JP2005149237A - Image processing system, personal identification method, and image forming apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To realize a further firm security by requesting an additional authentication to a third party in addition to a conventional personal identification method. <P>SOLUTION: Links to areas 307-309 describing the presence/absence of setting of personal identification method and the presence/absence of setting of additional authentication by a third party, in case of using each function or a box, are described in areas 301-306 of an authentication management table. For example, the description of the area 307 shows that additional authentication is needed in addition to the authentication by an IC card and a pass code. In this area, the link to an authentication destination table 313 is described. The table 313 is composed of an authentication logic expression 316 and an authentication destination entries 319-321 that are requesting destinations of authentication by the third party. The authentication logic expression 316 regulates that what kind of authentication received from the authentication destination entries 319-321 results in the determination of authentication. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an image processing system, a personal authentication method and an image forming apparatus in the system.

In recent years, the functions of copiers and printers have evolved and integrated, and multifunction machines incorporating a FAX function and a document server function have become widespread.

  When such a multifunction device is used in, for example, a company, personal authentication of the operator is required for accounting management such as copy count and print count, and security management for extracting documents on the document server. Need to do.

  Conventionally, typical methods for such personal authentication include an authentication method using a personal ID and a password, and an authentication method using an ID card.

  An authentication method using a personal ID and a password is a method of issuing a personal ID registered in an authentication system on a device main body or a network connected to the device in advance by operating a device panel when the device is used by the user. When the password is input, the authentication system verifies the personal ID and the password and authenticates the user.

  The ID card authentication method registers personal information in an ID card and inserts the ID card into an ID card reader connected to the device so that the device scans the information on the ID card. Based on the information, the ID card user is authenticated by collating with information registered in advance in an authentication system on the device main body or on the network to which the device is connected. Recently, a non-contact type reading device using an IC card has appeared, and there is a device that can read necessary information by simply holding the ID card and holding it over the reading device.

  Furthermore, in order to improve security, there is also a method of performing authentication using both an ID card and a password (Patent Document 1).

JP 2000-10441 A

  In the authentication method using the personal ID and password as described above, the personal ID and password may be stolen and used illegally. Even when an ID card is used, an illegally obtained card may be illegally used due to theft or forgery of the ID card. Furthermore, even when a password and an ID card are used in combination, if the password and the ID card are stolen, unauthorized access becomes possible. There are security problems such as.

  The present invention has been made to solve the above-mentioned problems, and its purpose is only to collate with personal data arranged on a system such as an authentication method using a personal ID and a password or an authentication method using an ID card. In addition to a personal authentication method for performing personal authentication, an image processing system capable of realizing stronger security by requesting additional authentication from a third party, and a personal authentication method and an image forming apparatus in the system. Is to provide.

  In order to achieve the above object, the image processing system according to the present invention includes a plurality of types of image processing functions or a plurality of types of information stored in the system, and the personal authentication and / or the personal authentication by the personal authentication means. Authentication method setting means for setting whether to perform personal authentication by a third party together with the authentication method, and according to the set authentication method, the personal authentication by the personal authentication means and / or the personal authentication by the third party And a plurality of types of image processing functions or additional authentication means for permitting use or access for each of the plurality of types of information according to the authentication result.

  Further, the personal authentication method in the image processing system according to the present invention provides the personal authentication by the personal authentication means for each of a plurality of types of image processing functions of the image processing system or a plurality of types of information stored in the system. And / or an authentication method setting step for setting whether to perform personal authentication by a third party together with the authentication method, and according to the set authentication method, the personal authentication by the personal authentication means and / or by the third party The personal authentication is performed, and a plurality of types of image processing functions or a further authentication step for permitting use or access for each of the plurality of types of information according to the authentication result is adopted.

  According to the present invention employing such a configuration, in addition to a personal authentication method for performing personal authentication only by collating personal authentication information arranged on a system, such as an authentication method using a personal ID and a password or an authentication method using an ID card. By requesting additional authentication from a third party, there is an effect that stronger security can be realized.

