JP4490208B2 - Image forming apparatus and roll information management method - Google Patents

Description

  The present invention relates to an image forming apparatus and a roll information management method.

  In an image forming apparatus called a multifunction peripheral or a multifunction peripheral having a plurality of functions such as a copy, a printer, a scanner, and a FAX (facsimile), a plurality of services providing various services on an OS (Operating System) such as UNIX (registered trademark). Daemons (server programs) and applications are running.

  In addition, when a command is input when a user uses a function, each daemon checks whether or not the user should be allowed to use the function, so that authentication, billing, and user restriction called CCS (Certification Control Service) is performed. Role information including user authority is acquired from an external module having the above function.

  FIG. 1 is a configuration diagram of a conventional image forming apparatus 11. When daemons 124 to 127 in an NCS (Network Control Service) 12 that provides a communication service receive a command from a client 16 via a network 15, The ncs daemon 121 that supervises the processing is requested to acquire role information. The ncs daemon 121 obtains the role information 131 from the CCS 13 and provides the internally held role information 123 to the daemons 124 to 127. Should the daemons 124 to 127 be permitted to use the function according to the contents of the role information 123? If it is permitted, the function is executed. Note that the role information is acquired via the ncs daemon 121 because the CCS library, which is a program for accessing the CCS 13, is linked to each of the daemons 124 to 127 to increase the program size. This is because the ROM (Read Only Memory) size for storing the programs of the daemons 124 to 127 is increased, so that access to the CCS 13 is concentrated in the ncs daemon 121 to provide an authentication function that can be used by a plurality of daemons. .

  FIG. 2 is a sequence diagram showing processing at the time of conventional printing, and shows general printing processing by FTP (File Transfer Protocol). In FIG. 2, the operations performed by the user via the client 16 are: login command input (step S1), ls command input (step S2), bin command input (step S3), and put command input (step S4). ), The logout command is input (step S5). Each time an individual command is input from the client 16 to the ftp daemon 126 at each stage (step S6), the ftp daemon 126 receives the role information from the ncs daemon 121. Is acquired (step S7), and the ncs daemon 121 acquires role information from the CCS 13 each time (step S8).

  As described above, in the conventional image forming apparatus, it is necessary to inquire role information from the CCS via the ncs daemon every time each daemon processes a command from the user, so that the response is slow and the processing takes time. There was a problem. In particular, when the CCS holds the role information in other devices on the network rather than inside itself (in the case of external authentication), it will take more time and a lot of time loss will occur. There was a problem.

  The present invention has been proposed in view of the above-described conventional problems, and an object of the present invention is to provide an image forming apparatus and roll information that can quickly provide roll information required by each daemon in the device. It is to propose a management method.

In order to solve the above-described problem, in the present invention, as described in claim 1, when a command is input from a user, the function of checking the user authority of the user and determining whether or not the user can use the function Including a user authority provided in a means for providing an authentication function that can be used from a plurality of protocol daemons and that aggregates access from the plurality of protocol daemons. It means for role information acquires role information when receiving a notification of a change to the role information from an external module to provide a case or role information is not present in the cache area from the external module, the obtained roll information The means for storing in the cache area and the load from the cache area when the user authority from the protocol daemon is confirmed. So that and means for providing information.

  According to a second aspect of the present invention, each of the above means can be provided in a daemon that supervises processing in a program that provides a communication service.

  According to a third aspect of the present invention, the external module may be a program that manages role information and provides an authentication service.

  According to a fourth aspect of the present invention, it is possible to filter predetermined information out of the role information acquired from the external module to obtain the role information to be cached.

  In addition, as described in claim 5, the role information acquired from the external module includes a notification destination, authentication permission / inhibition, error reason, user information, ticket information, role information, and application execution authority information. Only role information and application execution authority information can be filtered.

  Further, as described in claim 6, the role information stored in the cache area may include a number, the number of sessions, a user name, a password, a user authority, and an application execution authority.

