JP2006164174A - Information processor, user authentication processing, and access control method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To allow a person who belongs to the other departments to perform printing temporarily by permitting specified access control, when other authentication servers authenticate a user who cannot be identified by the authentication processing of a device having received a processing request. <P>SOLUTION: The user who has been authenticated by other authentication servers is cached for a fixed period in association with the authentication server to shorten the authentication time of successive processing. And the network distance between the authentication servers is detected by the number of hops, and access limitation is changed further according to whether the network distance exceeds a threshold, thus relieving the access limitation of the user who belongs to a neighborhood network. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a system that performs processing based on prescribed access restrictions after performing user authentication on devices distributed on a network.

  Conventionally, when an attempt is made to use a service provided by an information processing apparatus, user authentication relating to the service use of the information processing apparatus is performed, and the service can be used only when authenticated.

In addition, when a server that receives an authentication request from a user is not registered in the server and cannot be authenticated, there is a server that entrusts authentication processing to another registered authenticated station (for example, Patent Document 1).
JP 2003-308297 A

  In the above prior art, only a user who can be managed and identified in an information processing apparatus that provides a service or an information processing apparatus that performs authentication processing related to the information processing apparatus can use a service provided by the information processing apparatus. In order to temporarily use the service provided by the information processing apparatus in the adjacent department, the user needs to be registered.

  Accordingly, an object of the present invention is to provide an information processing apparatus, a user authentication process, and an information processing apparatus that can easily use a service under certain restrictions even for a user who requests service use and cannot be authenticated by the information processing apparatus. It is to provide an access control method.

  In order to achieve the above object, an information processing apparatus according to the present invention includes a communication unit that communicates with other devices on a network, an operation unit that operates the information processing device through user intervention, and a communication unit or A first user authentication unit that performs authentication based on user information input by the operation unit; and a detection unit that detects an authentication device that can authenticate the user when the first user authentication unit determines that the user is an unknown user; The second authentication unit that performs user authentication of the user with respect to the authentication device detected by the detection unit, and a user who is recognized as a valid user by the first or second user authentication unit Based on the attached restriction information, the access restriction means for restricting access to the service and the user authenticated by the second authentication means and the authentication device are stored in association with each other. And having a that authentication relationship storage means.

  The user authentication and access control method of the present invention can authenticate a user when the received user information is determined as an unknown user by the first user authentication step for determining whether or not the received user information is a valid user. An authentication device detection step for detecting a device on the network, a second user authentication step for performing user authentication for the authentication server detected in the authentication server detection step, and a user authentication in the first or second user authentication step Then, according to a predetermined restriction, an access restriction step for permitting use of the service is provided.

  A program according to the present invention causes an information processing apparatus to execute a user authentication and access control method.

  The computer-readable recording medium of the present invention is characterized in that the program is recorded.

  According to the present invention, when there is a processing request to the information processing apparatus connected to the network, the user authentication information is presented, and the user authentication is performed based on the user authentication information. In this case, authentication is performed by another information processing apparatus on the network that can perform the user authentication, and if the authentication is successful, the use of the service is permitted under a predetermined restriction. Even in an environment where a processing request from a user other than the user is rejected, if the user authentication is successful by another authentication device, the user can be temporarily processed without any further management or security degradation. To do.

  DESCRIPTION OF EXEMPLARY EMBODIMENTS Hereinafter, preferred embodiments to which the invention is applied will be described in detail with reference to the accompanying drawings.

<First Embodiment>
FIG. 1 is a diagram showing a configuration of a communication network according to an embodiment of the present invention. An information processing apparatus 102, image processing apparatuses 103 and 105 that perform complex processing such as printing and scanning, an information processing apparatus 104 called an authentication server, and a router 110 are connected to a LAN (local area network) 101 such as Ethernet (registered trademark). And can communicate with each other. The router 110 is also connected to the LAN 111, and relays communication between a device connected to the LAN 101 and a device connected to the LAN 111. An information processing apparatus 112, an image processing apparatus 113, and an authentication server 114 are connected to the LAN 111, and can communicate with apparatuses on the LAN 111, 121, and 101. The LAN 111 is also connected to a LAN 121 by a router 122 via a wide area network (WAN) 120, and devices on each LAN can communicate with each other. An information processing device 123 and an image processing device 124 are connected to the LAN 121. Reference numerals 106, 115, and 125 denote authentication ranges managed by the authentication servers 104 and 114 and the image processing apparatus 124 having an authentication function, respectively.

