JP2017212694A - Information processing device, information processing method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a technique which reduces an operation load on user authentication processing.SOLUTION: An information processing device includes: first determination means for determining whether or not a log-in user has the screen use authority in regard to a connection with a terminal device through a wireless LAN, on the basis of the authority information of the log-in user; and display control means for displaying a screen, which includes an object to accept a start-up instruction of the access point of the wireless LAN, on an operation unit when the first determination means determines that the log-in user has the use authority. When the start-up instruction of the wireless LAN access point is accepted through the object, the display control means displays on the operation unit a screen which includes connection information in order to connect to the wireless LAN access point.SELECTED DRAWING: Figure 9

Description

  The present invention relates to an information processing apparatus, an information processing method, and a program.

In recent years, information processing apparatuses (for example, multifunction peripherals) having a wireless local area network (LAN) access point function have emerged (Patent Document 1). Accordingly, a PC (personal computer) and a mobile terminal can be directly connected to the multifunction peripheral and can use the print function. A terminal that can connect to a wireless LAN access point generally allows connection to the wireless LAN access point by inputting an SSID and a passphrase.
In addition, mobile terminals can connect to multifunction devices compatible with Bluetooth (registered trademark) Low Energy (hereinafter referred to as BLE), which is one of the short-range wireless communication standards, and can use the functions of the multifunction devices. It becomes.
In addition, there is a technology in which a mobile terminal connects to a wireless LAN by reading an SSID and a passphrase embedded in a QR code (registered trademark).
The multifunction peripheral includes an operation unit and various applications that can be used from the operation unit, and one of them includes an application that displays a QR code in which the SSID and passphrase of the wireless LAN access point are embedded.
According to Japanese Patent Application Laid-Open No. 2004-228561, the user can set an authentication function for each application screen displayed on the operation unit of the multifunction device by setting the function-specific authentication setting from the operation unit of the multifunction device. With this function, it is possible to set a user to be used for each application of the multifunction peripheral and to display the application screen only for a limited number of users. For this reason, only a limited user can read the QR code in which the SSID and the passphrase are embedded.

JP 2006-123239 A Japanese Patent No. 4745657

According to the background art described above, the multifunction peripheral authenticates the user who reads the QR code in which the information for connecting to the wireless LAN access point held by the multifunction peripheral is embedded using the authentication function of the operation unit, thereby authenticating the user authority information. It is possible to set a limit by checking.
In addition, instead of using the QR code, it is conceivable that the user uses a mobile terminal to acquire the SSID and passphrase from the multifunction device using BLE communication.
However, even if the mobile terminal acquires the SSID and passphrase of the multifunction peripheral with BLE, in order to check the authority information as to whether the user possessing the mobile terminal has the authority to acquire the SSID and passphrase It is necessary to perform user authentication.
For this reason, after the authentication of the operation unit of the multifunction peripheral, the authentication is executed when the SSID and the passphrase are acquired again using BLE from the mobile terminal. Therefore, the user has to execute authentication twice, which is complicated.
An object of this invention is to provide the technique which reduces the operation load concerning a user's authentication process.

  The information processing apparatus according to the first aspect of the present invention determines, based on authority information of a logged-in user, whether or not the logged-in user has authority to use a screen related to a connection with a terminal device via a wireless LAN. When the determination unit and the first determination unit determine that the logged-in user has the usage authority, a screen including an object for receiving a wireless LAN access point startup instruction is displayed on the operation unit. Display control means, and the display control means includes connection information for connecting to the wireless LAN access point when an instruction to start up the wireless LAN access point is received via the object. A screen is displayed on the operation unit.

  ADVANTAGE OF THE INVENTION According to this invention, the technique which reduces the operation load concerning a user's authentication process can be provided.

It is a figure which shows an example of the system configuration | structure of a communication system. It is a figure which shows an example of the hardware constitutions of MFP and a mobile terminal. It is a figure which shows an example of a function structure of MFP and a mobile terminal. It is a figure (example 1) which shows an example of screen transition etc. It is FIG. (2) which shows an example of screen transition etc. It is a figure which shows an example of a user account registration screen. It is a flowchart (the 1) which shows an example of information processing. It is a flowchart (the 2) which shows an example of information processing. It is a flowchart (the 3) which shows an example of information processing.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

