JP2014029704A - Authentication control device, authentication control method, program, and recording medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication control device, an authentication control method, and a program which can properly realize user authentication using a card.SOLUTION: An authentication control device can communicate with a plurality of first devices which request authentication and a plurality of second devices which execute authentication, via a network. The authentication control device comprises: reception means which receives authentication request from the first device; and authentication request means which determines the authenticator second device on the basis of authenticator management information associating the first device and the second device, and requests the determined authenticator second device to execute authentication.

Description

  The present invention relates to an authentication control device, an authentication control method, a program, and a recording medium, and more particularly to an authentication control device, an authentication control method, a program, and a recording medium that perform user authentication.

  In recent years, in an embedded system such as an image forming apparatus, an increasing number of models are equipped with an interface for connecting an external device such as a USB device as a standard. Therefore, a solution has been developed in which user information is input using an external device (for example, an IC card reader or the like) at the time of user authentication in the image forming apparatus (for example, Patent Documents 1 to 3).

  When using a card for user authentication, it is desirable to use a high-function IC card combined with a PIN (Personal Identification Number) from the viewpoint of ensuring high security. This is because information cannot be obtained from such an IC card unless the correct PIN is input.

  By the way, when using information recorded on a high-functional IC card for user authentication, it is necessary to have the card issuer disclose the card format (information recording format, etc.) of the IC card. However, the card format is very important information for security and cannot be disclosed easily. Therefore, a complicated operation for disclosing a card format when constructing a system using an IC card is required.

  On the other hand, a simple card having only a card ID without using a PIN (for example, a magnetic card, a proximity card, etc.) has a problem that it is difficult to ensure the same security as a high-performance IC card. .

  The present invention has been made in view of the above points, and an object of the present invention is to provide an authentication control device, an authentication control method, a program, and a recording medium capable of appropriately realizing user authentication using a card. .

  In order to solve the above problem, the present invention provides an authentication control apparatus capable of communicating via a network with a plurality of first apparatuses that request authentication and a plurality of second apparatuses that perform authentication. Based on the authentication destination management information that associates the receiving means for receiving the authentication request from the first device, the first device, and the second device, the second device that is the authentication destination is specified and specified. Authentication request means for requesting the second apparatus as the authentication destination to execute authentication.

  In such an authentication control apparatus, user authentication using a card can be appropriately realized.

  According to the present invention, user authentication using a card can be appropriately realized.

It is a figure which shows the system configuration example in embodiment of this invention. It is a figure which shows the hardware structural example of the card | curd authentication control server in embodiment of this invention. 1 is a diagram illustrating an example of a hardware configuration of an image forming apparatus according to an embodiment of the present invention. It is a figure which shows the function structural example of the image forming apparatus in this Embodiment, and a card | curd authentication control server. It is a sequence diagram for demonstrating the process sequence by the system in this Embodiment. It is a figure which shows the example of the corresponding information which a corresponding information management part manages. It is a figure which shows the example of a display of a password screen. It is a figure which shows the structural example of an authentication destination management table.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram showing an example of a system configuration in the embodiment of the present invention. In the figure, a card authentication control server 10 includes one or more image forming apparatuses 20 such as image forming apparatuses 20a, 20b, and 20c, and one or more authentication servers 30 such as authentication servers 30a, 30b, and 30c. They are connected via a network (whether wired or wireless).

  The image forming apparatus 20 is a so-called printer. However, the application target of the present invention may be a copier, a scanner, a facsimile machine, or a multi-function machine that realizes a plurality of these functions in a single casing.

  The card authentication control server 10 is a computer that controls authentication processing using a card for an operator of the image forming apparatus 20. It is also possible to have the function of the card authentication control server 10 in the same apparatus as the image forming apparatus 20. The authentication server 30 is a computer that performs user authentication based on a user name and a password. That is, the authentication server 30 includes a user information database in which correspondence information with user names and passwords is recorded. The authentication server 30 executes the authentication process by comparing the correspondence information recorded in the user information database with the user name and password input in the authentication request. Note that the user name is user identification information that uniquely identifies a user, and is also referred to as a user ID. Each authentication server 30 has a different authentication method. Examples of authentication methods include LDAP (Lightweight Directory Access Protocol), Windows (registered trademark) authentication, Kerberos, NTLM (Windows (registered trademark) NT LAN Manager) authentication, and the like.

