JP2005025243A - Authentication system for print network system, remote management server, and remote output device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system for a print network system which employs a simple authentication method providing high accuracy for the individual authentication information of each registered user, while preventing abuse by third parties; a remote management server; and a remote output device. <P>SOLUTION: The authentication system for the print network system comprises a plurality of remote output devices and a remote management server capable of storing and transferring file information. The authentication system includes an image information reader for obtaining image information from the user's own identification documents, and an image authentication request means which causes each remote output device to store image information from the image information reader as personal authentication image information upon a registration request and to output image information upon an authentication request. The remote management server has an image authentication means which authenticates the user upon an authentication request by collating the image information from the remote output device with the personal authentication image information. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an authentication system for a print network system, a remote storage server, and a remote output device. For example, the user stores and acquires file information that is instructed to be stored and acquired from a remote storage server by the remote output device. The present invention can be applied to an authentication system, a remote storage server, and a remote output device in a print network system that prints out the file information.
[0002]
[Prior art]
For example, a registered user or a related person instructs a remote storage server on the network to store file information, and remote storage is possible even from the outside using an MMK installed in a convenience store or a station. There is a Web service that calls file information of a server and prints it out.
[0003]
When providing such a Web service, a personal authentication process for authenticating that the user is a registered user is required at the time of file information storage instruction or at the time of acquisition / printing of stored file information. This is performed based on the collation of the input user ID and password.
[0004]
[Problems to be solved by the invention]
However, when receiving a web service using a highly public communication terminal such as the above-mentioned MMK, there is a possibility that the personal identification information of the user ID and password may be seen by a third party, which is malicious. There is a risk of being used by a person.
[0005]
Further, when the registered user himself / herself has contracts for a plurality of Web services, it is necessary to store user IDs and passwords corresponding to all the services, and the burden on the registered user regarding the authentication processing is large.
[0006]
Therefore, there is a need for a print network system authentication system, a remote storage server, and a remote output device that are simple and highly reliable as identification information for registered users, and that can prevent abuse by a third party. .
[0007]
[Means for Solving the Problems]
In order to solve this problem, the print network system authentication system according to the first aspect of the present invention stores a plurality of remote output devices that can be used by an unspecified number of users and file information instructed to be stored by the remote output devices. And a print network system authentication system having a remote storage server for providing file information stored in response to a call instruction from the remote output device to the instructed remote output device. (2) Each remote output device outputs image information from the image information reading device at the time of a registration request, and stores the image information as image information for personal authentication. Image authentication requesting means for outputting image information acquired from the outside at the time of authentication request, The remote storage server stores the image information from the remote output device for each user as personal authentication image information at the time of registration request, and also receives the image information from the remote output device at the time of authentication request. Image authentication means for performing user authentication by collating with authentication image information is provided.
[0008]
The remote storage server of the second aspect of the present invention stores file information instructed to be stored from any of a plurality of remote output devices that can be used by an unspecified number of users, and stores the file information in response to a call instruction from the remote output device. (1) user information management means for managing user personal information previously associated with registered user identification information for each registered user; and (2) (3) Image information registration means for registering the received image information in the user information management means as personal authentication image information together with user authentication based on the identification information of the registered user received from the outside, and (3) image information from the outside when requesting authentication And image authentication means for authenticating the user by collating the image information with the image information for personal authentication. And butterflies.
[0009]
The remote output device of the third aspect of the present invention can be used by an unspecified number of users, and can instruct the remote storage server to store file information and to call out stored file information. The present invention relates to a remote output device that outputs file information from a storage server. (1) Image information reading means for obtaining image information from a document that can be verified by the user, and (2) Image information from the image information reading device at the time of a registration request. And a communication means for storing the image information as image information for personal authentication in a remote storage server via a network and outputting image information acquired from the outside at the time of authentication request. .
[0010]
DETAILED DESCRIPTION OF THE INVENTION
(A) Embodiment
Hereinafter, embodiments of an authentication system, a remote storage server, and a remote output device of a print network system according to the present invention will be described with reference to the drawings.
[0011]
In the present embodiment, file information instructed from a user terminal or the like is stored in a remote storage server, and a registered user can communicate with a multimedia kiosk terminal (MMK) or the like installed in a convenience store or a station even from the outside. A case will be described in which the present invention is applied to an authentication apparatus and an authentication system in a Web service system that uses a terminal to access a remote storage server, obtain file information, and print it out.
[0012]
(A-1) Configuration of the embodiment
(A-1-1) Overall configuration
FIG. 2 shows the overall configuration of the network system of this embodiment. As shown in FIG. 2, the network system 1 of the present embodiment can connect a remote output device 2 and a remote storage server 5 via a network 6. The remote output device 2 can be connected to the image input device 3 and the printer 4.
