunction peripheral (image forming apparatus), and the multifunction peripheral (image) is created. By distributing the authentication table to the forming apparatus), the authentication information held in the multifunction apparatus (image forming apparatus) is reduced, and the use of the multifunction apparatus (image forming apparatus) is made more efficient when authentication by the authentication server is not possible. be able to.

  Also, instead of managing all user information on the authentication server by the multifunction peripheral (image forming apparatus), only the user information that satisfies the preset condition is transmitted to the corresponding device group, thereby allowing the multifunction peripheral ( Authentication table information to be transmitted to the image forming apparatus) is limited, and only the minimum authentication table is transmitted to the multifunction peripheral (image forming apparatus). Therefore, the authentication server authenticates without flowing unnecessary authentication tables to the multifunction peripheral. Even when the server is down, it is possible to log in to a commonly used multifunction peripheral (image forming apparatus).

  Also, when logging in to a multifunction device (image forming device) when the authentication server is down, a list of multifunction devices that can be logged in is displayed on the touch panel of the multifunction device (image forming device). It is possible to improve the convenience of operation.

  It should be noted that the configuration and contents of the various data described above are not limited to this, and it goes without saying that the various data and configurations are configured according to the application and purpose.

  Although one embodiment has been described above, the present invention can take an embodiment as, for example, a system, apparatus, method, program, or recording medium, and specifically includes a plurality of devices. The present invention may be applied to a system including a single device.

  Further, the program according to the present invention is a program that allows a computer to execute the processing methods of the flowcharts shown in FIGS. 5 to 7. Is remembered. The program in the present invention may be a program for each processing method of each apparatus in FIGS.

  As described above, a recording medium that records a program that implements the functions of the above-described embodiments is supplied to a system or apparatus, and a computer (or CPU or MPU) of the system or apparatus stores the program stored in the recording medium. It goes without saying that the object of the present invention can also be achieved by executing the reading.

  In this case, the program itself read from the recording medium realizes the novel function of the present invention, and the recording medium storing the program constitutes the present invention.

  As a recording medium for supplying the program, for example, a flexible disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, DVD-ROM, magnetic tape, nonvolatile memory card, ROM, EEPROM, silicon A disk, solid state drive, or the like can be used.

  Further, by executing the program read by the computer, not only the functions of the above-described embodiments are realized, but also an OS (operating system) operating on the computer based on an instruction of the program is actually It goes without saying that a case where the function of the above-described embodiment is realized by performing part or all of the processing and the processing is included.

  Furthermore, after the program read from the recording medium is written to the memory provided in the function expansion board inserted into the computer or the function expansion unit connected to the computer, the function expansion board is based on the instructions of the program code. It goes without saying that the case where the CPU or the like provided in the function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.

  Further, the present invention may be applied to a system composed of a plurality of devices or an apparatus composed of a single device. Needless to say, the present invention can be applied to a case where the present invention is achieved by supplying a program to a system or apparatus. In this case, by reading a recording medium storing a program for achieving the present invention into the system or apparatus, the system or apparatus can enjoy the effects of the present invention.

  Furthermore, by downloading and reading a program for achieving the present invention from a server, database, etc. on a network using a communication program, the system or apparatus can enjoy the effects of the present invention.

  In addition, all the structures which combined each embodiment mentioned above and its modification are also included in this invention.

100 client PC
200 IC card authentication server 300 MFP 400 LAN
500 IC card reader 2001 CPU
2002 RAM
5001 CPU
5006 RAM

Claims (8)