  FIG. 2 is a diagram illustrating a hardware configuration example of the card authentication control server according to the embodiment of the present invention. The card authentication control server 10 of FIG. 2 is configured to include a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, and an interface device 105 that are mutually connected by a bus B. .

  A program for realizing processing in the card authentication control server 10 is provided by a recording medium 101 such as a CD-ROM. When the recording medium 101 on which the program is recorded is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program need not be installed from the recording medium 101 and may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program and also stores necessary files and data.

  The memory device 103 reads the program from the auxiliary storage device 102 and stores it when there is an instruction to start the program. The CPU 104 executes a function related to the card authentication control server 10 in accordance with a program stored in the memory device 103. The interface device 105 is used as an interface for connecting to the network 40 in FIG.

  FIG. 3 is a diagram illustrating a hardware configuration example of the image forming apparatus according to the embodiment of the present invention. In FIG. 3, the image forming apparatus 20 includes a CPU 201, a memory 202, a recording medium 203, a network I / F 204, an image output unit 205, an image processing unit 206, an external device I / F 207, a display unit 208, an operation unit 209, and the like. Have.

  A program that realizes the function of the image forming apparatus 20 is recorded (installed) in a non-volatile recording medium 203 such as an HDD (Hard Disk Drive). The recording medium 203 stores the installed program and also stores necessary files and data. The memory 202 reads and stores the program from the recording medium 203 when there is an instruction to start the program. The CPU 201 realizes functions related to the image forming apparatus 20 according to a program stored in the memory 202. The network I / F 204 is used as an interface for connecting to a network.

  The display unit 208 is configured by an LCD (Liquid Crystal Display) or the like, and displays an operation screen, a message, and the like. The operation unit 209 is configured by hardware buttons (keys) and is an input unit that receives an operation input by a user. The display unit 208 and the operation unit 209 may be integrally configured as an operation panel.

  The image processing unit 206 executes various types of image processing required when outputting (printing) image data. The image output unit 205 outputs (prints) image data.

  The external device I / F 207 is an interface for connecting to a card reader used for inputting user information for authentication, and includes, for example, a USB port (USB host interface) or a serial boat. The card reader 40 is a so-called card reader (card reader) that reads information from the card 50 and includes a hardware interface (for example, a USB connector or a serial interface) that can be connected to the external device I / F 207. However, the card reader 40 may be built in the image forming apparatus 20. The card reader 40 may be either a contact type or a non-contact type. The card 50 is not limited to an IC card, and any card ID (card number) unique to at least each card 50 such as a magnetic card can be recorded. The card ID is generally referred to as a Universal ID or a Card Serial Number. Specific examples of the card 50 include a proximity card, a mifare card, a Java (registered trademark) card, and the like.

  In the present embodiment, it is assumed that the card 50 is distributed to each user. However, a single card 50 may be shared by a plurality of users according to the level of security required for operation. Note that the card 50 distributed to each user may not be limited to one type. As described above, the card reader 40 can be easily connected to the image forming apparatus 20 by USB or the like. Therefore, a plurality of card readers 40 having different types of cards 50 (Proximity card, Mifare card, Java (registered trademark) Card, etc.) may be connected to the image forming apparatus 20 at the same time. In this case, a plurality of types of cards 50 can be used simultaneously.

  FIG. 4 is a diagram illustrating a functional configuration example of the image forming apparatus and the card authentication control server according to the present embodiment.

  In FIG. 1, the image forming apparatus 20 includes a card ID acquisition unit 21, a card ID transmission unit 22, a password acquisition unit 23, an authentication result reception unit 24, an address book 25, and the like. Each of these units is realized by processing executed by the CPU 201 by a program installed in the image forming apparatus 20.

  The card ID acquisition unit 21 acquires the card ID read by the card reader 40 from the card 50 from the card reader 40. The card ID transmission unit 22 requests authentication based on the card ID by transmitting the card ID acquired by the card ID acquisition unit 21 to the card authentication control server 10. The password acquisition unit 23 acquires a password input by the user via the operation unit 10. The authentication result receiving unit 24 receives the authentication result based on the card ID from the card authentication control server 10 and causes the display unit 108 to display it. The address book 25 is a set of user attribute information and is recorded in the recording medium 203.

