JP2007328663A - Image forming apparatus and control method thereof - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an image forming apparatus and a control method thereof which are capable of appropriately processing personal authentication information. <P>SOLUTION: The image forming apparatus includes an authentication information input means for inputting prescribed personal authentication information for authenticating a registered user and an authentication information control means for performing user authentication using the personal authentication information inputted from the authentication information input means, and the image forming apparatus includes an authentication information output means for outputting the personal authentication information inputted from the authentication information input means, to the outside. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention provides authentication information input means for inputting predetermined personal authentication information for authenticating a registered user, and authentication information control means for performing user authentication using the personal authentication information input from the authentication information input means. The present invention relates to an image forming apparatus provided with

  In recent years, an image forming apparatus having a function of restricting users by performing personal authentication with an IC card has been proposed.

  In addition, user restriction is realized by requesting user authentication information from a client device (for example, a personal computer device) that accesses the image forming apparatus via an external interface or a network.

  In that case, if the IC card reader device is installed in all the client apparatuses, authentication information can be acquired from the IC card and transmitted to the image forming apparatus for authentication. However, it is often impossible to install an IC card reader device for all user client devices due to the problem of introduction cost. This is handled by manually inputting authentication information as before.

  On the other hand, as for IC cards, the use of IC cards as employee ID cards or student ID cards has begun to spread. The personal authentication information recorded on the IC card is often protected by restricting access using the security function of the IC card to avoid the risk of information leakage, and the access method for the authentication information is classified as confidential information. Handled.

  Therefore, when a new device such as an image forming apparatus is introduced, there is a request to realize a personal authentication function using an already used employee ID card or student ID card, and there is a method for accessing personal authentication information in an IC card. In the case of disclosure, it can be considered that the control program of the image forming apparatus is customized based on the information of the disclosed access method. However, as described above, the method for accessing the personal authentication information is confidential information and is often not disclosed.

In such a case, it is possible to easily read from the IC card, such as a serial number that is uniquely determined for each installed IC card, and handle unique information for each IC card as authentication information. Thus, the user restriction function of the image forming apparatus by simple personal authentication is realized.
JP 2005-38372 A

  However, when information that can be easily read from the IC card and that is unique to each IC card is handled as the personal authentication information, for example, the manufacturing number is merely an alphanumeric data string and is not user-friendly data.

  In order to handle this data on the client device side that does not have an IC card reader, it is necessary for the user to manually input the data, which is very unusable. If the manually entered data is incorrect, an authentication error will occur.

  SUMMARY An advantage of some aspects of the invention is that it provides an image forming apparatus capable of appropriately processing personal authentication information and a control method thereof.

  The present invention provides authentication information input means for inputting predetermined personal authentication information for authenticating a registered user, and authentication information control means for performing user authentication using the personal authentication information input from the authentication information input means. And an authentication information output means for outputting the personal authentication information input from the authentication information input means to the outside.

  In addition, job information input means for inputting predetermined job information is further provided, and when the personal authentication information is added to the job information input from the job information input means, the personal authentication information is used to User authentication is performed by the information control means.

  Further, the information processing apparatus further includes an encryption unit that encrypts the personal authentication information output from the authentication information output unit.

  Further, the personal authentication information output from the authentication information output means is encrypted to form encrypted personal authentication information, and the encrypted personal authentication information is added to the job information input from the job information input means. In the case where the encrypted personal authentication information is included, the decryption means for decrypting the encrypted personal authentication information into the original personal authentication information is further provided.

  Also provided is authentication information input means for inputting predetermined personal authentication information for authenticating a registered user, and authentication information control means for performing user authentication using the personal authentication information input from the authentication information input means. A method for controlling an image forming apparatus, wherein the personal authentication information input from the authentication information input means is output to the outside.

  Therefore, according to the present invention, when personal authentication information is handled by an external client device or the like, the personal authentication information output from the image forming apparatus can be applied, so that the burden on the user can be greatly reduced. In addition, it is possible to prevent the occurrence of problems such as input errors.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

  FIG. 1 shows a network system according to an embodiment of the present invention.

