JP2017102813A - Information processing system, information processing device, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information processing system capable of providing a function different for each organization in an identical service.SOLUTION: An information processing system that has one or more information processing devices and provides functions of a service to an electronic apparatus includes: identification information management means that manages functions of a service which is provided after license authentication, in association with identification information used for the license authentication of the service; organization information management means that manages the functions of the service after the license authentication, for each organization; and service management means that manages the functions of the service to be provided to the organization on the basis of the functions of the service after the license authentication which is managed for each organization by the organization information management means.SELECTED DRAWING: Figure 6

Description

  The present invention relates to an information processing system, an information processing apparatus, and a program.

  In recent years, an increasing number of companies have introduced cloud services. A cloud service refers to a service provided by cloud computing technology. When providing a cloud service for a company, a multi-tenant configuration that can handle a plurality of companies is generally performed. When starting to use a service such as a cloud service, the start of using the service was confirmed by activating a tenant such as a company.

  For example, an information management system that can manage the usage status of services in organizational units is conventionally known. In a conventional information management system, a tenant ID is assigned to each organization, and the license ID and the tenant ID are associated and managed. As a result, the conventional information management system can manage the usage status of services (licenses) in organizational units (see, for example, Patent Document 1).

  However, the conventional method of confirming the start of use of a service by activating a tenant merely manages the validity of service use by checking the validity of the license. Therefore, the conventional method of confirming the start of use of a tenant by activating the tenant has a problem that the function provided to each tenant in the same service cannot be changed.

  Embodiments of the present invention have been made in view of the above points, and an object thereof is to provide an information processing system that can provide different functions for each organization in the same service.

  In order to achieve the above-mentioned problem, claim 1 of the present application is an information processing system that has one or more information processing apparatuses and provides a service function to an electronic device, and an identification used for license authentication of the service An identification information management means for managing functions of the service provided after license authentication in association with information; an organization information management means for managing functions of the service after license authentication for each organization; and the organization information management means. Service management means for managing the function of the service provided to the organization based on the function of the service after license authentication managed for each organization.

  According to the embodiment of the present invention, different functions can be provided for each organization in the same service.

It is a lineblock diagram of an example of an information processing system concerning a 1st embodiment. It is a hardware block diagram of an example of a computer. 1 is a hardware configuration diagram of an example of an image forming apparatus according to a first embodiment. 1 is a processing block diagram of an example of an image forming apparatus according to a first embodiment. It is a processing block diagram of an example of the service provision system which concerns on 1st Embodiment. It is a processing block diagram of an example of the service provision system showing the processing block required for description of 1st Embodiment. It is a block diagram of an example of service ID information. It is a block diagram of an example of tenant information. It is a block diagram of an example of user information. It is a sequence diagram of an example of processing at the time of activation of the information processing system according to the first embodiment. It is an image figure of an example of a user interface.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[First Embodiment]
<System configuration>
FIG. 1 is a configuration diagram of an example of an information processing system according to the first embodiment. The information processing system 1000 in FIG. 1 includes a network N1 such as an intra-office network, and a network N2 such as the Internet.

  The network N1 is a private network inside the firewall FW. The firewall FW is installed at the contact point between the network N1 and the network N2, and detects and blocks unauthorized access. An image forming apparatus 1013 such as a client terminal 1011, a portable terminal 1012, or a multifunction peripheral is connected to the network N 1.

  The client terminal 1011 is an example of a terminal device. The client terminal 1011 can be realized by an information processing apparatus equipped with a general OS or the like. The client terminal 1011 has a wireless communication means or a wired communication means. The client terminal 1011 is a user-operable terminal such as a desktop PC or a notebook PC.

  The mobile terminal 1012 is an example of a terminal device. The portable terminal 1012 has a wireless communication means or a wired communication means. The mobile terminal 1012 is a terminal that a user can carry and operate, such as a smartphone, a mobile phone, and a tablet PC.

  The image forming apparatus 1013 is an apparatus having an image forming function such as a multifunction peripheral. The image forming apparatus 1013 is also an example of a terminal device. The image forming apparatus 1013 includes a wireless communication unit or a wired communication unit.