  FIG. 2 is an internal configuration diagram of the image processing apparatus 103 in the communication network configuration of FIG. 1 for realizing the present invention, and the image processing apparatuses 105, 113, and 123 have the same configuration. Reference numeral 201 denotes a network interface, which is connected to the LAN 101 in FIG. 1 and similarly communicates with a device connected to the LAN 101. The data received from the LAN 101 by the network interface 201 is subjected to various protocol processes by the network control unit 202, and then a processing request is extracted and sent to the device control unit 203. When the device control unit 203 detects a processing request from the network control unit 202, the user authentication unit 206 performs user authentication using authentication information including a user identifier (user ID) and a password included in the processing request. The user authentication unit 206 transmits authentication information to the authentication server 104 to perform user authentication, or in the case of having an internal user authentication function like the image processing device 123, the user ID and password held in the data storage unit 208 User authentication is performed based on the above. The user interface control unit 204 processes an input from the operation panel 205 and conversely displays information such as the state of the apparatus. Upon detecting the input of authentication information from the operation panel 205, the user interface control unit 204 performs user authentication by the user authentication unit 206 via the device control unit 203. Authentication succeeds only when the user included in the authentication information is registered and the password is correct. When the user authentication unit 206 succeeds in authentication, the access control unit 207 next refers to the access control information set for the authenticated user and stored in the data storage unit 208, and the requested process is authenticated. If the authorized user is authorized, a normal response is returned. When a normal response is returned from the access control unit 207, if the processing request is a print request, printing is performed by the printer engine 210 under the control of the print control unit 209. If the processing request is a scan request, the scanner control unit 211 is printed. Under the control of the above, the scan engine 212 scans the information on the object placed on the reading table, but if the normal response is not returned, the process is rejected.

  FIG. 6 is an example of access restriction information that is referred to and managed by the access control unit 207. Here, there are four items for each user: “print”, “number of sheets”, “scan”, and “storage”, “print” and “number of sheets” are print requests, and “scan” is a scan request. In “storage”, a storage operation request and restrictions on three requests are set. Taking 601 as an example, it is indicated that the user “User1” can use the print without limitation (Unlimited) (Allow), and can use the scan and the storage operation.

  Hereinafter, a user (User-A) registered in the authentication server 114 connected to the LAN 111 is printed from the information processing apparatus 102 using the internal configuration diagram of the image processing apparatus in FIG. 2 and the flowcharts in FIGS. 4 and 5. Processing in the image processing apparatus 103 when a request is made to the image processing apparatus 103 will be described. Although the case where printing is performed by the image processing apparatus 103 will be described, the image processing apparatus 105 can be realized by performing the same processing.

  The image processing apparatus 103 that has received the print processing request from the information processing apparatus 102 first turns off the registered user flag in step S401 in FIG. 4 and calls the user authentication process in step S402. In general, the user authentication process is performed in an information processing apparatus different from the image processing apparatus such as the authentication server 104 or 114 in FIG. 1, but when the authentication server function is included like the image processing apparatus 124, It is also possible to perform authentication processing in the image processing apparatus. FIG. 5 is a flowchart of the user authentication process and shows the process of step S402 of FIG. First, in step S501, it is determined whether or not the user ID specified in the authentication information included in the processing request is registered in the authentication database. The authentication server has a data storage mechanism called an authentication database, which manages user ID and password pairs. If it is determined in step S501 that the user is not registered (the user ID does not exist in the authentication database), an unknown user (Unknown) is returned in step S502. If it is determined in step S501 that the user is registered, it is determined in step S503 whether the password specified in the authentication information matches the password associated with the user in the authentication database. Authentication failure (NG) is returned in step S505, and if they match, authentication success (OK) is returned in step S504.