  On the other hand, the card authentication control server 10 includes a card ID reception unit 11, a card ID conversion unit 12, an authentication destination determination unit 13, an authentication control unit 14, a user information acquisition unit 15, an authentication result transmission unit 16, a correspondence information management unit 121, It has an authentication destination management table 122, a user DB 123, and the like. Each of these units is realized by processing executed by the CPU 104 by a program installed in the card authentication control server 10.

  The card ID receiving unit 11 receives the card ID transmitted from the card ID transmitting unit 22 of the image forming apparatus 20. The card ID conversion unit 12 converts the card ID into a user name and a password based on information managed by the correspondence information management unit 121. The correspondence information management unit 121 manages correspondence information between a card ID, a user name, and a password. The authentication destination determination unit 13 determines the authentication server 30 that executes the authentication process based on the authentication destination management table 122. In the authentication destination management table 122, information for identifying the authentication server 30 as an authentication destination is registered for each combination of the user name and the image forming apparatus 20 to be logged in. The authentication control unit 14 causes the authentication server 30 determined as the authentication destination by the authentication destination determination unit 13 to execute authentication based on the user name and the password. The user information acquisition unit 15 acquires the attribute information (user information) of the user from the user DB 123 when the authentication is successful. User information is registered in the user DB 123 for each user. The authentication result transmitting unit 16 transmits the authentication result and user information to the authentication result receiving unit 24 of the image forming apparatus 20. The correspondence information management unit 121, the authentication destination management table 122, and the user DB 123 are formed in the auxiliary storage device 102.

  Hereinafter, a processing procedure of the system of FIG. 1 will be described. FIG. 5 is a sequence diagram for explaining a processing procedure by the system in the present embodiment.

  When the user sets the card 50 in the card reader 40 during login to the image forming apparatus 20 (S101), the card ID acquisition unit 21 reads the card ID (hereinafter referred to as “current card” read from the card by the card reader 40). ID ”) is obtained from the card reader 40 (S102). Note that the setting of the card 50 to the card reader 40 means that the card reader 40 can read information recorded on the card 50, such as inserting the card 50 into the card reader 40 or tricking the card 50. To do. Subsequently, the card ID transmission unit 22 requests user authentication based on the current card ID by transmitting the current card ID to the card authentication control server 10 (S103). Note that the IP address of the card authentication control server 10 is recorded in advance on the recording medium 203 of the image forming apparatus 20.

  When the card ID reception unit 11 of the card authentication control server 10 receives the current card ID, the card ID conversion unit 12 acquires the user name and password corresponding to the current card ID from the correspondence information management unit 121 (the current card ID is changed). (S104).

  FIG. 6 is a diagram illustrating an example of correspondence information managed by the correspondence information management unit. In the figure, correspondence information 1210 is information that holds a user ID, a card ID, and a password in association with each other for each user. Accordingly, in step S104, the card ID conversion unit 12 acquires the user name and password associated with the current card ID from the correspondence information management unit 121.

  The password is not necessarily registered in the correspondence information management unit 121. When the password corresponding to the current card ID cannot be acquired (S105), the card ID conversion unit 12 requests the image forming apparatus 20 to transmit the password (S106). In response to the request, the password acquisition unit 23 of the image forming apparatus 20 displays a password screen on the display unit 208 to request the user to input a password (S107).

  FIG. 7 is a diagram illustrating a display example of a password screen. When the password is input on the password screen 520 and the OK button 522 is pressed (S108), the password acquisition unit 23 displays the input password and information indicating the state of the check button 524 on the card ID of the card authentication control server 10. The data is transmitted to the conversion unit 12 (S109). When the check button 524 is checked, the card ID conversion unit 12 registers the received password in the correspondence information management unit 121 in association with the current card ID.

  In addition, when the input of a password is not essential, steps S105 to S109 may not be executed. In this case, the subsequent processing is executed with no password corresponding to the current card ID.

  Subsequently, the authentication destination determination unit 13 determines the authentication server 30 (authentication destination) that requests authentication based on the authentication destination management table 122 (S110).

  FIG. 8 is a diagram illustrating a configuration example of the authentication destination management table. As shown in the figure, in the authentication destination management table 122, information for identifying an authentication server as an authentication destination is registered for each user according to the image forming apparatus 20 (device). That is, in FIG. 9, the authentication destination management table 122a is the authentication destination management table 122 for the user A. The authentication destination management table 122b is the authentication destination management table 122 for the user B. In each authentication destination management table 122, device A, device B, and device C indicate the image forming apparatuses 20a, 10b, and 10c, respectively. Authentication server A, authentication server B, and authentication server C indicate authentication servers 30a, 30b, and 30c, respectively.