  Further, as described in claim 7, the user authority includes a device administrator authority, a user administrator authority, a document administrator authority, a network administrator authority, an authentication user authority, a supervisor authority, and a service authority. Can do.

  The application execution authority may include a copy authority, a FAX authority, a printer authority, and a scanner authority.

  In addition, as described in claim 9, when the role information is acquired from the external module, the role information on the cache area is initialized, and the user name and password at the time of login are set to the role information on the cache area. The user authority and application execution authority acquired from the external module can be set in the role information on the cache area.

  In addition, as described in claim 10, when the user logs out, the role information corresponding to the user on the cache area can be deleted.

  Further, as described in claim 11, when the same user opens a plurality of sessions, the role information corresponding to the user on the cache area is deleted when the user logs out from all the sessions. Can be.

  In addition, as described in claim 12, when the user logs in, the number of sessions provided in the roll information on the cache area is incremented from an initial value and decremented when logging out, and the number of sessions is the initial value. At this point, the role information corresponding to the user can be deleted.

  In addition, as described in claim 13, role information on the external module can be changed from the operation panel.

  In addition, as described in claim 14, the roll information on the cache area can be reacquired from the external module when a predetermined time has elapsed since the acquisition of the previous roll information.

According to a fifteenth aspect of the present invention, when a command is input from a user, the user authority in the image forming apparatus having a function of confirming the user authority of the user and determining whether or not the user can be used is retained. A role information management method that can be used from multiple protocol daemons , and that provides authentication functions that aggregate access from multiple protocol daemons, role information including user privileges exists in the cache area. the step of storing a step of acquiring the role information when receiving the notification indicating that a change from the external module to role information from the external module to provide a case no or role information, the acquired role information in the cache area When the user authority is confirmed from the protocol daemon, It can be configured as the role information management method comprising the steps of providing a le information.

  In the image forming apparatus and the roll information management method according to the present invention, the roll information is stored in the cache area and the roll information is provided from the cache area. Can be provided.

  Hereinafter, preferred embodiments of the present invention will be described.

  FIG. 3 is a configuration diagram of an image forming apparatus according to an embodiment of the present invention.

  In FIG. 3, the image forming apparatus 1 is provided with a service that can be commonly used for applications that require network I / O (Input / Output), and corresponds to data received from the network side by a predetermined protocol. NCS2 that distributes to applications and mediates when transmitting data from the application to the network side, CCS3 that provides authentication / billing / user restriction services, and issues function restriction information associated with user login authentication, and NCS2 And a role table 4 for managing function restriction information at the command level of the daemon. The image forming apparatus 1 includes hardware that realizes functions such as a copy, a printer, a scanner, and a FAX, and other software (programs).

  The NCS 2 includes an ncs daemon 21 that supervises the processing in the NCS 2 and provides an authentication function that can be used from a plurality of daemons (protocol daemons), and various daemons 24 to 27. In the ncs daemon 21, a cache area 22 for storing role information 23 acquired from the CCS 3 is provided.

  The roll information 31 is held in the CCS 3. Note that the role information 31 does not necessarily exist in the CCS 3 and may be held on other devices on the network.

  On the other hand, the image forming apparatus 1 can receive a command from the client 6 via the network 5.

  FIG. 4 is a configuration diagram of functional units related to acquisition of role information. The NCS 2 includes a data transmission unit 201 that transmits an inquiry about role information to the CCS 3, and a data reception unit 202 that receives role information from the CCS 3. A cache control unit 203 that writes the received roll information to the cache area 22. Note that the data receiving unit 202 has a function of filtering only information necessary when handing over the role information received from the CCS 3 to the cache control unit 203.

  Further, the CCS 3 acquires a data receiving unit 301 that receives an inquiry about role information from the NCS 2, an authentication management unit 302 that manages role information, and obtains requested role information from the authentication management unit 302 and sends it to the NCS 2. A data transmission unit 303 for transmission and a charging management unit 304 for managing charging for a user are provided.

