JP2004133907A - Image forming apparatus, use authentication information issue method and use authentication information issue system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an image forming apparatus, a use authentication information issue method and a use authentication information issue system, capable of reducing an unnecessary authentication process, and strengthening network security. <P>SOLUTION: When this image forming apparatus 1 receives an authentication request from network equipment 501, the image forming apparatus 1 generates use authentication information and use authentication identification information to a prescribed process according to an authentication process result, and transmits the use authentication identification information to the network equipment 501. When receiving a session establishment request including the use authentication identification information from network equipment 1b, the image forming apparatus 1 decides the use authentication information corresponding to the use authentication identification information, stores the use authentication information into session information of a session established to the network equipment 1b, and transmits session identification information identifying the session to the network equipment 1b. <P>COPYRIGHT: (C)2004,JPO

Description

The present invention relates to an image forming apparatus, a usage authentication information issuing method, and a usage authentication information issuing system, and more particularly to an image forming apparatus that executes processing in response to a request from an external network device, a usage authentication information issuing method, and usage authentication information. Issuing system.

In recent years, an image forming apparatus (hereinafter, referred to as a multifunction machine) in which functions of respective apparatuses such as a printer, a copier, a facsimile, and a scanner are housed in one housing has been known. This multifunction machine includes a display unit, a printing unit, an imaging unit, and the like in one housing, and four types of software corresponding to a printer, a copier, a facsimile, and a scanner, respectively. It operates as a copy, facsimile and scanner.

融合 Such a multifunction machine is connected to a network device via a network, for example, and executes a predetermined process according to an instruction from the network device. For example, a multifunction peripheral storing a document file as a stored document in a document management database (hereinafter, referred to as a document management DB) outputs the stored document stored in the document management DB according to an instruction from a network device. The multifunction peripheral uses an output function (such as a print function) to output a stored document stored in the document management DB. In order to cope with security issues, the multifunction peripheral often sets a password for each user who uses stored documents stored in the document management DB and services provided to network devices.

For example, when using a service provided by the multifunction peripheral, the network device transmits to the multifunction peripheral a user ID of a user who uses a desired service and a password proving the right to use the service. After performing password authentication, the MFP provided the service to the network device.

When outputting a stored document stored in the document management DB of the multifunction peripheral, the network device transmits to the multifunction peripheral a document ID for identifying the desired stored document and a password proving the right to use the stored document. I do. After performing the password authentication, the multifunction peripheral reads the stored document corresponding to the document ID from the document management DB, and outputs the stored document. Patent Literature 1 describes an example of the above-described fusion machine.
JP-A-2002-84383

For example, if password authentication is required for each user who uses the service provided by the multifunction device, the same authentication process must be repeated when the same service is used repeatedly. There was a problem of duplication.

Further, when a password is set for each stored document stored in the document management DB of the multifunction peripheral, the same authentication process must be repeatedly performed when the same stored document is repeatedly output. There was a problem that overlap.

Furthermore, since highly confidential information such as a user ID, a document ID, a password, and use authentication information is transmitted and received between the multifunction peripheral and the network device via the network, there is a problem that network security must be strengthened. there were.

The present invention has been made in view of the above points, and provides an image forming apparatus, a usage authentication information issuing method, and a usage authentication information issuing system capable of reducing unnecessary authentication processing and enhancing network security. The purpose is to provide.

Therefore, in order to solve the above problem, the present invention is an image forming apparatus having hardware resources used in image forming processing and a program for performing processing relating to image formation, wherein a predetermined When receiving the authentication request for the processing of, the authentication processing is performed based on the authentication request, use authentication information for the predetermined processing and use authentication identification information for identifying the use authentication information are generated according to the authentication processing result, While transmitting the usage authentication identification information to the first network device, when receiving a session establishment request including the usage authentication identification information from the second network device, the usage authentication information corresponding to the usage authentication identification information is determined. And a session of a session established with the second network device based on the session establishment request. Storing the usage authentication information broadcast, and transmits the session identification information for identifying the session to the second network device.

According to another aspect of the present invention, there is provided an image forming apparatus including hardware resources used in an image forming process, a program for performing a process related to image forming, and a document storage unit for storing a stored document. When an authentication request for the stored document is received from the device, an authentication process is performed based on the authentication request, and use authentication information for the stored document and use authentication identification information for identifying the use authentication information are generated according to the authentication processing result. And transmitting the usage authentication identification information to the first network device, and receiving a session establishment request including the usage authentication identification information from the second network device, the usage authentication information corresponding to the usage authentication identification information. And determines the security of the session established with the second network device based on the session establishment request. Deployment and stores the usage authentication information to the information, and transmits the session identification information for identifying the session to the second network device.

The present invention is also a method for issuing usage authentication information of an image forming apparatus having hardware resources used in an image forming process and a program for performing a process related to image forming, wherein the method includes the steps of: Upon receiving an authentication request for the process, the device performs an authentication process based on the authentication request, generates use authentication information for the predetermined process and use authentication identification information for identifying the use authentication information in accordance with the authentication process result, Transmitting usage authentication identification information to the first network device; and receiving a session establishment request including the usage authentication identification information from a second network device, determining usage authentication information corresponding to the usage authentication identification information. The session information of the session established with the second network device based on the session establishment request. The store usage authentication information, and having a step of transmitting a session identification information for identifying the session to the second network equipment.

Further, the present invention is a method for issuing usage authentication information of an image forming apparatus having hardware resources used in image forming processing, a program for performing processing relating to image formation, and document storage means for storing stored documents. Receiving an authentication request for the stored document from the first network device, performs authentication processing based on the authentication request, and identifies use authentication information for the stored document and use authentication information based on the authentication processing result. Generating usage authentication identification information and transmitting the usage authentication identification information to the first network device; and receiving a session establishment request including the usage authentication identification information from a second network device; Determining the use authentication information corresponding to the information, and communicating with the second network device based on the session establishment request. The use stores authentication information in the session information of the standing session, and having a step of transmitting a session identification information for identifying the session to the second network device.

