JP2009289164A - Image forming apparatus, authentication control method and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an image forming apparatus, an authentication control method and a program for appropriately authenticating a user using a card. <P>SOLUTION: The image forming apparatus has a card ID acquisition means for acquiring a card ID read by a card reader from a card; a correspondence information management means for managing information about the correspondence between the card ID and user identification information; a user information acquisition means for acquiring the user identification information corresponding to the card ID acquired by the card ID acquisition means from the correspondence information management means, and acquiring the password of a user related to the user identification information acquired; and an authentication control means for authenticating the user based on the user information identification information and the password acquired. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an image forming apparatus, an authentication control method, and a program, and more particularly, to an image forming apparatus that performs user authentication, an authentication control method, and a program.

  In recent years, in an embedded system such as an image forming apparatus, an increasing number of models are equipped with an interface for connecting an external device such as a USB device as a standard. Therefore, a solution has been developed in which user information is input using an external device (for example, an IC card reader or the like) at the time of user authentication in the image forming apparatus (for example, Patent Documents 1 to 3).

When using a card for user authentication, it is desirable to use a high-function IC card combined with a PIN (Personal Identification Number) from the viewpoint of ensuring high security. This is because information cannot be obtained from such an IC card unless the correct PIN is input.
JP 2006-215770 A JP 2007-122384 A JP 2006-92437 A

  By the way, when information recorded on a high-performance IC card is used for user authentication, the card format of the IC card (information recording format, etc.) needs to be disclosed from the card issuer. However, the card format is very important information for security and cannot be disclosed easily. Therefore, a complicated operation for disclosing a card format when constructing a system using an IC card is required.

  On the other hand, a simple card having only a card ID without using a PIN (for example, a magnetic card, a proximity card, etc.) has a problem that it is difficult to ensure the same security as a high-performance IC card. .

  SUMMARY An advantage of some aspects of the invention is that it provides an image forming apparatus, an authentication control method, and a program capable of appropriately realizing user authentication using a card.

  In order to solve the above problems, the present invention provides a card ID acquisition unit that acquires a card ID read from a card by a card reading device, a correspondence information management unit that manages correspondence information between the card ID and user identification information, and User information acquisition means for acquiring user identification information corresponding to the card ID acquired by the card ID acquisition means from the correspondence information management means, and acquiring a user password related to the acquired user identification information; And authentication control means for executing user authentication processing based on the user information identification information and the password.

  In such an image forming apparatus, user authentication using a card can be appropriately realized.

  According to the present invention, it is possible to provide an image forming apparatus, an authentication control method, and a program capable of appropriately realizing user authentication using a card.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram illustrating a hardware configuration example of an image forming apparatus according to an embodiment of the present invention. In FIG. 1, an image forming apparatus 10 is a multifunction machine that realizes a plurality of functions such as scanning, copying, and printing in a single casing, and includes a CPU 101, a memory 102, a recording medium 103, a network I / F 104, an image An output unit 105, an image processing unit 106, an external device I / F 107, a display unit 108, an operation unit 109, and the like are included.

  A program that implements the functions of the image forming apparatus 10 is recorded (installed) in a non-volatile recording medium 103 such as an HDD (Hard Disk Drive). The recording medium 103 stores the installed program and stores necessary files and data. The memory 102 reads and stores the program from the recording medium 103 when there is an instruction to start the program. The CPU 101 realizes functions related to the image forming apparatus 10 in accordance with a program stored in the memory 102. The network I / F 104 is used as an interface for connecting to a network.

  The display unit 108 is configured by an LCD (Liquid Crystal Display) or the like, and displays an operation screen, a message, and the like. The operation unit 109 is configured by hardware buttons (keys) and is an input unit that receives an operation input by a user. The display unit 108 and the operation unit 109 may be integrally configured as an operation panel.

  The image processing unit 106 executes various types of image processing required when outputting (printing) image data. The image output unit 105 outputs (prints) image data.

