JP2006155022A - Security management device and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To make it difficult to make illegal use, and to reduce operation costs by generating principal identification information by a simple algorithm, and by changing encryption and decoding timing on the basis of the user designation. <P>SOLUTION: A security management device (MFP1) encrypts a user name to be inputted and fetched by a user, and generates principal identification information, and sets a timing when principal identification information should be encrypted and when the encrypted principal identification information should be decoded based on the user designation. Also, a user name is converted into a predetermined specific code, and the converted specific code is shifted only by the predetermined number of digits, and the principal identification information is generated. Access provision is limited according to a service preliminarily defined in each time zone so as to be provided to the user. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a security management device and a program that are permitted to be used by a recording medium on which personal authentication information is recorded.

Business machines such as copiers and printers are increasingly compatible with networks, and the rate of connection to a network such as a LAN (Local Area Network) is rapidly increasing. In addition, colorization has progressed, and space-saving multi-function printers (MFPs) that decode functions such as copying, printing, and faxing have also evolved.
On the other hand, programmable MFPs that can be customized to match a POD (Print On Demand) service using a printer have appeared in convenience stores and the like. Here, in addition to the copy service, information retrieval and printing services are performed, and the use is permitted by a prepaid card or the like.

In this way, most of the security of prepaid type media that access specific software of the MFP installed in a place where many people come and go is based on ID and password. In other advanced areas, fingerprints and irises are used. There is also biometrics certification such as.
It is also conceivable to perform encryption according to a certain rule. As the encryption technique in this case, a technique in which a name converted into a JIS code is used for font encryption (see, for example, Patent Document 1), and a character converted into a JIS code is used as a two-dimensional mosaic pattern. A technique of rotating and encrypting (for example, refer to Patent Document 2), a technique for providing an effective period for personal identification information (for example, Patent Document 3), and the like are known.
JP 2001-22739 A Japanese Patent No. 3084163 JP 2002-216195 A

  According to the background art described above, the ID and password are not subject to leakage, and may be lost and illegally used. In addition, according to the techniques disclosed in Patent Documents 1 and 2, there is a public standard for encrypting data recorded on a medium, such as converting a name to JIS code. Like metrics, it leads to increased operational costs. Further, as disclosed in Patent Document 3, even if an effective period is simply provided for personal identification information, it does not fundamentally solve unauthorized use.

  The present invention has been made in view of the above various circumstances, generates personal authentication information according to a simple algorithm, makes unauthorized use difficult by changing the encryption and decryption timing based on user designation, It is another object of the present invention to provide a security management device and a program that can reduce operational costs.

  In order to solve the above-described problem, the security management device of the present invention includes a personal authentication information generating unit that encrypts a user name input and captured by a user to generate personal authentication information, and the encryption based on a user designation. And timing management means for setting a timing for decrypting the encrypted personal authentication information.

  In the present invention, the personal authentication information generating means converts the user name into a predetermined standard code, and generates the personal authentication information by shifting the converted standard code by a predetermined number of digits. And

  The present invention is characterized by comprising service provision management means for restricting access provision according to a service that can be provided to a user defined in advance for each time slot.

  Further, the present invention is a program executed in a security management apparatus that is permitted to be used by a recording medium on which personal authentication information is recorded, and generates user authentication information by encrypting a user name that is input and captured And a step of setting a timing for decrypting the encrypted and the encrypted personal authentication information based on user designation.

According to the present invention, the security management device generates user authentication information by encrypting a user name input and taken in by a user, and encrypts and decrypts the encrypted user authentication information based on a user designation. By setting the timing, it is possible to provide a security management device that makes unauthorized use difficult and reduces operating costs.
Also, the user name can be encrypted with a simple algorithm by converting the user name into a predetermined standard code and generating the personal authentication information by shifting the converted standard code by a predetermined number of digits. Furthermore, flexible service provision management is possible by restricting access provision according to services that can be provided to users defined in advance for each time period.

