JP2004295493A - Authentication device, its method and its program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication device capable of setting a permission range corresponding to the matching degree of inputted authentication data and registration data, its method and its program. <P>SOLUTION: An image formation apparatus 1 which is one embodiment of this invention is provided with an authentication data input device 10 for having a user input a track, an authentication part 20 for deciding the matching degree by comparing the inputted track with track data registered beforehand in a reference data part 25, and a function control part 30 for deciding the permission range of functions usable by the user on the basis of the matching degree decided in the authentication part 20. Further, only the functions in the permission range decided by the function control part 30 are displayed at a function display part 42. Also, the authentication part 20 uses user information for which the user corresponding to the inputted track is identified by a user list registered in a user list part 26 as well. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an authentication device for managing a network system such as a computer network or a device shared by a large number of people, an authentication method for the authentication device, and a program therefor. More specifically, the present invention relates to an authentication device that performs authentication based on a locus input by a user, a method thereof, and a program thereof.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, when accessing a computer network system or using a device that is shared by a plurality of departments, an authentication device that authenticates a user to permit use is often used. The information used for authentication in these authentication devices includes a method based on possession of a card and a key, a method based on data input such as a personal ID and a password, a method based on physical information such as a fingerprint, an iris pattern, a voiceprint, and handwriting data. There is a method based on comparison with registered data.
[0003]
Of the three, the former three can uniquely determine whether or not they match, but the last is authentication with ambiguity. In other words, if the password is different even for one character or even for a part of the fingerprint, the authentication is not established, and the use of the device is naturally rejected. On the other hand, handwriting is not always the case, and even the person himself can hardly reproduce exactly the same handwriting as registered data. Furthermore, depending on the physical condition and environment, the data may be considerably different from the registered data. For this reason, it is possible that no matter how many times the user inputs the information, the user is not authenticated.
[0004]
On the other hand, an authentication device has been proposed in which even if the input handwriting does not match the registered data very much, not all access is denied but some functions can be used (for example, Patent Documents) 1). In the authentication device of this document, if the character code as a result of character recognition of the input signature matches the registered data, the second level access, which is a restricted function, is permitted.
[0005]
[Patent Document 1]
JP-A-8-137800
[0006]
[Problems to be solved by the invention]
However, according to the above-described conventional technique, even if the handwriting is completely different, the second level (low level) access is possible if the character codes match. This poses a problem that even if the signature character of another person is stolen and entered with a polite character, the second level may be authenticated.
[0007]
The present invention has been made in order to solve the problems of the above-described conventional technologies. That is, an object of the present invention is to provide an authentication device, a method thereof, and a program thereof, which can set a permitted range according to the degree of coincidence between input authentication data and registration data.
[0008]
[Means for Solving the Problems]
An authentication device according to the present invention, which has been made for the purpose of solving this problem, has a trajectory input means for allowing a user to input a trajectory, and compares a trajectory input to the trajectory input means with pre-registered trajectory data to thereby obtain a matching degree. And a function control means for determining a permission range of a function that can be used by the user based on the matching degree determined by the matching degree determining means. Here, the trajectory includes not only a two-dimensional handwriting but also a three-dimensional trajectory such as an input pen.
[0009]
According to the present invention, the trajectory input to the trajectory input means by the user is compared with the trajectory data registered in advance by the coincidence determining means. In an ambiguous authentication method such as handwriting information, a perfect match between registered data and input data cannot usually be obtained, but the degree of matching can be determined. Since the permitted range of the function that can be used by the user is determined based on the degree of matching, the authentication apparatus can set the permitted range according to the degree of matching between the input authentication data and the registered data.
[0010]
Further, in the present invention, it is desirable to have display means for displaying a function which the user intends to use, and display control means for displaying on the display means only functions within the permitted range determined by the function control means.
With such display control means, for example, even if a person who is not recognized as a user is authenticated at a low level by impersonating a legitimate user, only functions within the permitted range are displayed. Therefore, a function that is not displayed does not even indicate its existence, so that it is a secure authentication device.
[0011]
In the present invention, the coincidence determining means also has a function of identifying a user corresponding to the trajectory input to the trajectory input means, and the function control means determines the user based on the user information identified by the coincidence determining means. It is desirable to determine the range of permission.
This is because it is possible to set, for each user, a function range that is not permitted even for the user.