The present invention also provides use authentication information for issuing use authentication information for a predetermined process using one or more external network devices and an image forming apparatus connected to the external network device via a network. An issuance system, wherein the image forming apparatus, upon receiving an authentication request for a predetermined process from a first network device, performs an authentication process based on the authentication request, and performs an authentication process based on the authentication process result. A session including the use authentication information and the use authentication identification information for identifying the use authentication information, transmitting the use authentication identification information to the first network device, and generating a session including the use authentication identification information from the second network device. Upon receiving the establishment request, the usage authentication information corresponding to the usage authentication identification information is determined, and the session establishment request is determined. Storing the use authentication information in session information of a session established with the second network device based on the authentication information, and transmitting session identification information for identifying the session to the second network device. And

The present invention also provides use authentication information for issuing use authentication information for a predetermined process using one or more external network devices and an image forming apparatus connected to the external network device via a network. An issuance system, wherein the image forming apparatus receives an authentication request for the stored document from a first network device, performs an authentication process based on the authentication request, and uses the stored document according to the authentication processing result. Generating authentication information and use authentication identification information for identifying the use authentication information, transmitting the use authentication identification information to the first network device, and establishing a session including the use authentication identification information from the second network device. Upon receiving the request, the usage authentication information corresponding to the usage authentication identification information is determined, and the session establishment request is determined. Storing the use authentication information in session information of a session established with the second network device based on the authentication information, and transmitting session identification information for identifying the session to the second network device. And

According to the present invention, use authentication information for a predetermined process and use authentication identification information for identifying the use authentication information are generated, and when the external network device makes a session establishment request, the use authentication information is transmitted. By using the usage authentication information corresponding to the usage authentication identification information, it is possible to reduce useless authentication processing and enhance network security, an image forming apparatus that issues usage authentication information, and issuance of usage authentication information. We can provide the system.

As described above, according to the present invention, it is possible to provide an image forming apparatus, a usage authentication information issuing method, and a usage authentication information issuing system that can reduce useless authentication processing and enhance network security.

Next, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a configuration diagram of an embodiment of the multifunction peripheral according to the present invention. The multifunction device 1 is configured to include a software group 2, a multifunction device activation unit 3, and hardware resources 4.

The multifunction device starting unit 3 is first executed when the power of the multifunction device 1 is turned on, and starts the application layer 5 and the platform 6. For example, the multifunction peripheral starting unit 3 reads the programs of the application layer 5 and the platform 6 from a hard disk device (hereinafter referred to as HDD) or the like, and transfers each read program to a memory area to start.

The hardware resources 4 include a plotter 11, a scanner 12, and other hardware resources 13 such as a facsimile. The software group 2 includes an application layer 5 and a platform 6 running on an operating system (hereinafter referred to as OS) such as UNIX (registered trademark). The application layer 5 includes programs for performing processes specific to user services related to image formation such as a printer, a copy, a facsimile, and a scanner.

The application layer 5 includes a printer application 21 which is a printer application, a copy application 22 which is a copy application, a fax application 23 which is a fax application, a scanner application 24 which is a scanner application, and a web page application. A web application 25, a SOAP communication application 26 as a simple object access protocol (hereinafter, referred to as SOAP) communication application, and one or more shared functions (hereinafter, referred to as SF) 28. 7 and a wrapping layer 8 comprising a WEB service function (hereinafter referred to as WSF) 27 provided between the WEB page application 25 and the SOAP communication application 26 and the SF 28 Including the.

The WSF 27 has an application program interface (hereinafter, referred to as an API) 51 that can receive a processing request from the web page application 25 or the SOAP communication application 26 by using a function defined in advance. The SF 28 has an API 52 that can receive a processing request from the WSF 27 by a function defined in advance.

When the WSF 27 receives a processing request from the web page application 25 or the SOAP communication application 26 via the API 51, the WSF 27 selects the SF 28 according to the processing request. The WSF 27 transmits the processing request received via the API 51 to the SF 28 selected according to the processing request via the API 52. When the SF 28 receives a processing request via the API 52, the SF 28 performs processing according to the processing request. For example, the MFP 1 of FIG. 1 includes two SFs 28, and one of the SFs 28 performs a network service process described later.

Further, the platform 6 interprets the processing request from the application layer 5 and generates a request for acquiring the hardware resource 4, and manages one or more hardware resources 4 to control the control service layer 9. And a handler layer 10 for managing the hardware resources 4 in response to the acquisition request from the SRM 39. In addition, the platform 6 is configured to have an API 53 that can receive a processing request from the application layer 5 by a function defined in advance. The OS executes each software of the application layer 5 and the platform 6 as a process in parallel.

The control service layer 9 includes a network control service (hereinafter, referred to as NCS) 31, a delivery control service (hereinafter, referred to as DCS) 32, an operation panel control service (hereinafter, referred to as OCS) 33, and a fax control service (hereinafter, referred to as FCS) 34. , An engine control service (hereinafter referred to as ECS) 35, a memory control service (hereinafter referred to as MCS) 36, a user information control service (hereinafter referred to as UCS) 37, a system control service (hereinafter referred to as SCS) 38, and the like. It is configured to include a service module.

The process of the NCS 31 provides a service that can be used in common to applications that require network I / O, and distributes data received from the network by each protocol to each application, or distributes data from each application. Mediation when sending to the network side.

For example, the NCS 31 performs data communication with a network device connected via a network via httpd (HyperText Transfer).
Protocol Daemon) is controlled by HTTP (HyperText Transfer Protocol).

The DCS 32 process controls the delivery of stored documents. The process of the OCS 33 controls an operation panel serving as information transmission means between the operator and the main body control. The FCS 34 process provides an API from the application layer 5 for performing facsimile transmission / reception using the PSTN or ISDN network, registration / quotation of various facsimile data managed in a backup memory, facsimile reading, facsimile reception printing, and the like. I do.

The process of the ECS 35 controls engine units such as the plotter 11, the scanner 12, and the hardware resources 13. The process of the MCS 36 performs memory control such as acquisition and release of a memory, use of an HDD, and compression and decompression of image data. The process of the UCS 37 manages user information. The process of the SCS 38 performs processes such as application management, operation unit control, system screen display, LED display, hardware resource management, and interrupt application control.

The process of the SRM 39 controls the system and manages the hardware resources 4 together with the SCS 38. For example, the process of the SRM 39 performs arbitration in accordance with an acquisition request from an upper layer using the hardware resources 4 such as the plotter 11 and the scanner 12, and controls execution.