  A configuration of a color composite image forming apparatus 100 suitable for applying the present invention will be described with reference to FIG. Needless to say, the image processing system to which the present invention can be applied is not limited to a color composite image forming apparatus, but may be a single printer, a single copying machine, a single FAX machine, and these black and white devices. Yes.

  FIG. 1 is a side sectional view showing a configuration of a color composite image forming apparatus to which the present invention is applicable. In the figure, 201 is an image scanner unit which scans a document and performs digital signal processing. A printer unit 200 prints and outputs the image read by the image scanner 201 and the image generated and processed by the controller unit 1000 in full color on paper.

  In the image scanner unit 201, a digitizer 202 also serves as a document pressure plate. The digitizer 202 is used to designate an area on the document by pressing a desired point on the document 204 placed thereon before the scanning operation with an attached pen.

Hereinafter, the configuration of the image scanner unit 201 and the document scanning operation will be described.
When an original 204 is placed on an original platen glass (hereinafter referred to as “platen”) 203 and a start of a copying or scanning operation is instructed from the operation unit 1010, the original 204 is irradiated with light from a halogen lamp 205. Reflected light from the original is guided to mirrors 206 and 207, and forms an image on a three-line sensor (hereinafter referred to as “CCD”) 210 by a lens 208.

  The CCD 210 decomposes the optical information into red (R), green (G), and blue (B) components, amplifies a signal representing the optical information by an amplification circuit (not shown), and sends the amplified signal to the image signal processing unit 209. .

  The halogen lamp 205 and the mirror 206 are at a speed v, and the mirror 207 is at a speed v / 2 and is perpendicular to the electrical scanning direction of the line sensor (hereinafter referred to as “main scanning direction”) (hereinafter referred to as “sub-scanning”). It is mechanically moved in the “scanning direction”) and scans the entire surface of the document.

  The image signal processing unit 209 electrically processes the read signal, performs appropriate image processing according to the document type, and sends it to the controller unit 1000 as a video signal.

  The controller unit 1000 supervises control of each device in the color composite image forming apparatus 100, and mainly includes PDL data, FAX data, remote print data notified from the outside, and image data notified from the image scanner unit 201. Image data to be printed is generated and notified to the printer unit 200 as magenta (M), cyan (C), yellow (Y), and black (BK) video signals.

Hereinafter, the configuration and printing operation of the printer unit 200 will be described.
The video signal sent to the printer unit 200 is converted into a laser drive signal by the laser driver 212 and drives a semiconductor laser (not shown). The laser beam scans the photosensitive drum 217 charged to a uniform potential by the charger 211 via the polygon mirror 214, the f-θ lens 215, and the mirror 216, thereby forming an electrostatic latent image.

  Reference numerals 219 to 222 denote developing units, which include a magenta developing unit 219, a cyan developing unit 220, a yellow developing unit 221, and a black developing unit 222. These four developing units are alternately in contact with the photosensitive drum 217, and the electrostatic latent image corresponding to each of the M, C, Y, and BK color components formed on the photosensitive drum 217 is developed with the corresponding toner.

  A transfer drum 223 winds a sheet fed from the sheet cassette 224 or 225 around the transfer drum 223, and transfers the toner image developed on the photosensitive drum 217 to the sheet.

  After the images formed by the four colors M, C, Y, and BK are sequentially transferred in this way, the sheet passes through the fixing unit 226 and is discharged.

  FIG. 2 is a block diagram illustrating a control system for the color composite image forming apparatus configured on the controller unit 1000. Note that the present invention is not limited to a single device, a system composed of a plurality of devices, or a system in which processing is performed via a network such as a LAN as long as the functions of the present invention are executed. Needless to say, it can be applied.

  In the controller unit 1000, reference numeral 1001 denotes a CPU, which is connected to the system bus 1004 based on a control program stored in the program ROM of the ROM 1003 or a control program stored in the hard disk (HD) 1006 and loaded into the RAM 1002 at startup. Overall control of access to various connected devices.

