JP2009129110A - Image forming apparatus, image forming method, program, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an image forming apparatus, an image forming method, a program, and a recording medium for ensuring a secure equipment operation. <P>SOLUTION: A function to be used is limited by type of IC cards in user authentication through an IC card, so that it is possible to easily set use authority by the type of the IC cards without changing the use authority of every user when using an image forming apparatus having an authentication function through the IC card, and that it is possible to achieve a secure equipment operation. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an image forming apparatus having an individual authentication function using an IC card, an image forming method, a program, and a recording medium.

  In recent years, IC (Integrated Circuit) cards have become widespread, and ID (Identification) cards for identifying individuals such as employee ID cards and student ID cards have been introduced with IC cards. The user restriction function for devices using this IC card has been realized on PCs, but not only for PCs but also for office devices with multiple copy and facsimile functions, security is taken into account and the user's personal It has been proposed to perform authentication using an IC card (see, for example, Patent Documents 1 and 2).

There are various types of IC cards, but in many cases, authentication information for identifying an individual is recorded in a storage area in the IC card, and the device performs authentication by reading the authentication information. This authentication information storage area may be equipped with a function of performing mutual authentication between the IC card and the device when accessing data. The IC card holds information for identifying an individual such as a serial number (hereinafter referred to as IDm), an ID and password for each user, a certificate for each user, and the device acquires the authentication information. Authenticate. In addition, since the authentication information and the registered user are associated with each other, the function for each user is restricted.
JP 2006-244321 A JP 2007-011942 A

However, in the technologies described in Patent Documents 1 and 2 described above, when the device acquires the authentication information, the processing for acquiring the authentication information differs depending on the type of the IC card. However, it is not compatible with secure device operation.
SUMMARY OF THE INVENTION Accordingly, an object of the present invention is to provide an image forming apparatus, an image forming method, a program, and a recording medium that can perform secure device operation.

  In order to solve the above-mentioned problem, the invention according to claim 1 is an image forming apparatus having a function of authenticating a user using an authentication server installed on a network. It is characterized by function restriction.

  The invention described in claim 2 is characterized in that, in the invention described in claim 1, the type of the IC card used for authentication in the authentication information acquisition process is determined.

  The invention described in claim 3 is characterized in that, in the invention described in claim 1 or 2, communication is performed with a server holding the same authentication information as the authentication information held by itself.

  The invention according to claim 4 is the invention according to claim 1 or 2, wherein the server holding the same authentication information as that held by the server also holds the type information of the IC card. It is characterized by.

  The invention according to claim 5 is characterized in that, in the invention according to claim 3 or 4, the management can be performed by associating the type of the IC card with the registered user.

  The invention according to claim 6 is the function restriction that the image forming apparatus can use for each type of IC card and the function restriction that the image forming apparatus can use for each registered user in the invention according to any one of claims 3 to 5. And a function restriction for the user is set.

  The invention described in claim 7 is characterized in that, in the invention described in claim 6, communication is performed with a program operating on the client PC.

  According to an eighth aspect of the present invention, in an image forming apparatus control method having a function of authenticating a user using an authentication server installed on a network, the function is restricted for each IC card after authentication with the IC card. It is characterized by that.

  According to the ninth aspect of the present invention, there is provided a process for causing a computer of an image forming apparatus having a function of authenticating a user using an authentication server installed on a network to authenticate with an IC card, and for each IC card after the authentication process It is a program for executing a process for restricting the functions.

  A tenth aspect of the invention is a recording medium on which the control program according to the ninth aspect is recorded.

  According to the present invention, when the image forming apparatus having the authentication function by the IC card is used by restricting the function to be used for each type of the IC card in the user authentication from the IC card, the use authority for each user is obtained. The usage authority can be easily set for each type of IC card without changing the password, and secure device operation is possible.

  One embodiment of an image forming apparatus according to the present invention is a function for each IC card after authentication with an IC card in an image forming apparatus having a function of authenticating a user using an authentication server installed on a network. It is characterized by restriction.

Here, the image forming apparatus is an apparatus typified by a printer, a scanner, a fax machine, and a multifunction peripheral having these functions.
The image forming apparatus includes an interface (I / F) for connecting to a LAN line as typified by a network printer apparatus / network scanner apparatus / Internet facsimile apparatus.