[0012]
Further, according to the present invention, there is provided resolution conversion means for converting the resolution of the trajectory input to the trajectory input means, and the coincidence determination means converts the trajectory input to the trajectory input means and the trajectory converted by the resolution conversion means. It is desirable to determine the degree of coincidence by comparing each of the resolutions with the locus data registered in advance for each resolution to determine whether or not the number of coincident pixels exceeds a predetermined threshold value.
With this configuration, the degree of coincidence is determined by the trajectory obtained by converting the resolution of the trajectory input to the trajectory input means. Therefore, if the resolution is reduced and compared, the number of pixels of the trajectory is reduced, so that the time required for the comparison determination can be reduced.
[0013]
Further, the coincidence determining means determines the trajectory input to the trajectory input means and the trajectory converted by the resolution conversion means in order from the lowest resolution, and determines the highest resolution in which the number of matching pixels exceeds the threshold value. It is desirable to determine the degree of coincidence by calculating.
If the determination is made in order from the one with the lowest resolution, the determination can be stopped when the required degree of coincidence is obtained. In other words, there is no need to increase the resolution further and make a comparison judgment. Therefore, the time required for the determination can be reduced.
[0014]
Further, the present invention allows the user to input a trajectory using the trajectory input means (1), and determines the degree of coincidence by comparing the trajectory input by the user with pre-registered trajectory data (2), ( Based on the degree of coincidence determined in 2), the permitted range of functions that can be used by the user is determined.
[0015]
Further, the present invention provides a procedure 1 for capturing a trajectory input by a user using a trajectory input means into a computer, and a procedure for determining the degree of coincidence by comparing the trajectory captured in procedure 1 with trajectory data registered in advance. 2 and a procedure 3 for determining a permitted range by distinguishing between functions that can be used by the user and functions that cannot be used based on the degree of coincidence determined in step 2.
[0016]
BEST MODE FOR CARRYING OUT THE INVENTION
"First Embodiment"
Hereinafter, a first embodiment of the present invention will be described in detail with reference to the accompanying drawings. In the present embodiment, the present invention is embodied as an authentication device that is mounted on an image forming apparatus shared by a plurality of users and sets an operation function range that is permitted for each authentication requester.
[0017]
FIG. 1 shows a schematic configuration of an image forming apparatus 1 according to the present embodiment. The image forming apparatus 1 includes an authentication data input device 10, an authentication unit 20, a function control unit 30, and an image forming unit 40. The authentication unit 20 includes an input unit 21, a reference input unit 22, a data comparison unit 23, and a level determination unit 24. Further, a reference data section 25 is connected to the reference input section 22, and a user list section 26 is connected to the level determination section 24, respectively. The image forming unit 40 includes an instruction input unit 41, a function display unit 42, and a process execution unit 43.
[0018]
The authentication data input device 10 is a device in which an authentication requester who is a user who is going to be authenticated inputs data for the authentication. As the authentication data input device 10, a general device such as an input pen or a tablet is used. When using the image forming apparatus 1, the authentication requester inputs his / her own authentication handwriting data using the authentication data input device 10. Here, the authentication data input device 10 corresponds to a locus input unit.
[0019]
The authentication unit 20 is a unit that performs an authentication process on input data for authentication input from the authentication data input device 10. For this authentication process, handwriting data input in advance by each prospective user is registered and stored in the reference data unit 25. The authentication unit 20 performs an authentication process by comparing input data input at the time of authentication with reference data stored in the reference data unit 25. As a result, an authentication level corresponding to the function range permitted to be used by the authentication requester is determined.
[0020]
The input unit 21 of the authentication unit 20 is a component that receives data input by the authentication data input device 10. The reference input unit 22 reads reference data to be compared from the reference data unit 25. The data comparing unit 23 compares the input data received by the input unit 21 with the reference data input by the reference input unit 22. The level determination section 24 is a section for reading the user list stored in the user list section 26 and determining the authentication level from the user list and the result of the data comparison section 23. Here, the data comparison unit 23 corresponds to a coincidence determination unit.
[0021]
The function control unit 30 sets a permitted function range based on the authentication level determined by the authentication unit 20. The image forming unit 40 is a component that executes functions within a range permitted by the function control unit 30 in accordance with an instruction from the authentication requester. The instruction input unit 41 of the image forming unit 40 receives an instruction input by the authentication requester. The function display unit 42 displays functions that can be executed within a range permitted by the authentication requester. The processing execution unit 43 is a unit that performs processing of the function instructed by the authentication requester to be executed from the instruction input unit 41. The instruction input unit 41 and the function display unit 42 are configured by hard keys or software switches provided on the front panel of the image forming apparatus 1, a liquid crystal display, and the like. Here, the function display unit 42 corresponds to a display unit, and the function control unit 30 corresponds to a function control unit and a display control unit.