  As main control contents of the CPU 1001, control for receiving a video signal input from the image scanner unit 201 via the scanner I / F and storing it in an image buffer formed in the RAM 1002, and input from the external network 2000 via the I / O 1007. The printer 100 interprets the print data such as PDL and controls the formation of an image in the image buffer formed in the RAM 1002. The FAX unit 1009 interprets the FAX data input from the telephone line 2001 via the telephone I / F 1013, and the RAM 1002. Control to form an image in the image buffer to be formed on the image buffer, and output images on the image buffer on the RAM 1002 to the print unit (printer engine) 200 connected via the print unit interface 1008 as output information Y, C, M , Bk video signals There is a control or the like for power.

  The program ROM of the ROM 1003 stores a control program of the CPU 1001 as shown in the flowcharts of FIGS. The data ROM of the ROM 1003 stores reference data obtained by extracting features of specific images such as banknotes and securities. The CPU 1001 can perform communication processing with an external device such as the host computer 2222 connected to the external network 2000 via the I / O 1012. In FIG. 2, the CPU 1001 communicates with an external device via the external network 2000, but it goes without saying that the communication may be performed by directly connecting to the external device via an interface (not shown). .

  The RAM 1002 functions as a main memory, work area, and the like of the CPU 12, and is configured such that the memory capacity can be expanded by an optional RAM connected to an expansion port (not shown). The RAM 1002 is used as an image buffer area for storing a PDL image, a FAX image, a scanned image, an environment data storage area, and the like. Access to the HD 1006 is controlled by a memory controller (MC) 1005. The HD 1006 is used as a document box or the like for storing font data used at the time of PDL data analysis, temporarily storing images in the image buffer of the RAM 1002, and storing various image data as a document server. The operation unit 1010 described above is provided with switches for operation, LED indicators, and the like.

  The document box stores images such as created PDL images, FAX images, scanned images, and images notified from the external network 200. The stored image is transferred to a device on the external network 2000, printed by the print unit 200, or sent via the FAX unit 1009 according to an operation of the operation unit 1010 or an instruction from a host computer connected to the external network. Fax transmission can be performed.

  The telephone authentication unit 1011 is connected to the telephone line 2001 via the telephone I / F 1013 and executes a telephone authentication task described later. The telephone authentication unit 1011 can also connect to an external network 2000 via the I / O 1012 and perform telephone authentication using an IP telephone network.

  The IC card reading unit 1014 reads data on the IC card in a contact or non-contact manner, and stores the read information on the RAM 1002 via the IC card I / F 1088.

  A personal authentication method in the color composite image forming apparatus configured as described above will be described with reference to FIGS.

  FIG. 3 is an example of an authentication method management table for managing the authentication method for each function and document box created on the RAM 1002 on the color composite image forming apparatus 100.

  In areas 301 to 303 of this management table, whether or not a personal authentication method is set on the color composite image forming apparatus 100 when each copy, scan, and fax transmission function is used, and authentication (additional) to a third party are performed. A link to the areas 307 to 309 in which the setting of presence / absence of authentication is described is described. That is, whether or not the personal authentication method is set and whether or not to authenticate a third party when using the copy function is described in the area 307, and a link to the area 307 is described in the area 301. In addition, when using the scan function, the setting of whether or not a personal authentication method is set and the setting of whether or not authentication is performed for a third party is described in an area 308, and a link to the area 308 is described in an area 302. In addition, in the area 309, the setting of whether or not the personal authentication method is set and whether or not to authenticate a third party when using the FAX transmission function is described in the area 309, and a link to the area 309 is described in the area 303.

  Further, in areas 304, 305, and 306, the setting of whether or not the personal authentication method is set on the color composite image forming apparatus 100 when accessing the document box and the setting of whether or not to authenticate the third party are described. A link to the area is described. That is, whether or not to set a personal authentication method and whether or not to authenticate a third party when accessing the document box (Box-1) with ID number 1 is described in area 310. A link to is described. In addition, in the area 311, the setting of whether or not a personal authentication method is set and whether or not to authenticate a third party when accessing the document box (Box-2) with ID number 2 is described. A link to is described.

  Similarly, areas 311,... 312 describing whether or not a personal authentication method is set and whether or not to authenticate a third party when accessing a document box (Box-N) up to ID number N are described. Yes, links to these areas 311 and 312 are described between the area 305 and the area 306.