Specifically, the process of the SRM 39 determines whether the requested hardware resource 4 is available (whether the hardware resource 4 is not used by another acquisition request). The upper layer is notified that the resource 4 is available. The process of the SRM 39 performs scheduling for using the hardware resource 4 in response to an acquisition request from the upper layer, and the content of the request (for example, paper conveyance and image forming operation by the printer engine, memory reservation, file generation, etc.). Is implemented directly.

The handler layer 10 also includes a fax control unit handler (hereinafter, referred to as FCUH) 40 that manages a fax control unit (hereinafter, referred to as FCU) described below, and an image that manages the memory allocated to the process and the memory allocated to the process. A memory handler (hereinafter referred to as IMH) 41. The SRM 39, the FCUH 40, and the like make a processing request to the hardware resource 4 using the engine I / F 54 that transmits a processing request to the hardware resource 4 by a function defined in advance.

With the configuration of FIG. 1, the multifunction peripheral 1 can unify processing required in common by each application on the platform 6. Next, the hardware configuration of the MFP 1 will be described.

FIG. 2 is a hardware configuration diagram of an embodiment of the multifunction peripheral according to the present invention. The MFP 1 includes a controller 60, an operation panel 80, an FCU 81, and an engine unit 82. The controller 60 includes a CPU 61, a system memory 62, a north bridge (NB) 63, a south bridge (SB) 64, an ASIC 66, a local memory 67, an HDD 68, a network interface card (NIC) 69, a USB device 70, an IEEE 1394 device 71, and a Centronics 72. Having. The operation panel 80 is connected to the ASIC 66 of the controller 60. Further, the FCU 81 and the engine unit 82 are connected to the ASIC 66 of the controller 60 via a PCI bus 83.

In the controller 60, the local memory 67, the HDD 68, and the like are connected to the ASIC 66, and the CPU 61 and the ASIC 66 are connected via the NB 63 of the CPU chipset. The controller 60 connects the CPU 61 and the ASIC 66 via the NB 63 to cope with a case where the interface of the CPU 61 is not disclosed.

Note that the ASIC 66 and the NB 63 are connected to an AGP (Accelerated
Graphics Port) 65. As described above, in order to control the execution of one or more processes forming the application 5 and the platform 6 of FIG. I'm preventing.

The CPU 61 performs overall control of the MFP 1. The CPU 61 activates the NCS 31, the DCS 32, the OCS 33, the FCS 34, the ECS 35, the MCS 36, the UCS 37, and the SCS 38 on the OS and executes them, and the printer application 21, the copy application 22, the fax application 23, the scanner application 24 Activate and execute the web page application 25, WSF27, SF28.

The NB 63 is a bridge for connecting the CPU 61, the system memory 62, the SB 64, the ASIC 66, the NIC 69, the USB device 70, the IEEE 1394 device 71, and the Centronics 72. The SB 64, the NIC 69, the USB device 70, the IEEE 1394 device 711, and the Centronics 72 are connected to the NB 63 via the PCI bus 73. The SB 64 is a bridge for connecting the PCI bus 73 to a ROM, peripheral devices, and the like.

The system memory 62 is a memory used as a drawing memory of the multifunction peripheral 1. The local memory 67 is a memory used as a copy image buffer and a code buffer. The ASIC 66 is an IC for image processing having hardware components for image processing. The HDD 68 is an example of a storage (auxiliary storage device) that stores image data, document data, programs, font data, forms, and the like.

The NIC 69 is an interface device for connecting the multifunction device 1 to a network. The USB device 70, the IEEE 1394 device 71, and the Centronics 72 are interfaces conforming to respective standards. The operation panel 80 is an operation unit that receives an input operation from the operator and performs display for the operator.

The FCU 81 has a backup memory. The memory of the FCU 81 is used, for example, to temporarily store facsimile data received when the power of the MFP 1 is OFF.

Hereinafter, a method of issuing usage authentication information realized by the multifunction peripheral 1 will be sequentially described with reference to the drawings. FIG. 3 is a functional configuration diagram of the multifunction peripheral for explaining the usage authentication information issuing method according to the first embodiment of the present invention. Note that the functional configuration diagram of FIG. 3 omits functional configurations that are not necessary for description.

In FIG. 3, network devices 301a and 301b are connected to the multifunction device 1 via a network 306 such as the Internet or a LAN. The MFP 1 provides various services to the network devices 301a and 301b. For example, when using the service provided by the MFP 1, the network devices 301a and 301b receive a session ID as service authentication information from the MFP 1 as described later, and provide the service using the usage authentication information. Receive.

The network devices 301a and 301b and the multifunction device 1 are, for example, XML (extensible Markup).
Language) format. The network devices 301a and 301b and the multifunction device 1 use a communication protocol standard called SOAP (Simple Object Access Protocol) as a data access protocol, for example.

If the network device 301a uses the service provided by the multifunction device 1, the network device 301a proceeds to step S10. In step S10, the network device 301a issues a session establishment request between the network device 301a and the network service 303 to the network service 303 of the MFP 1 via the network 306 and the httpd 302 of the NCS 31. The session establishment request includes authentication information necessary for causing the network service 303 to issue use authentication information for a predetermined service. In step S10, the network device 301a can also specify the expiration date of the session.

Step S11 is followed by step S11, where the network service 303 establishes a session between the network device 301a and the network service 303, and performs authentication using the authentication information included in the session establishment request. If the authentication is successfully completed, the network service 303 generates session information as shown in FIG. If the authentication is not completed normally, the network service 303 does not generate the session information. If the authentication is not completed normally, the network service 303 may release the session established with the network device 301a.

FIG. 4 is a configuration diagram of an example of the session information. The session information in FIG. 4 includes a session ID, the IP address of the network device that has transmitted the request, the IP address of the MFP that has received the request, and the expiration date.

"Session ID" is an identifier for identifying session information. The “IP address of the network device that has transmitted the request” is the IP address of the transmission side of the session establishment request. For example, in the case of FIG. 3, the “IP address of the network device that transmitted the request” is the IP address of the network devices 301a and 301b that transmitted the session establishment request to the MFP 1. The “IP address of the MFP that has received the request” is the IP address of the receiving side of the session establishment request. For example, in the case of FIG. 3, the “IP address of the MFP that has received the request” is the IP address of the MFP 1 that has received the session establishment request from the network devices 301a and 301b.