  The external device I / F 107 is an interface for connecting to a card reader used for inputting user information for authentication, and includes, for example, a USB port (USB host interface) or a serial boat. The card reader 30 is a so-called card reader that reads information from the card 50, and includes a hardware interface (for example, a USB connector or a serial interface) that can be connected to the external device I / F 107. However, the card reader 30 may be built in the image forming apparatus 10. The card reader 30 may be either a contact type or a non-contact type. The card 50 is not limited to an IC card, and any card ID (card number) unique to at least each card 50 such as a magnetic card can be recorded. The card ID is generally referred to as a Universal ID or a Card Serial Number. Specific examples of the card 50 include a proximity card, a mifare card, a Java (registered trademark) card, and the like.

  In the present embodiment, it is assumed that the card 50 is distributed to each user. However, a single card 50 may be shared by a plurality of users according to the level of security required for operation. Note that the card 50 distributed to each user may not be limited to one type. As described above, the card reader 30 can be easily connected to the image forming apparatus 10 by USB or the like. Accordingly, a plurality of card readers 30 having different types of cards 50 (Proximity card, Mifare card, Java (registered trademark) Card, etc.) may be connected to the image forming apparatus 10 at the same time. In this case, a plurality of types of cards 50 can be used simultaneously.

  In FIG. 1, an image forming apparatus 10 is connected to an authentication server 20 via a network (whether wired or wireless). The authentication server 20 is a computer that performs user authentication by an authentication method based on a user ID and a password, such as LDAP (Lightweight Directory Access Protocol), Windows (registered trademark) authentication, Kerberos, or the like. That is, the authentication server 20 includes a user information database in which correspondence information with user IDs and passwords is recorded. The authentication server 20 executes the authentication process by comparing the correspondence information recorded in the user information database with the user ID and password input in the authentication request. The user ID is user identification information that uniquely identifies a user, and is generally information that is also referred to as a user name.

  FIG. 2 is a diagram for explaining a functional configuration example of the image forming apparatus according to the embodiment of the present invention. In the figure, an image forming apparatus 10 includes a card ID acquisition unit 11, a user information acquisition unit 12, an authentication control unit 13, a password registration unit 14, a card ID registration unit 15, a card effect registration unit 16, a corresponding information management unit 17, and the like. Have Each of these units is software realized by processing executed by the CPU 101 by a program installed in the image forming apparatus 10.

  The card ID acquisition unit 11 acquires the card ID read from the card 50 by the card reader 30 from the card reader 30. The user information acquisition unit 12 acquires a user ID corresponding to the card ID acquired by the card ID acquisition unit 11 from the correspondence information management unit 17, and inputs a password input by the user to the operation unit 109. Get more. That is, the correspondence information management unit 17 is a storage area in the storage medium 107 that manages correspondence information between a card ID and user information. The authentication control unit 13 causes the authentication server 20 to execute an authentication process based on the user ID and password acquired by the user information acquisition unit 12. The password registration unit 14 registers the password in the correspondence information management unit 17 in association with the card ID for the purpose of eliminating the complexity of inputting the password every time during authentication. Therefore, when the password is registered in the correspondence information management unit 17, the user information acquisition unit 12 acquires the password corresponding to the card ID from the correspondence information management unit 17, not from the operation unit 109. The card ID registration unit 15 registers the card ID in the correspondence information management unit 17 in response to an operation instruction from the user. The card validity registration unit 16 registers information indicating the validity or invalidity of the card 50 (card validity) in the correspondence information management unit 17 in association with the card ID in accordance with an operation instruction from the user. When the card 50 is valid, authentication using the card I is valid. When the card 50 is invalid, authentication using the card 50 is invalid.

  Hereinafter, a processing procedure of the image forming apparatus 10 will be described. FIG. 3 is a flowchart for explaining the processing procedure of the authentication processing. FIG. 4 is a diagram showing an example of a display screen at the time of authentication processing.

  When the user information acquisition unit 12 displays the login screen 510 (see FIG. 4) on the display unit 108, if the user sets the card 50 in the card reader 30 (Yes in S101), the card ID acquisition unit 11 acquires the card ID read from the card by the card reader 30 from the card reader 30 (S102). The setting of the card 50 to the card reader 30 means that the card reader 30 can read the information recorded on the card 50, such as inserting the card 50 into the card reader 30 or deceiving the card 50. To do.