[0022]
Next, an authentication method by the authentication unit 20 will be described. As a comparative authentication method using handwriting data, various methods have hitherto been put into practical use. For example, there is a method of comparing pixels and calculating the ratio of coincident pixels. In this case, the input data and the reference data are image data in pixel units as shown in FIG. In FIG. 2, input data 51 is handwriting data input from the authentication data input device 10 by the authentication requester, and reference data 52 is handwriting data input in advance and registered in the reference data unit 25.
[0023]
Then, the data comparison unit 23 compares the input data 51 and the reference data 52 for each pixel, and calculates the degree of coincidence from the ratio of coincident pixels to the total number of pixels. In the example of FIG. 2, the pixels marked with x are mismatched pixels, and 10 out of 64 pixels are mismatched pixels. Therefore, the number of matching pixels is 54 pixels, and the matching degree is approximately 84% from (54/64 ≒ 0.84). Here, the characters to be input are very simple characters, but in reality, it is desirable to use a password consisting of multiple characters, or your own name, or a much more complicated symbol that cannot be understood by others. .
[0024]
Next, a user list used for authentication together with the above-mentioned degree of coincidence will be described. As shown in FIG. 3, the user list 53 has a permission level set in advance for each prospective user and is registered and stored in the user list section 26. The user list 53 is read out and used by the level determination unit 24 when performing authentication. As shown in FIG. 3, the user list 53 is provided with columns of “Individual No.”, “Name”, “Type”, and “Permission level”.
[0025]
In the “Individual No.” column, a serial number and an ID number for distinguishing each individual are described. The “Name” column and the “Type” column are provided for the convenience of an administrator who creates and manages the user list 53. In the “permission level” column, a level value indicating how much use range is permitted for the image forming apparatus 1 for each individual is indicated by numerical values of 1 to 3. Here, a smaller level value corresponds to a higher level at which a higher-level operation is permitted. The user list 53 is provided for each device, and all users who are permitted to use the device are registered. Anyone not registered in the user list 53 is not allowed to use the image forming apparatus 1.
[0026]
Further, a method in which the level determining unit 24 determines the authentication level using the degree of coincidence of the handwriting and the user list 53 will be described. First, the degree of coincidence is divided into four levels of coincidence according to the numerical value. Here, the coincidence level of 90% or more is defined as the coincidence level 1, the coincidence level of less than 90% and 80% or more is the coincidence level 2, and the coincidence level of less than 80% and 60% or more is the coincidence level 3. If the coincidence is less than 60%, the coincidence level is 4, and use of the image forming apparatus 1 is not permitted. Further, the level determination unit 24 has the table 54 shown in FIG. 4, and determines the authentication levels (A to D) from the coincidence level and the permission level by referring to the table 54.
[0027]
The obtained authentication level is input to the function control unit 30. The function control unit 30 stores a permitted function range corresponding to each authentication level. The requester of the authentication level D is not permitted to use all the functions. The permission function determined in this way is displayed on the function display section 42 of the image forming section 40. The authentication requester selects a function desired to be executed from the displayed functions and inputs the selected function to the instruction input unit 41. As a result, the processing execution unit 43 executes the function selected and instructed.
[0028]
The relationship between the authentication level and the permitted function range is as follows. For example, the image forming apparatus 1 has three modes of “service mode”, “administrator mode”, and “user mode”. The “service mode” is a mode in which, for example, a charging mode is set and various counters are set. The “administrator mode” is a mode in which, for example, setting of an upper limit number of sheets and the like and management updating of the user list 53 are performed. The “user mode” is a mode in which normal use such as setting of a one-touch key or program copy is performed. Then, the function control unit 30 permits the authentication requester of the authentication level A to execute all the modes, and permits the authentication requester of the authentication level B to perform the “administrator mode” and the “user mode”. , Only the “user mode” is permitted to the authentication requester of the authentication level C.
[0029]
Then, the permitted function range determined in this way is displayed on the function display section 42 of the image forming apparatus 1 as shown in FIG. FIG. 5A shows a display for an authentication requester of the authentication level B, and FIG. 5B shows a display for an authentication requester of the authentication level C. All functions related to general use are similarly displayed and can be selected and input. However, while the "administrator mode" key is displayed for the authentication requester of the authentication level B, this key is not displayed for the authentication requester of the authentication level C. It is naturally impossible to select a key that is not displayed, and an authentication requester of the authentication level C cannot execute the “administrator mode” function. Furthermore, their existence is not even known.