“Expiration date” is the expiration date of the session information. The “expiration date” may be updated each time the session ID is used, as described later. By updating the expiration date every time the session ID is used, the expiration date of the session information used before the expiration date elapses can be extended.

Then, the network service 303 transmits the session ID 305 to the network device 301a via the httpd 302 of the NCS 31 and the network 306 as a response to the session establishment request in step S11.

Upon receiving the session ID 305 from the network service 303, the network device 301a proceeds to step S12, makes a desired processing request to the network service 303 of the MFP 1 via the network 306 and the httpd 302 of the NCS 31, and transmits the session ID 305.

(4) Upon receiving the session ID 305 together with the processing request from the network device 301a, the network service 303 searches the session information DB 304 for session information corresponding to the received session ID 305. If the session information corresponding to the session ID 305 is stored in the session information DB 304, the network service 303 determines that a session has been established between the network device 301a and the network service 303.

Next, the network service 303 acquires the “IP address of the network device that sent the request” from the session information, and determines in step S12 whether the IP address is the same as the IP address of the network device 301a that has made the processing request. If it is determined that the “IP address of the network device that has transmitted the request” acquired from the session information is the same as the IP address of the network device 301a that has made the processing request in step S12, the network service 303 determines that the network device 301a has Execute the requested processing.

In step S13, the network service 303 transmits the processing result and the session ID 305 to the network device 301a via the httpd 302 of the NCS 31 and the network 306.

If the session information corresponding to the session ID 305 is not stored in the session information DB 304, the network service 303 considers that a session has not been established between the network device 301a and the network service 303, and the network device 301a performs the session. Do not execute the processing request. If it is determined that the “IP address of the network device that has transmitted the request” acquired from the session information is not the same as the IP address of the network device 301a that has made the processing request in step S12, the network service 303 determines that the network device 301a Does not execute the processing request made by.

As described above, the session information functions as use authentication information for proving use authority of the service provided by the network service 303. By causing the session information to function as the use authentication information, the following effects are produced.

For example, the other network device 301b refers to the session ID 305 obtained by the network device 301a by some method, makes a desired processing request to the network service 303 of the multifunction device 1 as in step S12 ', and transmits the session ID 305. The case will be described.

(4) Upon receiving the session ID 305 together with the processing request from the network device 301b, the network service 303 searches the session information DB 304 for session information corresponding to the received session ID 305. In this case, since the session information corresponding to the session ID 305 is stored in the session information DB 304, the network service 303 considers that a session has been established between the network device 301b and the network service 303.

Next, the network service 303 acquires the “IP address of the network device that sent the request” from the session information, and determines in step S12 ′ whether the IP address is the same as the IP address of the network device 301b that made the processing request.

In this case, it is determined that the “IP address of the network device that has transmitted the request” acquired from the session information is not the same as the IP address of the network device 301b that has made the processing request in step S12. The processing request made by the device 301b can be rejected. Since the session information has an expiration date, the session information whose expiration date has passed is deleted. As described above, the usage authentication information issuing method according to the present invention further enhances network security.

FIG. 5 is a functional configuration diagram of a multifunction peripheral for explaining a usage authentication information issuing method according to the second embodiment of the present invention. It should be noted that the functional configuration diagram of FIG. 5 omits functional configurations that are not necessary for description. FIG. 5 illustrates a service provided by the document management service to the network device 401 as an example of a service provided by the MFP 1.

In FIG. 5, a network device 401 is connected to the MFP 1 via a network (not shown) such as the Internet or a LAN. The multifunction device 1 provides the network device 401 with various services related to stored documents. For example, when using the service provided by the multifunction device 1, the network device 401 receives a session ID as use authentication information for the service from the multifunction device 1 as described later, and receives the service using the use authentication information. . Further, the network device 401 exchanges data with the multifunction device 1 in the XML format in the same manner as the network devices 301a and 301b described above, and uses SOAP as a communication protocol standard.

If the network device 401 uses the service provided by the multifunction device 1, the network device 401 proceeds to step S20. In step S20, the network device 401 requests the document management service 403 of the MFP 1 via the network and the httpd 402 of the NCS 31 to establish a session between the network device 401 and the document management service 403. This session establishment request includes authentication information necessary for causing the document management service 403 to issue use authentication information for the service provided by the document management service 403. In step S20, the network device 401 can also specify the expiration date of the session.

Step S20 is followed by step S21, where the document management service 403 establishes a session between the network device 401 and the document management service 403, and performs authentication using the authentication information included in the session establishment request. If the authentication ends normally, the document management service 403 generates session information as shown in FIG. 6 and stores it in the session information DB 404. If the authentication is not completed normally, the document management service 403 does not generate the session information. If the authentication is not completed normally, the document management service 403 may release the session established with the network device 401.

FIG. 6 is a configuration diagram of another example of the session information. The session information in FIG. 6 includes a session ID, the IP address of the network device that has transmitted the request, the IP address of the MFP that has received the request, the expiration date, and an array of password-authenticated document IDs.

The “session ID”, the “IP address of the network device that has transmitted the request”, the “IP address of the MFP that has received the request”, and the “expiration date” are the same as the session information in FIG. Is omitted. The “array of password-authenticated document IDs” stores the document IDs of the stored documents that have been password-authenticated.

Then, the document management service 403 transmits the session ID to the network device 401 via the httpd 402 of the NCS 31 and the network as a response to the session establishment request in step S20.

(4) Upon receiving the session ID from the document management service 403, the network device 401 displays a list of stored documents stored in the MFP 1. It is assumed that the network device 401 has obtained a list of stored documents stored in the MFP 1 and a document ID in advance. A user who operates the network device 401 selects a stored document to be obtained from a list of stored documents displayed on the screen, and inputs a password if a password is required to obtain the stored document.

In step S22, the network device 401 transmits the document ID, the password, and the session ID of the stored document selected by the user to the document management service 403 of the MFP 1 via the httpd 402 of the NCS 31, thereby authenticating the use of the stored document. Requests acquisition of a document ticket as information.

(4) Upon receiving the document ID, password, and session ID of the stored document from the network device 401, the document management service 403 searches the session information DB 404 for session information corresponding to the received session ID. If the session information corresponding to the session ID is stored in the session information DB 404, the document management service 403 determines that a session has been established between the network device 401 and the document management service 403.