  The image forming apparatus 1013 is an apparatus that performs processing related to image formation, such as a multifunction peripheral, a copier, a scanner, a printer, a laser printer, a projector, and an electronic blackboard. FIG. 1 shows an example in which the client terminal 1011, the mobile terminal 1012, and the image forming apparatus 1013 are each one as an example, but a plurality of clients may be used.

  A mobile terminal 1012 and a service providing system 1014 are connected to the network N2. The mobile terminal 1012 may be other than the network N1 such as an intra-office network, and an example in which the mobile terminal 1012 is connected to the network N1 and the network N2 is shown in FIG.

  The service providing system 1014 is realized by one or more information processing apparatuses. The service providing system 1014 is an example of a system that provides services such as a cloud service to the client terminal 1011, the mobile terminal 1012, and the image forming apparatus 1013 in a multi-tenant configuration. At the start of using a service provided in a multi-tenant configuration, an activation (license authentication) process as described later is performed. Details of the service providing system 1014 will be described later.

<Hardware configuration>
The client terminal 1011 and the portable terminal 1012 in FIG. 1 are realized by a computer having a hardware configuration as shown in FIG. One or more information processing apparatuses that implement the service providing system 1014 are also realized by a computer having a hardware configuration shown in FIG.

  FIG. 2 is a hardware configuration diagram of an example of a computer. The computer 100 of FIG. 2 includes an input device 101, a display device 102, an external I / F 103, a RAM 104, a ROM 105, a CPU 106, a communication I / F 107, an HDD 108, and the like.

  The input device 101 includes a keyboard, a mouse, a touch panel, and the like, and is used by a user to input each operation signal. The display device 102 includes a display and the like, and displays a processing result by the computer 100. The input device 101 and the display device 102 may be connected and used when necessary.

  The communication I / F 107 is an interface that connects the computer 100 to the networks N1 and N2. Thereby, the computer 100 can perform data communication via the communication I / F 107.

  The HDD 108 is a nonvolatile storage device that stores programs and data. The stored programs and data include, for example, an OS that is basic software for controlling the entire computer 100, and application software that provides various functions on the OS. The computer 100 may use a drive device (for example, a solid state drive: SSD) that uses a flash memory as a storage medium instead of the HDD 108.

  The external I / F 103 is an interface with an external device. The external device includes a recording medium 103a. Accordingly, the computer 100 can read and / or write the recording medium 103a via the external I / F 103. Examples of the recording medium 103a include a flexible disk, a CD, a DVD, an SD memory card, and a USB memory.

  The ROM 105 is a nonvolatile semiconductor memory (storage device) that can retain programs and data even when the power is turned off. The ROM 105 stores programs and data such as BIOS, OS settings, and network settings that are executed when the computer 100 is started up. The RAM 104 is a volatile semiconductor memory (storage device) that temporarily stores programs and data.

  The CPU 106 is an arithmetic unit that realizes control and functions of the entire computer 100 by reading a program and data from a storage device such as the ROM 105 and the HDD 108 onto the RAM 104 and executing processing.

  The client terminal 1011 and the mobile terminal 1012 in FIG. 1 can implement various processes as described later depending on the hardware configuration of the computer 100. In addition, one or more information processing apparatuses that implement the service providing system 1014 can also implement various processes as described below by the hardware configuration of the computer 100.

  FIG. 3 is a hardware configuration diagram of an example of the image forming apparatus according to the first embodiment. An image forming apparatus 1013 illustrated in FIG. 3 includes a controller 201, an operation panel 202, an external I / F 203, a communication I / F 204, a printer 205, a scanner 206, and the like.

  The controller 201 includes a CPU 211, a RAM 212, a ROM 213, an NVRAM 214, an HDD 215, and the like. The ROM 213 stores various programs and data. The RAM 212 temporarily stores programs and data. The NVRAM 214 stores setting information, for example. The HDD 215 stores various programs and data.

  The CPU 211 implements control and functions of the entire image forming apparatus 1013 by reading programs, data, setting information, and the like from the ROM 213, the NVRAM 214, the HDD 215, and the like onto the RAM 212 and executing processing.

  The operation panel 202 includes an input unit that receives input from the user and a display unit that performs display. The external I / F 203 is an interface with an external device. The external device includes a recording medium 203a. Accordingly, the image forming apparatus 1013 can read and / or write the recording medium 203a via the external I / F 203. Examples of the recording medium 203a include an IC card, a flexible disk, a CD, a DVD, an SD memory card, and a USB memory.