[0030]
Alternatively, as another method of setting the permitted function range, there is a method of setting an authentication level required for each function irrespective of the mode. For example, the “charging mode setting function” is authentication level A, the “various counter setting function” is authentication level B, the “user list 53 management and updating function” is authentication level A, and the “one-touch key setting function” is authentication. All functions, such as level C, are set and stored. Then, each function may be displayed and executable only to the authentication requester whose authentication level is satisfied.
[0031]
Alternatively, instead of setting the four authentication levels A to D in the table of FIG. 4, the permitted functions and the processing ranges thereof may be determined by the permission level and the coincidence level. For example, a correspondence table 55 between permission levels and permission functions shown in FIG. 6 and a correspondence table 56 between correspondence levels and permission operations shown in FIG. 7 are prepared. Here, the permission level is in a range of 1 to 4. Then, among the above three modes, the user of the permission level 1 is permitted all the functions of the mode, the user of the permission level 2 is permitted the “service mode” and the “user mode”, and the user of the permission level 3 is permitted. The user is permitted to be in the “administrator mode” and the “user mode”, and the user of the permission level 4 is permitted only in the “user mode”. On the other hand, according to the degree of coincidence of the handwriting, all functions of "confirmation", "change" and "deletion" of the content are permitted in the case of the coincidence level 1, and "confirmation" and "change" of the content in the coincidence level 2 And only "confirmation" of the content at the matching level 3 are permitted.
[0032]
Next, an authentication level determination procedure by the authentication unit 20 of the image forming apparatus 1 will be described with reference to flowcharts of FIGS. The image forming apparatus 1 is started by power input or operation of a start key, and a main routine shown in FIG. 8 is executed. First, handwriting data for authentication is input from the authentication data input device 10 by the authentication requester, and the authentication unit 20 receives the input data 51 (S101). Next, a permission level determination routine is executed (S102). Further, a coincidence level determination routine is executed (S103). Each of these routines will be described later. Then, the authentication unit 20 determines the authentication level based on the table 54 of FIG. 4 from the permission level determined in the permission level determination routine and the matching level determined in the matching level determination routine (S104). , End this processing.
[0033]
Next, the permission level determination routine executed in S102 of the main routine of FIG. 8 will be described with reference to FIG. When this routine is executed, first, the authentication unit 20 reads the user list 53 registered for the image forming apparatus 1 (S201). Then, the authentication requester is searched from the user list 53. Here, as a method of determining the authentication requester, the input data 51 is subjected to character analysis and read as a password, or a personal ID or the like is input separately from the authentication data. Thus, it is determined who the authentication requester is (S202). If the authentication requester is a person registered in the user list 53 (S203: Yes), the individual No. Is obtained, and the permission level can be determined (S204). However, if the authentication requester is not registered in the user list 53 (S203: No), the permission level is set to 4 (S205). Then, the permission level determination routine ends.
[0034]
Next, the matching level determination routine executed in S103 of the main routine of FIG. 8 will be described with reference to FIG. When this routine is executed, first, the authentication unit 20 determines whether or not the permission level determined in the permission level determination routine of FIG. 9 is 4 (S301). If the permission level is 4 (S301: Yes), the authentication requester is not permitted to use all the functions, so that it is not necessary to determine the matching level. Therefore, the coincidence level is set to 4 (S310), and the coincidence level determination routine is terminated.
[0035]
Alternatively, if the permission level is not 4 (S301: No), the individual No. obtained in the permission level determination routine of FIG. First, the reference data 52 is read from the reference data section 25 (S302). Next, the input data 51 input in S101 of the main routine is compared with the reference data 52 to calculate the degree of coincidence (S303). Further, if the matching degree is 90% or more (S304: Yes), the matching degree level is set to 1 (S305), and this routine ends. If the degree of coincidence is less than 90% and equal to or more than 80% (S304: No, S306: Yes), the degree of coincidence is set to 2 (S307), and this routine ends. If the degree of coincidence is less than 80% or more than 60% (S304: No, S306: No, S308: Yes), the degree of coincidence is set to 3 (S309), and this routine ends. If the coincidence is less than 60% (S304: No, S306: No, S308: No), the coincidence level is set to 4 (S310), and this routine is ended. Then, the process returns to S104 of the main routine to determine the authentication level.