Next, the document management service 403 acquires the “IP address of the network device that sent the request” from the session information corresponding to the session ID, and the same as the IP address of the network device 401 that has issued the document ticket acquisition request in step S22. Is determined. If it is determined that the “IP address of the network device that has transmitted the request” acquired from the session information is the same as the IP address of the network device 401 that has issued the document ticket acquisition request in step S22, the document management service 403 determines It determines that the session established with the network device 401 is valid, and updates the “expiration date” of the session information corresponding to the session ID.

If the session information corresponding to the session ID is not stored in the session information DB 404, the document management service 403 considers that a session has not been established between the network device 401 and the document management service 403, and the network device 401 Do not execute the obtained document ticket acquisition request.

If it is determined that the “IP address of the network device that sent the request” acquired from the session information is not the same as the IP address of the network device 401 that has issued the document ticket acquisition request in step S22, the document management service 403 Does not execute the document ticket acquisition request made by the network device 401.

If the document management service 403 determines that the session established with the network device 401 is valid, the document ID received from the network device 401 is already included in the “array of password-authenticated document IDs” in the session information. It is determined whether or not it has been performed. Here, the description is continued assuming that the document ID received from the network device 401 is not included in the “array of password-authenticated document IDs” in the session information.

In this case, the document management service 403 determines that the right to use the stored document corresponding to the document ID received from the network device 401 has not been approved, and proceeds to step S23. In step S23, the document management service 403 transmits the document ID and the password of the stored document received from the network device 401 to the MCS 36, and makes a password authentication request. The MCS 36 performs password authentication using the document ID and the password received from the document management service 403.

(5) After step S23, the process proceeds to step S24, where the MCS 36 transmits the result of the password authentication to the document management service 403. The result of the password authentication is transmitted from the MCS 36 to the document management service 403 as a response to the password authentication request. When the password authentication of the document ID ends normally, the document management service 403 adds the document ID received from the network device 401 in step S22 to the “array of password-authenticated document IDs” of the session information.

When the password authentication of the document ID is completed normally, the document management service 403 generates a document ticket as shown in FIG. FIG. 7 is an explanatory diagram for describing a document ticket.

FIG. 7A shows the structure of a document ticket. The document ticket stores the ticket ID and the data size of the document ticket. FIG. 7B shows document ticket information 405 for collating a document ticket. The document ticket information 405 is held by the document management service 403. The document ticket information 405 includes document ticket content information and document ticket management information. The document ticket content information in FIG. 7B has, as information, a ticket ID, an expiration date of the document ticket, the number of files, and an array of a structure in which a file ID as a document ID and a password are paired. The document ticket management information has a current ticket number and the number of issued tickets as information. Note that the document ticket and the document ticket information 405 are associated by a ticket ID.

In step S25, the document management service 403 transmits the generated document ticket to the network device 401 via the httpd 402 of the NCS 31 and the network. For example, when it is desired to obtain the document ID included in the document ticket, the network device 401 proceeds to step S26, and transmits the session ID received in step S21 and the document ticket received in step S25 to the MFP 1 via the httpd 402 of the NCS 31. Of the document ticket included in the document ticket by transmitting the document ID to the document management service 403.

When receiving the session ID and the document ticket from the network device 401, the document management service 403 searches the session information DB 404 for session information corresponding to the received session ID. If the session information corresponding to the session ID is stored in the session information DB 404, the document management service 403 determines that a session has been established between the network device 401 and the document management service 403.

Next, the document management service 403 acquires the “IP address of the network device that sent the request” from the session information corresponding to the session ID, and in step S26, has issued the acquisition request for the document ID included in the document ticket. Is determined to be the same as the IP address.

If it is determined that the “IP address of the network device that has transmitted the request” acquired from the session information is the same as the IP address of the network device 401 that has made the acquisition request of the document ID included in the document ticket in step S26, The document management service 403 determines that the session established with the network device 401 is valid. If the document management service 403 determines that the session established with the network device 401 is valid, the process advances to step S27 to transmit the document ID included in the document ticket to the network device 401 via the httpd 402 of the NCS 31 and the network. I do. When the document management service 403 determines that the session established with the network device 401 is valid, the document management service 403 updates the “expiration date” of the session information corresponding to the session ID.

If the session information corresponding to the session ID is not stored in the session information DB 404, the document management service 403 considers that a session has not been established between the network device 401 and the document management service 403, and the network device 401 The request for acquiring the document ID included in the issued document ticket is not executed. If it is determined that the “IP address of the network device that has transmitted the request” acquired from the session information is not the same as the IP address of the network device 401 that has issued the acquisition request of the document ID included in the document ticket in step S26. The document management service 403 does not execute the acquisition request of the document ID included in the document ticket made by the network device 401.

For example, when it is desired to acquire the properties of the stored document, the network device 401 proceeds to step S28, and stores the session ID received in step S21 and the document ID received in step S27 in the document management of the MFP 1 via the httpd 402 of the NCS 31. By sending the request to the service 403, a property acquisition request for the stored document is made. Upon receiving the session ID and the document ID from the network device 401, the document management service 403 determines the validity of the session established with the network device 401, as in step S26.

If the document management service 403 determines that the session established with the network device 401 is valid, the document ID received from the network device 401 is already included in the “array of password-authenticated document IDs” in the session information. It is determined whether or not it has been performed. Here, the description is continued on the assumption that the document ID received from the network device 401 is already included in the “array of password-authenticated document IDs” in the session information.

In this case, the document management service 403 determines that the right to use the stored document corresponding to the document ID received from the network device 401 has been approved, and proceeds to step S29. In step S29, the document management service 403 transmits the property of the stored document corresponding to the document ID to the network device 401 via the httpd 402 of the NCS 31 and the network.

For example, when a request to acquire a document ticket is desired again, the network device 401 proceeds to step S30, and stores the document ID of the stored document selected by the user, the session ID received from the document management service 403 in step S21, and the httpd 402 of the NCS 31. A document ticket acquisition request is made by sending the document ticket to the document management service 403 of the multifunction device 1 via the MFP.