[0013]
Here, the network 6 is a network constructed by a public network, a dedicated network, or a network that combines them.
[0014]
The remote storage server 5 stores the file information requested by the remote output device 2 in a storage area determined for each registered user, and remotely stores the stored file information in response to a call instruction from the remote output device 2. It is a server that transfers to the output device 2. The remote storage server 5 has a personal authentication function for registered users. For example, the remote storage server 5 provides the above-described service only when the legitimacy is obtained through personal authentication when storing and transferring file information. is there.
[0015]
The remote storage server 5 performs a simple authentication processing function according to the user's intention. This simple authentication processing function refers to the identity of the registered user (eg license, insurance card, etc.) and physical authentication information of the registered user (eg fingerprint, iris, palm, palm defect distribution) Etc.) (hereinafter referred to as personal authentication image data), and simple personal authentication based on the image data received from the remote output device 2 and the stored personal authentication image data. Say.
[0016]
In addition to the above-described functions, the remote storage server 5 comprehensively manages, for example, user management, billing management using registered users, access history for each registered user, and the like.
[0017]
The remote output device 2 is a communication terminal operated by a user. For example, an MMK terminal installed in a convenience store or a station, a personal computer used by the user, or the like can be applied.
[0018]
The remote output device 2 instructs the remote storage server 5 to store file information, instructs the remote storage server 5 to acquire / output storage file information (screen output, print output, etc.), and inputs the user ID / Stores a password and / or a transmission function for transmitting image data of authentication information acquired from the image input device 5 to the remote storage server 5; print control for the printer 4; image data input / output control for the image input device 3; A storage instruction is given to a medium (for example, an IC card or a portable terminal), and a user ID encryption process using an encryption key from the remote storage server 5 is performed.
[0019]
When the user desires simple authentication processing, the remote output device 2 acquires image data scanned by the user from the image input device 3, and sends the acquired image data to the remote storage server 5 via the network 6. To be sent. Further, the remote output device 2 has a connection unit that can be connected to a storage medium, and gives the acquired image data to the storage medium for storage by the user's intention.
[0020]
When the authentication of the user to be operated is obtained by the authentication process or the simple authentication process by the remote storage server 5, the remote output device 2 allows the user to perform the service providing operation.
[0021]
The image input device 3 is commonly handled by a user's operation in a user's license, insurance card, student ID card, other identification card, user signature, company logo (mark), and each business division or department. An image scanner that scans documents that can prove the user, such as a document with a mark, and / or an image that scans personal authentication information such as fingerprint information, iris information, palm information, and blood vessel partial distribution information of the user Applicable to input means. The image input device 3 gives image data of authentication information (identification or personal authentication information) scanned by an image reading means (not shown) to the remote output device 2.
[0022]
The printer 4 is an existing printer that outputs and prints on printing paper based on the acquired file information, and outputs and prints based on the file information acquired from the remote storage server 5 when the user's personal authentication is successful.
[0023]
In the present embodiment, the printer 4 and the image input device 3 are shown as separate components from the remote output device 2, but the remote output device 2 may have a print output function and an image input function.
[0024]
(A-1-2) Internal configuration of remote storage server 5
Next, the internal configuration of the remote storage server 5 will be described in detail with reference to FIG.
[0025]
As shown in FIG. 3, the internal configuration of the remote storage server 5 includes a control unit 501, a storage unit 502, a personal authentication image data storage unit 503, an image authentication unit 504, an encryption key issuing unit 505, and an unauthorized authentication determination unit 506. A user management unit 507, a user management database 508, and a communication unit 509.
[0026]
The remote storage server 5 is configured by software that can be executed by the control unit 501, and functions executed by the remote storage server 5 are controlled by the control unit 501.
[0027]
The control unit 501 controls the function of the remote storage server 5 and corresponds to a CPU or the like.
[0028]
The storage unit 502 is a storage unit necessary for the control unit 501 to operate a function, and corresponds to a ROM, a RAM, or the like.
[0029]
The personal authentication image data storage unit 503 stores the image data received from the remote output device 2 as individual authentication image data for each user. The personal authentication image data storage unit 503 stores the address of the storage area of the personal authentication image data stored for each user in the user management database 508 in association with the user ID.
[0030]
The personal authentication image data storage unit 503 can change the registered personal authentication image data in accordance with an instruction from the remote output device 2. Further, a plurality of personal authentication image data may be stored in combination.
[0031]
The image data for personal authentication may be all image data obtained by converting the ID card and the personal authentication information into an image, or may be a part of the image information.
[0032]
For example, when scanning a license, for example, the image of the license may be divided into four, and may be image information of the divided ¼ portion, or when scanning the user's fingerprint, for example, the characteristics of the fingerprint The extracted image information obtained by converting only points may be used.