  When the user authentication process in FIG. 5 is completed, the process returns to the flowchart in FIG. 4. In step S403, it is determined whether the authentication is successful (OK is returned). If the authentication is successful, the registration is performed in step S414. The user flag is turned on and the process proceeds to step S415. If authentication is not successful (Unknown or NG is returned) in step S403, it is determined in step S404 whether or not the authenticated user is an unknown user, and if it is not an unknown user, that is, if authentication has failed. In step S413, the access is denied and the process is terminated. If it is determined in step S404 that the user is an unknown user, it is determined in step S405 whether the user is registered in the temporary user cache as shown in FIG. The temporary user cache is composed of a pair of an unknown user and an IP address of an authentication server that can authenticate the user, and is held in the data storage unit 208 of FIG. If the user is registered in the temporary user cache, an authentication request is transmitted to the authentication server indicated by the IP address paired with the user in step S406, and the process proceeds to step S411. If it is not registered in the temporary user cache in step S405, a user authentication request including the user ID included in the authentication information is transmitted to the authentication server on the network in step S407. The user authentication request is transmitted to a specific multicast address using a multicast packet, so that the authentication server listening to the multicast address analyzes the user authentication request and authenticates the user registered in the own device. If requested, a permission response is returned. In addition to the realization of an authentication request using a multicast address, E.I. Guttman, C.I. Perkins, J .; Veizades, M .; Day, June 1999, Internet <URL: http: // www. ietf. org / rfc / rfc2608. It is also possible to detect an authentication server using a search specification such as Service Location Protocol, Version 2 shown in txt>, and send a user authentication request for each detected authentication server to perform user authentication. Needless to say.

  In step S408, it is determined whether a predetermined time (timeout time) that is preset and can be changed has elapsed. If the time has elapsed, the process proceeds to step S413. If it is determined in step S408 that the timeout period has not elapsed, it is determined in step S409 whether there is an authentication permission response to the user authentication request transmitted in step S407. If there is no response, the timeout period of step S408 has elapsed. Return to the process of determining whether or not. If there is an authentication permission response in step S409, authentication information is transmitted to the authentication server that transmitted the response in step S410. Since the illustrated User-A is managed by the authentication server 114 on the LAN 111, an authentication permission response is returned from the authentication server 114. The authentication server 114 that has received the authentication information, that is, returning the authentication permission response, performs the user authentication process shown in the flowchart of FIG. 5 and returns the authentication result. In step S411, it is determined whether the authentication is successful. If the authentication fails, the processing request is rejected in step S413, and the process is terminated. If the authentication succeeds in step S411, in step S412, the pair of the user ID and the IP address of the authentication server is registered in the temporary user cache as shown in FIG. 3, and the process proceeds to step S415. In step S415, it is determined whether the authenticated user is a registered user by checking whether the registered user flag is ON. If the registered user is a registered user, in step S416, access restriction information set for each user as shown in FIG. To allow or reject the requested action. For example, if the user is User 1 and the request is a scan request, refer to 601 in FIG. 6 and the request is permitted because the “Scan” column is “Allow”, and then the scan process is executed. . On the other hand, if it is not a registered user, in step S417, the requested process is permitted or rejected according to a preset temporary user restriction. Since User-A illustrated is a user that cannot be identified by the information processing apparatus and is a temporary user authenticated by another server, it is treated as a “Guest” user indicated by reference numeral 602 in FIG. Since the “print” item is “Black” and the “number of sheets” item is “100”, if the print request is for black and white only and up to 100 sheets, the printing process is subsequently performed.

  In the first embodiment, the processing request is made from the information processing apparatus connected to the communication network to the image processing apparatus having the composite function. However, the operation panel of the image processing apparatus having the composite function is exemplified. It goes without saying that the present invention can be similarly applied to a case where a processing request for a function of the apparatus is made from (user interface).