(4) Upon receiving the session ID and the document ID from the network device 401, the document management service 403 determines the validity of the session established with the network device 401, as in step S26. If the document management service 403 determines that the session established with the network device 401 is valid, the document ID received from the network device 401 is already included in the “array of password-authenticated document IDs” in the session information. It is determined whether or not it has been performed. Here, the description is continued on the assumption that the document ID received from the network device 401 is already included in the “array of password-authenticated document IDs” in the session information.

In this case, the document management service 403 determines that the right to use the stored document corresponding to the document ID received from the network device 401 has been approved, and generates a document ticket as shown in FIG. Then, proceeding to step S31 following step S30, the document management service 403 transmits the generated document ticket to the network device 401 via the httpd 402 of the NCS 31 and the network.

As described above, by storing the document ID of the authenticated stored document in the “array of password-authenticated document IDs” of the session information, it becomes possible to issue a document ticket without performing password authentication.

(4) By storing the “array of authenticated document IDs” in the session information, the following effects are obtained. For example, for a processing request related to a stored document protected by a password, the password must be transmitted to the document management service 403 to perform password authentication. For this reason, when the processing request regarding the stored document protected by the password is repeatedly performed, the password authentication processing is duplicated.

Therefore, once the network device 401 performs password authentication on the stored document, the authenticated document ID is stored as the “array of authenticated document IDs” in the session information. The password authentication processing can be omitted when the processing request for the document is made next. As described above, in the usage authentication information issuing method according to the present invention, the overlapping password authentication processing is omitted, so that the processing speed can be increased.

FIG. 8 is a functional configuration diagram of a multifunction peripheral for describing a usage authentication information issuing method according to a third embodiment of the present invention. Note that the functional configuration diagram of FIG. 8 omits functional configurations that are not necessary for description. FIG. 8 illustrates a service provided by the document management service 503 to another MFP 1b and the network device 501 as an example of a service provided by the MFP 1a. Here, the other multifunction device 1b is an example of a network device.

In FIG. 8, the multifunction device 1b and the network device 501 are connected to the multifunction device 1a via a network (not shown) such as the Internet or a LAN. The MFP 1a provides various services related to the stored document to the MFP 1b and the network device 501. For example, when using the service provided by the multifunction peripheral 1a, the multifunction peripheral 1b and the network device 501 receive a session ID as use authentication information for the service from the multifunction peripheral 1a as described later, and use the use authentication information to perform a service. Receive the offer. Similarly to the network devices 301a and 301b, the multifunction device 1b and the network device 501 exchange data with the multifunction device 1a in the XML format and use SOAP as a communication protocol standard.

When the service provided by the multifunction peripheral 1a is used, the network device 501 proceeds to step S40. The processing in step S40 is the same as the processing in steps S20 to S22 in FIG. The processing in steps S41 to S43 is the same as the processing in steps S23 to S25 in FIG.

For example, when the print service 504 of the multifunction peripheral 1b prints the stored document of the document ID included in the document ticket, the network device 501 proceeds to step S44, and transmits the document ticket received in step S43 to the multifunction peripheral via the httpd 502b of the NCS 31b. By transmitting the document ID to the print service 504 of FIG. Although not shown, the process of step S44 includes a session establishment request and a response to the session establishment request as in steps S20 and S21.

Upon receiving the print request from the network device 501, the print service 504 proceeds to steps S45 and S46, and stores the stored document of the document ID included in the document ticket received in step S44 from the document management service 503 of the multifunction device 1a in FIG. To get so.

FIG. 9 is a sequence diagram of an example of a process for acquiring a stored document from the document management service using a document ticket. In step S100, the print service 504 transmits the document management service 503 of the multifunction peripheral 1a to the document management service 503 of the multifunction peripheral 1a via the httpd 502b of the NCS 31b, the network and the httpd 502a of the NCS 31a. Request for session establishment.

This session establishment request includes the document ticket received by the print service 504 in step S44. The document ticket is also used as authentication information necessary for causing the document management service 503 to issue use authentication information for the service provided by the document management service 503. In step S100, the print service 504 can also specify the expiration date of the session.

The document management service 503 establishes a session between the document management service 503 and the print service 504, and performs authentication using a document ticket included in the session establishment request. For example, the document management service 503 performs authentication based on whether or not there is the document ticket information 507 of the document ticket received in step S45.

If the authentication is successfully completed, the document management service 503 generates the above-described session information as shown in FIG. 6 and stores it in the session information DB 506. Further, the document management service 503 adds the document ID included in the document ticket information 507 of the document ticket received in step S45 to the “array of password-authenticated document IDs” of the session information.

As described above, the document ticket is included in the session establishment request, and when the authentication is successfully completed, the password-authenticated document ID included in the document ticket information 507 of the document ticket is changed to the “password-authenticated document” of the session information. By adding the document ID to the “ID array”, the password-authenticated document ID can be used as it is in a new session.

On the other hand, if the authentication is not completed normally, the document management service 503 does not generate the session information. If the authentication is not completed normally, the document management service 503 may release the session established with the print service 504.

Then, the document management service 503 proceeds to step S101, and transmits a session ID to the print service 504 as a response to the session establishment request in step S100. Upon receiving the session ID from the document management service 503, the print service 504 proceeds to step S102, and transmits the document ticket received in step S44 and the session ID received in step S101 to the document management service 503, thereby requesting the stored document to acquire the stored document. I do.

Upon receiving the document ticket and the session ID from the print service 504, the document management service 503 searches the session information DB 506 for session information corresponding to the received session ID. If the session information corresponding to the session ID is stored in the session information DB 506, the document management service 503 considers that a session has been established between the print service 504 and the document management service 503.

Next, the document management service 503 acquires the “IP address of the network device that sent the request” from the session information corresponding to the session ID, and in step S102, the MFP 1b including the print service 504 that has issued the acquisition request of the stored document. Is determined to be the same as the IP address.

If it is determined that the “IP address of the network device that has transmitted the request” acquired from the session information is the same as the IP address of the multifunction peripheral 1b including the print service 504 that has issued the acquisition request of the stored document in step S102, The document management service 503 determines that the session established with the print service 504 is valid. If the document management service 503 determines that the session established with the print service 504 is valid, the process advances to step S103, and stores the document ID included in the document ticket in response to the stored document acquisition request in step S102. The document is transmitted to the print service 504. If the document management service 503 determines that the session established with the print service 504 is valid, it updates the “expiration date” of the session information corresponding to the session ID.