[0033]
Alternatively, for example, image information obtained by multiplying scanned image data by a predetermined conversion coefficient may be used.
[0034]
After the registration of the personal authentication image data, the image authentication unit 504 compares the image data received from the remote output device 2 with the personal authentication image data registered in the personal authentication image data storage unit 503 for authentication processing. Is to do.
[0035]
When the image authentication unit 504 receives the image data and the encrypted user ID from the remote output device 2, the image authentication unit 504 acquires a user ID and a secret key registered in the user management database 508 based on the image data. Then, the image authentication unit 504 decrypts the encrypted user ID received using the acquired secret key, and collates the decrypted user ID with the registered user ID, thereby confirming the user's Personal authentication is performed.
[0036]
Further, when the image authentication unit 504 acquires image data from the remote output device 2, the image authentication unit 504 authenticates the user by comparing the image data with the image data for personal authentication stored in the personal authentication image data storage unit 504. Is.
[0037]
The encryption key issuing unit 505 issues an encryption key for each user ID for encrypting and decrypting the user ID when the remote output device 2 receives a simple authentication registration selection instruction. For example, the encryption key issuing unit 505 issues a public key and a secret key, stores the secret key in the user management database 508 in association with the user ID, and transmits the public key to the remote output device 2. is there.
[0038]
The unauthorized authentication determination unit 506 manages the installation position information of the remote output device 2 that has requested authentication and the date and time information related to the authentication request, and for the same user, the remote output device 2 related to the previous and current authentication requests. It is determined whether or not an authentication request by the user is physically possible based on the installation position information and date / time information related to the previous and current authentication requests.
[0039]
For example, when the remote user is requested from the remote output device 2 in Osaka city 30 minutes later when the remote user is placed in the Tokyo location of the remote output device 2 related to the previous authentication request for the same user. The current authentication request is determined to be a physically impossible request, and the authentication process is rejected.
[0040]
The unauthenticated authentication determination unit 506, for example, of the installation position information of the remote greedy device 2 determined according to the distance that the user can move within a certain time (for example, within 30 minutes, within 1 hour, within 1 day, etc.). It has a list, and based on the management information of the current time and the previous time, the list is referred to and it is determined whether or not it is an unauthorized authentication request.
[0041]
The management information for the unauthorized authentication determination unit 506 to determine an unauthorized authentication request is not limited to the installation position of the remote output device 2. For example, the location of the store where the remote output device 2 is installed (a plurality of stores has multiple stores). Even when the remote output device 2 is provided, the store position is indicated), the use area, the distance calculated from the previous and current installation positions of the remote output device 2, the country name of the authentication request destination, and the like may be managed. In the present embodiment, the installation information of the remote output device 2 and the date / time information related to the authentication request are used as management information.
[0042]
The user management unit 507 manages personal information of each registered user stored in the user management database 508.
[0043]
The user management database 508 is a database for storing personal authentication information of registered users. Information stored in the user management database 508 is managed by the control unit 501 based on the personal authentication information management table 510.
[0044]
The personal information management table 510 is managed, for example, with a configuration as shown in FIG.
[0045]
As shown in FIG. 4, the personal authentication information management table 510 includes a user ID, a password, image data for personal authentication, a user name / address, an encryption key, and an installation position of a remote output device for a previous authentication request (FIG. 4). (The position of the previous authentication request), the previous authentication request date / time information, age, contract details, and the like. In addition, accounting management, authentication request history, and the like can be managed.
[0046]
The communication unit 509 corresponds to a communication board, communication software, or the like, and has a communication function that enables communication on the network 7 and an electronic mail communication function.
[0047]
(A-1-3) Internal configuration of remote output device 2
Next, the internal configuration of the remote output device 2 will be described with reference to FIG. The remote output device 2 includes a control unit 201, a storage unit 202, an operation unit 203 operated by a user, a display unit 204, an image authentication unit 205, a scan data storage unit 206, and a communication unit 207.
[0048]
The control unit 201 controls the function of the remote output device 2 and corresponds to a CPU or the like.
[0049]
The storage unit 202 is a storage unit necessary for the control unit 201 to operate a function, and corresponds to a ROM, a RAM, or the like.
[0050]
The operation unit 203 is an interface operated by the user, and requests for authentication to the remote storage server 5, input processing of a user ID and password, selection of simple authentication registration, and an image for personal authentication captured from the image input device 3. A storage instruction for storing data in a storage medium such as an IC card, a storage instruction for file information stored in the remote storage server 2, and the like are given.
[0051]
The display unit 204 is a display unit for displaying a progress procedure such as an instruction related to an authentication procedure or a selection instruction from the remote storage server 5 or displaying information extracted from the remote storage server 5 by a user operation.