  The personal authentication method performed on the color composite image forming apparatus 100 includes an authentication method using an IC card and an authentication method using a passcode. In this embodiment, there are an authentication method using an IC card and an authentication method using a passcode (see areas 307, 309, 310, and 312). However, other authentication methods such as fingerprint authentication and iris authentication are used. It goes without saying that it is also good.

  In the color composite image forming apparatus 100, an administrator registers a personal ID and an associated personal information that can use the function for each function, each document box, or can access the document box. Are stored on the HD 1006 and read onto the RAM 1002 as necessary. In addition, the personal information accompanying the personal ID includes a pass code, and this pass code is known only to the user having the personal ID.

  In the authentication method using the IC card described above, the personal ID is registered in the IC card. When the user holds the IC card over the IC card reading unit 1014, the personal ID registered in the IC card is read and the RAM 1002 is read. Written on. The CPU 1001 compares the personal ID registered in the IC card written in the RAM 1002 with the accessible personal ID registered for each function or each document box, and if there is a match, Authenticate that the function is available or accessible to the document box.

  Further, in the authentication method using the passcode, after authentication by the above-described IC card is performed, a screen for prompting the input of the passcode is displayed on the LCD on the operation panel 1010, and the user operates the operation panel 1010 to operate the passcode. Wait for the input. When the user inputs a passcode, the input passcode and the passcode attached to the personal ID authenticated by the IC card are collated, and if they match, the user is authenticated.

  In the areas 307 to 312 where the presence / absence of personal authentication method settings and the presence / absence of authentication to a third party are described for each function and each document box, “IC card”, “passcode”, “additional authentication” 0 or more settings are described. When it is 0, it is treated as no setting, and indicates that the first authentication and the authentication to the third party are not necessary. When “IC card” is described, it indicates that authentication by an IC card is necessary as a personal authentication method. When “passcode” is described, it indicates that authentication by a passcode is necessary as a personal authentication method. However, the “pass code” is not described alone, and is always described together with the “IC card”. When “additional authentication” is described, it indicates that authentication to a third party is necessary.

  That is, the area 307 indicates that authentication with an IC card, authentication with a passcode, and authentication with a third party are necessary, the area 308 indicates that no authentication is necessary, and the area 309 indicates authentication with an IC card. Area 310 indicates that authentication with an IC card and authentication with a passcode are required, area 311 indicates that authentication with a third party is required, and area 312 indicates an IC card Indicates that authentication by and authentication to a third party are required.

  In the area where the setting of whether or not a personal authentication method is required and the setting of whether or not to authenticate the third party is described, a link to an authentication destination table for the third party described later is provided. Described. In other words, in the example of FIG. 3, the areas 307, 311 and 312 describe links to the third party authentication destination setting tables 313, 314 and 315, respectively.

  The third party authentication destination setting tables 313, 314, and 315 are configured by authentication logical expressions 316, 317, and 318, and one or more authentication destination entries 319 to 327, respectively. The authentication logical expressions 316, 317, and 318 are logical expressions that define what kind of authentication is received from a plurality of authentication destinations, and are determined to be authenticated as a result. Described. In each authentication logical expression, “+” represents a logical sum, and “*” represents a logical product. A logical product has a higher priority of operation than a logical sum, and has the highest priority of operations surrounded by "(" and ")". Further, if the authentication request to the authentication destination ID is authenticated, the logical value of the authentication destination ID in the authentication logical expression is true, and false if the authentication request is not authenticated.

  Each authentication destination entry describes, from the left, an authentication destination ID, an authentication request method, an authentication destination, and an authentication result. The authentication ID is used to describe the above-described authentication logical expression. The color composite image forming apparatus 100 has, as authentication request methods, an authentication request by e-mail, an authentication request by pop-up display, and an authentication request by telephone, any one of which is described as the authentication request method. Each authentication request will be described later.