  In the figure, a plurality of network terminal devices TM1 to TMn, an authentication server device SV, and a network compatible MFP MFP are connected to the local area network LAN.

  Here, the authentication server SV provides, for example, an authentication service such as user personal authentication to the network terminal devices TM1 to TMn connected to the local area network LAN and the network network compatible MFP MFP. Is.

  The network-compatible MFP MFP is an e-mail processing function for exchanging image information and various reports as e-mail, and a network that accepts and prints print jobs from the network terminal devices TM1 to TMn via the local area network LAN. A print function, a scan-to-email function that transmits image data obtained by reading a document image to a specified destination using an e-mail, and an analog public line network PSTN. And a facsimile communication function for transmitting image information according to the group 3 facsimile transmission procedure. The network-compatible MFP MFP has a function of accessing an IC card CC and a USB (Universal Serial Bus) memory MM.

  The network terminal devices TM1 to TMn also exchange a variety of data via the network print client function for transmitting a print job to the network compatible MFP MFP via the local area network LAN and the local area network LAN. Various programs, such as various software for performing, have been introduced and are used by specific users. Here, the specific user may be one or a plurality of users. The network terminal devices TM1 to TMn also have a function that can access the USB memory MM.

  FIG. 2 shows a configuration example of the network compatible MFP MFP.

  In the figure, a system control unit 1 performs various control processes such as a control process of each part of the network compatible MFP MFP and a facsimile transmission control procedure process. The control processing program to be executed and various data necessary for executing the processing program are stored, and the work area of the system control unit 1 is configured. The parameter memory 3 is a network compatible MFP MFP. The clock circuit 4 outputs current time information.

  The scanner 5 is for reading a document image at a predetermined resolution, the plotter 6 is for recording and outputting an image at a predetermined resolution, and the operation display unit 7 is a network-compatible MFP MFP. It is for operation and consists of various operation keys and various displays.

  The encoding / decoding unit 8 encodes and compresses the image signal, and also decodes the encoded and compressed image information into the original image signal. The image storage device 9 performs encoding and compression. This is for storing a large number of image information in the selected state.

  The group 3 facsimile modem 10 is for realizing the modem function of the group 3 facsimile, and is a low-speed modem function (V.21 modem) for exchanging transmission procedure signals, and mainly for exchanging image information. A high-speed modem function (V.17 modem, V.34 modem, V.29 modem, V.27ter modem, etc.) is provided.

  The network control device 11 is for connecting the network compatible MFP MFP to the analog public line network PSTN, and has an automatic outgoing / incoming function.

  The local area network interface circuit 12 is for connecting the network compatible MFP MFP to the local area network LAN, and the local area network transmission control unit 13 is connected to another data terminal device via the local area network LAN. For executing communication control processing of various predetermined protocol suites for exchanging various data with each other.

  The USB host unit 14 is for realizing a USB host function, and is provided with a socket 15 for attaching / detaching the USB memory MM, and an IC for accessing the IC card CC via the USB cable 16. A card driving device 17 is connected.

  The system control unit 1, system memory 2, parameter memory 3, clock circuit 4, scanner 5, plotter 6, operation display unit 7, encoding / decoding unit 8, image storage device 9, group 3 facsimile modem 10, network The control device 11, the local area network transmission control unit 13, and the USB host unit 14 are connected to an internal bus 18, and data exchange between these elements is mainly performed via the internal bus 18. It has been broken.

  Data exchange between the network control device 11 and the group 3 facsimile modem 10 is performed directly.

  Here, as described later, data such as user authentication information and key information for accessing the authentication information is transmitted to and received from the USB cable 16. For this reason, there is a concern about leakage of information due to monitoring of signals on the USB cable 16 and the USB bus.

  For this reason, transmission and reception of commands and data between the USB host unit 14 and the IC card driving device 17 are encrypted. Prior to encryption, authentication is performed between the USB host unit 14 and the IC card driving device 17, a common key obtained from the result is generated, and encryption / decryption is performed using the generated common key. To secure the USB bus.