[0052]
The operation unit 203 and the display unit 204 may be a touch panel type operation display unit.
[0053]
The scan data storage unit 206 captures and temporarily stores the image data for personal authentication acquired from the image input device 3 by a user operation, and a storage medium such as an IC card or a portable terminal according to a user instruction from the operation unit 203 Is to be stored.
[0054]
The scan data storage unit 206 includes an IC card insertion slot, a connector that enables connection with a portable terminal, a wireless communication unit (for example, an infrared communication unit, Bluetooth (registered trademark)), and the like. The image data for personal authentication is stored in an IC card or a connectable mobile phone.
[0055]
The communication unit 207 corresponds to a communication board, communication software, or the like, and has a communication function and an electronic mail communication function that enable communication on the network 7.
[0056]
(A-2) Operation of the embodiment
Next, operations of the authentication apparatus and the authentication system of the present embodiment will be described in detail with reference to the drawings.
[0057]
In the following, first, an operation for acquiring and registering personal authentication image data as a simple authentication registration operation will be described with reference to FIG.
[0058]
(A-2-1) Simple authentication registration operation
By the operation of the user, the remote output device 2 starts access to the remote storage server 5 via the network 6 (S101).
[0059]
A request for input of a user ID and password is made from the remote storage server 5, and in response to the request, the user ID and password are input to the remote output device 2 by the user's operation, and the remote output device 2 sends it to the remote storage server 2. Is given (S102).
[0060]
When the user ID and password are input from the remote output device 2, the remote storage server 5 retrieves the personal authentication information from the user management database 508 based on the user ID and performs password verification (S103).
[0061]
When the password authentication is NG, the remote storage server 5 determines that the registered user is not valid, ends the authentication process, and does not perform the simple authentication registration process (S103 and S113). At this time, the remote storage server 5 may request the remote output device 2 to re-input the user ID and password a predetermined number of times.
[0062]
If the password authentication is OK, the remote storage server 5 determines that the registered user is valid, and transmits an inquiry as to whether or not to perform simple authentication registration to the remote output device 2, which indicates that the display unit 203. (S104).
[0063]
An inquiry as to whether or not to perform simple authentication registration is displayed on the display unit 203, and whether or not to perform simple authentication registration is selected by a user operation (S105).
[0064]
If the user does not wish to perform simple authentication registration, the personal authentication has already been completed, and the authentication process ends (S105 and S113).
[0065]
When the user desires simple authentication registration, the user presses a selection key for selecting registration of simple authentication, and this is given to the remote storage server 5.
[0066]
At this time, the type of authentication information for personal authentication (type of identification, fingerprint, etc.) for simple authentication registration may be determined in advance by the administrator on the remote storage server 5 side, or the administrator side The user may be able to select from the types shown.
[0067]
Here, the authentication information for personal authentication will be described as an identification card (for example, a license).
[0068]
By the user's operation, the image input device 3 reads the identification card owned by itself, and gives the image data of the identification card to the remote output device 2 (S106).
[0069]
When identification image data is given to the remote output device 2, an inquiry as to whether or not to store the identification image data in the IC card possessed by the user is displayed on the display unit 204 of the remote output device 2 ( S107).
[0070]
In this embodiment, the storage medium for storing the image data of the identification card is an IC card. However, the present invention can be widely applied to a portable terminal having storage means and other storage media possessed by the user.
[0071]
When the user wishes to store in the IC card, the user presses a selection key for storing in the IC card, and this is given to the remote storage server 5 (S107).
[0072]
At this time, the remote storage server 5 receives a notification from the remote output device 2 and issues an encryption key for encrypting / decrypting the user ID for each user ID (S114). As for the issued encryption key, the public key is transmitted to the remote output device 2, and the secret key is stored in association with the user ID of the user management database 508.
[0073]
The remote output device 2 downloads the public key issued by the remote storage server 5 by the user (S108), and encrypts the user ID using the public key (S109).
[0074]
When the user ID is encrypted in the remote output device 2, the image data and the public key are stored in a predetermined storage area of the IC card in association with the encrypted user ID (S110).
[0075]
The image data to be stored in the IC card is the same as the personal authentication image data registered in the remote storage server 5 and may be all or a part of the authentication information. When using a palm or the like, the image input device 3 may extract only feature points such as a fingerprint or a palm and store the feature points in a storage medium (an IC card or a portable terminal).
[0076]
When the image data for personal authentication is stored in the IC card or when it is not desired to store in the IC card in S107, the image data acquired by the image input device 3 is transmitted to the remote storage server 5 (S111). .
[0077]
When image data is given from the remote output device 2 to the remote storage server 5, the received personal authentication image data is stored in the personal authentication image data storage unit 503 as personal authentication image data in the remote storage server 5. (S112). Also, the storage area address storing the personal authentication image data is stored in the user management database 508 in association with the user ID.