  Subsequently, the user information acquisition unit 12 acquires a user ID corresponding to the acquired card ID (hereinafter referred to as “current card ID”) from the correspondence information management unit 17 (S103).

  FIG. 5 is a diagram illustrating an example of correspondence information managed by the correspondence information management unit. In the figure, correspondence information 170 is information that holds a user ID, a card ID, a password, and a card effect in association with each other for each user. Therefore, in step S <b> 103, the user information acquisition unit 12 acquires the user ID associated with the current card ID from the correspondence information management unit 17 in the correspondence information management unit 17.

  The password is not necessarily registered in the correspondence information management unit 17. When a password is registered for the current ID, the user information acquisition unit 12 displays a symbol (for example, “******” indicating that it is not necessary to input a password in the password input field on the login screen 510. *** ”is displayed.

  When the user ID cannot be acquired (S104 No), the user information acquisition unit 12 determines that an authentication error has occurred. When the user ID can be acquired (Yes in S104), the user information acquisition unit 12 refers to the card validity value (valid or invalid) associated with the current card ID in the correspondence information management unit 17, and the card It is determined whether 50 is valid (S105). When the card 50 is invalid (No in S105), the user information acquisition unit 12 determines that an authentication error has occurred.

  When the card 50 is valid (Yes in S105), the user information acquisition unit 12 determines whether or not a password is registered for the current card ID in the correspondence information management unit 17 (S106). When the password is not registered (No in S106), the user information acquisition unit 12 displays the password screen 520 (see FIG. 4) on the display unit 108 (S107). After the input button 521 is pressed by the user on the password screen 520 and the password is input (Yes in S108), when the OK button 522 is pressed instead of the Cancel button 523 (No in S109) (Yes in S110), The authentication control unit 13 causes the authentication server 20 to execute the authentication process by transmitting an authentication request based on the user ID acquired in step S103 and the password input in step S108 to the authentication server 20 (S112).

  On the other hand, when a password is registered for the current card ID in the correspondence information management unit 17 (Yes in S106), the user information acquisition unit 12 acquires the password (S111). Subsequently, the authentication control unit 13 causes the authentication server 20 to execute an authentication process by transmitting an authentication request based on the user ID and the password acquired in step S103 to the authentication server 20 (S112).

  If the reply from the authentication server 20 indicates that the authentication is successful (Yes in S116), the password registration unit 14 determines whether the password entered on the password screen 520 is based on the state of the check button 524 on the password screen 520. It is determined whether registration (storage) is necessary (S117). When the check button 524 is checked (Yes in S117), the password registration unit 14 registers the password in the correspondence information management unit 17 in association with the current card ID (S118). On the other hand, when the check button 524 is not checked (No in S117), the password registration unit 14 deletes the password registered for the current card ID in the correspondence information management unit 17 (S119). However, if no password is registered for the current card ID, deletion is not necessary.

  On the other hand, after the login screen 510 is displayed, the card 50 is not set in the card reader 30 (No in S101), and after the user ID and the password are input to the login screen 510 as required (in S113). Yes), the case where the Login button 511 is pressed (Yes in S114) will be described. In this case, the user information acquisition unit 12 acquires the user ID and password input on the login screen 510 (however, if a password is registered for the current ID, the password is acquired), and authentication control is performed. The unit 13 requests authentication from the authentication server 20 using the user ID and password (S115). Subsequently, the processing after step S116 described above is executed.

  In step S116, when the reply from the authentication control unit 13 indicates that the authentication has failed (No in S116), the user information acquisition unit 12 sends the password used for authentication to the correspondence information management unit 17. It is determined whether or not it has been registered (S120). This determination is performed based on the information stored in the memory 102 when the password registered in the correspondence information management unit 17 (hereinafter referred to as “registered password”) is used. Just do it. If the password used for authentication is not a registered password (No in S120), the authentication control unit 13 determines that an authentication error has occurred.

