JP2004102663A - Access control system, access control method, terminal device and network equipment - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To give using permission of equipment only to a person near the equipment to be used, and to restrict use of the equipment to a user having used it once. <P>SOLUTION: A keyword is displayed on a display device 2 of a printer 1, and a person near the printer can read the keyword. The keyword is changed at every hour or at every use. The printer 1 is connected to a LAN 3. When using the printer 1, the user looks at the keyword as shown by a dashed line L1. Then, the user inputs the keyword into a terminal 4 as shown by a dashed line L2. A service request and the keyword are transmitted from the terminal 4 to the printer 1 as shown by a dashed line L3. The service request includes data as a service object. The printer 1 accepts only a service request having a keyword attached thereto coincident with the present keyword. Then, the printer 1 performs the requested service. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an access control system, an access control method, a terminal device, and a network device.
[0002]
[Prior art]
Generally, resources such as a printer and a display are connected to a LAN (Local Area Network). This type of resource is usually unavailable only within the LAN to which it is connected. For example, a printer in an office can be used only from a terminal in the office.
[0003]
[Problems to be solved by the invention]
Such a restriction is effective when the geographical division matches the division on the network, but otherwise, there is a problem that resources cannot be used. For example, a user connects a terminal (for example, a notebook-type personal computer) to the Internet via a mobile phone while away from home, and from a public printer (connected to the Internet via a LAN) installed at a certain place. When it is desired to print some information, printing cannot be performed due to the above-described restrictions.
[0004]
In addition, when an outsider comes to the office, he / she wants to use the printer in that office. However, due to the security of the network, he / she does not want the office network to directly connect the terminal of the outsider. It is also assumed. If it can be used from outside the LAN, it may be illegally used or attacked by a completely unrelated person, and it is not preferable to make it available from outside the LAN without restriction. In order to reduce this risk, it is conceivable that only registered users can be used from outside the LAN, but it takes time and effort to manage user registration and deletion. In particular, if a visitor who happens to visit temporarily wants to use it, management such as user registration and deletion becomes troublesome.
[0005]
Further, in order to restrict access, a wireless tag, a key device connectable to a USB connection or a connector, a non-contact type IC card storing an ID, and the like are used. That is, only a person who possesses these special hardware can use the device. However, there is a problem that it is necessary to carry special hardware so as not to lose it.
[0006]
Therefore, an object of the present invention is to provide an access control system and an access control system capable of solving these problems by permitting only those who are at the place to use resources without requiring special hardware. A method, a terminal device, and a network device are provided.
[0007]
[Means for Solving the Problems]
In order to solve the above-mentioned problem, the invention according to claim 1 provides a system for controlling access to a device connected to a network,
A keyword presenting device that is provided integrally with or separately from the device, and that presents a keyword that changes every time or every use to only a user who is near the device;
A terminal device to which a keyword is input and which sends a service request including the input keyword to the device;
The service request is received only if the keyword included in the service request is the same as the current keyword or any number of keywords before the current keyword. An access control system comprising a control device for performing processing.
[0008]
The invention according to claim 6 is a method for controlling access to a device connected to a network,
A keyword presenting step of presenting a keyword that changes every time or every use to only a user who is near the device;
Inputting a keyword, and sending a service request including the input keyword to the device;
Accepting a service request and causing the device to process the service request only when the keyword included in the service request matches the current keyword or any number of keywords before the current keyword. It is a control method.
[0009]
The invention according to claim 7 is a terminal device for sending a service request to a device connected to a network,
A keyword that can be known only when you are in the vicinity of the device to be used and that changes every hour or every use is input,
The terminal device sends a service request including an input keyword to the device.
[0010]
The invention according to claim 8 is a device connected to a network,
A keyword presenting device that presents a keyword that changes every time or every use,
The network device includes a control device that accepts only a service request including a current keyword or a keyword that matches an arbitrary number of keywords before the current keyword, and processes the received service request.