[0078]
The personal authentication image data may be in any form as long as it is stored in association with the user ID.
[0079]
As described above, the registration operation of the personal authentication image data used for the simple authentication process is completed (S113).
[0080]
(A-2-2) Simple authentication process based on personal authentication image data
Next, the operation of the simple authentication process based on the registered personal authentication image data will be described with reference to FIG.
[0081]
By the user's operation, the remote output device 2 starts access to the remote storage server 5 via the network 6 (S201).
[0082]
An authentication request reception screen from the remote storage server 5 is displayed on the display unit 204 of the remote output device 2, and the reception screen includes a selection key for determining whether or not to perform simple authentication processing. In this embodiment, since the user desires simple authentication, the user selects a selection key for the simple authentication process (S202).
[0083]
When the simple authentication process is selected by the user, the image data related to the simple authentication process is fetched, that is, the image data stored in the IC card is used or the image data read by the image input device 3 without using the IC card. An inquiry about whether to use is displayed (S203). Here, an inquiry as to whether or not to use the IC card storing the personal authentication image data is displayed on the display unit 204 (S203).
[0084]
Hereinafter, the case where the IC card is used and the case where the IC card is not used will be described separately.
[0085]
If the user wishes to use an IC card, the user presses the selection key for using the IC card, inserts the IC card into the IC card insertion slot (S204), and stores the encryption stored in the IC card. The user ID and the corresponding image data are extracted (S205).
[0086]
The encrypted user ID and image data taken out from the IC card are given as transmission signals from the remote output device 2 to the remote storage server 5 (S206).
[0087]
When the transmission signal is given to the remote storage server 5, the remote storage server 5 extracts the image data included in the transmission signal, extracts the user ID and the secret key corresponding to the image data, and uses the secret key. The encrypted user ID is decrypted (S211).
[0088]
In the remote storage server 5, when the user ID is decrypted, the decrypted user ID is collated with the registered user ID (S212).
[0089]
User authentication is performed by comparing the image data and the encrypted user ID (S213). If the authentication is OK, the user is authenticated as a registered user and the remote output device 2 indicates that the authentication is OK. Notification is made (S214).
[0090]
If the authentication is NG, it cannot be justified that the user is a registered user, and the remote output apparatus 2 is notified of the authentication NG (S215).
[0091]
In this way, the simple authentication process ends (S216).
[0092]
Next, a case where the user does not wish to use an IC card will be described.
[0093]
If the user does not wish to use the IC card, the user selects a selection key not to use the IC card (or does not select the selection key to use the IC card), and the registered personal authentication image The image input device 3 scans the image data of the same authentication information (identification in this embodiment) as the data (S207).
[0094]
When the identification card is scanned, image data of the scanned identification card is temporarily stored, and an inquiry as to whether or not to send a password is displayed. (S208).
[0095]
When the user desires to input a password, the password is input by the user (S209), and the password together with the image data is transmitted as a transmission signal to the remote storage server 5 (S210).
[0096]
The remote storage server 5 retrieves the registered password based on the received transmission signal or image data, collates the received password with the registered password, and performs personal authentication of the user (S212 to S213).
[0097]
If the user does not wish to input a password, the password is not input and a transmission signal including image data is transmitted to the remote storage server 5 (S210).
[0098]
When the transmission signal is given from the remote output device 2, the remote storage server 5 collates the image data included in the transmission signal with the registered personal authentication image data (S212), and the user authentication process is performed. .
[0099]
Here, the collation of the image data in the remote storage server 5 will be described.
[0100]
In the remote storage server 5, after the simple authentication process by collating the personal authentication image data, the operations in S213 to S216 are the same as those described above, and the description thereof is omitted here.
[0101]
(A-2-3) Unauthorized authentication judgment operation
Next, if the authentication request from the remote output device 2 is physically impossible, an illegal authentication determination operation for rejecting the simple authentication process for the authentication request will be described with reference to FIGS. I will explain.
[0102]
The operation flow of FIG. 7 relates to the operation of the remote storage server 5. For authentication requests from the same user, the previous and current authentication request date and time information and the previous and current remote output device installation position information. Based on the above, a case where it is determined whether or not an authentication request by the user is possible is described.
[0103]
The remote storage server 5 starts by accessing from the remote output device 2 (S301), and an authentication request is made from the remote output device 2 (S302).
[0104]
When the simple authentication process is selected from the remote output device 2, image data for personal authentication is given from the remote output device 2 (S303).
[0105]
When the personal authentication image data is received from the remote output device 2, the remote storage server 5 performs a simple authentication process by comparing the received personal authentication image data with the registered personal authentication image data (S304). .