  A communication I / F 204 is an interface for connecting the image forming apparatus 1013 to the network N1. Accordingly, the image forming apparatus 1013 can perform data communication via the communication I / F 204.

  A printer 205 is a printing device for printing print data on a transported object. For example, the object to be conveyed is not limited to paper such as paper, coated paper, cardboard, OHP, plastic film, prepreg, and copper foil. A scanner 206 is a reading device for reading image data (electronic data) from a document and generating an image file (electronic file).

  The image forming apparatus 1013 according to the present embodiment can realize various processes as described below with the above hardware configuration. Note that the description of the hardware configuration of the firewall FW is omitted.

<Software configuration>
<Image forming apparatus>
The image forming apparatus 1013 according to the first embodiment is realized by a processing block as illustrated in FIG. 4, for example. FIG. 4 is a processing block diagram of an example of the image forming apparatus according to the first embodiment. The image forming apparatus 1013 implements the activation operation unit 12 for the user to perform the activation operation by executing the embedded application 10.

  The activation operation unit 12 includes a user interface that accepts input of a service ID and authentication information from a user. The service ID that the activation operation unit 12 accepts input is information used by the tenant for activation. The service ID is associated with license information, service information, and authorization function information. The authentication information that the activation operation unit 12 receives input is, for example, authentication information of a user who has authority necessary for executing the activation, such as a tenant ID of a user having an administrator role, a user ID, and a password.

  The activation operation unit 12 has a function of transmitting authentication information received from the user through the user interface to the service providing system 1014 and making an authentication request. In addition, the activation operation unit 12 has a function of making an activation request by transmitting a service ID received from the user through the user interface to the service providing system 1014. In the processing block diagram of FIG. 4, portions unnecessary for the description of the first embodiment are omitted.

《Service provision system》
The service providing system 1014 according to the first embodiment is realized by, for example, the processing blocks illustrated in FIG. FIG. 5 is a processing block diagram of an example of a service providing system according to the first embodiment. The service providing system 1014 implements a processing block as shown in FIG. 5 by executing a program.

  The service providing system 1014 in FIG. 5 realizes an application 1101, a common service 1102, a database (DB) 1103, a management 1104, a business 1105, and a platform API 1106.

  The application 1101 includes a portal service application 1111, a scan service application 1112, and a print service application 1113 as an example.

  The portal service application 1111 is an application that provides a portal service. The portal service provides a service serving as an entrance for using the service providing system 1014. The scan service application 1112 is an application that provides a scan service. The print service application 1113 is an application that provides a print service. The application 1101 may include other service applications.

  The platform API 1106 is an interface for the portal service application 1111, the scan service application 1112, the print service application 1113, and the like to use the common service 1102. The platform API 1106 is a pre-defined interface provided for the common service 1102 to receive a request from the application 1101 and includes, for example, a function and a class.

  The platform API 1106 can be realized by, for example, a Web API that can be used via a network when the service providing system 1014 includes a plurality of information processing apparatuses.

  The common service 1102 includes an authentication unit 1121, a tenant management unit 1122, a user management unit 1123, a print service management unit 1124, a service ID management unit 1125, a device management unit 1126, a temporary image storage unit 1127, a log collection unit 1128, and an image processing workflow. A control unit 1130 is included.

  The image processing workflow control unit 1130 includes a message queue 1131 and one or more workers 1132. The worker 1132 implements functions such as image conversion and image transmission.

  The authentication unit 1121 performs authentication based on a request from an office device such as the client terminal 1011 or the image forming apparatus 1013. Note that office equipment is a generic term for the client terminal 1011, the mobile terminal 1012, the image forming apparatus 1013, and the like.

  The authentication unit 1121 authenticates the user by accessing, for example, a user information storage unit 1143 and a service ID information storage unit 1144 described later. Further, the authentication unit 1121 authenticates the image forming apparatus 1013 and the like by accessing, for example, a tenant information storage unit 1142, a service ID information storage unit 1144, a device information storage unit 1145, which will be described later.