  In addition, it is preferable to perform encrypted communication similar to the data exchange between the USB host unit 14 and the IC card driving device 17 for the data exchange between the USB host unit 14 and the USB memory MM.

  In general, there are two types of IC cards CC, contact type and non-contact type, but in the case of the present embodiment, either can be applied.

  In addition, a key for accessing each storage area is usually set in the IC card CC, and authentication using this key is performed when reading / writing. Thereby, the confidentiality of the data in the IC card CC is maintained.

  Therefore, when the user ID and password used as personal authentication information in this embodiment are stored in a specific area, it is necessary to authenticate using an individual access key in order to access the personal authentication information.

  On the other hand, the card identification information such as a serial number assigned uniquely is held in the IC card CC, and the serial number can be read without using the access key as described above.

  Therefore, when a network compatible MFP MFP is newly introduced, if an access method to personal authentication information in the IC card CC is disclosed, customization is performed to change the control program of the network compatible MFP MFP. The authentication function can be realized.

  On the other hand, when the method for accessing the personal authentication information in the IC card CC is not disclosed, the IC card CC is also used by treating the manufacturing number uniquely held by the IC card CC as the authentication information. Authentication can be performed. For example, in the IC card system called FeliCa (registered trademark; ISO / IEC 18092), the manufacturing number is hexadecimal data of 8 bytes, and this information can be easily read out.

  As described above, when the manufacturing number of the IC card CC is used as the personal authentication information, the conversion of the manufacturing number into character string data is registered as the user ID.

  Thus, for personal authentication using the IC card CC, there are two types of personal authentication information: a user ID and a password, or only a user ID (manufacturing number of the IC card). Which method is to be applied must be set in advance in the initial setting of the network compatible MFP MFP.

  FIG. 3 shows a configuration example of the network terminal device TM (TM1 to TMn).

  In the figure, a CPU (Central Processing Unit) 21 controls the operation of the data processing unit DT, and a ROM (Read Only Memory) 22 is a program executed when the CPU 21 starts up, necessary data, etc. RAM (Random Access Memory) 23 is used to configure a work area of the CPU 21 and the like.

  The character generator 24 is for generating graphic character display data, the clock circuit 25 is for outputting current date and time information, and the local area network interface circuit 26 is connected to the data processing device DT. The local area network transmission control unit 27 is used to connect to a local area network LAN. The local area network transmission control unit 27 performs various kinds of predetermined data for exchanging various data with other data terminal devices via the local area network LAN. This is for executing the communication control processing of the protocol suite.

  The magnetic disk device 28 is for storing various data such as various application programs, work data, file data, image information data, and the optical medium driving device 29 is an optical recording medium that can be exchanged (for example, CD-ROM, DVD, etc.) for accessing (reading and writing) data, and the screen display device 31 is for displaying a screen for operating this data processing device DT, and is a display control unit. 32 is for controlling display contents of the screen display device 31.

  The keyboard device 33 is for performing various key operations on the data processing device DT, and the screen instruction device 34 is for performing operation operations such as indicating an arbitrary point on the screen display device 31. Yes, the input control unit 35 is for capturing input information of the keyboard device 33 and the screen instruction device 34.

  The USB host unit 36 is for realizing a USB host function, and is provided with a socket 37 for attaching / detaching the USB memory MM.

  These CPU 21, ROM 22, RAM 23, character generator 24, clock circuit 25, local area net transmission control unit 27, magnetic disk device 28, optical medium drive device 29, display control unit 32, input control unit 35, and USB host unit 36 is connected to an internal bus 38, and data exchange between these elements is mainly performed via the internal bus 38.

  FIG. 4 shows a software configuration diagram of the network compatible MFP MFP, and FIG. 5 shows an example of a module relation diagram focusing on the authentication service module. FIG. 6 shows a specific example of the authentication control service 41.

  In this case, the network-compatible MFP MFP can operate applications such as copy, facsimile, printer, and Web, and personal authentication for using these applications is performed by the authentication control service.