  According to the above configuration, by using a peripheral device typified by a multifunction peripheral having an authentication function using an IC card by restricting a function used for each type of IC card in user authentication from the IC card, The usage authority can be easily set for each type of IC card without changing the usage authority for each user, and secure device operation is possible.

  Another embodiment of the image forming apparatus according to the present invention is characterized in that, in the above configuration, the type of the IC card used for authentication in the authentication information acquisition process is determined.

  According to the above configuration, since the type of IC card can be determined in the process when the peripheral device acquires authentication information from the IC card, the IC card issuance manager issues the IC card to the user in advance. It is possible to operate without setting information on the type of IC card.

  Another embodiment of the image forming apparatus according to the present invention is characterized in that, in the above-described configuration, communication is performed with a server holding the same authentication information as the authentication information held by itself.

  According to the above configuration, the authentication information held by the peripheral device and the server holding the authentication information also hold the information related to the type of IC card because the server holds the information related to the type of IC card. Therefore, there is no need to operate a server for the peripheral device, and the peripheral device does not need to make an inquiry about information on the type of IC card to another server.

  In another embodiment of the image forming apparatus according to the present invention, in the above configuration, the server holding the same authentication information as the authentication information held by the server also holds the type information of the IC card. It is characterized by that.

  According to the above configuration, the authentication information held by the peripheral device and the server holding the authentication information also hold the information related to the type of IC card because the server holds the information related to the type of IC card. Therefore, there is no need to operate a server for the peripheral device, and the peripheral device does not need to make an inquiry about information on the type of IC card to another server.

  Another embodiment of the image forming apparatus according to the present invention is characterized in that, in the above configuration, the type of IC card and a registered user can be linked and managed.

  According to the above configuration, the server holding the registered user authentication information and the registered user authentication information held by the peripheral device enables the association between the type of IC card and the registered user, It becomes possible to manage registered users by grouping them into IC card types. Thereby, it becomes possible to make it depend on the kind of IC card currently used, without managing each registered user.

  In another embodiment of the image forming apparatus according to the present invention, in the above configuration, a function restriction that can be used by the image forming apparatus for each type of IC card and a function restriction that can be used by the image forming apparatus for each registered user are combined. It is characterized in that the user's function restriction is set.

  According to the above configuration, the authentication information held by the peripheral device and the server holding the authentication information can set a combination of a function restriction for each type of IC card and a function restriction for each registered user. As a result, the function level of all the target users can be changed for each type of IC card without changing the function limit for each user, so that the security level can be easily changed.

  Another embodiment of the image forming apparatus according to the present invention is characterized in that, in the above-described configuration, communication with a program operating on a client PC is performed.

  According to the above configuration, even when using a peripheral device from a program running on a client PC, the function used for each type of IC card is similarly restricted, so that when accessing the device remotely. Secure device operation.

  An embodiment of an image forming apparatus control method according to the present invention is an image forming apparatus control method having a function of authenticating a user using an authentication server installed on a network. It is characterized in that the function is restricted for each IC card later.

  According to the above configuration, the use authority for each user when using the image forming apparatus having the authentication function by the IC card by restricting the function to be used for each type of the IC card in the user authentication from the IC card. The usage authority can be easily set for each type of IC card without changing the password, and secure device operation is possible.

  According to one embodiment of the control program for an image forming apparatus of the present invention, a computer of an image forming apparatus having a function of authenticating a user using an authentication server installed on a network authenticates with an IC card. It is characterized in that a process for performing function restriction for each IC card is executed after the process and the authentication process.

  According to the above configuration, the use authority for each user when using the image forming apparatus having the authentication function by the IC card by restricting the function to be used for each type of the IC card in the user authentication from the IC card. The usage authority can be easily set for each type of IC card without changing the password, and secure device operation is possible.

  One embodiment of the recording medium of the present invention is characterized in that the control program having the above-described configuration is recorded.

<Program and recording medium>
The image forming apparatus of the present invention described above is realized by an image forming program that causes a computer to execute an image forming process. Examples of the computer include general-purpose computers such as personal computers and workstations, but the present invention is not limited to this.

  The control program performs processing for causing the computer of the image forming apparatus having the function of authenticating the user using an authentication server installed on the network to authenticate with the IC card, and restricts the function for each IC card after the authentication processing. The processing to be performed is executed.