  The tenant management unit 1122 manages tenant information stored in a tenant information storage unit 1142 described later. A tenant represents a unit of a group (organization) such as a company or a department. The user management unit 1123 manages user information stored in a user information storage unit 1143 to be described later. The print service management unit 1124 manages functions provided by the print service application 1113 to the image forming apparatus 1013 and the like based on tenant information described later.

  The service ID management unit 1125 manages service ID information stored in a service ID information storage unit 1144 described later. The device management unit 1126 manages device information stored in a device information storage unit 1145 described later. The temporary image storage unit 1127 stores a temporary image in a temporary image storage unit 1146, which will be described later, and acquires a temporary image from the temporary image storage unit 1146. The log collection unit 1128 manages log information stored in a log information storage unit 1141 described later.

  An image processing workflow control unit 1130 controls a workflow related to image processing based on a request from the application 1101. The message queue 1131 has a queue corresponding to the type of processing. The image processing workflow control unit 1130 puts a request message relating to a process (job) into a queue corresponding to the type of the job.

  Worker 1132 is monitoring the corresponding queue. When a message is input to the queue, the worker 1132 performs processing such as image conversion and image transmission according to the type of the corresponding job. The message put in the queue may be read by the worker 1132 (Pull) or may be provided to the worker 1132 from the queue (Push).

  5 includes a log information storage unit 1141, a tenant information storage unit 1142, a user information storage unit 1143, a service ID information storage unit 1144, a device information storage unit 1145, a temporary image storage unit 1146, a job information storage unit 1147, and An application-specific setting information storage unit 1150 is included.

  The log information storage unit 1141 stores log information. The tenant information storage unit 1142 stores tenant information. The user information storage unit 1143 stores user information. The service ID information storage unit 1144 stores service ID information. The device information storage unit 1145 stores device information.

  The temporary image storage unit 1146 stores a temporary image. The temporary image is, for example, a file or data such as a scanned image processed by the worker 1132. The job information storage unit 1147 stores request information (job information) related to processing (job). The application specific setting information storage unit 1150 stores setting information specific to the application 1101.

  The management 1104 in FIG. 5 includes a monitoring unit, a deployment unit, a server account management unit, and a server login management unit as an example. 5 includes, as an example, a customer information management unit, a contract management unit, a sales management unit, a license management unit, and a development environment unit.

  The service providing system 1014 functions as an integrated platform that provides common services such as workflows related to authentication / authorization and image processing, and a service group that provides application services such as a scan service and a print service using the functions of the integrated platform. .

  The integrated platform is configured by, for example, a common service 1102, a DB 1103, a management 1104, a business 1105, and a platform API 1106. The service group is configured by, for example, the application 1101.

  The service providing system 1014 shown in FIG. 5 can easily develop an application 1101 that uses the platform API 1106 by separating the service group and the integration platform.

  Note that the processing block classification form of the service providing system 1014 illustrated in FIG. 5 is an example, and the application 1101, the common service 1102, the DB 1103, the management 1104, and the business 1105 are classified in a hierarchy as illustrated in FIG. It is not essential. As long as the processing of the service providing system 1014 according to the first embodiment can be performed, the hierarchical relationship shown in FIG. 5 is not limited to a specific one.

  The processing block diagram of FIG. 5 can be represented, for example, as in FIG. 6 by omitting unnecessary portions for the description of the first embodiment. FIG. 6 is a processing block diagram of an example of a service providing system showing processing blocks necessary for the description of the first embodiment.

  The authentication unit 1121 indicates whether the user indicated by the authentication information received from the activation operation unit 12 illustrated in FIG. 4 exists in the tenant and has the authority to execute the activation. 1143 is checked for confirmation.

  The service ID management unit 1125 checks the service information and authorization function information associated with the service ID by checking the service ID information storage unit 1144. The tenant management unit 1122 registers service information of services that can be provided to each tenant in the tenant information storage unit 1142. The print service management unit 1124 sets and manages functions (authorization functions) that can be provided to the tenant in the tenant information storage unit 1142.

  FIG. 7 is a configuration diagram of an example of service ID information. The service ID information in FIG. 7 has a configuration including service ID, service information, start information, and authorization function information as items. The service ID is information used by the tenant for service activation, and is unique for each license. The service information is information representing a service provided to the image forming apparatus 1013. The start information is information indicating the start of the service by activation. The authorization function information is information indicating the authorization function of the service associated with the service ID.