[0106]
Since the selection operation of the simple authentication process, the transmission / reception operation of the personal authentication image data, and the operation of the simple authentication process by the remote output device 2 have already been described with reference to FIG.
[0107]
When the user authentication is performed based on the simple authentication based on the personal authentication image data and the authentication is OK, the date and time information related to the previous authentication request and the date and time information related to the current authentication request acquired from the user management database 508 for the user. The time difference is determined based on (S305).
[0108]
The date / time information related to the authentication request is, for example, date / time information acquired by using a date / time management unit (not shown) of the remote storage server 5 or a standard date / time management server (not shown) connectable to the network. The date / time information related to the previous authentication request is stored in the user management database 506 in association with the user ID.
[0109]
Also, if the date and time information related to the previous authentication request is not stored in the user management database 506, the current authentication request is regarded as the first one and no unauthorized authentication determination is performed.
[0110]
Next, for the user, the distance between the installation positions based on the installation position of the remote output device 2 related to the previous authentication request acquired from the user management database 506 and the installation position of the remote output device 2 related to the current authentication request. The difference is determined (S306).
[0111]
The distance difference between the remote output device 2 related to the previous and current authentication requests may be, for example, a distance connecting two points (the previous and current installation positions of the remote output device 2) with a straight line, or It may be a distance based on one or a plurality of map-like moving routes required to register the installation position of the remote output device 2 on the map in advance and move between the two points. In this case, when there are a plurality of movement routes, a priority order such as selecting the shortest distance among them may be provided.
[0112]
Whether or not the current authentication request is physically possible within the time difference based on the information of the previous and current authentication request time difference obtained in S305 and S306 and the distance difference between the remote output devices 2. An unauthorized authentication determination is made (S307).
[0113]
This unauthorized authentication determination is made by referring to, for example, a list in which the distance that the user can move is determined every certain time, and the distance between the previous and current authentication request destinations is determined from the time difference between the previous and current authentication requests. When the distance is equal to or shorter than the distance of the list corresponding to the obtained time, it is determined that the request is valid, and when it is larger than the distance of the list, it is determined that the request is invalid.
[0114]
In addition, as another unfair accreditation determination, for example, a circle indicating the distance that can be moved in the time obtained from the difference between the previous and current authentication request time is formed with the previous installation position of the remote output device 2 as the center of the circle, When the installation position of the remote output device 2 related to the current authentication request is located within the movable circle, and is determined to be a valid authentication request, and is located outside the inner circle. It is determined that the authentication request is invalid.
[0115]
If it is determined in S307 that the request is a valid authentication request, the remote output device 2 is notified that the authentication has been successful (S308). If it is determined that the request is an invalid authentication request, an authentication error occurs. A message to that effect or a warning is sent to the remote output device 2 (S309).
[0116]
As described above, when the unauthorized authentication determination is performed and it is determined that the request is an unauthorized authentication request, the authentication process for the user is rejected and terminated (S310).
[0117]
Next, the operation of the unauthorized authentication determination will be described with reference to FIG.
[0118]
The operation flow of FIG. 8 also relates to the operation of the remote storage server 5 as in FIG. 7, and FIG. 8 illustrates the case where the installation position of the remote output device 2 related to the previous and current authentication requests is between different countries. To do.
[0119]
In FIG. 8, the operations from the start to the user authentication correspond to the operations of S301 to S304 described in FIG.
[0120]
In S304, when the user authentication is performed and the authentication is OK, the date / time difference based on the date / time information related to the previous authentication request and the date / time information related to the current authentication request acquired from the user management database 508 for the user. Is determined (S401).
[0121]
Further, based on the transmission signal received from the remote output device 2, the country name where the remote output device 2 is installed is determined (S402).
[0122]
Further, the country name where the remote output device 2 used for the previous authentication request is installed is acquired from the location information of the previous authentication request stored in the user management database 508, and between the date and time obtained in S401, If the country name of the location where the remote output device 2 used this time is different from that of the previous time, and the authentication request is made continuously, it is determined that the current authentication request is invalid. .
[0123]
When it is determined to be unfair by this unfair authentication determination, a notification or a warning is given to the remote output device 2 that has been requested this time (S309), and it is determined to be valid Is notified that the authentication was successful (S308).
[0124]
In this way, an unauthorized authentication determination is made and the authentication process ends (S310).
[0125]
(A-3) Effects of the embodiment
As described above, according to the present embodiment, after the personal authentication image data is registered, the user can simply perform the registered personal authentication image data and perform authentication processing with high accuracy of personal authentication. .
[0126]
(B) Other embodiments
(B-1) In the above-described embodiment, the description has been given regarding the authentication process of the print storage server 5, but the present invention is not limited to this, and the present invention can be widely applied to the authentication process of a system network that can provide a service via the network.