  In the authentication control service 41, the authentication information control unit 41a appropriately controls the encryption / decryption processing unit 41b to apply the encryption processing and decryption processing of the personal authentication information, and the authentication information output unit 41c. Thus, the personal authentication information is output to an external function (external device or the like) such as the USB memory MM.

  Here, the output destination of the authentication information output unit 41c is not limited to the USB memory MM, and may be another terminal device via the local area network LAN.

  Also, in the network compatible MFP MFP, these applications can be used only after the personal authentication of the user is successful. In addition, it is possible to select an application that can be used for each registered user, and it is also possible to limit functions for each user by performing personal authentication.

  FIG. 7 shows an example of a software configuration related to the network printing function of the network terminal apparatuses TM1 to TMn.

  The print application 61 instructs the printer driver 62 to form a print job. The printer drive 62 uses the authentication library 63 or lower (including the IC card R / W device driver 64 and the USB host device driver 65) to acquire personal authentication information from the USB memory MM and print the acquired personal authentication information. The job is added to the job, and the print job is transmitted to the network compatible MFP MFP via the local area network LAN using the network library 66.

  The personal authentication information stored in the USB memory MM is as shown in FIG. As described above, when the user ID and password stored in the IC card CC can be accessed, the user ID and password are stored. When the user ID and password cannot be accessed, the IC card CC serial number is used as the user ID. The converted version is saved.

  As for personal authentication, any method can be employed when the network compatible MFP MFP executes it on its own or when it is performed using the authentication server device SV. When the network-compatible MFP MFP performs personal authentication by itself, it is necessary to register personal authentication information. For example, a user ID and a password may be stored in one piece of information in the address book DB as shown in FIG.

  FIG. 9 shows a display example of the operation display unit 7 of the network compatible MFP MFP, and this screen is displayed by enabling the personal authentication function by the IC card CC.

  The user performs an authentication operation by setting the employee ID or student ID distributed by the administrator to the IC card driving device 17 connected to the MFP corresponding to the network.

  If the personal authentication information read from the IC card CC matches the authentication information registered in advance in the network compatible MFP MFP, the authentication is completed and the function is enabled. FIG. 10 is a screen display example of the copy application after the authentication is completed. If the authentication fails, the authentication failure is displayed as shown in FIG.

  Here, the authentication information acquisition setting operation is shown in FIG.

  The network-compatible MFP MFP displays a user authentication setting screen (see FIG. 13) using the IC card CC according to an instruction from the user operation display unit 7 (process 101).

  When the user presses an “acquire from IC card CC” button (process 102), a screen (see FIG. 14) for setting the IC card CC in the IC card driving device 17 is displayed.

  When detecting that the IC card CC is set in the IC card driving device 17, the network compatible MFP MFP reads personal authentication information from the IC card CC (process 103).

  When it is determined that the reading of the authentication information has been completed normally (the result of determination 104 is YES), the user name acquired from the IC card CC is displayed in the login user name display portion displayed on the user authentication information setting screen. (Process 105; see FIG. 15).

  If the user has connected the USB memory MM to the socket 15 at this point in time, an “output to USB memory MM” button is displayed on the user authentication information setting screen. When the user presses the “output to USB memory MM” button (the result of determination 106 is YES), the personal authentication information acquired from the IC card CC is written into the USB memory MM (process 107). When the user presses the “SET” button, the user authentication information of the network compatible MFP MFP is registered and the process ends.

  If the output to the USB memory MM is not instructed and the result of determination 106 is NO, this operation is terminated at that point.

  On the other hand, if the authentication information cannot be normally read from the IC card CC and the result of determination 104 is NO, an IC card reading error is displayed (process 108). The user determines whether to read the IC card again or end, and when a retry is instructed, the IC card CC is read again (the result of determination 109 is YES). If the retry is canceled (the result of determination 109 is NO), the process ends.

  In this way, in this embodiment, since the personal authentication information stored in the IC card CC can be output to the USB memory MM, it is attached to the network terminal devices TM1 to TMn to which this USB memory MM can be attached. Thus, when a print job is to be output from an external device of the network compatible MFP MFP, the personal authentication information stored in the USB memory MM is added to the print job. The restriction can be appropriately performed, which is very convenient.