  In the authentication destination, the authentication destination according to the above-described authentication request method is described with contents suitable for each authentication request method. That is, an e-mail address is used as an authentication destination of an authentication request by e-mail, a host name or an IP address that displays a pop-up is used as an authentication destination of an authentication request by pop-up display, and a telephone is used as an authentication destination of an authentication request by phone. Each number or speed dial number is described. In the authentication result, the authentication result at the authentication destination requested by the above authentication request is registered by each authentication task described later.

  For example, the third party authentication destination setting table 315 describes an authentication destination for authentication to a third party performed when accessing the document box with the ID number N, and “CCC @ bbb. "ddd.fff" is requested by e-mail, pop-up authentication is requested to "host B" with authentication destination ID 2 and authentication request is made by telephone to "00-3333-2222" with authentication destination ID 3. Then, an authentication request is made to “00-3333-4444” whose authentication destination ID is 4. Then, according to the authentication logical expression 318, at least one of the authentication requests whose authentication destination ID is 1 or 2 or 3 is authenticated, and only when the authentication request whose authentication destination ID is 4 is authenticated, It is determined that the authentication request has been authenticated.

  By the way, registration of presence / absence of personal authentication method setting and presence / absence of authentication to a third party in the areas 307 to 312 is performed by an administrator or a document box creator by an apparatus connected to the operation unit 1010 or the external network 2000. Can be done from. Further, when it is set that the authentication request to the third party is necessary in the setting area of the presence / absence of the personal authentication method setting and the presence / absence of the authentication to the third party, a third party authentication setting table is created and the setting person is set. The authentication logical expression of the created third party authentication table and one or more authentication destination entries must be registered.

  Here, the operation in which the color composite image forming apparatus 100 performs authentication based on the contents registered in the authentication method management table of FIG. 3 and executes the function designated by the operator will be described with reference to the flowchart of FIG.

  When the power is turned on and various initializations are completed (step S401), the color composite image forming apparatus 100 waits for an operator to perform an operation from the operation panel 1010 in step S402. In step S403, when the operator operates the operation panel 1010 to specify a copy operation, a scan operation, a FAX transmission operation, or an access operation to a document box, it is determined which operation is specified in step S404, and authentication is performed. The authentication method of the designated operation is read with reference to the method management table. That is, for example, when a copy operation is designated, the link described in the area 301 is followed, and the setting contents registered in the area 307 are read.

  In step S405, if “IC card” is described in the authentication method read in step S404, the process proceeds to step S406, and if not described, the process proceeds to step S409.

  In step S406, an authentication method using an IC card is performed, and the process proceeds to step S407.

  In step S407, it is determined whether or not authentication has been performed by the IC card authentication method performed in step S406. If the authentication has been performed, the process proceeds to step S409. If the authentication has not been performed, the process proceeds to step S408, where authentication is impossible.

  In step S409, if “passcode” is described in the authentication method read in step S404, the process proceeds to step S410, and if not described, the process proceeds to step S412.

  In step S410, an authentication method using a passcode is performed, and the process proceeds to step S411.

  In step S411, it is determined whether or not authentication has been performed by the authentication method using the passcode performed in step S410. If authenticated, the process proceeds to step S412. If not authenticated, the process proceeds to step S408, and authentication is disabled.

  In step S412, if "additional authentication" is not described in the authentication method read in step S404, the process proceeds to step S415, and if it is described, the process proceeds to step S413.

  In step S413, the third person is authenticated by the additional authentication routine of FIG. 5 described later, and the process proceeds to step S414. When calling the additional authentication routine, the link to the third party authentication destination table described in the area read in step S404 is followed, and the content is passed as an input to the additional authentication routine. That is, for example, when the copy operation is designated in step S403, the content of the third party authentication destination setting table 313 is passed as an input to the additional authentication routine.

  In step S414, it is determined whether or not authentication has been performed by the authentication to the third party performed in step S413. If the authentication has been performed, the process proceeds to step S415. If the authentication has not been performed, the process proceeds to step S408, where authentication is disabled. .

  Step S415 is reached only when authentication is performed by all the specified authentication methods (when the authentication logical expression 313 is established), the operation specified in step S403 is performed, and the process returns to step S402.