If the session information corresponding to the session ID is not stored in the session information DB 507, the document management service 503 considers that a session has not been established between the document management service 503 and the print service 504, and the print service 504 Do not execute the stored document acquisition request. If it is determined that the “IP address of the network device that transmitted the request” acquired from the session information is not the same as the IP address of the multifunction peripheral 1b including the print service 504 that has issued the acquisition request of the stored document in step S102. The document management service 503 does not execute the acquisition request of the stored document made by the print service 504.

In step S104, the print service 504 issues a session release request between the document management service 503 and the print service 504 by transmitting the session ID to the document management service 503. The document management service 503 releases the session between the document management service 503 and the print service 504. Then, the document management service 503 proceeds to step S105, and transmits a response to the session release request in step S104 to the print service 504.

Returning to FIG. 8, upon receiving the stored document from the document management service 503, the print service 504 proceeds to step S47, issues a print request for the stored document to the ECS 35, and receives the print result from the ECS 35. Proceeding to step S48, the print service 504 transmits a print request reception result to the network device 501, and ends the processing.

In this way, by including the document ticket in the session establishment request, the password-authenticated document ID can be added to the session information of the newly established session without performing password authentication.

According to the usage authentication information issuing method of FIG. 8, once the network device 501 performs password authentication on the stored document, the document ID of the password-authenticated document ID is transmitted between the document management service 503 and the print service 504 via the document ticket. Since it is added to the “array of authenticated document IDs” of the session information of the session established in between, the stored document can be printed without password authentication in the print service 504.

Therefore, once the authentication of the stored document protected by the password is performed, the password authentication process can be omitted when the processing request for the stored document is performed next. As described above, in the usage authentication information issuing method according to the present invention, the overlapping password authentication processing is omitted, so that the processing speed can be increased.

The present invention is not limited to the above embodiments, and various modifications and changes can be made within the scope of the present invention.

FIG. 1 is a configuration diagram of an embodiment of a fusion machine according to the present invention. FIG. 2 is a hardware configuration diagram of an embodiment of the multifunction peripheral according to the present invention. FIG. 2 is a functional configuration diagram of the multifunction peripheral for explaining a usage authentication information issuing method according to the first embodiment of the present invention. FIG. 3 is a configuration diagram of an example of session information. FIG. 9 is a functional configuration diagram of a multifunction peripheral for explaining a usage authentication information issuing method according to a second embodiment of the present invention. FIG. 11 is a configuration diagram of another example of session information. It is an explanatory view for explaining a ticket. FIG. 13 is a functional configuration diagram of a multifunction peripheral for describing a usage authentication information issuing method according to a third embodiment of the present invention. FIG. 11 is a sequence diagram illustrating an example of a process of acquiring a stored document from a document management service using a document ticket.

Explanation of symbols

1, 1a, 1b MFP 2 Software group 3 MFP starter 4 Hardware resource 5 Application layer 6 Platform 7 Shared function layer 8 Wrapping layer 9 Control service layer 10 Handler layer 11 Plotter 12 Scanner 13 Hardware resource 21 Printer application 22 Copy application 23 Fax application 24 Scanner application 25 Web page application 26 SOAP communication application 27 Web service function (WSF)
28 Shared Function (SF)
31 Network Control Service (NCS)
32 Delivery Control Service (DCS)
33 Operation Panel Control Service (OCS)
34 Fax Control Service (FCS)
35 Engine Control Service (ECS)
36 Memory Control Service (MCS)
37 User Information Control Service (UCS)
38 System Control Service (SCS)
39 System Resource Manager (SRM)
40 Fax control unit handler (FCUH)
41 Image Memory Handler (IMH)
51-53 Application Program Interface (API)
54 Engine I / F
60 Controller 61 CPU
62 System memory 63 North Bridge (NB)
64 South Bridge (SB)
65 AGP (Accelerated
Graphics Port)
66 ASIC
67 Local memory 68 Hard disk drive (HDD)
80 Operation panel 81 Fax control unit (FCU)
82 Engine unit 301a, 301b, 401, 501 Network device 302, 402, 502a, 502b httpd (HyperText Transfer
Protocol Daemon)
303 Network service 304,404,505,506 Session information 306 Network 403,503 Document management service 405,507 Document ticket information 504 Printing service

Claims (26)