  FIG. 8 is a configuration diagram of an example of tenant information. The tenant information in FIG. 8 has a configuration having tenant ID, service information, and setting function information as items. The tenant ID is an example of identification information that uniquely identifies a tenant. The service information is information representing a service provided to the image forming apparatus 1013. The setting function information is information indicating the function (setting function) of the service that can be provided to the tenant by the activation.

  FIG. 9 is a block diagram showing an example of user information. The user information shown in FIG. 9 has a tenant ID, user ID, password, and authority information as items. The tenant ID is an example of identification information that uniquely identifies a tenant. The user ID is an example of identification information that uniquely identifies the user. The password is an example of user secret information. The authority information is information representing the authority that the user has, such as authority to execute activation.

<Details of processing>
Hereinafter, in the information processing system 1000 according to the first embodiment, processing at the time of activation of a service provided by the service providing system 1014 will be described with reference to the sequence diagram of FIG. FIG. 10 is a sequence diagram illustrating an example of processing during activation of the information processing system according to the first embodiment.

  First, the activation operation unit 12 of the image forming apparatus 1013 displays the user interface shown in FIG. 11 on the operation panel 202 and allows the user to input information on the tenant ID, user ID, and password. FIG. 11 is an image diagram of an example of a user interface. The user interface in FIG. 11 accepts input of account information and service use registration information from the user.

  The user interface in FIG. 11 accepts input of tenant ID, administrator ID, and administrator password as account information from the user. The user inputs the tenant ID of the tenant to be activated in the tenant ID input field. In addition, the user inputs the user ID and password of a user such as an administrator having an administrator role who has the authority necessary for executing the activation in the input fields for the administrator ID and the administrator password.

  The user interface in FIG. 11 accepts an input of a service ID from the user as service use registration information. The user inputs the service ID associated with the service information and the authorization function information in the service ID input field. The user requests authentication and activation by pressing the “apply” button after inputting account information and service use registration information in the user interface of FIG. Note that the user can clear account information and service use registration information input to the user interface of FIG. 11 by pressing a “cancel” button.

  In step S <b> 11, the activation operation unit 12 transmits the tenant ID, user ID, and password information input by the user to the authentication unit 1121 of the service providing system 1014 and makes an authentication request.

  In step S12, the authentication unit 1121 collates the received tenant ID, user ID, and password against the database 1103 to obtain an authentication result. Here, the description is continued assuming that the authentication is successful. In step S13, the authentication unit 1121 generates an authentication token based on the authentication result of successful authentication, and returns authentication permission together with the authentication token.

  In step S14, the activation operation unit 12 transmits the tenant ID, service ID, and authentication token to the tenant management unit 1122, and requests the tenant management unit 1122 for activation.

  In step S15, the tenant management unit 1122 transmits an authentication token to the authentication unit 1121 and requests authentication confirmation. The authentication unit 1121 determines the validity of the authentication token received from the tenant management unit 1122 and returns it to the tenant management unit 1122 as an authentication result. Here, the description is continued assuming that the authentication is successful.

  In step S16, the tenant management unit 1122 transmits the service ID to the service ID management unit 1125, and requests license activation. In step S17, the service ID management unit 1125 accesses the database 1103, and registers the start of the service ID in the start information of the service ID information in FIG.

  In step S18, the service ID management unit 1125 accesses the database 1103, and acquires authorization function information corresponding to the service ID from the service ID information shown in FIG. In step S 19, the service ID management unit 1125 returns the authorization function information to the tenant management unit 1122 as a result of the license activation request in step S 16.

  In step S20, the tenant management unit 1122 transmits the tenant ID and authorization function information to the print service management unit 1124 and requests authorization function setting. In step S21, the print service management unit 1124 accesses the database 1103, and registers the authorization function information as the setting function information of the tenant information in FIG. In step S 22, the print service management unit 1124 returns the authorization function setting result to the tenant management unit 1122. The tenant management unit 1122 returns the activation result to the activation operation unit 12.

(Summary)
As described above, the service providing system 1014 according to the first embodiment manages the authorization function information in association with the service ID used for tenant activation.