  As described above, according to the present embodiment, when authentication for a user who requests processing fails, when an authentication request is made to another authentication server on the network and user authentication is successful on the other authentication server, Assuming that the user is reliable to some extent, by allowing processing under specific access restrictions, the security level is lowered by permitting unlimited access without incurring administrative costs such as temporary user registration. It is possible to use the apparatus temporarily. In addition, when there is a continuous processing request within a certain time by caching the user authenticated by another authentication server and the pair of the authentication server, by referring to the cache and connecting to the authentication server, The authentication processing can be performed at high speed.

<Second Embodiment>
In the first embodiment, a user who is authenticated by an authentication server other than the authentication server that performs user authentication of a device that provides a service is centrally handled as a user called “guest”. However, in the environment of a company or the like that constructs a wide network, it may be difficult to trust the authenticity of a user who is authenticated by an authentication server that is distant from the region. Therefore, in the second embodiment of the present invention, the distance between the authentication server that returns the authentication permission response corresponding to the authentication request request and performs authentication in the subsequent user authentication processing, and the authentication server related to the apparatus that provides the service For example, if the number of hops is within five, it is assumed that it is an authentication server of a neighboring department, based on how many devices called routers that are arranged between networks called hops and exchange data. Therefore, it is possible to place a certain degree of trust, so by restricting the use of services moderately, for example, if this is 5 or more, it is considered that the reliability is low, so that more severe restrictions are imposed. It becomes possible.

  When the user (User-B) managed by the image processing apparatus 124 having the authentication server function of the LAN 121 makes a scan request from the operation panel 205 of the image processing apparatus 103 of the LAN 101 in the communication network of FIG. As described in the first embodiment, the apparatus 103 performs the processing shown in the flowchart of FIG. 4. However, since User-B is not managed by the authentication server 104, it is treated as an unknown user and responds to the authentication request. Authentication is performed by the image processing apparatus 124 having an authentication server function. In this case, the image processing apparatus 124 having the authentication server function for authenticating User-B is transmitted from the authentication server 104 via the router 110 to the LAN 111, although it is centrally processed as a Guest user in the first embodiment. In addition, since it is connected to the image processing apparatus 124 having the authentication function on the LAN 121 via the router 122 via the WAN 120, assuming that the number of hops is 6, the number of hops exceeding the threshold value 5 is exceeded. Therefore, processing is performed with reference to the access restriction list for unknown users as shown in FIG. The access restriction list for unknown users in FIG. 7 is obtained by cutting out users other than registered users in the access restriction list in FIG. 6 and is authenticated by an authentication server within the threshold of hop count (set to 5 in the present embodiment). The user who has been authenticated by the authentication server exceeding the threshold is treated as “Guest 2”. Since User-B has been authenticated by the image processing apparatus 124 with 6 hops, it is treated as “Guest2” in the unknown user list in FIG. 7, and the “scan” item indicating scan processing is “Deny”. The scan request is rejected. On the other hand, when User-A authenticated by the authentication server 114 makes a similar processing request, since the authentication server 104 is connected to the authentication server 114 via the router 110, the number of hops is 1. 7 is handled as “Guest1”, and the “scan” item is “Allow”, so the scan request is permitted. Note that an arbitrary value can be set and changed from the operation panel 205 of the image processing apparatus as the threshold value of the hop count.

  As described above, according to the second embodiment of the present invention, the network distance between the image processing apparatus that has received a processing request from a user and another authentication apparatus on the network that has authenticated the user is represented by the number of passages of the router. By measuring the number of hops and changing the access restriction depending on whether this exceeds the specified value, it is determined that users authenticated by an authentication device with a short network distance are relatively reliable, and a wider range of access permissions is granted. On the other hand, a user who is authenticated by an authentication apparatus having a long network distance enables flexible operation such as giving only a minimum access permission because the reliability is low.

  In the first and second embodiments, an image processing apparatus having a composite function, which is a kind of information processing apparatus, has been described as an example. However, a personal computer (PC), a workstation (WS), or the like is used. Needless to say, the present invention can also be applied to processing requests to an information processing apparatus.