  For example, if it is the user A, the authentication server A (authentication server 30a) becomes an authentication destination for the login to the device A (image forming apparatus 20a). In the case of the user B, the authentication server B (authentication server 30b) becomes the authentication destination for login to the device A (image forming apparatus 20a). Further, when none of the authentication servers 30 is an authentication destination (when the user A logs in to the device C), the authentication destination is the card authentication control server 10.

  Note that which image forming apparatus 20 the login target is is based on the identification information (IP address or host name, etc.) of the image forming apparatus 20 transmitted together with the card ID in step S103. Is determined.

  Subsequently, the authentication control unit 14 requests the authentication destination determined by the authentication destination determination unit 13 to execute authentication by transmitting the user name and password acquired based on the current card ID (S111). ). Upon receiving the request, the authentication server 30 executes an authentication process based on the user name and password (S112), and returns an authentication result (success / failure) to the authentication control unit 14 (S113).

  However, when the authentication destination is the card authentication control server 10, the authentication control unit 14 compares the user name and password acquired based on the current card ID with the user name and password registered in the user DB 123. Authenticate.

  Further, when the authentication destination is any one of the authentication servers 30 and the authentication control unit 14 does not respond within a predetermined period after transmitting the authentication execution request (when timed out), the authentication control unit 14 may perform authentication by comparing the user name and password acquired based on the current card ID with the user name and password registered in the user DB 123.

  If there is no password corresponding to the current card ID, the authentication control unit 14 logs in to the authentication server 30 of the authentication destination using the user name and password of the proxy user (for example, guest user), and then the current card The success or failure of authentication is determined by confirming with the authentication server 30 whether or not the user name corresponding to the ID exists (whether or not the user name is registered). That is, if the user name is registered, it is determined that the authentication is successful, and if the user name is not registered, the authentication is determined to be unsuccessful.

  If the authentication is successful, the user information acquisition unit 15 acquires user information (user name, user display name, email address, FAX number, authority information, etc.) corresponding to the user name of the current user from the user DB 123 (S114). . Note that the user information may be acquired from the authentication server 30 that has performed authentication. Moreover, you may acquire from the other server (user information management server) which manages user information integratedly.

  Subsequently, the authentication result transmitting unit 16 transmits the authentication result to the image forming apparatus 20 (S115). If the authentication is successful, user information is also transmitted along with the authentication result. When the authentication result receiving unit 23 of the image forming apparatus 20 receives the authentication result and also receives the user information (when the authentication is successful), the user information is registered in the address book 25 (S116). Thereby, consistency between the user DB 123 and the address book 25 is achieved. Subsequently, the authentication result receiving unit 23 causes the display unit 108 to display an authentication result (whether login is possible) (S117). For example, if the authentication is successful, the screen transitions to the initial screen after login. If authentication fails, a message indicating that login is not permitted is displayed.

  As described above, the card authentication control server 10 manages the correspondence information between the card ID and the user name, and can determine the user name based on the card ID. Further, not only the card ID but also the password can be input for the login in the image forming apparatus 20. Then, authentication can be executed based on these user name and password. Therefore, even if the card 50 is recorded with only the card ID, an authentication function with a security level equivalent to a high-function IC card using a PIN (Personal Identification Number) is provided. Can be provided centrally.

  As mentioned above, although the Example of this invention was explained in full detail, this invention is not limited to such specific embodiment, In the range of the summary of this invention described in the claim, various deformation | transformation・ Change is possible.