  FIG. 5 is a diagram showing an example of role information held in the CCS 3 and shows the structure definition. “Notification destination” “Authentication availability” “Error reason” “User information” “Ticket information” “ It includes elements corresponding to “role information” and “application execution authority information”.

  FIG. 6 is a diagram showing an example of filtering role information by the data receiving unit 202 of NCS2 shown in FIG. 4, and the information drawn with a horizontal line in FIG. 6 is removed from the role information shown in FIG. Only “role information” and “application execution authority information” are delivered.

  FIG. 7 is a diagram showing a structure of cached role information, which includes “No. (number)”, “number of sessions”, “user name”, “password”, “user authority”, and “application execution authority”. Here, as the “user authority”, specifically, “device administrator authority”, “user administrator authority”, “document administrator authority”, “network administrator authority”, “authentication user authority”, “supervisor authority”, “service” “Authority” and the like are set. The device administrator is an administrator who manages the initial settings of the device (image forming apparatus), the user administrator is an administrator who manages personal information in the address book, and the document administrator is a manager who manages the access rights of the stored documents. Administrators, network administrators are administrators who manage settings for connecting to the network, and supervisors can delete each administrator's password (responding to the case where the administrator forgets the password, etc.) or set a new one Administrator who can.

  As the “application execution authority”, specifically, “copy authority”, “FAX authority”, “printer authority”, “scanner authority”, and the like are set. The “number of sessions” is for managing the timing of deleting the cached role information when the same user opens a plurality of sessions.

  FIG. 8 is a diagram showing an example of role information to be cached, where “No.” is assigned a serial number, and “number of sessions” is normally set to “1” (initial value is “0”). . “Admin”, “supervisor”, “user-A”, etc. are set as “user name”, and “(none)” is set in “password” because passwords for “admin” and “supervisor” are separately managed on the OS. Thus, for other users such as “user-A”, a predetermined password is set. As the “user authority”, “device administrator authority / user administrator authority / document administrator authority / network administrator authority”, etc. are set for the user name “admin”, and the user name “supervisor” is set. “Supervisor authority” or the like is set for the user name, and “authentication user authority” or the like is set for the user name “user-A”. As “application execution authority”, “copy authority / FAX authority / printer authority / scanner authority” or the like is set for the user name “admin”, and “(none)” or the like is set for the user name “supervisor”. “Copy authority / printer authority” or the like is set for “user-A”.

  FIG. 9 is a sequence diagram showing processing at the time of printing according to the above-described embodiment, and shows general printing processing by FTP.

  9, operations performed by the user via the client 6 are: login command input (step S101), ls command input (step S102), bin command input (step S103), and put command input (step S104). ), The logout command is input (step S105), and each time an individual command is input from the client 6 to the ftp daemon 26 at each stage (step S106), the ftp daemon 26 starts from the ncs daemon 21. Role information is acquired (step S107).

  Here, if the user logs in and the role information related to the user is not yet in the cache area (FIG. 3), the ncs daemon 21 is initialized according to the setting of the role information from the ftp daemon 26 (step S108). The role information 23A is generated, and the user name and password input by the user are set in the role information to obtain role information 23B. In this state, the user authority and the application execution authority remain blank.

  Next, in response to a role acquisition request from the ftp daemon 26 (step S109), the ncs daemon 21 sets the user name and password as authentication conditions for the CCS 3 (step S110), acquires the role information, and acquires the role information 23C. As a result, all fields are filled (step S111).

  Then, the ncs daemon 21 requests the CCS 3 to discard the authentication condition and receives confirmation (steps S112 and S113), and provides role information to the ftp daemon 26 (step S114). Thereafter, when role information is requested from the ftp daemon 26 (step S115), the cached role information 23C is provided without accessing the CCS 3 (step S116).

  Similarly, even when role information is requested from the ftp daemon 26 in the subsequent ls command input (step S102), bin command input (step S103), and put command input (step S104), The cached role information is provided as the role information 23C without access.