[0127]
(B-2) Although the simple authentication registration in FIG. 1 has been described as being performed after user authentication by the registered user's user ID, image data for personal authentication may be registered at the time of contract.
[0128]
Further, when the user or the related person stores a plurality of file information in the remote storage server 5 or receives provision of a plurality of different service contents, images for personal authentication that differ for each file information or service contents Data may be registered.
[0129]
Further, when the store where the MMK terminal (remote output device 2) used by the user is determined, different personal authentication image data may be registered for each store.
[0130]
A plurality of pieces of image data for personal authentication may be associated with one file information stored in the remote storage server 5. For example, when employees in a department or department of a company commonly store and acquire file information in the remote storage server 5, all of the departments or departments are stored for each file information to be stored or allocated storage area. The image data for personal authentication of each employee may be associated, and the authentication processing of the above-described embodiment may be performed when the file information is stored and acquired.
[0131]
In the above case, the remote storage server 5 needs to manage image data for personal authentication for each service and / or each store.
[0132]
(B-3) The simple authentication process in FIG. 6 has been described as performing the simple authentication process using the image data for personal authentication of the IC card.
[0133]
However, in addition to this, for example, when an e-mail address of a communication terminal (including a mobile phone having an e-mail function) used by the user is registered in advance and the remote storage server 5 receives the image data for personal authentication. Or, after authenticating with the image data for personal authentication, using the corresponding user's e-mail address as the destination, send an e-mail attached with information that a simple authentication request has been made, and confirmation from the user who received the e-mail After obtaining the certificate, the final authentication may be completed.
[0134]
Thereby, a user loses an IC card, and it can prevent the authentication request | requirement by a malicious third party.
[0135]
(B-4) In FIG. 6, the case where the password is input in the simple authentication process when the IC card is not used has been described (S208). However, the identification is not limited to the password, and other identifications such as a user ID and an email address Information may be input.
[0136]
(B-5) Although the unauthorized authentication determination process of FIGS. 7 and 8 has been described for the case where the simple authentication process is performed, it can also be applied to a conventional authentication process for managing the user authentication request history.
[0137]
(B-6) Although it has been described in FIG. 7 and FIG. 8 that the inappropriate authentication determination process is performed after the user authentication process, it may be performed before the user authentication process. In this case, after making an unauthorized authentication determination based on the authentication request history (including the previous authentication request) of the user corresponding to the personal authentication image data, if the authentication is unauthorized, the user's simple authentication process is rejected.
[0138]
(B-7) In the unauthorized authentication determination process of FIGS. 7 and 8, the present embodiment has been described as rejecting the authentication process in response to an authentication request that is physically impossible.
[0139]
However, when the authentication system of the present application is applied to authentication processing of another network system, the authentication request may be rejected according to the service contents provided by the network system.
[0140]
For example, when the service content to be provided is a service provided only in a region, the authentication request from the remote output device 2 installed outside the region is rejected, or a user under 18 years old If the service is prohibited from being provided, the age of the user stored in the user management database 508 may be confirmed, and if it is less than 18, the authentication request may be rejected.
[0141]
In the latter case, when the personal authentication information of the user is registered, contact information of the guardian, for example, information that can be contacted such as an e-mail address or an address telephone number is registered, and the user requests authentication. It may be possible to notify the guardian.
[0142]
(B-8) The remote storage server 5 provides an effective period during which the registered personal authentication image data can be used, and invalidates the use of the registered personal authentication image data after the expiration of the effective period.
[0143]
The remote storage server 5 may notify the registered user of the e-mail address registered in advance before the expiration of the valid period as the transmission destination, and decide to change or maintain the instruction according to the instruction from the registered user. it can.
[0144]
【The invention's effect】
As described above, according to the print network system authentication system, remote storage server, and remote output device of the present invention, it is a highly accurate and simple authentication method as personal authentication information for registered users, and prevents misuse by third parties. Can do.
[Brief description of the drawings]
FIG. 1 is a flowchart illustrating simple authentication registration according to an embodiment.
FIG. 2 is an overall configuration diagram of a network system 1 according to the embodiment.
FIG. 3 is an internal configuration diagram of a remote storage server 5 according to the embodiment.
FIG. 4 is a personal authentication management table of a user management database according to the embodiment.
FIG. 5 is an internal configuration of a remote output device according to the embodiment.
FIG. 6 is a flowchart illustrating a simple authentication process according to the embodiment.
FIG. 7 is a flowchart illustrating an unauthorized authentication process according to the embodiment.
FIG. 8 is a flowchart illustrating an unauthorized authentication process according to the embodiment.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 ... Network system, 2 ... Remote output device, 3 ... Image input device,
5 ... remote storage server, 501 control unit, 502 ... storage unit,
503 ... Image data storage unit for personal authentication, 504 ... Image authentication unit,
507 ... User management unit, 508 ... User management database, 201 ... Control unit,
206: Scan data storage unit.