[0036]
Therefore, even if the handwriting is slightly different due to hand injury or poor physical condition, etc., it is possible to execute a somewhat restricted function. In the case of poor physical condition or the like, the judgment may be erroneous, so it is reasonable that the function is restricted. Further, since no additional authentication information is required, there is no need to increase the size of the device or take time for authentication. Furthermore, even if the authentication is performed at a low authentication level due to impersonation by another person, the number of permitted functions is small. Further, since the functions that are not permitted are not displayed, it cannot be determined that there are more functions. As a result, a more secure and easy-to-use authentication device and method are provided.
[0037]
As described in detail above, according to the image forming apparatus 1 of the present embodiment, authentication is performed in the authentication unit 20 at the request of the authentication requester, and the authentication level is determined. For this purpose, reference data 52 for comparison is registered in the reference data section 25 in advance. Then, the input data 51 input from the authentication data input device 10 and the reference data 52 input by the reference input unit 22 are compared by the data comparison unit 23. As a result, a handwriting coincidence level is obtained. In addition, a user list 53 in which a permission level for each user is specified is registered in the user list unit 26. Thereby, the permission level of the requester is obtained. Further, the level determination unit 24 determines the authentication level from the permission level and the matching level. The function control unit 30 determines the permitted function range based on the authentication level. The permitted functions are displayed on the function display unit 42, and among them, the function specified by the instruction input unit 41 is executed by the processing execution unit 43. Therefore, the permitted range can be set according to the degree of coincidence between the input authentication data and the registered data.
[0038]
"Second embodiment"
Hereinafter, a second embodiment of the present invention will be described in detail with reference to the accompanying drawings. In the present embodiment, the present invention is embodied as an authentication device mounted on a computer system or the like and for setting an access range permitted for an authentication requester and a method thereof.
[0039]
FIG. 11 shows a schematic configuration of the computer system 2 of the present embodiment. The computer system 2 has a file management unit 60, and issues an authentication request to the authentication unit 20 when there is an access request for a folder or a file. That is, if an authentication condition is attached to a folder or file for which access is requested, data input for authentication is required before the access is executed. Therefore, anyone can access free files and the like, but only authorized users can access personal folders and confidential matters. FIG. 2 shows only a part of the computer system 2 related to the present embodiment.
[0040]
In the computer system 2, the file management unit 60 to be authenticated includes an instruction input unit 61, a display unit 62, and a process execution unit 63. The instruction input unit 61 is a component input by a user to request access to a file or the like. The display unit 62 displays a message prompting the user to input data for authentication, a file to which access is permitted as a result of the authentication, and the like. The process execution unit 63 executes a process permitted as a result of the authentication in accordance with a request from the user. The authentication data input device 10 and the authentication unit 20 have the same configurations as those in the first embodiment, and therefore, are denoted by the same reference numerals and description thereof is omitted. Here, the display unit 62 corresponds to a display unit, and the file management unit 60 includes a function control unit and a display control unit.
[0041]
In this embodiment, when the user requests access to a file or the like from the instruction input unit 61, the file management unit 60 requests the authentication unit 20 to perform authentication. Then, a message to the effect that authentication is required is displayed on the display unit 62, and the user is prompted to input authentication data. Therefore, the user uses the authentication data input device 10 to input handwriting data.
[0042]
The authentication method is the same as in the first embodiment. A user list 53 as shown in FIG. 3 is provided for each file or the like. For a personal file or the like, the creator of the file has permission level 1. Then, the authentication level is determined from the matching level calculated from the input data and the reference data and the permission level read from the user list 53.
[0043]
In the computer system 2, for example, a difference is made in the execution process permitted according to each authentication level as follows. At authentication level A, read, write, copy, and delete of the file are all permitted. At the authentication level B, file read / write is permitted. At the authentication level C, only reading of a file is permitted. At the authentication level D, all accesses are not permitted. Alternatively, in authentication for a folder, authentication is required when opening a folder, and the authentication level of the user is determined. Then, the displayed files are restricted according to the authentication level or the permission level and the coincidence level.
[0044]
As described in detail above, according to the computer system 2 of the present embodiment, similarly to the image forming apparatus 1 of the first embodiment, according to the degree of coincidence between the input authentication data and registration data. An authentication device and a method for setting an allowed range are provided.
[0045]
"Third embodiment"
Hereinafter, a third embodiment of the present invention will be described in detail with reference to the accompanying drawings. This embodiment is another method of determining the matching level in the authentication unit 20 which is mounted on the image forming apparatus 1 of the first embodiment or the computer system 2 of the second embodiment. Other parts are the same as in the above embodiments.