  When the logout command is input from the user (step S105), the ftp daemon 26 requests the ncs daemon 21 to release the role information (step S117), and the ncs daemon 21 caches the role information. Is deleted, and the role information 23D is set.

  As described above, since the role information is obtained by inquiring the CCS only once when the user logs in, and the cached role information is provided to the requesting daemon until the user logs out, Compared with the case where the role information is obtained by inquiring CCS every time, the response can be greatly improved. In particular, when the CCS holds role information in another device on the network rather than inside itself (in the case of external authentication), the effect of reducing time loss is great.

  Next, FIG. 10 is a sequence diagram showing a session management process. That is, when the same user opens a plurality of sessions (when logged in to a plurality of daemons), it is included in the role information in order to manage the timing of deleting the role information 23 on the cache area 22 (FIG. 3). Session management is performed using the “number of sessions” (FIG. 7).

  In FIG. 10, it is assumed that the user logs in to the ftp daemon 26A (step S201), and then the same user logs in to the ftp daemon 26B (step S202).

  When the ftp daemon 26A logged in first requests the ncs daemon 21 to acquire role information (step S203), the ncs daemon 21 increments the number of sessions in the role information from the initial value “0” (add 1). The user name and password authentication conditions are set for the CCS 3 (step S205), and role information is acquired (step S206). The ncs daemon 21 requests the CCS 3 to discard the authentication conditions and obtains confirmation (steps S207 and S208), and then provides role information to the ftp daemon 26A (step S209).

  Next, when the ftp daemon 26B logged in later requests the ncs daemon 21 to acquire role information (step S210), the ncs daemon 21 increments (adds 1) the number of sessions in the role information to “2”. (Step S211) The user name and password authentication conditions are set for the CCS 3 (Step S212), and role information is acquired (Step S213). The ncs daemon 21 requests the CCS 3 to discard the authentication condition and obtains confirmation (steps S214 and S215), and then provides role information to the ftp daemon 26B (step S216). Note that the role information acquisition from the CCS 3 (steps S212 to S215) may be omitted, and the cached role information may be provided to the ftp daemon 26B.

  Thereafter, when the user logs out from the ftp daemon 26A (step S217), the ncs daemon 21 decrements (subtracts 1) the number of sessions in the role information to “1” (step S218), but the number of sessions is “0”. Since there is no cached role information, it is left as it is. When the user logs out from the ftp daemon 26B (step S219), the ncs daemon 21 further decrements (subtracts 1) the number of sessions in the role information (step S220), and the role information is obtained when the number of sessions becomes “0”. Is deleted.

  Next, FIGS. 11 to 14 are sequence diagrams showing processing when role information is changed. That is, as shown in FIG. 15, the role information can be changed for each administrator from the operation panel of the image forming apparatus, such as a user name, a password, and the like. It is shown in FIG.

  FIG. 11 uses the cached role information until the latest role information is read at the next login without particularly reflecting the change even if the role information is changed.

  In FIG. 11, when the ftp daemon 26 requests role information from the ncs daemon 21 (step S301), the ncs daemon 21 sets authentication conditions for the CCS 3 (step S302) and acquires role information (step S303). ). Then, the CCS 3 is requested to confirm the discard of the authentication condition (steps S304 and S305), and the role information is provided to the ftp daemon 26 (step S306). Thereafter, when the ftp daemon 26 requests role information from the ncs daemon 21 (step S307), the ncs daemon 21 provides the cached role information to the ftp daemon 26 (step S308).

  FIG. 12 does not use a cache as in the prior art, and acquires roll information from the CCS 3 every time roll information is requested from the ftp daemon 26.