[0011]
According to the present invention, the use permission of the device can be given only to a person near the device to be used, and the use from a place where the keyword is not known can be restricted. Of course, there is an advantage that no special hardware is required. Further, according to the present invention, since the keyword changes every time or every use, the use of the device can be restricted even for the user who has used it once. Also, even if the keyword is stolen, there is no damage or very little damage can be suppressed.
[0012]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, an embodiment of the present invention will be described. The present invention is applied to the use of resources (hereinafter, referred to as devices) connected to a network. This device has a display device that can be viewed by a nearby user. The device provides services to the user over the network by web, email, or a proprietary network protocol. The device displays a keyword composed of characters (text) that can be viewed by the user on the display device and that can be input from the terminal. The keyword changes every predetermined time, for example, every 10 minutes, or changes every time it is used.
[0013]
An example of the device is a printer. In FIG. 1, reference numeral 1 indicates a part of an upper panel of the printer, and reference numeral 2 indicates a display device provided on the upper panel of the printer 1. The display device 2 displays the status of the printer, and a keyword such as "abcdefg" is displayed, so that a person near the printer can read the keyword. Preferably, the keyword is displayed when any trigger or request is issued, such as a user pressing a button, issuing a request to a printer via a network, or the like. Although the keyword is displayed on the display device 2 of the printer 1 itself, the keyword may be displayed on a display device at a position distant from the printer 1, for example, a display of a personal computer connected to the printer 1.
[0014]
The devices connected to the network may be devices other than the printer. For example, in FIG. 2A, the present invention can be applied to a case where an electronic bulletin board indicated by reference numeral 100 is used. The electronic bulletin board 100 includes a projector and a screen or a white wall on which the image of the projector is projected. A personal computer is connected to the projector, and the personal computer is connected to a network.
[0015]
A character string signal of a photo and a message posted from a terminal via a network is input from the personal computer to the projector, and posted images 101 ₁ , 101 ₂ , 101 ₃ ,... You. In FIG. 2A, the message is omitted. A user can create a posted image using a terminal such as a camera-equipped mobile phone or an electronic camera. The electronic bulletin board 100 displays a predetermined number of posted images 101 ₁ , 101 ₂ , 101 ₃ ,... In chronological order from the latest posted time.
[0016]
For example illustrating the post image 101 ₁ in the upper left of the screen in the enlarged view of Figure 2B. Post image 101 ₁ is to and the message 103 displayed 102 posts of date time is superimposed on a photograph. Further, an address and keyword display area 104 is set in an empty space of the electronic bulletin board 100. As shown in FIG. 2C, an address 104a indicating a posting destination and a keyword 104b are displayed in the display area 104. The projector alone can be used as a device.
[0017]
FIG. 3 shows an example of a system according to the present invention, in which a printer 1 having a display device 2 is connected to a LAN 3 and the printer 1 is used by a terminal 4 connected to the same LAN 3. In the following description, an example in which a printer is used as a device, but the above-described electronic bulletin board or projector can be used instead of a printer. When the user 5 uses the printer 1 by the terminal 4, the user 5 looks at the keyword displayed on the display device 2 as indicated by a broken line L1. Next, as shown by a broken line L2, a keyword is input to the terminal 4.
[0018]
A service request and a keyword are sent from the terminal 4 to the printer 1 via the LAN 3 as shown by a broken line L3. The service request includes data as a service target. The LAN 3 is a wired or wireless LAN. The printer 1 accepts only a service request to which a keyword matching the issued current keyword is attached. Then, the printer 1 executes the requested service.
[0019]
FIG. 4 shows another example of the system according to the present invention, in which the server 6 and its display device 7 are connected to the LAN 3 together with the printer 1 and the terminal 4. The printer 1 may be directly connected to the server 6 via a parallel cable or the like instead of over a network. The keyword is displayed on the display device 7, and the user 5 reads the keyword as indicated by a broken line L1. Next, as shown by the broken line L2, the user 5 inputs a keyword to the terminal 4.
[0020]
A service request and a keyword are sent from the terminal 4 to the server 6 via the LAN 3 (dashed line L3). When the server 6 determines that the keyword matches the current keyword, the server 6 sends a command and data for instructing the printer 1 to perform a service process (broken line L4). Then, the printer 1 executes the service. For example, the printer 1 prints data from the terminal 4.