Thus, the image forming apparatus of the present invention can be realized anywhere as long as there is a computer environment capable of executing the image forming program.
Such a control program for the image forming apparatus may be stored in a computer-readable recording medium.
Here, examples of the recording medium include a computer-readable recording medium such as a CD-ROM (Compact Disc Read Only Memory), a flexible disk (FD), a CD-R (CD Recordable), and a DVD (Digital Versatile Disk). Semiconductor memory such as HDD (Hard Disc Driver), flash memory, RAM (Random Access Memory), ROM (Read Only Memory), FeRAM (ferroelectric memory), and the like.

  The above-described embodiment shows an example of a preferred embodiment of the present invention, and the present invention is not limited thereto, and various modifications can be made without departing from the scope of the invention. is there.

Next, the embodiment of the present invention will be described with reference to diagrams and the like.
FIG. 1 is a network system configuration diagram of an image forming apparatus according to an embodiment of the present invention.
The image forming apparatus 20, the network terminal apparatus 24, and the external authentication server 23 can communicate via the network 25. The image forming apparatus 20 is connected to an IC card reader / writer device (hereinafter referred to as an IC card R / W) 21-1 capable of interfacing with the IC card 22-1. A network terminal device 24 is connected to the network 25, and an IC card reader / writer device 21-2 capable of reading / writing another IC card 22-2 is connected to the network terminal device 24.
The user has an IC card 22-1 in which his / her personal authentication information issued in advance by a system administrator (both not shown) is recorded, and the IC card 22-1 is started when the operation of the image forming apparatus 20 is started. Over the IC card R / W (Reader Writer) 21-1, the authentication process is performed and when the authentication is successful, the use of the image forming apparatus 20 can be started.

  A key (also referred to as a key) for accessing each storage area is set in the IC card 22-1 so that when the IC card 22-1 is read / written, authentication using this key is performed. It has become. Thereby, the confidentiality of the data in the IC card 22-1 is maintained. The user ID and password are stored in separate areas, and it is necessary to authenticate using individual access keys for access. In addition to the personal authentication information, information such as a serial number uniquely assigned to the IC card 22-1 is held, and a special access method is not required for reading and can be easily performed. There are generally two types of IC cards 22-1: contact type and non-contact type, but either type may be used.

FIG. 2 is an example of a block diagram illustrating a hardware configuration of the image forming apparatus according to the present invention.
The image forming apparatus shown in FIG. 1 includes a controller 29, an IC card R / W 41, an operation unit 42, a fax control unit 44, a plotter 45, a scanner 46, and other hardware resources 47.
The controller 29 includes an ASIC (Application Specific Integrated Circuit) 35, a CPU 30, an NB (North Bridge) 34, a RAM (Random Access Memory) 31, 32, an HDD 33, a serial bus 36, and a NIC (Network Interface Card). , USB (Universal Serial) 38, USB host 39, memory card I / F 40, and PCI BUS (Peripheral Component Interface BUS).

  For accessing the IC card 42, the CPU 30 is connected to the IC card R / W device 41 with a USB cable via the NB 34, PCI BUS, and USB (Universal Serial Bus) host 39. Control is performed by sending a command to 41, and the IC card R / W device 41 communicates with the IC card 42. Data such as user authentication information and key information for accessing the authentication information is transmitted and received through the USB communication path. For this reason, there is a concern about leakage of information due to the monitoring of the USB bus. In order to prevent such a situation, transmission / reception of commands and data on the USB is encrypted. Before encryption, authentication is performed with the IC card R / W device 41, and a common key obtained from the result is generated. The USB bus is secured by using a common key for encryption / decryption.

FIG. 3 is an example of a software configuration diagram of the image forming apparatus according to the present invention.
The image forming apparatus 20 can operate applications 50 to 54 such as a copy, a facsimile machine, a printer, and a Web (world wide web), and personal authentication for using these applications 50 to 54 is given to the authentication control service 61. It is carried out. In addition, there are a system control service 55, a fax control service 56, an engine control service 57, a memory control service 58, an operation unit control service 59, and a network control service 60.
These applications can only be used after successful authentication. In addition, it is possible to select an application that can be used for each registered user, and it is possible to limit functions for each user by performing personal authentication. The image forming apparatus 20 includes an OS (Operation System) 62, an engine control board 633, a plotter engine 64, a scanner engine 65, and other hardware resources 66.