  FIG. 16 shows another example of the authentication information acquisition setting operation.

  The network-compatible MFP MFP displays a user authentication setting screen (see FIG. 13) using the IC card CC according to an instruction from the user operation display unit 7 (process 201).

  When the user presses an “acquire from IC card CC” button (process 202), a screen (see FIG. 14) for setting the IC card CC in the IC card driving device 17 is displayed.

  When detecting that the IC card CC is set in the IC card driving device 17, the network compatible MFP MFP reads personal authentication information from the IC card CC (process 203).

  When it is determined that the reading of the authentication information has been normally completed (the result of determination 204 is YES), the user name acquired from the IC card CC is displayed in the login user name display portion displayed on the user authentication information setting screen. (Processing 205; see FIG. 15).

  If the user has connected the USB memory MM to the socket 15 at this point in time, an “output to USB memory MM” button is displayed on the user authentication information setting screen. When the user presses the “output to USB memory MM” button (the result of determination 206 is YES), it is checked whether encryption is set when outputting personal authentication information (determination 207).

  When the result of determination 207 is YES, it is checked whether or not a predetermined public key is stored in the USB memory MM (decision 208). When the result of determination 208 is YES, the public key is acquired from the USB memory MM. The personal authentication information is encrypted using the public key (process 209), and the encrypted personal information is stored in the USB memory MM (process 210).

  If the result of determination 208 is NO, the personal authentication information is encrypted using the private key set in the terminal (process 211), and the encrypted personal information is stored in the USB memory MM (process 212). .

  On the other hand, if encryption is not set and the result of determination 207 is NO, the personal authentication information acquired from the IC card CC is written to the USB memory MM (processing 213). When the user presses the “SET” button, the user authentication information of the network compatible MFP MFP is registered and the process ends.

  If the output to the USB memory MM is not instructed and the result of determination 206 is NO, this operation is terminated at that point.

  On the other hand, when the authentication information cannot be normally read from the IC card CC and the result of determination 204 is NO, an IC card reading error is displayed (process 214). The user determines whether to read the IC card again or end, and when a retry is instructed, the IC card CC is read again (the result of determination 215 is YES). If the retry is canceled (the result of determination 216 is NO), the process ends.

  In this way, when it is set to encrypt personal information, if the user's public key is stored in the USB memory MM, the personal authentication information is encrypted using the public key and then the USB memory Since the personal authentication information is encrypted and stored in the USB memory MM using the private key set in the own terminal when the public key is not stored in the MM, it is advantageous in terms of security.

  FIG. 17 shows an example of processing when a printing operation using the network compatible MFP MFP is instructed in the network terminal apparatuses TM1 to TMn. In this case, a network printing function is used.

  When a print instruction is input from the user (process 301), print job data for printing the print data delivered from the print application is created (process 302). Here, it is checked whether or not the USB memory MM is set (determination 303). When the result of determination 303 is NO, a display requesting the user to set the USB memory MM is performed (processing 304). Return to decision 303.

  If the USB memory MM is set and the result of determination 303 is YES, authentication information is read from the USB memory MM (process 305). Here, it is checked whether a public key and a private key paired with the public key are set in the terminal (determination 306). When the result of determination 306 is YES, the read authentication information is set. The private authentication key is decrypted to form personal authentication information (process 307).

  Next, the personal authentication information (plain text) created in process 307 or the personal authentication information (encrypted text) read from the USB memory MM is added to the print job data (process 308), and the personal authentication information is added in process 308. The completed print job is transmitted to the network compatible MFP MFP (process 309).

  FIG. 18 shows an example of processing of the network compatible MFP MFP when a print job is received from the network terminal devices TM1 to TMn via the local area network LAN.

  When the print job data is received (process 401), it is checked whether the personal authentication information added to the received print job data is encrypted (decision 402). Whether or not the personal authentication information is encrypted can be determined, for example, by adding an encryption flag that indicates whether or not the personal authentication information is encrypted to the print job data.