[0021]
An example of the system shown in FIG. 3 has a configuration in which a device that displays and authenticates a keyword and a device that actually provides a service are common devices (printer 1). Another example of the system shown in FIG. 4 has a configuration in which a device (server 6) for displaying and authenticating a keyword and a device (printer 1) for actually providing a service are different devices. In the present invention, any configuration is possible.
[0022]
FIG. 5 shows an example in which the printer 1 is used via a terminal outside the LAN 3 to which the printer 1 is connected. As shown by the broken line L1, the user 5 looks at the keyword displayed on the display device 2 and inputs the keyword on the portable terminal 4 owned by the user 5 (broken line L2). The terminal 4 is connected to the mobile phone network 8, and the service request and the keyword are transmitted from the terminal 4 to the mobile phone network 8 as indicated by a broken line path L5. Further, as shown by broken lines L6 and L7, a service request and a keyword are transmitted to the printer 1 on the LAN 3 via the Internet 9. The printer 1 accepts only a service request to which a keyword matching the current keyword is attached. Then, the requested service is processed.
[0023]
FIG. 6 shows an example of a data format of a service request to which a keyword is attached. Reference numeral 11 is an example of an HTTP (Hyper Text Transfer Protocol) service request that the browser actually sends to the web server. In FIG. 6, "POST" is a command to be sent to the web server. The part of “http://foo.bar/someservice” is a URL (Uniform Resource Locator). A keyword is included as an argument of the URL part. In the example of FIG. 5, it is assumed that the current keyword is “abcdefg”. It is a part of the command of "HTTP / 1.0" protocol. “Content-Length: 32768” indicates the data length. Although omitted, the data of the main unit follows. Note that a keyword may be included as a part of the data of the main body.
[0024]
In FIG. 7, reference numeral 12 indicates an example of a service request in the case of an electronic mail. The mail header includes a sender, subject, address (From...), A format for sending data (Mime-Version: 1.0), and a header (Content-Encoding: base64) for designating the data format later. . The current keyword "abcdefg" is written as the subject. A keyword may be included in the content of the header or in a part of the body. A file to be printed by the printer is attached to the e-mail.
[0025]
Although not shown, a keyword may be passed to the device as part of authentication for logging in to the network.
[0026]
With reference to FIG. 8, processing of a device (a printer, an electronic bulletin board, etc.) according to an embodiment of the present invention will be described. Step S1 is a process of generating and displaying a new keyword. The keyword is changed at predetermined time intervals. This is to prevent the keyword from being stored and being usable even when not near the device.
[0027]
In the next step S2, the presence or absence of a request is checked. The request is a request for printing when the device is a printer, and is a request for permission of posting when the device is an electronic bulletin board. If it is determined that there is no request, the process proceeds to step S3.
[0028]
In step S3, it is checked whether a predetermined time has elapsed since the current keyword was generated. If it is determined that the predetermined time has not elapsed, the presence or absence of a request is checked in step S2. If it is determined that the predetermined time has elapsed, the process returns to step S1 for generating a new keyword. A new keyword is generated, and the determination in step S2 is made.
[0029]
If it is determined in step S2 that there is a request, it is determined in step S4 whether the keyword attached to the request matches the current keyword. If the attached keyword matches the current keyword, the request is processed in step S5, and the process of step S3 (whether a certain period of time has elapsed since the generation of the current keyword?) Is performed. For example, a printer executes printing. Posting is permitted, and the posted image is posted on the electronic bulletin board.
[0030]
On the other hand, if it is determined that the attached keyword does not match the current keyword, the request is rejected in step S6, and the process in step S3 is performed. By rejecting the request, the service request is deleted. In this case, a response to the effect that the keywords are different may be transmitted to the requesting user by e-mail.
[0031]
As described above, when the keyword changes every predetermined time, the keyword changes immediately after the user sends the service request to which the keyword is attached, and when the printer or the server performs authentication, the keyword changes. It may be determined that they do not match. In order to avoid this risk, a service request that matches one or an arbitrary number of previously generated keywords other than the one that matches the current keyword may be accepted.