  In FIG. 12, when the ftp daemon 26 requests role information from the ncs daemon 21 (step S401), the ncs daemon 21 sets authentication conditions for the CCS 3 (step S402), and acquires role information (step S403). ). Then, the CCS 3 is requested to confirm the discard of the authentication condition (steps S404 and S405), and the role information is provided to the ftp daemon 26 (step S406). Thereafter, when the ftp daemon 26 requests role information from the ncs daemon 21 (step S407), the ncs daemon 21 sets the authentication condition for the CCS 3 again (step S408), and the change is reflected. The latest role information is acquired (step S409), the authentication condition is requested to be discarded from the CCS3 for confirmation (steps S410 and S411), and the role information is provided to the ftp daemon 26 (step S412).

  In FIG. 13, the latest role information is periodically acquired by a polling method.

  In FIG. 13, when the ftp daemon 26 requests role information from the ncs daemon 21 (step S501), the ncs daemon 21 sets authentication conditions for the CCS 3 (step S502), and acquires role information (step S503). ). Then, the CCS 3 is requested to confirm the discard of the authentication condition (steps S504 and S505), and the role information is provided to the ftp daemon 26 (step S506). Thereafter, when the ftp daemon 26 requests role information from the ncs daemon 21 (step S507), the ncs daemon 21 provides the cached role information to the ftp daemon 26 (step S508).

  Thereafter, when a predetermined time t has elapsed since the acquisition of the first role information (step S503), the ncs daemon 21 sets authentication conditions for the CCS 3 again (step S509), acquires the role information (step S510), The CCS 3 is requested to confirm the discard of the authentication condition and confirmed (steps S511 and S512). As a result, the cached role information becomes the latest state.

  Thereafter, when the ftp daemon 26 requests role information from the ncs daemon 21 (step S513), the ncs daemon 21 provides the cached role information to the ftp daemon 26 (step S514).

  After that, until the user logs out, when the predetermined time t has elapsed from the previous acquisition of role information (step S510), the ncs daemon 21 sets authentication conditions for the CCS 3 again (step S515), and acquires the role information. (Step S516), the CCS 3 is requested to confirm the discard of the authentication condition and confirmed (Steps S517 and S518).

  FIG. 14 shows a case where the ncs daemon 21 receives a notification from the CCS 3 and acquires the latest role information when the role information is changed by the role notification method.

  In FIG. 14, when the ftp daemon 26 requests role information from the ncs daemon 21 (step S601), the ncs daemon 21 sets authentication conditions for the CCS 3 (step S602) and acquires role information (step S603). ). Then, the CCS 3 is requested to confirm the discard of the authentication condition (steps S604 and S605), and the role information is provided to the ftp daemon 26 (step S606).

  Thereafter, when the role information is changed on the operation panel, the CCS 3 notifies the ncs daemon 21 that the role information has been changed (step S607), and the ncs daemon 21 sets the authentication condition for the CCS 3. (Step S608), the role information is acquired (Step S609), and the CCS 3 is requested to confirm the discarding of the authentication condition (Steps S610 and S611). When the ftp daemon 26 requests role information from the ncs daemon 21 (step S612), the ncs daemon 21 provides the cached role information to the ftp daemon 26 (step S613).

  The present invention has been described above by the preferred embodiments of the present invention. While the invention has been described with reference to specific embodiments, various modifications and changes may be made to the embodiments without departing from the broad spirit and scope of the invention as defined in the claims. Obviously you can. In other words, the present invention should not be construed as being limited by the details of the specific examples and the accompanying drawings.

It is a block diagram of a conventional image forming apparatus. It is a sequence diagram which shows the process at the time of the printing in the past. 1 is a configuration diagram of an image forming apparatus according to an embodiment of the present invention. It is a block diagram of the function part concerning acquisition of role information. It is a figure which shows the example of the roll information hold | maintained by CCS. It is a figure which shows the example of filtering of roll information. It is a figure which shows the structure of the role information cached. It is a figure which shows the example of the role information cached. It is a sequence diagram which shows the process at the time of printing. It is a sequence diagram which shows the process of session management. It is a sequence diagram (the 1) which shows a process when the change of roll information is performed. It is a sequence diagram (the 2) which shows a process when the change of roll information is performed. It is a sequence diagram (the 3) which shows a process when the change of roll information is performed. It is a sequence diagram (the 4) which shows a process when the change of roll information is performed. It is a figure which shows the example of a screen of the operation panel at the time of changing role information.