  When the password used for authentication is a registered password (Yes in S120), the user information acquisition unit 12 displays the password screen 520 on the display unit 108 again, and causes the user to input a new password (S121). Here, when authentication fails with the registered password, the user is prompted to input the password again for the following reason.

  In recent years, passwords have been regularly changed to improve security. Therefore, inconsistency that the password registered in the correspondence information management unit 17 is old even though the password of the authentication server 20 is updated may occur. In order to easily deal with such inconsistency, the user is given an opportunity to input a new password (changed password) in step S121.

  When a password is input to the newly displayed password screen 520, the user information acquisition unit 12 acquires the password input to the password screen 520, and the authentication control unit 13 acquires the user ID acquired in step S103. And the authentication request based on the said password is transmitted to the authentication server 20, and the authentication server 20 is made to perform an authentication process anew (S122).

  If the reply from the authentication server 20 indicates a failure of authentication (No in S123), the authentication control unit 13 determines that an authentication error has occurred. If the reply from the authentication server 20 indicates that the authentication is successful (Yes in S123), the processing from step S117 onward is executed. Therefore, when the check button 524 is checked, the password registered in the correspondence information management unit 17 is updated with a new password.

  If the authentication is successful by the processing of FIG. 3, the user is permitted to use the image forming apparatus 10. On the other hand, if the authentication error is determined, the user is restricted from using the image forming apparatus 10.

  As described above, the image forming apparatus 10 manages correspondence information between the card ID and the user ID, and can determine the user ID based on the card ID. Further, the authentication in the image forming apparatus 10 requires not only the setting of the card ID but also the input of a password. Therefore, even with the card 50 in which only the card ID is recorded, authentication processing with a security level equivalent to that of a highly functional IC card using a PIN (Personal Identification Number) can be realized.

  Further, since the image forming apparatus 10 can store a password corresponding to the card ID and can use the password for authentication, it is possible to save the trouble of inputting the password when using the card 50. And convenience can be improved.

  Further, even when a mismatch occurs between the registered password and the password managed by the authentication server 20, the user is given an opportunity to input a new password in a series of authentication processes. Therefore, it is possible to easily maintain the consistency of the system.

  Next, a card ID registration process in the correspondence information management unit 17 will be described. The registration process needs to be executed before performing authentication (card authentication) using the card 50 in FIG.

  The registration of the card ID is based on the premise that the user is authenticated by the process of FIG. However, in this case, since card authentication cannot be used, at least the user ID needs to be input on the login screen 510.

  When the authenticated user inputs a card ID registration request via the operation unit 109, the card ID registration unit 15 displays a card ID registration screen. FIG. 6 shows a display example of the card ID registration screen. When the card ID acquisition button 531 on the card ID registration screen 530 is pressed, the card ID acquisition unit 11 acquires the card ID of the card 50 from the card reader 30 and displays it on the card ID registration screen 530. Subsequently, when the registration button 532 is pressed, the card ID registration unit 15 registers the card ID in the correspondence information management unit 17 in association with the user ID of the authenticated user.

  Thus, in the image forming apparatus 10 according to the present embodiment, each user can register the card ID of his / her card 50 in the correspondence information management unit 17. Registration of the card ID may be performed by a specific person such as an administrator in a lump, but the burden on the administrator can be reduced by enabling registration by each user.

  The registration of the card effect is performed by the manager or the owner of the card 50 (hereinafter simply referred to as “user”). In either case, it is assumed that authentication has been performed by the processing of FIG.

  When the authenticated user inputs a card effect registration request via the operation unit 109 with the card 50 set in the card reader 30, the card effect registration unit 16 displays a card effect registration screen.

  FIG. 7 is a diagram showing a display example of the card effect registration screen. In the figure, the card validity registration screen 540 displays the card ID of the card 50 set in the card reader 30 and the user ID associated with the card ID in the correspondence information management unit 17. The card validity (valid or invalid) can be set by a radio button.

  When the card effect is set on the card effect registration screen 540 and the OK button 541 is pressed, the card effect registration unit 16 associates the card effect with the corresponding information management unit 17 in association with the card ID for which the card effect is set. sign up.