(Embodiment 1)
<System configuration of communication system>
FIG. 1 is a diagram illustrating an example of a system configuration of a communication system. Since the environment for executing the information processing of the present embodiment is assumed to be an office environment, the communication system includes a plurality of MFPs (Multi Function Peripherals), a plurality of PCs connected to the MFP using a wired LAN, and a plurality of PCs. There is a mobile terminal. However, FIG. 1 shows an environment in which a single MFP 100 and a single mobile terminal 101 communicate with each other for the sake of simplicity. The MFP 100 shown in FIG. 1 has a wireless LAN access point and a BLE communication function. FIG. 1A shows an example in which the user activates an access point of the MFP 100 to establish a wireless connection with the mobile terminal 101 and use the functions of the MFP 100. FIG. 1B shows an example in which the BLE communication connection process is performed by using the function of the MFP 100 when the mobile terminal 101 receives the BLE radio wave transmitted by the MFP 100. BLE communication is an example of near field communication.
The MFP 100 according to the present embodiment is an image forming apparatus having a printer function, a copy function, and a scan function, and has a function of connecting to a network via a wired LAN and performing printing through network cooperation with a PC. MFP 100 also has a DHCP (Dynamic Host Configuration Protocol) function for dynamically allocating an IP address to a terminal connected to an access point. MFP 100 is an example of an information processing apparatus.

FIG. 2 is a diagram illustrating an example of a hardware configuration of the MFP 100 and the mobile terminal 101.
<Hardware Configuration of MFP 100>
The MFP 100 includes a printer 206, a copy 207, a scanner 208, an operation unit 200 for operating the MFP 100, an IC card reader 201 that holds a card at the time of login, and a CPU 205 that controls these. The MFP 100 also includes a ROM 202 that stores programs, setting information, and the like, a RAM 203 that provides a function as a data storage area when the CPU 205 executes the programs, and an HDD 204 that stores programs, data, and the like. The MFP 100 also includes a wired LAN I / F 209, a wireless LAN I / F 210, and a BLE I / F 211 as communication functions. On the other hand, the mobile terminal 101 includes an operation unit 212 that performs user operations, a telephone network I / F 213, a wireless LAN I / F 214, a BLE I / F 215, and a CPU 219 that controls these. The mobile terminal 101 also includes a ROM 216 that stores programs, setting information, and the like, a RAM 217 that provides a function as a data storage area when the CPU 219 executes the programs, and a flash memory 218 that stores programs, data, and the like.
The printer 206 is a unit that implements a reception function. For example, the printer 206 forms an image according to a print job received from a PC connected to the wired LAN of the same network and the mobile terminal 101 connected to the wireless LAN access point, and performs processing to output the image on paper. . A copy 207 and a scanner 208 are units that realize a transmission function, and perform a process of optically reading a document image set in the scanner unit and outputting it to a sheet as image data. A wired LAN I / F 209 is an interface for connecting to a LAN configured by a local area network or the like, and is an interface necessary for cooperating with a PC connected to the same network. The wireless LAN I / F 210 has a function as an access point for connecting to the mobile terminal 101. Since the wireless LAN I / F 210 has a function as an access point, direct communication can be performed with the mobile terminal 101 connected to the access point. In order to perform BLE connection processing, the BLE I / F 211 broadcasts an advertisement packet that is a mechanism for disclosing the device name of the device and information on the corresponding service to other devices. By broadcasting the advertisement packet, BLE communication can be performed with the mobile terminal 101 that has received the advertisement packet.
The CPU 205 dynamically controls various hardware 200 to 204 and 206 to 211 constituting the MFP 100, thereby realizing each function included in the MFP 100. The CPU 205 can send signals to various hardware via a bus line and perform data communication with other hardware. The operation unit 200 is a user interface for a user who uses the MFP 100 to use the printer 206, the copy 207, the scanner 208, and the wireless LAN I / F 210. The operation unit 200 can be operated as a touch panel. The IC card reader 201 is a unit for realizing authentication using a card.
When the CPU 205 executes processing based on a program stored in the ROM 202 or the HDD 204, all or part of the functional configuration of the MFP 100 in FIG. 3A described later and the processing in the flowcharts in FIGS. The

<Hardware configuration of mobile terminal 101>
The telephone network I / F 213 is an interface for realizing a function as mobile communication using the telephone network. Wireless LAN I / F 214 is an interface for enabling wireless LAN connection with MFP 100. The BLE I / F 215 is an interface for enabling BLE communication with the MFP 100.
The CPU 219 dynamically controls the hardware 212 to 218 constituting the mobile terminal 101. The CPU 219 sends signals to various hardware via the bus line, and controls the functions of the telephone network I / F 213, the wireless LAN I / F 214, and the BLE I / F 215. The operation unit 212 is a user interface for a user using the mobile terminal 101 to execute the telephone network I / F 213 and the wireless LAN I / F 214. The operation unit 212 can be operated as a touch panel.
When the CPU 219 executes processing based on the program stored in the ROM 216, all or part of the functional configuration of the mobile terminal 101 shown in FIG.