[0032]
The present invention is not limited to the above-described embodiment of the present invention, and various modifications and applications are possible without departing from the gist of the present invention. For example, a pre-registered user may use the device without a keyword, and only an unregistered user may need a keyword. Further, when the user presses a button or the like to request a keyword, the device can be used only once within a long validity period of the keyword, for example, one day. The right of use may be obtained.
[0033]
Although the user reads the keyword and inputs the keyword to the terminal, the terminal itself may recognize the keyword using a camera or the like provided in the terminal. In this case, a keyword encoded in a symbol mark other than a character, a bar code, or the like is displayed to facilitate recognition. Further, the keyword is not limited to a keyword to be displayed, but may be a keyword transmitted to the user by voice.
[0034]
【The invention's effect】
According to the present invention, the use permission of the device can be given only to a person near the device to be used, and the use from a place where the keyword is not known can be restricted. Therefore, even if the device itself can be accessed from outside the LAN, illegal use by a malicious user can be avoided. Of course, there is an advantage that no special hardware is required.
[0035]
Further, according to the present invention, since the keyword changes every time or every use, the use of the device can be restricted even for the user who has used it once. Also, even if the keyword is stolen, there is no damage or very little damage can be suppressed. As described above, according to the present invention, provision of a service using the web or mail can be easily and safely constructed.
[Brief description of the drawings]
FIG. 1 is a schematic diagram illustrating an example of a device connected to a network to which the present invention can be applied.
FIG. 2 is a schematic diagram for explaining another example of a device connected to a network to which the present invention can be applied.
FIG. 3 is a block diagram showing a first example of a system configuration according to the present invention.
FIG. 4 is a block diagram showing a second example of the system configuration according to the present invention.
FIG. 5 is a block diagram showing a third example of the system configuration according to the present invention.
FIG. 6 is a schematic diagram illustrating an example of a service request to which a keyword is attached according to the present invention.
FIG. 7 is a schematic diagram for explaining another example of a service request to which a keyword is attached according to the present invention.
FIG. 8 is a flowchart showing a flow of processing of a device according to the present invention.
[Explanation of symbols]
1 ... printer, 2 ... display, 3 ... LAN, 4 ... terminal, 5 ... user, 100 ... electronic bulletin _board, 101 _1, 101 2, ₁₀₁ 3, ... Post image, 104 ... address and keyword display area

Claims (8)

In a system that controls access to devices connected to a network,
A keyword presenting device that is provided integrally with or separately from the device and that presents a keyword that changes with time or with use only to a user who is near the device;
A terminal device in which the keyword is input and a service request including the input keyword is sent to the device;
Provided integrally or separately with the device, accepts the service request only when the keyword included in the service request matches the current keyword or an arbitrary number of keywords before the current keyword, and accepts the service request. An access control system comprising a control device for performing the service request processing. In claim 1,
An access control system in which the keyword presentation device is attached to the device. In claim 1,
An access control system in which the keyword presentation device is separate from the device. In claim 1,
An access control system in which the terminal device is connected to the same LAN as the control device. In claim 1,
An access control system in which the terminal device is outside the LAN to which the control device is connected, and sends the service request to the control device via the Internet. In a method for controlling access to a device connected to a network,
A keyword presenting step of presenting a keyword that changes every time or every use to only a user who is near the device;
Inputting the keyword, and sending a service request including the input keyword to the device;
Only when the keyword included in the service request matches the current keyword or an arbitrary number of keywords before the current keyword, accepts the service request and causes the device to process the service request. An access control method comprising steps. In a terminal device for sending a service request to a device connected to a network,
A keyword that can be known only when you are in the vicinity of the device to be used and that changes every hour or every use is input,
A terminal device that sends a service request including the input keyword to the device. For devices connected to the network,
A keyword presenting device that presents a keyword that changes every time or every use,
A network device comprising: a control device that receives only a service request including a current keyword or a keyword that matches an arbitrary number of keywords before the current keyword, and processes the received service request.

Images