Explanation of symbols

1 Image forming apparatus 2 NCS
21 ncs daemon 22 cache area 23 role information 24 rsh daemon 25 lp daemon 26 ftp daemon 27 telnet daemon 201 data transmission unit 202 data reception unit 203 cache control unit 3 CCS
31 Role Information 301 Data Receiving Unit 302 Authentication Management Unit 303 Data Transmitting Unit 304 Charge Management Unit 4 Roll Table 5 Network 6 Client

Claims (15)

An image forming apparatus having a function of confirming a user authority of a user when a command is input from the user and determining whether or not the user can use the command,
Provided within a means for providing an authentication function that can be used from a plurality of protocol daemons and that aggregates access from the plurality of protocol daemons ;
Means for roll information including user authority acquires role information when receiving a notification of a change to the role information from an external module to provide a case or role information is not present in the cache area from the external module,
Means for storing the acquired role information in the cache area;
An image forming apparatus comprising: means for providing role information from the cache area when user authority from the protocol daemon is confirmed.   The image forming apparatus according to claim 1, wherein each of the units includes a daemon that supervises processing in a program that provides a communication service.   The image forming apparatus according to claim 1, wherein the external module is a program that manages role information and provides an authentication service.   4. The image forming apparatus according to claim 1, wherein predetermined information among the roll information acquired from the external module is filtered to be role information to be cached. 5.   The role information acquired from the external module includes a notification destination, authentication availability, error reason, user information, ticket information, role information, and application execution authority information, and only role information and application execution authority information are filtered from these. The image forming apparatus according to claim 4.   6. The image forming apparatus according to claim 1, wherein the role information stored in the cache area includes a number, the number of sessions, a user name, a password, a user authority, and an application execution authority. .   7. The image forming apparatus according to claim 6, wherein the user authority includes a device administrator authority, a user administrator authority, a document administrator authority, a network administrator authority, an authentication user authority, a supervisor authority, and a service authority. .   8. The image forming apparatus according to claim 6, wherein the application execution authority includes a copy authority, a FAX authority, a printer authority, and a scanner authority. When acquiring role information from the external module,
Initialize role information on the above cache area,
Set the user name and password at login in the role information on the above cache area,
The image forming apparatus according to claim 1, wherein the user authority and the application execution authority acquired from the external module are set in the roll information on the cache area.   10. The image forming apparatus according to claim 1, wherein role information corresponding to the user on the cache area is deleted when the user logs out.   10. When the same user opens a plurality of sessions, the role information corresponding to the user on the cache area is deleted when the user logs out from all the sessions. The image forming apparatus according to claim 1. When the user logs in, the number of sessions provided in the role information on the cache area is incremented from the initial value and decremented when logging out,
The image forming apparatus according to claim 11, wherein the role information corresponding to the user is deleted when the number of sessions reaches an initial value.   The image forming apparatus according to claim 1, wherein roll information on the external module can be changed from an operation panel.   The image forming apparatus according to claim 1, wherein the roll information on the cache area is reacquired from the external module when a predetermined time has elapsed since the acquisition of the previous roll information. A role information management method for holding the user authority in an image forming apparatus having a function of confirming a user authority of the user and determining whether or not the user can be used when a command is input from the user,
In providing an authentication function that can be used from a plurality of protocol daemons and access from the plurality of protocol daemons is aggregated ,
A step of roll information including user authority acquires role information when receiving the notification from the external module indicating that a change in the role information to provide a case or role information is not present in the cache area from the external module,
Storing the acquired role information in the cache area;
A role information management method comprising: providing role information from the cache area when the user authority from the protocol daemon is confirmed.