Next, functional configurations of the MFP 100 and the mobile terminal 101 will be described with reference to FIG.
<Functional Configuration of MFP 100>
FIG. 3A is a diagram illustrating an example of a functional configuration of the MFP 100. The MFP 100 in FIG. 3A includes a copy 301, a scan 302, a print 303, a mobile portal screen 304, an MFP setting 305, and a login function 306 as applications that operate on the platform OS 319. The application described above communicates with various control services through an application program interface (API) 307 to start the application. The various control services are a module group including a scanner control service 308, a printer control service 309, an operation unit control service 310, a wireless LAN control service 314, a BLE control service 315, and an authentication control service 316. In addition, a user DB 317 that stores user information and a login context storage RAM 318 that stores a login context of a user who has performed login are provided.
A copy 301, a scan 302, a print 303, a mobile portal screen 304, and an MFP setting 305 provide a user interface that can be operated by the user. The mobile portal screen 304 is a user interface for wirelessly connecting the MFP 100 and the mobile terminal 101, and can be connected to the mobile terminal 101 by starting up an access point. When the mobile portal screen 304 is activated, an SSID (Service Set Identifier) and a passphrase are displayed on the screen of the MFP 100. The SSID and passphrase are examples of connection information. The user performs connection processing by inputting the SSID and passphrase displayed on the screen of the MFP 100 to the mobile terminal 101. After the mobile print process is finished, the user instructs the end of the process by selecting an access point stop button from the mobile portal screen 304. Login function 306 provides a function for logging in to MFP 100. The login function 306 performs new user registration, user information change, and the like using the user DB 317 and manages login users.

<Functional configuration of mobile terminal 101>
FIG. 3B is a diagram illustrating an example of a functional configuration of the mobile terminal 101. The document management application 320 is an application that manages photos, documents, and the like stored in the mobile terminal 101. A platform 321 used in the mobile terminal 101 in FIG. 3B is configured by a platform such as Android (registered trademark) or iOS (registered trademark). The above-described application communicates with the control service by API and starts up the application. The control service is a module including a wireless LAN control service 322, a BLE control service 323, and a print service 324. In addition, a wireless LAN information DB 325 is provided in the platform.
The user instructs the start of connection with the access point of MFP 100 by inputting the SSID and passphrase displayed on MFP 100 to mobile terminal 101. The mobile terminal 101 records the SSID and passphrase of the access point that has been successfully connected in the wireless LAN information DB 325. Further, when the mobile terminal 101 performs a BLE connection process with the MFP 100, the mobile terminal 101 searches for an advertisement packet transmitted from the connected MFP 100. If the search is successful, the mobile terminal 101 performs a BLE connection process with the MFP 100, and can authenticate the MFP 100 and acquire the SSID and passphrase described above.

<Setting of MFP 100>
FIG. 4A shows a screen of the operation unit 200 of the MFP 100. The screen of the operation unit 200 includes a menu screen 401, a login screen 402, and mobile portal screens 403 and 404.
The menu screen 401 includes buttons for the mobile portal screen 408 in addition to the copy 405, scan 406, and print 407 buttons that the normal MFP 100 has. When detecting that the button on the mobile portal screen 408 of the menu screen 401 is selected, the CPU 205 changes the screen of the operation unit 200 to the login screen 402. The CPU 205 authenticates the user based on the user name and password input via the login screen 402, and when the authentication is successful, the screen of the operation unit 200 transitions to the mobile portal screen 403. The screen of the mobile portal screen 403 is displayed only for users who have been granted usage rights. On the mobile portal screen 403, the name of the currently used device is displayed, and an access point activation button 413 for activating the access point is displayed. The user instructs activation of the access point by selecting the access point activation button 413. When the selection of the access point activation button 413 is detected, the CPU 205 changes the screen of the operation unit 200 to the mobile portal screen 404. On the mobile portal screen 404, SSID and passphrase information 415 for wireless connection with the mobile terminal 101 is displayed on the screen, and an access point stop button 416 for performing access point stop processing is displayed. In addition, in order to perform an SSID and passphrase transfer process using BLE communication with the mobile terminal 101, the MFP 100 in which the BLE function is effective displays a wording such as “the handover function by BLE is effective” 417 on the screen. Let The access point activation button 413 is an example of an object that receives an instruction to start up a wireless LAN access point.