  Step S408 is reached when the authentication is not performed by any of the specified authentication methods. The fact that the authentication is not performed is displayed on the LCD on the operation panel 1010, and the operator is not authenticated. And returns to step S402. In addition, when displaying that the authentication has not been performed, it may be displayed which authentication method is not used. Further, when authentication is not performed by authentication to a third party, an authentication destination that has not been authenticated may be displayed.

  Subsequently, the operation of the additional authentication routine executed in step S413 will be described with reference to the flowchart of FIG.

  In the additional authentication routine, in accordance with the contents of the third party authentication table passed as input, an authentication request is made by the authentication request method designated to the authentication destination of each authentication destination entry registered in the third party authentication table.

  When the additional authentication routine is executed (step S501), steps S502 to S509 are repeated until an authentication request is made to all authentication destinations registered in the authentication entry registered in the input third party authentication table. .

  In step S502, one authentication destination entry is read, and the process proceeds to step S503.

  In step S503, if the authentication destination entry authentication request method read in step S502 is a request by e-mail, the process proceeds to step S504, and if a different authentication method is designated, the process proceeds to step S505.

  In step S504, the authentication destination ID of the authentication destination entry read in step S502 and the e-mail address registered in the authentication destination are read, and the e-mail approval task is activated with the read authentication destination ID and e-mail address as inputs. .

  The e-mail approval task is used by an authentication method using an IC card after describing “not yet” indicating that the authentication result has not yet been determined in the authentication result column of the authentication destination entry having the input authentication destination ID. A user is identified based on the personal ID, and a mail document indicating that the user requests authentication for performing the operation specified in step S403 is created and transmitted to the input e-mail address. Note that the user is unknown when the IC card is not used for authentication.

  The authenticator who has received the authentication request e-mail notifies the color composite image forming apparatus 100 of whether or not authentication is possible by sending back a mail describing whether to authenticate or not authenticating as a reply mail. The e-mail authentication task that has been notified of authentication is described as “true” in the authentication result column of the authentication destination entry having the input authentication destination ID if it has been authenticated, and if it has not been authenticated, the input authentication destination “False” is described in the authentication result column of the authentication destination entry having the ID.

  In step S505, if the authentication destination entry authentication request method read in step S502 is a request by pop-up, the process proceeds to step S506, and if a different authentication method is designated, the process proceeds to step S507.

  In step S506, the authentication destination ID of the authentication destination entry read out in step S502 and the host name or IP address registered in the authentication destination are read out, and the pop-up authentication task is activated with the read out authentication destination ID and the host as inputs.

  The pop-up authentication task describes the individual used by the IC card authentication method after describing “not yet” indicating that the authentication result has not yet been determined in the authentication result column of the authentication destination entry having the input authentication destination ID. The user is identified from the ID, and a pop-up screen indicating that the user is requesting authentication for performing the operation specified in step S403 is displayed on the input host display. Note that the user is unknown when the IC card is not used for authentication.

  The user of the host on which the authentication request pop-up screen is displayed clicks the authentication button or the non-authentication button on the pop-up screen to notify the color composite image forming apparatus 100 of whether or not authentication is possible. If the authentication is notified, the popup authentication task is described as “true” in the authentication result column of the authentication destination entry having the input authentication destination ID if it is authenticated, and if the authentication is not authenticated, the input authentication destination ID is entered. "False" is described in the authentication result column of the authentication destination entry having.

  In step S507, if the authentication destination entry authentication request method read in step S502 is a request by pop-up, the process proceeds to step S508, and if a different authentication method is specified, the process proceeds to step S509.

  In step S508, the authentication destination ID of the authentication destination entry read in step S502 and the telephone number registered in the authentication destination are read, and the telephone authentication task is activated with the read authentication destination ID and the telephone number as inputs.

  The telephone authentication task is executed by the telephone authentication unit 1011 after “unknown” indicating that the authentication result has not yet been determined in the authentication result column of the authentication destination entry having the input authentication destination ID. The user is identified based on the personal ID used in the authentication method using the IC card, the entered telephone number is called via the telephone I / F 1013, and the user receives the call at step S403. Tells you that you are requesting authentication to perform the action specified in. Note that the user is unknown when the IC card is not used for authentication.