FIG. 4 is an example of a software module configuration diagram focusing on the authentication service module.
The authentication service 1 accepts an authentication request from the application 12, displays it on the operation panel (not shown) via the drawing processing module 10 and the graphic driver 11, and the IC card resource manager 2 (IC card R / W device driver 3, Authentication information is acquired from an IC card (not shown) from the USBHOST device driver 4). The obtained authentication information is inquired to the address book DB 7 (file system 8, HDD (Hard Disc Drive) driver 9) or the network library 5 (NIC device driver 6) is used for an external authentication server (not shown). Make an inquiry. As a result of the inquiry, whether the authentication has succeeded or failed is output to the application 12.

  FIG. 5 shows the screen display unit and operation unit (operation panel) of the image forming apparatus shown in FIG. 1, and this screen (“Set the authentication card” is set by enabling the personal authentication function by the IC card. Or, enter your login user name and login password and press the [Login] key.

  FIG. 7 is a display example of an authentication request screen at the time of setting valid only for authentication from the IC card. As shown in the figure, when setting is effective only for authentication from the IC card, this screen (“Set the authentication card”) is displayed by requesting authentication with the IC card.

  The user performs an authentication operation by setting an employee ID or student ID distributed in advance by an administrator to an IC card reader device connected to the image forming apparatus. If the personal authentication information read from the IC card matches the authentication information registered in the image forming apparatus in advance, or if the authentication is successful by making an inquiry to the external authentication server, the device is used for that user. Is permitted and the function is enabled. If the authentication fails, the authentication failure is displayed as shown in the screen of FIG. 6 (“authentication failed”). FIG. 6 shows a screen display unit and an operation unit of the image forming apparatus shown in FIG.

Embodiments of claims 1, 2, 8, and 9 will be described.
FIG. 8 is a screen display example of the copy application after the authentication is completed.
As shown in the figure, the authentication and the acquisition of the IC card type information are performed from the authentication information in the fraudulent IC card, and the use of the result of applying the restriction on the function of the IC card type used after the authentication is established This is an example of displaying function restrictions.
There are four indications “Copy”, “Print”, “FAX”, and “Scan” under the phrase “The functions that can be used with this IC card device are limited to the following.” Only “Copy” is lit. Has been. That is, in this case, only a copy can be used.

  FIG. 9 is a screen display example of the copy application after completion of the authentication shown in FIG. FIG. 10 is an example of granting the usage authority for each IC card and the usage authority of the registered user.

Embodiments of claims 3, 4 and 5 will be described.
Next, an example of the IC card authentication operation of the image forming apparatus according to the present invention will be described with reference to the flowchart of FIG. FIG. 11 is an example of a flowchart for explaining the operation of the image forming apparatus shown in FIG.
Set restrictions on the functions that can be used on devices depending on the type of IC card. Also, valid / invalid setting is made for the function restriction for each type of IC card (S1).
After that, if the setting is made to authenticate with the IC card, an authentication request screen is displayed after the system is activated (S2).
The user sets his IC card in the card reader (S3).
It is detected that the IC card is set, and authentication information for each user in the IC card is acquired (S4).
The authentication information for each user held in the IC card has different processing for accessing depending on the type of IC card. Thereby, in order to determine the type of the IC card, the peripheral device acquires the IC card type information held in the server such as the external authentication server (S5).

From the authentication information for each user acquired in (S4), user authentication is performed on the device (S6, S7).
If the authentication is successful for the device by the user authentication, it is determined whether the information set in (S1) is “valid / invalid with respect to function restriction for each type of IC card” (S8) (S9).
If the function restriction for each type of IC card is valid, the usage authority for each IC card is linked to the usage authority of the registered user holding the IC card, and the peripheral device to the IC card user is All usage rights are granted (S10).
Regarding the granting of the usage authority, it is possible to perform the authority setting to be given by a combination of the usage authority for each IC card and the usage authority of the registered user of the IC card. An example in which this provision condition is set as an AND condition in the initial setting of (S1) is shown in FIG.
Through the process of (S10), the user is notified of the restriction on the devices that can be used by the user who has been successfully authenticated (S11).
In addition, when the function restriction for each type of IC card is invalid in (S8) and (S9), the function restriction for each user is applied.

An embodiment of claim 6 will be described.
The same applies to the network terminal device in FIG. 1, and when the peripheral device is authenticated by using the IC card, the network terminal device and the peripheral device communicate with each other, and the peripheral device determines each IC card from the acquired authentication information. Is associated with the usage authority of the registered user of the IC card, and the usage authority of the peripheral device is given to the user.