<BLE connection of mobile terminal 101>
FIG. 4B shows BLE connection processing of the mobile terminal 101. The BLE operation unit login 422 is for performing the authentication process on the login screen 402 described above by the communication process of BLE. The BLE multi-login 423 does not authenticate the operation unit 200, and enables BLE connection processing with the MFP 100 even when another user is logged in to the operation unit 200. When the BLE operation unit login 422 or the BLE multi-login 423 is selected, the mobile terminal 101 transitions to a login screen 426 and pops up a screen for inputting a user account 427 and a password 428. The user can log in to the MFP 100 by inputting his / her user account and password from the login screen. The BLE handover 424 is a function that can be used only by the mobile terminal 101 that has performed the BLE operation unit login 422 or the BLE multi-login 423 described above. Therefore, the BLE handover 424 can acquire the SSID and passphrase without performing the login process when acquiring the SSID and passphrase. The mobile terminal 101 acquires an SSID and a passphrase necessary for performing a wireless direct connection with the MFP 100 through BLE communication, and switches the connection from BLE communication to wireless LAN communication. The functions on the MFP 100 side of the above-described BLE operation unit login 422 or BLE multi-login 423 will be described later in <Request for BLE authentication of MFP 100>.

認証なしの場合、ユーザの権限情報の確認を行わないため、どのユーザにおいてもモバイルポータル画面５０３から無線ＬＡＮダイレクト機能を利用することが可能となる。
デバイス認証の場合、ＭＦＰ１００の機能を利用する際に、図５に示すように認証画面５０１が操作部２００に表示され、認証を行った後、メニュー画面５０２が表示される。ここでモバイルポータル画面５０３の利用権限がないユーザの場合、ＣＰＵ２０５は、モバイルポータル画面５１０のボタンをマスクして表示する。
機能別認証の場合、モバイルポータル画面への認証がある場合とない場合とでＭＦＰ１００の処理が異なる。モバイルポータル画面５０３への認証がない場合、認証なしと同じくどのユーザにおいても、モバイルポータル画面５０３から無線ＬＡＮダイレクト機能を利用することが可能となる。モバイルポータル画面５０３への認証がある場合、ＣＰＵ２０５は、認証したユーザの権限を確認し、権限が付与されているユーザである場合、モバイルポータル画面５０３を表示させる。権限が付与されていないユーザである場合、ＣＰＵ２０５は、「モバイルポータル画面の利用権限がありません」といった文言を表示する。 <Description of authentication function>
The authentication function shown in <Setting of MFP 100> has been described using a function-specific authentication function that performs authentication for each application. In addition, there are functions such as no authentication and device authentication, and a user having administrator authority can set the functions.
The usage form of the mobile portal screen for each authentication function is shown below.

In the case of no authentication, since the user authority information is not confirmed, any user can use the wireless LAN direct function from the mobile portal screen 503.
In the case of device authentication, when using the function of the MFP 100, an authentication screen 501 is displayed on the operation unit 200 as shown in FIG. 5, and after performing authentication, a menu screen 502 is displayed. If the user is not authorized to use the mobile portal screen 503, the CPU 205 masks and displays the buttons on the mobile portal screen 510.
In the case of authentication by function, the processing of the MFP 100 differs depending on whether or not the mobile portal screen is authenticated. If there is no authentication on the mobile portal screen 503, any user can use the wireless LAN direct function from the mobile portal screen 503 as in the case of no authentication. When there is authentication on the mobile portal screen 503, the CPU 205 confirms the authority of the authenticated user, and displays the mobile portal screen 503 if the user is an authorized user. If the user is not authorized, the CPU 205 displays a message such as “no authority to use the mobile portal screen”.

また、ログイン機能３０６は、操作部２００を利用するユーザに対してログイン及びログアウト機能を提供する。ログイン機能３０６は、操作部２００にログイン画面４０２を表示し、ログインしていないユーザが権限を持たないアプリケーションを利用できないようにガードを行う。同時にログイン機能３０６は、操作部２００を介してログインできるユーザ数は１とする。複数のユーザが同時に操作部２００からログインはできない。ユーザのログインが成功した場合、ログイン機能３０６は、操作部２００の画面をログイン画面４０２からアプリケーション画面となるモバイルポータル画面４０３に遷移させ、ユーザがＭＦＰ１００を利用可能な状態にする。ログイン機能３０６は、ログインを行う機能として、複数のログイン方法を提供する。例えば、ログイン機能３０６は、以下のようなログイン方法を提供する。
−キーボードログイン方法
操作部２００のログイン画面４０２にて、ソフトキーボードを表示し、ログインボタン４１２のボタンの押下を検知した場合には、入力されたユーザ名４１０とパスワード４１１とを取得してユーザ認証し、ログイン処理を行う。
−ＩＣカードログイン方法
ＩＣカードリーダ２０１にかざされたＩＣカードからＩＣカード番号を取得して、ユーザを特定し、ログイン処理を行う。 <Detailed description of login function 306>
The login function 306 provides a user with a user interface for registering and managing user accounts. Also, the login function 306 manages information registered in the user DB 317 via the user interface. Examples of information to be managed include a user name, password, IC card number, authority information, and the like as shown in a table (user information list).