  Further, it is instructed to dial “1” if authentication is continued for the authentication request, and “2” if not authenticated, and waits until the authenticator dials. Upon receiving the call, the authenticator dials the designated number to notify the color composite image forming apparatus 100 whether authentication is possible. The telephone authentication task that has been notified of whether or not it is authenticated, describes “true” in the authentication result column of the authentication destination entry having the input authentication destination ID if it has been authenticated, and if it has not been authenticated, the authentication destination ID that has been input "False" is described in the authentication result column of the authentication destination entry having.

  In step S509, if there is an authentication destination entry for which no authentication request has been made in the third party authentication destination table passed as input, the authentication destination entry read in step S502 is advanced by one, and the flow returns to step S502. The operation so far is repeated. If an authentication request has been made to the authentication destination of all the authentication destination entries, the process proceeds to step S510.

  In step S510, the authentication logical expression in the inputted third party authentication destination table is referred to, and the authentication result from each authentication task activated in steps S504, S506, and S508 is waited until the result of this authentication logical expression is obtained. If the authentication result column of each authentication destination entry is “not yet”, it indicates that the authentication request result of the authentication destination entry has not yet been issued, and if “true” or “false”, authentication is already permitted. Since it indicates that notification has been made, the authentication logical expression is evaluated using the result that has already been notified of whether or not authentication is possible.

  Even if there is an authentication destination entry for which no authentication result has been output, the process proceeds to step S511 as soon as an evaluation result of the authentication logical expression is output. For example, if the third party authentication destination table input to the additional authentication task is a table indicated by 315, the authentication logical expression 318 is (1 + 2 + 3) * 4, and therefore, authentication of the authentication destination entry with the authentication ID of 4 is performed. If the result is “false”, it can be determined that the authentication is not performed regardless of the calculation result of (1 + 2 + 3). Therefore, when “false” is described in the authentication result of the authentication destination entry whose authentication ID is 4, the authentication result of this additional authentication routine is authenticated without waiting for the authentication result of the authentication destination entry whose authentication ID is 1 to 3. Judge not to.

  On the other hand, when “true” is described in the authentication result of the authentication destination entry with the authentication ID 4, the authentication result of the authentication destination entry with the authentication ID 1 to 3 is output, and “true” or “false” is described. After waiting until the authentication logical expression 318 is calculated, the determination is made. That is, the authentication result of the authentication destination entry whose authentication destination ID is 4 is determined with more importance than the authentication result of the authentication destination entry of another authentication destination ID.

  If the third party authentication destination table is a table indicated by 313, the authentication logical expression 316 is (1 + 2 + 3), and therefore the authentication logical expression 316 is calculated after the authentication result of the authentication destination entry of 3 from the authentication ID 1 is obtained. It is necessary to judge. Also, if the third party authentication destination table is a table indicated by 314, the authentication logical expression 317 is a logical product (1 * 2), and therefore the authentication result of either of the authentication destination entries with the authentication IDs 1 and 2 If “false”, it can be determined that authentication is not performed regardless of the authentication result of the remaining authentication destination entries.

  In this way, when the authentication logical expression is expressed including a logical product, the security level is higher than the case where the authentication logical expression is expressed only by the logical sum. Therefore, the security level should be set depending on the setting of the authentication logical expression. Can do. For example, the security level can be increased as the number of authentication destination entries to be ANDed increases.

  In step S511, an end notification is sent to each task making an authentication request for an authentication destination entry in which “not yet” is described in the authentication result, and the additional authentication routine is ended. At this time, each authentication task that has received the end notification notifies the authentication destination that authentication is no longer necessary, and then ends.

  As described above, according to the present embodiment, as an authentication method for each function and each document box, in addition to the authentication by the IC card which is a personal authentication method performed on the color composite image forming apparatus 100 and the conventional authentication by the passcode, Authentication to a plurality of third parties can be set, and stronger security can be realized according to the security level set by the authentication logical expression.