  Therefore, the service providing system 1014 according to the first embodiment is efficient because it is not necessary to define and manage it as a separate service when it is desired to change the function of the service provided for each tenant. In addition, when the service providing system 1014 according to the first embodiment wants to change the function of the service provided for each tenant, the service providing system 1014 eliminates the trouble of performing the authorization setting together with the service provision. Secure.

  In particular, when the authorization setting is individually performed in the service providing system 1014, if the authorization setting is performed after the activation of the tenant, the authorization setting is incomplete from the activation to the implementation of the authorization setting. There was a possibility of being connected to.

  According to the service providing system 1014 according to the first embodiment, the activation of the license and the authorization of the function to be provided are performed by using the service ID associated with the license information and the authorization function information at the time of activation. Can be done at once.

  Further, according to the service providing system 1014 according to the first embodiment, the service providing system 1014 having a multi-tenant configuration can be managed in the same multi-tenant environment even when the functions provided for each tenant are different.

  As described above, the service providing system 1014 according to the first embodiment can efficiently and securely provide different functions for each tenant within the same service.

  The present invention is not limited to the specifically disclosed embodiments, and various modifications and changes can be made without departing from the scope of the claims.

DESCRIPTION OF SYMBOLS 10 Embedded application 12 Activation operation part 100 Computer 101 Input apparatus 102 Display apparatus 103 External I / F
103a, 203a Recording medium 104 RAM
105 ROM
106 CPU
107 Communication I / F
108 HDD
201 Controller 202 Operation panel 203 External I / F
204 Communication I / F
205 Printer 206 Scanner 211 CPU
212 RAM
213 ROM
214 NVRAM
215 HDD
1000 Information Processing System 1011 Client Terminal 1012 Mobile Terminal 1013 Image Forming Apparatus 1014 Service Providing System 1101 Application 1102 Common Service 1103 Database 1104 Management 1105 Business 1106 Platform API (Application Programming Interface)
1111 Portal service application 1112 Scan service application 1113 Print service application 1121 Authentication unit 1122 Tenant management unit 1123 User management unit 1124 Print service management unit 1125 Service ID management unit 1126 Device management unit 1127 Temporary image storage unit 1128 Log collection unit 1130 Image processing workflow Control unit 1131 Message queue 1132 Worker 1141 Log information storage unit 1142 Tenant information storage unit 1143 User information storage unit 1144 Service ID information storage unit 1145 Device information storage unit 1146 Temporary image storage unit 1147 Job information storage unit 1150 Application-specific setting information storage Part B Bus FW Firewall N1-N2 Network

Japanese Patent Laid-Open No. 2015-111407

Claims (7)

An information processing system having one or more information processing devices and providing a service function to an electronic device,
Identification information management means for managing functions of the service provided after license authentication in association with identification information used for license authentication of the service;
Organization information management means for managing the function of the service after license authentication for each organization;
Service management means for managing the function of the service provided to the organization based on the function of the service after license authentication managed for each organization by the organization information management means;
An information processing system having The service from the user who has the authority to execute the license authentication of the service based on the authentication information of the user who has the authority to execute the license authentication of the service stored in the user information storage unit 2. The information processing system according to claim 1, further comprising authentication means for determining whether or not the license authentication is requested. The electronic device further comprises license authentication operation means for displaying on a display unit a user interface for receiving input of authentication information of the user and identification information used for license authentication of the service. 2. The information processing system according to 2. Service provision means for providing the service to the electronic device;
4. The information processing according to claim 1, wherein the service providing unit provides the electronic device with the function of the service provided to the organization managed by the service management unit. 5. system. The information processing system according to claim 4, wherein the service providing unit is a print service application that provides a print service to the electronic device, and provides a print function in cooperation with the electronic device. An information processing apparatus that provides a service function to an electronic device,
Identification information management means for managing functions of the service provided after license authentication in association with identification information used for license authentication of the service;
Organization information management means for managing the function of the service after license authentication for each organization;
Service management means for managing the function of the service provided to the organization based on the function of the service after license authentication managed for each organization by the organization information management means;
An information processing apparatus. An information processing device that provides electronic devices with service functions
Identification information management means for managing functions of the service provided after license authentication in association with identification information used for license authentication of the service;
Organization information management means for managing the function of the service after license authentication for each organization;
Service management means for managing the function of the service provided to the organization based on the function of the service after license authentication managed for each organization by the organization information management means;
Program to function as.

Images