The login function 306 provides a login and logout function to a user who uses the operation unit 200. The login function 306 displays a login screen 402 on the operation unit 200, and performs a guard so that a user who is not logged in cannot use an application for which the user does not have authority. At the same time, the login function 306 assumes that the number of users who can log in via the operation unit 200 is one. Multiple users cannot log in from the operation unit 200 at the same time. If the user login is successful, the login function 306 transitions the screen of the operation unit 200 from the login screen 402 to the mobile portal screen 403 serving as an application screen, so that the user can use the MFP 100. The login function 306 provides a plurality of login methods as functions for performing login. For example, the login function 306 provides the following login method.
-Keyboard login method When a soft keyboard is displayed on the login screen 402 of the operation unit 200 and the pressing of the login button 412 is detected, the input user name 410 and password 411 are acquired and user authentication is performed. And log in.
-IC card login method An IC card number is acquired from an IC card held over the IC card reader 201, a user is specified, and a login process is performed.

Normally, the login function 306 authenticates the user by checking whether the user name and password or IC card number acquired by the keyboard login method or the IC card login method matches those registered in the user DB 317. . Further, the login function 306 may cooperate with a user authentication server connected by a wired LAN. In this case, the login function 306 performs user authentication by checking whether or not the acquired user name and password and the IC card number match those registered in the server.
When the user logs in, the login function 306 generates an object in which information of the logged-in user is recorded and records the object on the RAM 203. An object in which information of a logged-in user is recorded is hereinafter referred to as a login context. The following table shows examples of information recorded in the login context.

操作部２００に表示されたログアウトボタン４１８の押下を検知した場合、ＣＰＵ２０５は、ログインコンテキストに記録した情報を消去して、再び、メニュー画面４０１の表示を行う。 In the login context, an area for recording the domain name is provided so that the user account registered in the user DB 317 and the user account set in the user authentication server can be distinguished as different accounts. For example, when a user registered in the user DB 317 logs in, the login function 306 records a character string “localhost” in the domain name recording area. When logged in with a user account managed by the user authentication server, the login function 306 records the domain name and server name as a character string in the domain name recording area. The following table shows an example of information recorded in the login context when logging in with a user account managed by the server.

When detecting that the logout button 418 displayed on the operation unit 200 is pressed, the CPU 205 deletes the information recorded in the login context and displays the menu screen 401 again.

<Description of Function Restriction of MFP 100>
Next, function restrictions of MFP 100 will be described with reference to FIG.
The MFP 100 has a function of setting function restrictions, and can restrict functions that can be used for each user. FIG. 6 is a diagram illustrating an example of a screen for registering a user account. The process of displaying the screen illustrated in FIG. 6 on the operation unit 200 is an example of a display control process. Authority information can be set from the user account registration screen 601. The user who is set with the authority shown in FIG. 6 is restricted in the use of the application possessed by the MFP 100 and is given the authority to use the mobile portal screen 403. Therefore, this user can use the mobile portal screen 403 function. That is, the CPU 205 displays a registration screen on the operation unit 200 for registering the usage authority for each function provided by the MFP 100 for each user. CPU 205 registers the usage authority for each function provided by MFP 100 for each user in response to a user operation via the registration screen.
As described in <Detailed Description of Login Function 306>, authority information exists in the login context, and the administrator of MFP 100 sets the authority of the user by distributing the authority information for each user. Can do.

<BLE service characteristic held by MFP 100>
Hereinafter, the characteristics included in GATT (Generic Attribute Profile) defined when MFP 100 performs BLE communication with mobile terminal 101 will be described for each function.
-Authentication service characteristic This is a service characteristic for performing authentication processing in BLE. The mobile terminal 101 can log in using the MFP 100 and BLE by searching for the authentication service characteristic.
-Request Characteristic Characteristic used when the mobile terminal 101 makes an SSID and passphrase acquisition request or an access point start-up request, and is given only a Write right that is a write right.
-Response Characteristic Characteristic used when response processing is returned from the MFP 100 after request processing from the mobile terminal 101 is performed, and only Notify authority for notifying the mobile terminal 101 from the MFP 100 is granted. Has been.
-User Information Characteristic When the mobile terminal 101 performs login using BLE, it is a characteristic for including information such as user information and a password, and only the write authority that is a write authority is granted.