FIG. 1 is a diagram showing an example of a system configuration to which a security management apparatus according to an embodiment of the present invention is connected. Here, an MFP (1) installed in a convenience store is assumed as an example of the security management apparatus.
The MFP (1) is LAN-connected to the POS terminal 6 in the store and the backyard server 2. Further, the MFP (1) can be accessed by short-range wireless communication by the mobile phone terminal 5 or by contact communication by the prepaid card 4. Note that the POS terminal 6 is connected to a server (not shown) of the headquarters via a WAN (Wide Area Network) 7, and billing processing of the MFP (1) is concentrated here.
The document DB (3) stores data processed by the MFP (1) and is used for reuse.

  FIG. 2 is a block diagram showing an internal configuration of the security management apparatus according to the embodiment of the present invention. Here, only the part related to the present invention is extracted and shown in the configuration block of MFP (1), and encryption unit 21, decryption unit 22, timing management unit 23, access restriction table 24, service provision management unit are shown. 25, an authentication management unit 26, an authentication DB (Data Base) 27, and a software DB (28).

The encryption unit 21 functions as an authentication information generation unit of the present invention that generates user authentication information by encrypting a user name input and taken in by a user. Further, the decryption unit 22 decrypts the personal authentication information encrypted as described above and provides it to the authentication management unit 26, and the timing management unit 23 performs encryption and decryption by the encryption unit 21 based on the user designation. It functions as the timing management means of the present invention that performs timing control by setting the timing of decoding by the conversion unit 22.
In generating the personal authentication information, the encryption unit 21 converts a user name formed of a character string that is input and captured into, for example, a JIS code, and shifts the converted JIS code by a predetermined number of digits. Generate personal authentication information. In the case of the same family name and the same name, attribute data for distinction is given.

On the other hand, the service provision management unit 25 functions as a service provision management unit according to the present invention that restricts access provision according to a service that can be provided to a user defined in advance for each time period, and the control is defined in the access restriction table 24. Depends on the data collected. An example of the data structure of the access restriction table 24 is shown in FIGS. 3 and 4, and the procedure for creating the access restriction table 24 is shown in FIG. Details will be described later with reference to FIGS.
Note that personal authentication information registered in advance is stored in the authentication DB (27), and becomes basic data when the authentication management unit 26 collates with the personal authentication information decrypted by the decryption unit 22. . The software DB (28) stores various programs such as copying, searching, printing, and faxing provided by the MFP (1).

  3 and 4 are diagrams showing an example of the data structure of the access restriction table 24 described above. As shown in the figure, in the access restriction table 24, access restriction data for the service of the MFP (1) is defined for each time zone. Here, in addition to copying, fax, mail, and database search are shown as examples of service provision, and an encryption time zone t1 and a decryption time zone t2 are defined, and services that can be provided for each time zone are shown. Has been. For example, in the time zone from 24:00:01 to 04:00:00, copy, fax, and mail services are possible except database search. Further, the access limit count is “2”. Since it is considered that the data retrieval service is not normally used from midnight to 4 o'clock, the service is limited in case of an emergency.

5 and 6 are flowcharts cited for explaining the operation of the security management apparatus according to the embodiment of the present invention. The flow of creating the access restriction table 24 (FIG. 5) and the flow of security management (FIG. 6). Each is shown.
Hereinafter, the operation of the embodiment of the present invention will be described in detail with reference to FIGS.

The flow of creating the access restriction table 24 will be described with reference to FIG. First, the MFP (1) secures a storage area in the built-in memory (access restriction table 24) in order to create encryption and decryption tables (T1 and T2 respectively) in the access restriction table 24 (S51). ). Subsequently, the user or the administrator is prompted to input a user name to be used, and the user or the administrator waits for an input consisting of a character string of the user name, and takes in and converts (encrypts) it (S52). The encryption procedure will be described later.
If there is a time designation t1 in the encryption time zone, this is stored (S53, S54). Subsequently, if there is a time designation t2 in the decryption time zone, the type of service and access defined A limit number of times is set and stored (S55, S56). The above processing is repeated for 24 hours to create an encryption table T1 and a decryption table T2 (access restriction table 24) and store them in the previously secured storage area (S57).

  In this case, the user authentication information (ID and master password) obtained by encrypting the user name that is input and captured is generated by a combination of 25 sets of every 4 hours of the encryption time t1 and the decryption time t2. Shall be.