1 is a diagram illustrating a configuration of a color composite image forming apparatus that is an example of an image processing system according to the present invention. FIG. FIG. 2 is a block diagram illustrating a configuration of a controller unit included in the color composite image forming apparatus of FIG. 1. FIG. 3 is an explanatory diagram illustrating an example of an authentication method management table created in a RAM provided in the color composite image forming apparatus of FIG. 1. 2 is a flowchart showing the operation of the color composite image forming apparatus when the personal authentication method according to the present invention is implemented by the color composite image forming apparatus of FIG. 1. It is a flowchart which shows operation | movement of the additional authentication routine in FIG.

Explanation of symbols

200 Printer Unit 201 Image Scanner Unit 1000 Controller Unit 1001 CPU
1002 RAM
1011 Telephone authentication unit 1014 IC card reading unit 2000 External network

Claims (11)

In an image processing system provided with a personal authentication means for performing personal authentication by comparing personal authentication information on the system with personal authentication information from outside,
Set together with the authentication method whether the personal authentication by the personal authentication means and / or personal authentication by a third party is performed for each of a plurality of types of image processing functions of the system or a plurality of types of information stored in the system Authentication method setting means to perform,
According to the set authentication method, the personal authentication by the personal authentication means and / or the personal authentication by the third party is performed, and the plurality of types of image processing functions or the plurality of types of information are used according to the authentication result. An image processing system comprising: additional authentication means for permitting access.   When the authentication method setting unit sets the personal authentication by the third party, the additional authentication unit connects to the external device according to the set method, and passes through the external device. The image processing system according to claim 1, wherein the personal authentication is requested by the third party.   The image processing system according to claim 2, wherein there are a plurality of the external devices and the third party, and a security level is set according to a logical expression of an authentication result by the plurality of third parties.   The authentication method setting means has a plurality of authentication methods for the personal authentication by the personal authentication means, and selects zero or more authentication methods for each of the plurality of types of image processing functions or the plurality of types of information. The image processing system according to claim 1, wherein the image processing system is set as follows.   The authentication method setting means has a plurality of authentication methods for the personal authentication by the third party, and selects zero or more authentication methods for each of the plurality of types of image processing functions or the plurality of types of information. The image processing system according to claim 1, wherein the image processing system is set as follows. In a personal authentication method in an image processing system having a personal authentication means for performing personal authentication by comparing personal authentication information on the system with personal authentication information from outside,
Whether to perform the personal authentication by the personal authentication means and / or personal authentication by a third party for each of a plurality of types of image processing functions of the image processing system or a plurality of types of information stored in the system. An authentication method setting step to be set together with the authentication method;
According to the set authentication method, the personal authentication by the personal authentication means and / or the personal authentication by the third party is performed, and the plurality of types of image processing functions or the plurality of types of information are used according to the authentication result. Or a personal authentication method comprising a further authentication step for permitting access.   In the additional authentication step, when performing the personal authentication by the third party is set in the authentication method setting step, the external device is connected according to the set method, and the external device is connected via the external device. The personal authentication method according to claim 6, wherein the personal authentication is requested by the third party.   8. The personal authentication method according to claim 7, wherein there are a plurality of the external devices and the third party, and a security level is set according to a logical expression of an authentication result by the plurality of third parties.   In the authentication method setting step, as the authentication method of the personal authentication by the personal authentication means, zero or more of a plurality of authentication methods are selected separately for each of the plurality of types of image processing functions or the plurality of types of information. The personal authentication method according to claim 6, wherein the personal authentication method is set as follows.   In the authentication method setting step, as the authentication method for the personal authentication by the third party, 0 or more of a plurality of authentication methods are individually selected for each of the plurality of types of image processing functions or the plurality of types of information. The personal authentication method according to claim 6, wherein the personal authentication method is set as follows. A first personal authentication means for performing personal authentication by collating personal data;
A third party authentication request means for requesting authentication from the third party and receiving the request by the third party;
An image forming apparatus comprising: an authentication method setting unit configured to set whether or not to perform authentication by the third party authentication request unit for each function or each information.

Images