<Request for BLE authentication of MFP 100>
A request for BLE authentication of MFP 100 will be described.
Login to MFP 100 Operation Unit MFP 100 performs authentication by including the user account and password set in the mobile terminal 101 owned by the user in the characteristic of the authentication service of BLE communication in the login function to the operation unit.
Logout to MFP 100 Operation Unit MFP 100 has a function to log out a user using BLE communication in the function of logging out from the operation unit. Here, the user who uses the logout function includes the user account and password set in the mobile terminal 101 owned by the user in the characteristic of the authentication service of BLE communication. The MFP 100 compares the user account and password of the user who has logged into the MFP 100 from this characteristic writing information, and if they match, performs a logout function. Further, the MFP 100 ends the GATT communication regardless of whether logout to the operation unit 200 is possible or not.
BLE Multi-Login to MFP 100 Unlike login to the operation unit 200 of the MFP 100, this is a function for connecting to the MFP 100 without logging in to the operation unit 200. When the mobile terminal 101 makes an acquisition request for an SSID and a passphrase used when connecting to an access point provided in the MFP 100, the mobile terminal 101 can acquire the mobile terminal 101 by performing BLE multi-login to the MFP 100. The login method is the same as the login method to the operation unit of the MFP 100.

<Explanation of flowchart showing information processing>
Next, information processing of the CPU 205 of the MFP 100 shown in this specification will be described with reference to the flowcharts of FIGS. In addition, the flowchart in this specification describes a flowchart for logging in to the operation unit on the MFP 100 side and a flowchart for performing multi-login using BLE communication.
In addition, if the users who can access the mobile portal are not limited, there is a security problem. Therefore, a function-specific authentication function is provided to restrict the use of the mobile portal.

<Login Flow to MFP 100 Operation Unit>
When using the mobile portal function of MFP 100 using login to MFP 100 operation unit, the user selects a mobile portal screen button displayed on the operation unit of MFP 100. In step S <b> 702, the CPU 205 receives selection of a mobile portal screen button on the operation unit. At this time, the CPU 205 requests the user to log in to the MFP 100 by function-based authentication. The user inputs his / her user account and password in the operation unit. In step S <b> 703, the CPU 205 acquires user information in the user DB stored in the HDD 204 or the like based on the user account and password input via the operation unit, and starts login processing. In step S <b> 704, the CPU 205 determines whether authentication is successful based on whether user information corresponding to the input user account and password is stored. If the CPU 205 determines that the authentication has succeeded (YES in S704), the process proceeds to S705. If the CPU 205 determines that the authentication has failed (NO in S704), the process of FIG. In step S705, the CPU 205 generates a login context. In step S <b> 706, the CPU 205 confirms authority information for the logged-in user. If the result of the confirmation is that the user has been granted the mobile portal screen authority (YES in S706), the CPU 205 proceeds to S707. On the other hand, if the result of the confirmation is that the user is not a user to whom the mobile portal screen authority is granted (NO in S706), the CPU 205 ends the process of FIG. This is because if the user is not granted the mobile portal screen authority, the authenticated user cannot use the mobile portal screen application. In step S <b> 707, the CPU 205 displays a mobile portal screen on the operation unit 200, and determines whether an access point startup process is accepted via the mobile portal screen. The process of S707 is an example of a display control process. When the CPU 205 displays the mobile portal screen on the operation unit 200, the user can use the wireless LAN access point function of the MFP 100. If the CPU 205 determines that the access point startup process has been accepted (YES in S707), the process proceeds to S708, and if it is determined that the access point startup process has not been received (NO in S707), the process of FIG. Exit. In step S <b> 708, the CPU 205 displays the SSID and passphrase necessary for wireless LAN access point connection on the mobile portal screen. The user can directly connect to the MFP 100 by inputting the displayed SSID and passphrase to the mobile terminal 101 owned by the user. Further, the user can acquire wireless LAN access point information from the MFP 100 by using a login method using BLE communication without inputting the SSID and passphrase to the mobile terminal 101. In step S709, the CPU 205 executes the mobile terminal connection process in FIG.

Hereinafter, the mobile terminal connection process of FIG. 7B will be described.
In step S712, the CPU 205 acquires user information from the mobile terminal via BLE communication. In step S713, the CPU 205 determines whether the acquired user information matches the login context. If CPU 205 determines that they match (YES in S713), it proceeds to S714, and if it does not match (NO in S713), it ends the mobile terminal connection process. In S714, the CPU 205 transmits the SSID and passphrase to the mobile terminal via BLE communication.