An image forming apparatus having hardware resources used in image forming processing and a program for performing processing related to image formation,
When an authentication request for a predetermined process is received from the first network device, an authentication process is performed based on the authentication request, and usage authentication information for the predetermined process and usage identifying the usage authentication information according to a result of the authentication process. While generating authentication identification information and transmitting the usage authentication identification information to the first network device,
When a session establishment request including the use authentication identification information is received from the second network device, use authentication information corresponding to the use authentication identification information is determined, and a communication with the second network device is determined based on the session establishment request. An image forming apparatus, wherein the use authentication information is stored in session information of a session established in (1), and session identification information for identifying the session is transmitted to the second network device. When a predetermined processing request using the session identification information is received from the second network device, session information corresponding to the session identification information is determined, and the session information is determined in accordance with the use authentication information stored in the session information. 2. The image forming apparatus according to claim 1, wherein a predetermined processing request is executed. 3. The image forming apparatus according to claim 1, wherein the use authentication information includes at least use authentication identification information and processing information that has been authenticated by the authentication processing. The session information includes at least session identification information, identification information of a second network device that has transmitted the session establishment request, identification information of an image forming apparatus that has received the session establishment request, and processing information that has been authenticated by the authentication processing. The image forming apparatus according to claim 3, further comprising: When receiving a session establishment request including the usage authentication identification information from the second network device, the usage authentication information corresponding to the usage authentication identification information is determined, and a communication with the second network device is determined based on the session establishment request. Storing the usage authentication information in the session information of the session established in step (a), wherein the authenticated processing information included in the usage authentication information is added to the authenticated processing information included in the session information. The image forming apparatus according to claim 4. Upon receiving a predetermined processing request using the session identification information, determining session information corresponding to the session identification information, the authenticated processing information of the session information includes the predetermined processing, and the session information Executing the predetermined processing request when the identification information of the second network device that has transmitted the session establishment request and the identification information of the network device that has transmitted the predetermined processing request are included. The image forming apparatus according to claim 5, wherein 7. The image forming apparatus according to claim 1, wherein the session information has an expiration date, and the session information after the expiration date is deleted. 8. The image forming apparatus according to claim 7, wherein upon receiving a predetermined processing request using the session identification information, the validity period of the session information corresponding to the session identification information is updated. The image forming apparatus according to any one of claims 1 to 8, wherein the predetermined processing request is processing related to image formation. 10. The hardware resource used in the image forming process includes at least a scanner unit that generates image data from an image and a plotter unit that forms an image from the image data. Image forming apparatus. 11. The image forming apparatus according to claim 1, wherein the second network device receives the usage authentication identification information from the first network device. 12. An image forming apparatus comprising: a hardware resource used in an image forming process; a program for performing a process related to an image forming process;
When an authentication request for the stored document is received from the first network device, an authentication process is performed based on the authentication request, and usage authentication information for the stored document and usage authentication for identifying the usage authentication information according to the authentication processing result. Generating identification information and transmitting the use authentication identification information to the first network device;
When a session establishment request including the use authentication identification information is received from the second network device, use authentication information corresponding to the use authentication identification information is determined, and a communication with the second network device is determined based on the session establishment request. An image forming apparatus, wherein the use authentication information is stored in session information of a session established in (1), and session identification information for identifying the session is transmitted to the second network device. When a predetermined processing request for the stored document using the session identification information is received from the second network device, session information corresponding to the session identification information is determined, and the usage authentication information stored in the session information is determined. 13. The image forming apparatus according to claim 12, wherein the predetermined processing request is executed in response to the request. 14. The image forming apparatus according to claim 12, wherein the use authentication information includes at least use authentication identification information and identification information of a stored document that has been authenticated by the authentication processing. The session information includes at least session identification information, identification information of a second network device that has transmitted the session establishment request, identification information of an image forming apparatus that has received the session establishment request, and a stored document that has been authenticated by the authentication processing. The image forming apparatus according to claim 14, further comprising identification information. When a session establishment request including the use authentication identification information is received from the second network device, use authentication information corresponding to the use authentication identification information is determined, and a communication with the second network device is determined based on the session establishment request. Storing the use authentication information in the session information of the session established in the step of adding the identification information of the authenticated stored document included in the use authentication information to the identification information of the authenticated stored document included in the session information The image forming apparatus according to claim 15, wherein: When a predetermined processing request using the session identification information is received, the session information corresponding to the session identification information is determined, and the identification information of the stored document that has been authenticated of the session information is stored in the storage information that is the target of the predetermined processing. When the identification information of the document is included and the identification information of the second network device that has transmitted the session establishment request included in the session information matches the identification information of the network device that has transmitted the predetermined processing request. 17. The image forming apparatus according to claim 16, wherein a predetermined processing request for the stored document is executed. 18. The image forming apparatus according to claim 12, wherein the session information has an expiration date, and the session information after the expiration date is deleted. 19. The image forming apparatus according to claim 18, wherein upon receiving a predetermined processing request using the session identification information, the validity period of the session information corresponding to the session identification information is updated. 20. The image forming apparatus according to claim 12, wherein the predetermined processing request is processing related to image formation. 21. The hardware resource used in the image forming processing includes at least a scanner unit that generates image data from an image and a plotter unit that forms an image from the image data. Image forming apparatus. 22. The image forming apparatus according to claim 12, wherein the second network device receives the use authentication identification information from the first network device. A method for issuing usage authentication information of an image forming apparatus, comprising: a hardware resource used in an image forming process; and a program for performing a process related to image forming.
When an authentication request for a predetermined process is received from the first network device, an authentication process is performed based on the authentication request, and usage authentication information for the predetermined process and usage identifying the usage authentication information according to a result of the authentication process. Generating authentication identification information and transmitting the usage authentication identification information to the first network device;
When a session establishment request including the use authentication identification information is received from the second network device, use authentication information corresponding to the use authentication identification information is determined, and a communication with the second network device is determined based on the session establishment request. Storing the usage authentication information in the session information of the session established in step (a), and transmitting session identification information for identifying the session to the second network device. . A use authentication information issuing method for an image forming apparatus, comprising: a hardware resource used in an image forming process; a program for performing a process related to the image forming; and a document storage unit for storing a stored document.
When an authentication request for the stored document is received from the first network device, an authentication process is performed based on the authentication request, and usage authentication information for the stored document and usage authentication for identifying the usage authentication information according to the authentication processing result. Generating identification information and transmitting the usage authentication identification information to the first network device;
When a session establishment request including the use authentication identification information is received from the second network device, use authentication information corresponding to the use authentication identification information is determined, and a communication with the second network device is determined based on the session establishment request. Storing the usage authentication information in the session information of the session established in step (a), and transmitting session identification information for identifying the session to the second network device. . A use authentication information issuing system for issuing use authentication information for a predetermined process by using one or more external network devices and an image forming apparatus connected to the external network device via a network,
The image forming apparatus, upon receiving an authentication request for a predetermined process from the first network device, performs an authentication process based on the authentication request, and uses usage authentication information for the predetermined process and its use in accordance with the authentication process result. While generating use authentication identification information for identifying authentication information and transmitting the use authentication identification information to the first network device,
When a session establishment request including the use authentication identification information is received from the second network device, use authentication information corresponding to the use authentication identification information is determined, and a communication with the second network device is determined based on the session establishment request. Storing the usage authentication information in session information of the session established in step (a), and transmitting session identification information for identifying the session to the second network device. A use authentication information issuing system for issuing use authentication information for a predetermined process by using one or more external network devices and an image forming apparatus connected to the external network device via a network,
Upon receiving an authentication request for the stored document from the first network device, the image forming apparatus performs an authentication process based on the authentication request, and uses usage authentication information for the stored document and usage authentication based on the authentication processing result. While generating use authentication identification information for identifying information and transmitting the use authentication identification information to the first network device,
When a session establishment request including the use authentication identification information is received from the second network device, use authentication information corresponding to the use authentication identification information is determined, and a communication with the second network device is determined based on the session establishment request. Storing the usage authentication information in session information of the session established in step (a), and transmitting session identification information for identifying the session to the second network device.

Images