[0046]
In the first and second embodiments, as shown in FIG. 2, all pixels of input data and reference data are compared. In this method, if the number of pixels is increased in order to make the authentication strict, the authentication takes a longer time. For example, it is not preferable that much time is required for authentication even though the image forming apparatus 1 simply uses the user mode. Therefore, in the present embodiment, the authentication time can be shortened according to the requested processing content.
[0047]
First, as shown in FIG. 12, the reference data portion 25 includes, in addition to the reference data 52 having the same size as the original input data 51, the reference data 72 obtained by reducing the four dots to one dot and reducing it to 1/4. And the reference data 74 further reduced to 1/4 thereof are stored. Then, the input data 51 is similarly reduced, and the data comparison unit 23 compares the reduced data. For example, if the degree of coincidence of the 1/16 size is 90% or more, the degree of coincidence is determined such that the degree of coincidence is 3; If the matching level required for the requested processing is 3, only the 1/16 size needs to be compared, so that the time for authentication is reduced. Here, the data comparison unit 23 includes a resolution conversion unit.
[0048]
Alternatively, using the data obtained by reducing the input data 51 to various sizes as shown in FIG. 12, the processing content of the coincidence level determination routine can be changed as shown in FIG. This routine is executed in S103 of FIG. 8 instead of FIG. When this routine is executed, the permission level has already been determined in S102 of FIG. 8 (permission level determination routine of FIG. 9). Therefore, first, if the permission level is 4 (S401: Yes), all the authentications are not permitted, so the coincidence level = 4 (S402), and the process returns.
[0049]
If the permission level is not 4 (S401: No), the reference data 52, 72, and 74 of each size are read from the reference data section 25 (S403). Next, “the number of types of prepared reference data + 1” is substituted for N corresponding to the numerical value of the coincidence level (S404). Here, since three types of reference data are prepared, 4 is substituted for N. Then, the size of the input data is made the same as the smallest size of the prepared reference data (S405). Here, since the 1/16 size is the smallest, it is reduced to 1/16.
[0050]
Then, the degree of coincidence is calculated by comparing the input data 73 of 1/16 size with the reference data 74 (S406). If the matching degree is lower than a predetermined value (S407: No), or if N = 1 (S408: Yes), no further authentication is necessary. If the degree of coincidence is lower than the predetermined value, it means that there is not much coincidence, and no higher-order authentication is recognized. If N = 1, it is already the highest and there is no more. Therefore, the matching level is set to the value of N at that time (S409), and the process returns. Here, the predetermined value is 60%.
[0051]
Alternatively, if the degree of coincidence is equal to or more than a predetermined value (S407: Yes) and N is not 1 (S408: No), N is decreased by 1 (S410). Then, the size of the input data is increased, and the input data 73 is changed from 1/16 input data 73 to 1/4 input data 71 (S411). Then, the degree of coincidence is calculated again by comparing with the reference data 72 of 1/4 size (S406).
[0052]
In this manner, the matching level is increased while the input data is increased, and when the required matching level is obtained, the authentication processing is interrupted. Alternatively, in the case of authentication for access to a folder in the computer system 2 as in the second embodiment, the files that are permitted to be accessed at the level at which authentication has been completed are sequentially displayed on the display unit 62. You may do so. Then, the user can access the file when the desired file name is displayed, in which case the further authentication is canceled. In this way, the authentication can be interrupted when the level desired by the user is obtained, so that the time required for the authentication is reduced.
[0053]
As described above in detail, according to the present embodiment, in the image forming apparatus 1 of the first embodiment and the computer system 2 of the second embodiment, the authentication time can be reduced. An authentication apparatus and a method for setting a permitted range according to the degree of coincidence between input authentication data and registration data are provided.
[0054]
Note that the present embodiment is merely an example, and does not limit the present invention in any way. Therefore, naturally, the present invention can be variously modified and modified without departing from the gist thereof.
For example, in each of the above embodiments, the image forming apparatus 1 has the authentication data input device 10, but the external device may receive only the authentication data.
Further, for example, instead of having the reference data section 25 and the user list section 26, the reference data 52 and the user list 53 may be stored outside the image forming apparatus 1 and taken in as needed.
Further, for example, the number of stages of the permission level and the coincidence level is not limited to the examples in the above embodiments.