The following describes a workaround for double authentication that occurs when mobile login is executed when acquiring information necessary for the wireless LAN access point after logging in to the operation unit.
<Workaround for double authentication>
-When using BLE communication for authentication to the operation unit Since the GATT connection is established between the MFP 100 and the mobile terminal 101, the MFP 100 logs in to the operation unit and the user in BLE communication Can be determined to be the same. Therefore, the user can acquire the SSID and passphrase as shown in FIG. 7B without performing the authentication function that occurs when performing BLE communication.
-When BLE communication is not used for authentication to the operation unit When BLE communication is not used for authentication to the operation unit, the MFP 100 performs BLE communication connection from the mobile terminal 101 with the user who has logged in the operation unit, and the SSID and pass It is impossible to determine whether the user who makes the phrase acquisition request is the same. Therefore, the MFP 100 determines whether or not the user is the same user by acquiring user information transmitted from the mobile terminal 101 when performing the BLE connection.

Hereinafter, each of a method of using a user account included in user information and a method of using a unique identification ID will be described.
-Method for confirming user account included in characteristic of BLE communication The CPU 205 confirms a user account included in the characteristic for a user who uses multi-login in BLE communication. When the confirmed user account is the same as the user account of the user who is logging in locally, the CPU 205 does not perform the authentication process and includes information for connecting to the wireless LAN access point in the BLE communication packet.
-Method of storing the unique identification ID of the mobile terminal 101 possessed by the user in the DB possessed by the device side When the CPU 205 performs GATT communication using BLE, the unique identification ID of the mobile terminal 101 possessed by the user An acquisition request is made, and the acquired unique identification ID is registered in the DB as user information. When the CPU 205 performs BLE multi-login with the mobile terminal 101, the CPU 205 checks the ID for each consciousness of the mobile terminal 101 included in the characteristic. The CPU 205 acquires the unique identification ID of the user who has logged in the operation unit 200 from the DB, and compares it with the unique identification ID requested when performing BLE multi-login. If they are the same, the CPU 205 includes the information for connecting to the wireless LAN access point in the BLE communication packet without using the BLE authentication function.

<BLE multi-login flow>
Details of the BLE multi-login processing flow will be described below.
In step S <b> 802, when the CPU 205 receives the BLE communication information from the mobile terminal 101, the CPU 205 confirms the request command from the written characteristic information. In step S <b> 803, the CPU 205 determines whether the request command information is a command for executing BLE multi-login based on the confirmation result. If the command is a command for executing BLE multi-login (YES in S803), the CPU 205 proceeds to S804. If the command is not a command to execute BLE multi-login (NO in S803), the CPU 205 proceeds to S807. In step S <b> 804, the CPU 205 acquires a user account / password from the Written characteristic. In step S <b> 805, the CPU 205 determines whether the acquired user account / password matches the information in the user DB held by the MFP 100 as a result of the acquisition. If the CPU 205 determines that the information matches the user DB information (YES in S805), the process proceeds to S806. If the CPU 205 determines that the information does not match the user DB information (NO in S805), the process proceeds to S808. In step S806, the CPU 205 notifies the mobile terminal 101 of the success result of the BLE multi-login process. On the other hand, in step S <b> 808, the CPU 205 notifies the mobile terminal 101 of the authentication failure result. In step S807, the CPU 205 notifies the mobile terminal 101 that the command is not correct.

<Flow of BLE handover processing>
Details of the BLE handover process flow will be described below with reference to FIG.
When using the acquisition of the SSID and the passphrase using the BLE of the MFP 100 in the MFP 100, the user sets a mobile unique unique identification ID in the user information of his / her mobile terminal 101 and holds it as information. When performing the BLE handover process, the CPU 219 of the mobile terminal 101 writes the user information including the above-described user information. In step S <b> 902, when the CPU 205 of the MFP 100 receives BLE communication information, the CPU 205 acquires user information from the written characteristic. In step S <b> 903, the CPU 205 confirms whether the user is currently logged in the operation unit 200. In S904, if the CPU 205 determines that the user is logged in as a result of the confirmation (YES in S904), the process proceeds to S905. If it is determined that the user is not logged in (NO in S904), the CPU 205 proceeds to S908. In step S905, the CPU 205 confirms the user information of the user stored locally. In step S <b> 906, the CPU 205 compares the confirmed locally stored user information with the user information of the mobile terminal 101 that has been written, and determines whether or not they match. If it is determined that they match (YES in S906), the CPU 205 proceeds to S907, and if it is determined that they do not match (NO in S906), the process proceeds to S908. In step S907, the CPU 205 returns the response information desired by the user without performing the authentication process in the MFP 100 multi-login.