The operation when providing various services by the MFP (1) using the access restriction table 24 created as described above will be described with reference to FIG.
First, the MFP (1) performs master registration for the user in the authentication DB (27) and issues a prepaid card (S61). The timing management unit 23 constantly monitors the encryption timing defined in the access restriction table 24 (T1), and activates the encryption unit 21 when it is confirmed that it is in the time zone defined here. In step S62, the encryption unit 21 encrypts the input user name that has been input, and outputs the user ID and the master password.
In encrypting the user name, the user name consisting of the input character string is converted into a JIS code, and the character string is shifted by a certain number of digits, making it difficult for a third party to decipher the user name. The user ID and password obtained are registered and issued.

Subsequently, it is checked whether or not the user ID and password are within the valid period (S64). Here, in order to enhance the security effect, the user ID and password are invalidated every 4 hours.
If it is confirmed that it is within the valid period (S64 “Yes”), the timing management unit 23 monitors the decoding timing defined in the access restriction table 24 (S65) and decodes the decoding unit 22. Thus, the decryption unit 22 executes decryption processing (S66). Subsequently, the authentication management unit 26 collates the personal authentication information stored in the authentication DB (27) with the user ID and password that can be decrypted (S67). 25 starts the access restriction check.

The service provision management unit 25 confirms that it is included in the service provision contents for each time zone defined in the access restriction table 24 and the number of access restrictions (S68: accessible), and then stores it in the software DB (28). The corresponding program stored is acquired and loaded into the MFP (1) main body to provide necessary services to the user.
Note that in the check processes in S64, S67, and S68, if it is determined as “No”, “NG”, or “present”, respectively, the service by the MFP (1) that the user desires to be inaccessible is not provided.

As described above, according to the present invention, the security management apparatus (MFP 1) encrypts the user name input and captured by the user to generate the personal authentication information, and encrypts the encrypted user name based on the user designation. It is an object of the present invention to provide a security management device that makes unauthorized use difficult by setting the timing for decrypting the personal authentication information and reduces the operation cost.
Also, the user name can be encrypted with a simple algorithm by converting the user name into a predetermined standard code and generating the personal authentication information by shifting the converted standard code by a predetermined number of digits. Furthermore, flexible service provision management is enabled by restricting access provision according to services that can be provided to users defined in advance for each time slot.
In this embodiment, the image forming apparatus (MFP) has been described as an example. However, the present invention is not limited to this. For example, a download terminal for downloading various data such as an application and music data, and an automatic ticket issuing machine Needless to say, the present invention can also be applied to a security management device and a program for performing security management for a device system for providing some service to a user such as a browsing system for browsing various information.

It is a figure which shows an example of the system configuration | structure to which the security management apparatus concerning embodiment of this invention is connected. It is a block diagram which shows the internal structure of the security management apparatus concerning embodiment of this invention. It is a figure which shows an example of the data structure of the access restriction table used in this embodiment. It is a figure which shows an example of the data structure of the access restriction table used in this embodiment. It is the flowchart quoted in order to demonstrate operation | movement of embodiment of this invention. It is the flowchart quoted in order to demonstrate operation | movement of embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... MFP, 2 ... Server, 3 ... Document DB, 4 ... Prepaid card, 5 ... Mobile phone terminal, 6 ... POS terminal, 7 ... WAN, 8 ... LAN, 21 ... Encryption part, 22 ... Decryption part, 23 ... Timing management part 24 ... Access restriction table 25 ... Service provision management part ... 26 Authentication management part 27 ... Authentication DB 28 ... Software DB

Claims (4)

User authentication information generating means for generating user authentication information by encrypting a user name inputted and captured by a user;
A timing management means for setting the encryption and a timing for decrypting the encrypted personal authentication information based on a user designation;
A security management device comprising: The identity authentication information generating means includes
The security management device according to claim 1, wherein the user name is converted into a standard code, and the converted standard code is shifted by a predetermined number of digits to generate the personal authentication information. Service provision management means for restricting access provision according to services that can be provided to users defined in advance for each time period; and
The security management apparatus according to claim 1, further comprising: A program that is executed in a security management device that is permitted to be used by a recording medium on which personal authentication information is recorded,
Encrypting a user name that is input and captured to generate personal authentication information;
Setting the encryption and a timing for decrypting the encrypted personal authentication information based on a user designation;
A program that causes a computer to execute.

Images