  When the result of determination 402 is YES, the encrypted personal authentication information is decrypted using the private key set in the terminal itself, and the personal authentication information is acquired (process 403).

  Next, an authentication operation is performed using either the personal authentication information formed by the process 403 or the plaintext personal authentication information added to the print job data (process 404).

  If the authentication result of the process 404 is OK (the result of the determination 406 is YES), the printing operation of the received print job is performed (process 406).

  If the result of authentication in process 404 is NG (result of determination 406 is NO), an authentication error is displayed (process 407), and the received print job is not executed.

  By the way, in the above-described embodiment, the case where the network compatible MFP MFP has a personal authentication function using the IC card CC has been described. However, other than the personal authentication function, for example, a face, a voiceprint, A biometric authentication function using the iris, fingerprint, vein, etc. of the pupil can be employed.

  In the above-described embodiment, the case where a print job is transmitted from the network terminal device to the network compatible MFP MFP using the network printing function has been described. The present invention can be similarly applied when transmitting a print job from a terminal device directly connected via an interface.

  In the above-described embodiment, the personal authentication is transferred between the network compatible MFP MFP and the network terminal device TM using the USB memory MM, but the network terminal device TM is passed through the local area network LAN. It can also be configured to transmit. Alternatively, a storage medium other than the USB memory MM can be used.

1 is a block diagram showing a network system according to an embodiment of the present invention. FIG. 2 is a block diagram showing a configuration example of a network compatible MFP MFP. The block diagram which showed the structural example of network terminal device TM (TM1-TMn). FIG. 2 is a software configuration diagram of a network compatible MFP. The figure which showed an example of the module related figure which paid its attention to the authentication service module. The block diagram which showed the specific example of the authentication control service 41. FIG. The block diagram which showed an example of the software structure regarding the network printing function of network terminal device TM1-TMn. Schematic which showed an example of the personal authentication information preserve | saved at USB memory MM. Schematic which showed an example of the authentication request | requirement screen. Schematic which showed an example of the screen display of the copy application after authentication completion. Schematic which showed the example of a display of an authentication failure screen. The flowchart which showed an example of authentication information acquisition setting operation | movement. Schematic which showed the example of a display of a user authentication information setting screen. Schematic which showed the example of a display of an IC card set request screen. Schematic which showed the other example of the display of a user authentication information setting screen. The flowchart which showed the other example of authentication information acquisition setting operation | movement. 6 is a flowchart illustrating an example of processing when a printing operation using a network-compatible MFP MFP is instructed in the network terminal devices TM1 to TMn. 7 is a flowchart showing an example of processing of the network compatible MFP MFP when a print job is received from the network terminal devices TM1 to TMn via the local area network LAN.

Explanation of symbols

MFP network compatible MFP TM, TM1 to TMn Network terminal device SV authentication server device CC IC card MM USB memory

Claims (5)

Authentication information input means for inputting predetermined personal authentication information for authenticating a registered user;
An image forming apparatus comprising authentication information control means for performing user authentication using the personal authentication information input from the authentication information input means,
An image forming apparatus comprising: authentication information output means for outputting the personal authentication information input from the authentication information input means to the outside. Job information input means for inputting predetermined job information is further provided.
2. The user authentication is performed by the authentication information control unit using the personal authentication information when the personal authentication information is added to the job information input from the job information input unit. Image forming apparatus.   The image forming apparatus according to claim 1, further comprising an encryption unit configured to encrypt the personal authentication information output from the authentication information output unit. Encryption means for encrypting personal authentication information output from the authentication information output means to form encrypted personal authentication information;
When the encrypted personal authentication information is added to the job information input from the job information input means, the information processing apparatus further comprises decryption means for decrypting the encrypted personal authentication information into the original personal authentication information. The image forming apparatus according to claim 2. An image including authentication information input means for inputting predetermined personal authentication information for authenticating a registered user, and authentication information control means for performing user authentication using the personal authentication information input from the authentication information input means A method for controlling a forming apparatus, comprising:
A control method for an image forming apparatus, characterized in that the personal authentication information input from the authentication information input means is output to the outside.