Claims (13)

Multiple remote output devices available to an unspecified number of users;
A print network system having a remote storage server for storing file information instructed to be stored from the remote output device and supplying the file information stored in response to a call instruction from the remote output device to the remote output device instructed In the authentication system of
An image information reading device for obtaining image information from a document that can be proved by the user,
Each remote output device outputs image information from the image information reading device at the time of registration request, stores the image information as image information for personal authentication, and outputs image information acquired from the outside at the time of authentication request Image authentication request means for
The remote storage server stores image information from the remote output device for each user as a personal authentication image information at the time of registration request, and receives image information from the remote output device at the time of authentication request. An authentication system for a print network system, comprising image authentication means for performing user authentication by comparing the personal authentication image information with the personal authentication image information. Provided with an individual information reading device that obtains individual information from individual characteristics such as the user's own fingerprint, iris, palm, and blood vessel distribution of the palm,
2. The print network system authentication system according to claim 1, wherein the remote output device stores the individual information from the individual information reading device in the remote storage server as the image information for personal authentication. The remote storage server is
User information management means for managing user personal information previously associated with identification information of registered users for each registered user;
At the time of registration request, after successful user authentication with the identification information from the remote output device, the image information from the remote output device is received, and the image information is associated with the identification information and the user information management means 3. An authentication system for a print network system according to claim 1, further comprising image information registration means to be stored in the print network system. 4. The storage device according to claim 1, wherein the remote output device has storage medium communication means for storing the image information from the image input device in a storage medium possessed by the user when a registration request is made. An authentication system for a print network system as described in 1. The remote storage server comprises an encryption key issuing means for issuing an encryption key for encrypting the identification information according to an instruction from the remote output device;
5. The remote output device stores the identification information encrypted using the encryption key from the remote storage server in the storage medium in association with the image information. The print network system authentication system described. In the remote output device, when an authentication request is made, the storage medium communication means calls the image information stored in the storage medium and the encrypted identification information, and remotely transmits the image information and the encrypted identification information. 6. The print network system authentication system according to claim 4, wherein the authentication is output to a storage server. The remote storage server is
For the remote output device that has requested the authentication, at least the access position of the installation position information and the authentication request date and time information is detected, and the access mode detection unit that is stored in the user information management unit,
Referring to the authentication request history, an unauthorized authentication determination means for determining whether or not the access mode of the remote output device related to the current authentication request is a physically impossible request;
7. An authentication refusing unit for rejecting user authentication related to the current authentication request when the unauthenticated authentication determining unit determines that the current authentication request is invalid. An authentication system for a print network system as described in 1. The file information instructed to be stored from any of a plurality of remote output devices that can be used by an unspecified number of users, and the remote instructed to store file information in response to a call instruction from the remote output device In the remote storage server that feeds the output device,
User information management means for managing user personal information previously associated with identification information of registered users for each registered user;
Image information registration means for registering the received image information as personal authentication image information in the user information management means together with user authentication based on registered user identification information received from outside,
A remote storage server comprising image authentication means for receiving image information from the outside and requesting user authentication by collating the image information with the personal authentication image information when an authentication request is made. 9. The remote storage server according to claim 8, further comprising: an encryption key issuing unit that issues an encryption key for encrypting the identification information according to an instruction from the outside. For the remote output device that has requested the authentication, at least the access position of the installation position information and the authentication request date and time information is detected, and the access mode detection unit that is stored in the user information management unit
Referring to the authentication request history, an unauthorized authentication determination means for determining whether or not the access mode of the remote output device related to the current authentication request is a physically impossible request;
The remote storage according to claim 9, further comprising: an authentication rejection unit that rejects user authentication related to the current authentication request when the incorrect authentication determination unit determines that the current authentication request is invalid. server. A remote that can be used by an unspecified number of users, can instruct the remote storage server to store file information, can also call the stored file information, and can output file information from the remote storage server In the output device,
Image information reading means for obtaining image information from a document that can be proved by the user,
At the time of registration request, the image information from the image information reading device is output, and the image information is stored as personal authentication image information in a remote storage server via the network, and the image information acquired from the outside at the time of authentication request And a communication means for outputting a remote output device. 13. The remote output device according to claim 12, further comprising storage medium communication means for supplying the image information from the image information reading means to a storage medium possessed by the user for storage. An encryption means for encrypting the identification information using an encryption key received from the remote storage server;
13. The remote output device according to claim 12, further comprising storage medium storage instruction means for instructing the storage medium to store the identification information encrypted by the encryption means in association with the image information.

Images