An authentication system including an authentication server for storing user information for user authentication and an image forming apparatus when logging in to the image forming apparatus,
The authentication server is
In response to a user authentication request from the image forming apparatus, an authentication history storage unit that stores authentication history in which authenticated user information is associated with image forming apparatus information of an image forming apparatus that has made a user authentication request;
An authentication table creating means for creating an authentication table recording image forming apparatus information requested for user authentication for each user information according to the authentication history for each image forming apparatus serving as a distribution destination;
A delivery unit for delivering the authentication table to the image forming apparatus;
The image forming apparatus includes:
Authentication table storage means for storing the authentication table;
An authentication request means for requesting authentication of the user information in response to reception of the user information;
An authentication system comprising: local authentication means for authenticating using an authentication table stored in the authentication table storage means when authentication is not performed by the authentication request. The image forming apparatus includes:
The authentication system according to claim 1, further comprising display means for displaying image forming apparatus information to which an authenticated user can log in when authentication is performed by the local authentication means.   2. The authentication table creation unit deletes user information that does not include authentication medium information used for authentication from user information in which image forming apparatus information to be distributed by the distribution unit is not recorded. Or the authentication system of 2. The authentication server stores a device group defining a group of image forming apparatuses,
The authentication system according to any one of claims 1 to 3, wherein the authentication table creation unit creates an authentication table for each device group. When logging in to the image forming apparatus, user information for user authentication is stored, and in response to a user authentication request from the image forming apparatus, the authenticated user information and the image of the image forming apparatus that has made the user authentication request are stored. An authentication history in which the forming apparatus information is associated is stored, and for each image forming apparatus serving as a distribution destination, an authentication table is created in which the image forming apparatus information requested for user authentication is recorded for each user information according to the authentication history. An image forming apparatus capable of communicating with an authentication server that distributes the authentication table to be transmitted to the image forming apparatus,
Authentication table storage means for storing the authentication table;
An authentication request means for requesting authentication of the user information in response to reception of the user information;
An image forming apparatus comprising: a local authentication unit configured to authenticate using an authentication table stored in the authentication table storage unit when authentication is not performed by the authentication request. An authentication table is stored, and upon receiving user information, an authentication request for the user information is made. When authentication is not performed by the authentication request, communication is possible with an image forming apparatus that performs local authentication using the authentication table. An authentication server that stores user information for user authentication when logging in to an image forming apparatus,
In response to a user authentication request from the image forming apparatus, an authentication history storage unit that stores authentication history in which authenticated user information is associated with image forming apparatus information of an image forming apparatus that has made a user authentication request;
An authentication table creating means for creating an authentication table recording image forming apparatus information requested for user authentication for each user information according to the authentication history for each image forming apparatus serving as a distribution destination;
An authentication server comprising distribution means for distributing the authentication table for transmission to the image forming apparatus. An authentication method for an authentication system including an authentication server that stores user information for user authentication and an image forming apparatus when logging into the image forming apparatus,
The authentication server is
An authentication history storage step for storing an authentication history in which the authenticated user information is associated with the image forming apparatus information of the image forming apparatus that has made the user authentication request in response to a user authentication request from the image forming apparatus;
An authentication table creating step for creating an authentication table recording image forming apparatus information requested for user authentication for each user information according to the authentication history for each image forming apparatus serving as a distribution destination;
A delivery step for delivering the authentication table to the image forming apparatus;
The image forming apparatus includes:
An authentication table storing step for storing the authentication table;
An authentication request step for requesting authentication of the user information in response to reception of the user information;
A local authentication step of performing authentication using the authentication table stored in the authentication table storage step when authentication is not performed by the authentication request. A program that can be executed by an authentication system including an authentication server that stores user information for user authentication and an image forming apparatus when logging into the image forming apparatus,
The authentication server,
In response to a user authentication request from the image forming apparatus, an authentication history storage unit that stores authentication history in which authenticated user information is associated with image forming apparatus information of an image forming apparatus that has made a user authentication request;
An authentication table creating means for creating an authentication table recording image forming apparatus information requested for user authentication for each user information according to the authentication history for each image forming apparatus serving as a distribution destination;
Function as distribution means for distributing the authentication table to the image forming apparatus,
The image forming apparatus;
Authentication table storage means for storing the authentication table;
An authentication request means for requesting authentication of the user information in response to reception of the user information;
A program that functions as a local authentication unit that performs authentication using an authentication table stored in the authentication table storage unit when authentication is not performed by the authentication request.

Images