[0055]
Also, for example, in the image forming apparatus 1 of each of the above-described embodiments, when activated, first, input of handwriting data is requested. However, a mode key or the like is provided, and handwriting data is requested by the key input. A data size for determining the degree level may be selected.
Further, for example, in each of the above embodiments, the coincidence level is determined by the coincident area ratio in pixel units. However, other methods of calculating the coincidence include a method of calculating the sum of the vectors of the trajectory data, A method of calculating as a figure based on figure information such as the distance of the center of gravity may be used.
Further, for example, the structure of the handwriting data may be not only two-dimensional data as shown in FIG. 2 but also three-dimensional data in which a spatial pen locus is input.
[0056]
(Supplementary note 1) trajectory input means for allowing a user to input a trajectory,
Coincidence determining means for determining the degree of coincidence by comparing the trajectory input to the trajectory input means with previously registered trajectory data;
An authentication apparatus comprising: a function control unit that determines a permission range of a function that can be used by a user based on the degree of coincidence determined by the degree of coincidence determination unit.
[0057]
(Supplementary note 2) In the authentication device described in Supplementary note 1,
The coincidence determining means also has a function of identifying a user corresponding to the locus input to the locus input means,
The authentication device, wherein the function control means determines a permission range based on the user information identified by the coincidence determination means.
[0058]
(Supplementary note 3) In the authentication device described in Supplementary note 1 or 2,
Display means for displaying a function that the user intends to use;
An authentication device, comprising: display control means for causing the display means to display only functions within the permitted range determined by the function control means.
[0059]
(Supplementary Note 4) In the authentication device described in any one of Supplementary Notes 1 to 3,
Resolution resolution means for converting the resolution of the trajectory input to the trajectory input means;
The coincidence determination means compares the trajectory input to the trajectory input means and the trajectory converted by the resolution conversion means with trajectory data registered in advance for each of them, and determines the number of matching pixels by a predetermined threshold value. An authentication apparatus characterized in that the degree of coincidence is determined by judging whether or not the number is higher than each resolution.
[0060]
(Supplementary Note 5) In the authentication device according to Supplementary Note 4, the coincidence determination unit may include:
Determination is made in order from the locus having the lowest resolution among the locus input to the locus input means and the locus converted by the resolution converting means, and the degree of coincidence is determined by obtaining the highest resolution in which the number of matching pixels exceeds a threshold. An authentication device characterized in that:
[0061]
(Supplementary Note 6) The user inputs a trajectory using the trajectory input means (1),
The degree of coincidence is determined by comparing the trajectory input by the user with trajectory data registered in advance (2),
(3) An authentication method, wherein a permission range of a function that can be used by a user is determined based on the matching degree determined in (2).
[0062]
(Appendix 7) In the authentication method described in Appendix 6,
The user corresponding to the locus is identified based on the locus input by the user (4),
An authentication method, characterized in that the determination in (3) is made based on the user information identified in (4).
[0063]
(Supplementary note 8) In the authentication method described in Supplementary note 6 or 7,
An authentication method, characterized in that a display means for displaying a function to be used by a user displays only functions within the permitted range determined in (3).
[0064]
(Supplementary note 9) In the authentication method described in any one of supplementary notes 6 to 8,
The resolution of the locus input in the above (1) is converted,
In (2), the trajectory input in (1) and the trajectory converted in (5) are compared with trajectory data registered in advance for each of them, and the number of matching pixels is set to a predetermined threshold. An authentication method characterized in that the degree of coincidence is determined by judging for each resolution whether or not it exceeds.
[0065]
(Supplementary Note 10) In the authentication method described in Supplementary Note 9, in (2),
Determination is made in order from the locus having the lowest resolution among the locus inputted in (1) and the locus converted in (5), and the degree of coincidence is determined by obtaining the highest resolution in which the number of matching pixels exceeds the threshold. Authentication method characterized by performing.
[0066]
(Appendix 11)
Procedure 1 for capturing a locus input by the user using the locus input means;
A procedure 2 for determining the degree of coincidence by comparing the trajectory captured in the procedure 1 with trajectory data registered in advance;
An authentication program for executing a step 3 of determining a permitted range by distinguishing a function that can be used by a user from a function that cannot be used based on the degree of coincidence determined in the step 2.
[0067]
(Appendix 12) In the authentication program described in Appendix 11, the computer
A procedure 4 for identifying a user corresponding to the trajectory captured in the procedure 1 is also executed.
The authentication program according to claim 3, wherein the permission range is determined based on the user information identified in step 4.