[Function and effect]
(1) By limiting the functions used for each type of IC card in user authentication from an IC card, when using a peripheral device typified by a multifunction peripheral having an authentication function using an IC card, The usage authority can be easily set for each type of IC card without changing the usage authority, thereby enabling secure device operation.

(2) Since the type of the IC card can be determined in the process when the peripheral device acquires the authentication information from the IC card, the IC card issuance manager issues the IC card to the user in advance. Operation is possible without setting information on the type of

(3) Since the server holding the authentication information and the authentication information held by the peripheral device also holds the information related to the type of the IC card, the server for holding the information related to the type of the IC card It is not necessary for the peripheral device to make an inquiry about information on the type of IC card to another server.

(4) The server holding the registered user authentication information and the registered user authentication information held by the peripheral device enables the association between the type of the IC card and the registered user. It becomes possible to group and manage IC card types. Thereby, it becomes possible to make it depend on the kind of IC card currently used, without managing each registered user.

(5) The authentication information held by the peripheral device and the server holding the authentication information can be set by combining a function restriction for each type of IC card and a function restriction for each registered user. The security level can be easily changed by changing the function restrictions of all the target users for each type of IC card without changing the function restrictions for each user.

(6) Also, when using a peripheral device from a program running on a client PC, similarly, by restricting the functions used for each type of IC card, it is also possible to access the device remotely. Enables secure device operation.

1 is a configuration diagram of a network system of an image forming apparatus according to an embodiment of the present invention. 1 is an example of a block diagram illustrating a hardware configuration of an image forming apparatus according to the present invention. 1 is an example of a software configuration diagram of an image forming apparatus according to the present invention. It is an example of the software module block diagram which paid its attention to the authentication service module. 2 is a screen display unit and an operation unit (operation panel) of the image forming apparatus illustrated in FIG. 1. 2 illustrates a screen display unit and an operation unit of the image forming apparatus illustrated in FIG. 1. It is a display example of an authentication request screen at the time of setting valid only for authentication from an IC card. It is an example of a screen display of a copy application after completion of authentication. FIG. 9 is a screen display example of a copy application after completion of authentication shown in FIG. 8. It is an example of granting the usage authority for each IC card and the usage authority of a registered user. 2 is an example of a flowchart for explaining the operation of the image forming apparatus shown in FIG. 1.

Explanation of symbols

1 Authentication Service 2 IC Card Resource Manager 3 IC Card R / W Device Driver 4 USBHOST Device Driver 5 Network Library 6 NIC Device Driver 7 Address Book DB
8 File system 9 HDD driver 10 Drawing process 11 Graphic driver 20 Image forming apparatus 21-1, 21-2 IC card R / W
22-1 and 22-2 IC card 23 External authentication server 24 Network terminal device 25 Network

Claims (10)

  An image forming apparatus having a function of authenticating a user using an authentication server installed on a network, wherein the function is restricted for each IC card after authentication with the IC card.   2. The image forming apparatus according to claim 1, wherein the type of the IC card used for authentication in the authentication information acquisition process is determined.   3. The image forming apparatus according to claim 1, wherein the image forming apparatus communicates with a server holding authentication information identical to the authentication information held by the image forming apparatus.   3. The image forming apparatus according to claim 1, wherein the server that holds the same authentication information as that held by the server also holds IC card type information. apparatus.   5. The image forming apparatus according to claim 3, wherein the type of IC card and a registered user can be linked and managed.   6. The image forming apparatus according to claim 3, wherein a function restriction that can be used by the image forming apparatus for each type of IC card is combined with a function restriction that can be used by the image forming apparatus for each registered user. An image forming apparatus configured to perform function restriction settings.   7. The image forming apparatus according to claim 6, wherein the image forming apparatus communicates with a program operating on a client PC.   In a method for controlling an image forming apparatus having a function of authenticating a user using an authentication server installed on a network, the function of each IC card is restricted after authentication with the IC card. Control method.   Executes processing to make the computer of the image forming apparatus having the function of authenticating the user using the authentication server installed on the network authenticate with the IC card, and to perform the function restriction for each IC card after the authentication processing A program for controlling an image forming apparatus.   A recording medium on which the control program according to claim 9 is recorded.

Images