DESCRIPTION OF SYMBOLS 10 Card authentication control server 11 Card ID receiving part 12 Card ID conversion part 13 Authentication destination determination part 14 Authentication control part 15 User information acquisition part 16 Authentication result transmission part 20, 20a, 20b, 20c Image forming apparatus 21 Card ID acquisition part 22 Card ID transmission unit 23 Password acquisition unit 24 Authentication result reception unit 25 Address book 30, 30a, 30b, 30c Authentication server 100 Drive device 101 Recording medium 102 Auxiliary storage device 103 Memory device 104 CPU
105 Interface device 121 Corresponding information management unit 122 Authentication destination management table 123 User DB
201 CPU
202 Memory 203 Recording medium 204 Network I / F
205 Image output unit 206 Image processing unit 207 External device I / F
208 Display unit 209 Operation unit B Bus

JP 2006-215770 A JP 2007-122384 A JP 2006-92437 A

Claims (10)

An authentication control device capable of communicating via a network with a plurality of first devices requesting authentication and a plurality of second devices executing authentication,
Receiving means for receiving an authentication request from the first device;
Based on authentication destination management information for associating the first device with the second device, the second device of the authentication destination is specified, and the authentication is performed on the specified second device of the authentication destination. A requesting authentication request means;
An authentication control device comprising:   The authentication request means includes: a user specified based on authentication information included in the authentication request based on the authentication destination management information associating a user, the first device, and the second device; The authentication control device according to claim 1, wherein the second device of the authentication destination associated with the first device that has transmitted the message is specified. Correspondence information management means for managing correspondence information between the recording medium identification information, the user identification information, and the password;
Acquisition means for acquiring user identification information and password corresponding to the recording medium identification information as the authentication information from the correspondence information management means;
The acquisition unit can acquire the user identification information, and when the password cannot be acquired, a password request unit that requests a password from the first device;
Password receiving means for receiving a password corresponding to the password request means from the first device;
With
The receiving means receives from the first device recording medium identification information read from the recording medium by a reading device connected to the first device,
The authentication requesting unit requests the second apparatus to be authenticated to execute authentication based on the user identification information and the password acquired by the acquiring unit or received by the password receiving unit. The authentication control device according to claim 2. A computer capable of communicating with a plurality of first devices requesting authentication and a plurality of second devices executing authentication via a network,
A receiving procedure for receiving an authentication request from the first device;
Based on authentication destination management information for associating the first device with the second device, the second device of the authentication destination is specified, and the authentication is performed on the specified second device of the authentication destination. The required authentication request procedure;
The authentication control method characterized by performing.   The authentication request procedure includes: a user specified based on authentication information included in the authentication request based on the authentication destination management information that associates a user, the first device, and the second device; 5. The authentication control method according to claim 4, wherein the second apparatus of the authentication destination associated with the first apparatus that has transmitted is specified. An acquisition procedure for acquiring user identification information and a password corresponding to the recording medium identification information that is the authentication information from correspondence information management means that manages correspondence information between the recording medium identification information, the user identification information, and the password;
In the acquisition procedure, the user identification information can be acquired, and if the password cannot be acquired, a password request procedure for requesting a password from the first device;
A password receiving procedure for receiving a password according to the password request procedure from the first device;
The computer executes,
The reception procedure receives, from the first device, recording medium identification information read from the recording medium by a reading device connected to the first device,
The authentication request procedure requests the second apparatus to be authenticated to execute authentication based on the user identification information and the password acquired in the acquisition procedure or received in the password reception procedure. The authentication control method according to claim 5. A plurality of first devices that request authentication and a plurality of second devices that perform authentication with a computer that can communicate via a network;
A receiving procedure for receiving an authentication request from the first device;
Based on authentication destination management information for associating the first device with the second device, the second device of the authentication destination is specified, and the authentication is performed on the specified second device of the authentication destination. The required authentication request procedure;
A program characterized by having executed.   The authentication request procedure includes: a user specified based on authentication information included in the authentication request based on the authentication destination management information that associates a user, the first device, and the second device; The program according to claim 7, wherein the second apparatus of the authentication destination associated with the first apparatus that transmitted the message is specified. An acquisition procedure for acquiring user identification information and a password corresponding to the recording medium identification information that is the authentication information from correspondence information management means that manages correspondence information between the recording medium identification information, the user identification information, and the password;
In the acquisition procedure, the user identification information can be acquired, and if the password cannot be acquired, a password request procedure for requesting a password from the first device;
A password receiving procedure for receiving a password according to the password request procedure from the first device;
To the computer,
The reception procedure receives, from the first device, recording medium identification information read from the recording medium by a reading device connected to the first device,
The authentication request procedure requests the second apparatus to be authenticated to execute authentication based on the user identification information and the password acquired in the acquisition procedure or received in the password reception procedure. The program according to claim 8.   A computer-readable recording medium on which the program according to any one of claims 7 to 9 is recorded.

Images