  Another object of the present invention is to supply a storage medium storing software program codes for realizing the functions of the above-described embodiments to a system or apparatus, and the computer (or CPU or MPU) of the system or apparatus stores the storage medium. Needless to say, this can also be achieved by reading and executing the program code stored in.

  In this case, the program code itself read from the storage medium realizes the functions of the above-described embodiments, and the program code itself and the storage medium storing the program code constitute the present invention.

  As a storage medium for supplying the program code, for example, a flexible disk, a hard disk, an optical disk, a magneto-optical disk, a CD-ROM, a CD-R, a magnetic tape, a nonvolatile memory card, a ROM, or the like can be used.

  Further, by executing the program code read by the computer, not only the functions of the above-described embodiments are realized, but also an OS (basic system or operating system) running on the computer based on the instruction of the program code. Needless to say, a case where the function of the above-described embodiment is realized by performing part or all of the actual processing and the processing is included.

  Further, after the program code read from the storage medium is written in a memory provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer, the function is determined based on the instruction of the program code. It goes without saying that the CPU or the like provided in the expansion board or function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.

It is a figure which shows the structure of the communication network which concerns on one Embodiment of this invention. 2 is an internal module configuration example of an image processing apparatus according to an embodiment of the present invention. It is a figure which shows an example of the temporary user cache preserve | saved in the image processing apparatus which implement | achieves this invention. 4 is a flowchart illustrating access control processing of the image processing apparatus according to an embodiment of the present invention. It is a flowchart which shows the authentication process processed with the image processing apparatus which concerns on one Embodiment of this invention. It is a figure which shows an example of the access control information managed and hold | maintained with the image processing apparatus which concerns on this invention. It is a figure which shows an example of the access control information for unknown users managed and hold | maintained with the image processing apparatus which concerns on this invention.

Explanation of symbols

101, 111, 121 Network 102, 112, 123 Information processing device (client)
103, 105, 113, 124 Image processing device 104, 114 Information processing device (authentication server)
110, 122 routers

Claims (9)

  An information processing apparatus that performs various types of processing in a device connected to a communication network. The communication unit communicates with a device on the communication network, and displays various information such as the state of the device or gives an instruction to the device. User interface means, data storage means for storing various data, first user authentication means for determining whether a user who makes a processing request by means of communication means or user interface means is a valid user, and first user authentication means The authentication device detecting means for detecting a device that can authenticate the user to another authentication device on the network when the user is not recognized as a valid user, and the authentication device detecting means detects a valid authentication device. If the authentication request is issued, the second authentication unit that performs the authentication process for the authentication device and the processing request based on the restriction information for each authenticated user The information processing apparatus characterized by having an access limiting means for accessing limitations.   The information processing apparatus according to claim 1, further comprising an authentication relationship holding unit that holds a user who has been successfully authenticated by another authentication device by the authentication request unit and the authentication device.   3. The information processing apparatus according to claim 1, wherein the user authentication means uses an authentication means inside the apparatus or an authentication means of an external device.   4. The information processing apparatus according to claim 1, wherein the second user authentication unit can be disabled by setting from the user interface unit.   5. The information processing apparatus according to claim 1, wherein the processing request is restricted by the access restriction unit, with the user authenticated by the second user authentication unit as a specific user. 6.   Measurement that measures the network distance between the authentication device that performs user authentication in accordance with the procedure with the second user authentication unit and the authentication device that performs user authentication of the information processing device in response to the authentication request transmitted by the authentication request unit 6. The information processing apparatus according to claim 1, further comprising: means for changing the access restriction of the specific user depending on whether the network distance measured by the measuring means exceeds a specified value.   A user authentication process and an access control method by an information processing apparatus, wherein a first user authentication step for authenticating a user, and an authentication request step for requesting another user for authentication when user authentication fails in the user authentication step And an access control step for performing access control based on access restriction information set for each authenticated user, and a user authentication process and an access control method.   A program for causing a computer to execute the user authentication processing and the access control method according to claim 7.   A computer-readable recording medium on which the program according to claim 8 is recorded.

Images