[0068]
(Supplementary Note 13) In the authentication program described in Supplementary Note 11 or 12, the computer
An authentication program for executing a step 5 of displaying only a function within the permission range determined in the step 3 on a display unit for displaying a function to be used by the user.
[0069]
(Supplementary Note 14) In the authentication program described in any one of Supplementary Notes 11 to 13, the computer
Step 6 of converting the resolution of the locus taken in Step 1 is also executed.
In the procedure 2, the trajectory captured in the procedure 1 and the trajectory subjected to the resolution conversion in the procedure 6 are compared with the trajectory data registered in advance for each of the trajectories to determine whether the number of matching pixels exceeds a predetermined threshold value. An authentication program characterized in that the degree of coincidence is determined by determining for each resolution.
[0070]
(Appendix 15) In the certification program described in Appendix 14, the computer
In the procedure 2, the trajectory taken in the procedure 1 and the trajectory subjected to the resolution conversion in the procedure 6 are determined in order from the one having the lowest resolution, and the matching is performed by obtaining the highest resolution in which the number of matching pixels exceeds the threshold. An authentication program characterized by determining the degree.
【The invention's effect】
As is apparent from the above description, according to the present invention, there are provided an authentication apparatus, a method, and a program for setting an allowable range according to the degree of coincidence between input authentication data and registration data.
[Brief description of the drawings]
FIG. 1 is a block diagram illustrating a schematic configuration of an image forming apparatus according to a first embodiment.
FIG. 2 is an explanatory diagram illustrating an example illustrating a method of comparing input data for authentication with reference data.
FIG. 3 is a table showing an example of a user list.
FIG. 4 is an explanatory diagram showing a reference table.
FIG. 5 is an explanatory diagram illustrating a display example of a function display unit.
FIG. 6 is a table showing the correspondence between permission levels and permission functions.
FIG. 7 is a table showing a correspondence between a matching degree level and a permission operation;
FIG. 8 is a flowchart illustrating a main routine of an authentication level determination procedure.
FIG. 9 is a flowchart illustrating a permission level determination routine.
FIG. 10 is a flowchart illustrating a coincidence level determination routine.
FIG. 11 is a block diagram illustrating a schematic configuration of a computer system according to a second embodiment.
FIG. 12 is an explanatory diagram illustrating a method of calculating a degree of coincidence.
FIG. 13 is a flowchart illustrating another method of the coincidence level determination routine.
[Explanation of symbols]
1 Image forming device (including authentication device)
2 Computer system (including authentication device)
10. Authentication data input device (trajectory input means)
23 Data comparison unit (coincidence determination means, resolution conversion means)
30 Function control unit (function control means, display control means)
42 Function display section (display means)
60 file management unit (function control means, display control means)
62 display unit (display means)

Claims (5)

Locus input means for allowing the user to input a locus,
Coincidence determining means for determining the degree of coincidence by comparing the trajectory input to the trajectory input means with previously registered trajectory data;
An authentication apparatus comprising: a function control unit that determines a permission range of a function that can be used by a user based on the degree of coincidence determined by the degree of coincidence determination unit. The authentication device according to claim 1,
Display means for displaying a function that the user intends to use;
Display control means for displaying on the display means only the functions within the permitted range determined by the function control means,
The coincidence determining means also has a function of identifying a user corresponding to the locus input to the locus input means,
The authentication device, wherein the function control means determines a permission range based on the user information identified by the coincidence determination means. In the authentication device according to claim 1 or 2,
Resolution resolution means for converting the resolution of the trajectory input to the trajectory input means;
The coincidence determining means comprises:
The trajectory input to the trajectory input means and the trajectory converted by the resolution conversion means are sequentially compared with the trajectory data registered in advance for each of the trajectories having the lowest resolution. Judge whether it exceeds the threshold,
An authentication device, wherein a matching degree is determined by obtaining a highest resolution in which the number of matching pixels exceeds a threshold. The user inputs a locus using the locus input means (1),
The degree of coincidence is determined by comparing the trajectory input by the user with trajectory data registered in advance (2),
(3) An authentication method, wherein a permission range of a function that can be used by a user is determined based on the matching degree determined in (2). On the computer,
Procedure 1 for capturing a locus input by the user using the locus input means;
A procedure 2 for determining the degree of coincidence by comparing the trajectory captured in the procedure 1 with trajectory data registered in advance;
An authentication program for executing a step 3 of determining a permitted range by distinguishing a function that can be used by a user from a function that cannot be used based on the degree of coincidence determined in the step 2.

Images