  On the other hand, in step S908, the CPU 205 makes an authentication request to the mobile terminal 101. In step S <b> 909, the CPU 205 confirms the user account / password held by the MFP 100 and the written information, and starts a login process. In step S910, the CPU 205 determines whether the user information matches as a result of the confirmation. If the CPU 205 determines that the user information matches (YES in S910), the process proceeds to S911. If the CPU 205 determines that the user information does not match (NO in S910), the process proceeds to S916. In step S911, the CPU 205 generates a login context. On the other hand, in S916, the CPU 205 notifies the mobile terminal 101 of an authentication error response. After authentication, in step S912, when a command to use an access point is requested from the mobile terminal 101, the CPU 205 determines its own state and determines whether an access point started by another user is not activated. To do. If it is determined that the CPU 205 is not activated (YES in S912), the process proceeds to S913, and if it is determined that it is activated (NO in S912), the process proceeds to S917. In step S <b> 913, the CPU 205 confirms authority information for the logged-in user. If the result of the confirmation is that the user has been granted the mobile portal screen authority (YES in S913), the CPU 205 proceeds to S914. On the other hand, if the result of the confirmation is that the user is not a user to whom the mobile portal screen authority is granted (NO in S913), the CPU 205 proceeds to S918. In step S917, the CPU 205 returns an access point activation error response to the mobile terminal 101 in order to notify the mobile terminal 101 that another user has activated the access point. In step S914, the CPU 205 performs access point activation processing. In step S <b> 915, the CPU 205 transmits the SSID and passphrase necessary for connection to the mobile terminal 101. On the other hand, in S918, the CPU 205 notifies the mobile terminal 101 that the mobile portal screen authority is not granted.

(Other embodiments)
The present invention supplies a program that realizes one or more functions of the above-described embodiments to a system or apparatus via a network or a storage medium. It can also be realized by a process in which one or more processors in the computer of the system or apparatus read and execute the program. It can also be realized by a circuit (for example, ASIC) that realizes one or more functions.

  As mentioned above, although preferable embodiment of this invention was explained in full detail, this invention is not limited to the specific embodiment which concerns.

  As mentioned above, according to the process of each embodiment mentioned above, the technique which reduces the operation load concerning a user's authentication process can be provided.

100 MFP
101 Mobile terminal 205 CPU

Claims (9)

First determination means for determining whether or not the logged-in user has authority to use a screen related to connection with a terminal device via a wireless LAN based on authority information of the logged-in user;
Display control means for displaying, on the operation unit, a screen including an object for receiving an instruction to start up a wireless LAN access point when it is determined by the first determination means that the logged-in user has the use authority When,
Have
When the display control unit receives an instruction to start up a wireless LAN access point via the object, the information processing unit displays a screen including connection information for connecting to the wireless LAN access point on the operation unit. apparatus. When user information is received from the terminal device via short-range wireless communication after receiving an instruction for starting up a wireless LAN access point via the object, the user information and the information processing device hold the user information. Second determination means for determining whether or not the user information matches;
A first transmission unit that transmits the connection information to the terminal device via the short-range wireless communication when the second determination unit determines that the user information matches;
The information processing apparatus according to claim 1, further comprising: A third determination unit configured to determine whether or not the user information of the user who has logged in via the operation unit matches with the user information when the user information is received from the terminal device via short-range wireless communication;
A second transmission unit configured to transmit the connection information to the terminal device via short-range wireless communication when the third determination unit determines that the user information matches;
The information processing apparatus according to claim 1, further comprising:   The information processing apparatus according to any one of claims 1 to 3, further comprising a registration unit that registers, for each user, a function-specific usage right provided by the information processing apparatus. The display control means displays, on the operation unit, a registration screen for registering a use authority for each function provided by the information processing apparatus for each user.
5. The information processing apparatus according to claim 4, wherein the registration unit registers a usage right for each function provided by the information processing apparatus for each user in response to a user operation via the registration screen.   The information processing apparatus according to claim 1, wherein the connection information is an SSID (Service Set Identifier) and a passphrase.   The information processing apparatus according to claim 1, wherein the information processing apparatus is an image forming apparatus. An information processing method executed by an information processing apparatus,
A determination step of determining whether or not the logged-in user has authority to use a screen related to connection with a terminal device via a wireless LAN, based on authority information of the logged-in user;
If the determination step determines that the logged-in user has the use authority, a display control step for displaying a screen including an object for accepting an instruction to start up a wireless LAN access point on the operation unit;
Including
In the display control step, when an instruction for starting up a wireless LAN access point is received via the object, information processing for displaying a screen including connection information for connecting to the wireless LAN access point on the operation unit Method.   The program for functioning a computer as each means of the information processing apparatus of any one of Claims 1 thru | or 7.

Images