  In this way, by setting the card effect, when the user does not use the image forming apparatus 10 temporarily, such as when the user is on a long vacation, the use of the card 50 of the user is temporarily restricted. Thus, unauthorized use of the card 50 can be prevented appropriately.

  Note that access control for each function of the image forming apparatus 10 may be performed in combination with the authentication function using the card 50 described in the present embodiment. For example, FIG. 8 is a diagram illustrating a configuration example of a table for performing access control of functions of the image forming apparatus. Each table in the figure is recorded on the recording medium 103, for example.

  The table 181 is a table in which authority IDs for associating with group IDs and identifying authority to use functions of the image forming apparatus 10 are defined for each user (for each user ID). In the example of the figure, each user ID is associated with a group ID of group ID-A and group ID-B. Group ID-A is a group ID related to group A. Group A is a group distinguished by the department to which it belongs. Group ID-B is a group ID related to group B. Group B is a group that is distinguished by job title or duties.

  The table 182 is a table in which an authority ID is defined for each group ID of group A (group ID-A). The table 183 is a table in which an authority ID is defined for each group ID of group B (group ID-B). The table 184 is a table in which identification information of usable functions (Scan, Copy, Print, FAX, etc.) is defined for each authority ID. “All” indicates that all functions can be used. “None” indicates that no function is available. For Copy and Print, the use authority may be subdivided with regard to whether or not colors can be used. Further, for FAX and Scan, it may be limited so that an image transmission destination or storage destination cannot be set to a value other than a preset value.

  By using the table 181 and the table 184, functions that can be used for each user can be limited based on the card 50 distributed to each user. Further, by using the table 181, the table 182, and the table 184, the functions that can be used for each department can be limited based on the card 50 distributed to each user. In addition, by using the table 181, the table 1183, and the table 184, it is possible to limit the functions that can be used for each post based on the card 50 distributed to each user.

  For example, when a user who is authenticated in the authentication process of FIG. 3 selects a function via the operation unit 109, the image forming apparatus 10 has the right to use the selected function based on the table of FIG. Check if the user is authorized. When the usage authority is granted, the image forming apparatus 10 causes the display unit 108 to display an operation screen for the selected function. When the use authority is not authorized, the image forming apparatus 10 displays a message such as “This function cannot be used” on the display unit 108 and restricts the use of the function.

  Furthermore, not only applications (Scan, Copy, Print, FAX, etc.) incorporated as basic functions of the image forming apparatus 10 but also applications developed by third vendors can be authenticated by single sign-on. it can. Therefore, for example, for an application (distribution management tool) that is developed by a third vendor and realizes distribution processing of scanned images, a workflow, a display screen, and the like can be personalized for each card ID.

  As mentioned above, although the Example of this invention was explained in full detail, this invention is not limited to such specific embodiment, In the range of the summary of this invention described in the claim, various deformation | transformation・ Change is possible.

1 is a diagram illustrating a hardware configuration example of an image forming apparatus according to an embodiment of the present invention. FIG. 3 is a diagram for explaining an example functional configuration of an image forming apparatus according to an embodiment of the present invention. It is a flowchart for demonstrating the process sequence of an authentication process. It is a figure which shows the example of a display screen at the time of an authentication process. It is a figure which shows the example of the corresponding information which a corresponding information management part manages. It is a figure which shows the example of a display of a card ID registration screen. It is a display example of a card effect registration screen. 3 is a diagram illustrating a configuration example of a table for performing access control of functions of the image forming apparatus. FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Image forming apparatus 11 Card ID acquisition part 12 User information acquisition part 13 Authentication control part 14 Password registration part 15 Card ID registration part 16 Card effect registration part 17 Corresponding information management part 20 Authentication server 30 Card reader 50 Card 101 CPU
102 Memory 103 Recording medium 104 Network I / F
105 Image output unit 106 Image processing unit 107 External device I / F
108 Display unit 109 Operation unit

Claims (21)

Card ID acquisition means for acquiring a card ID read from the card by the card reader;
Correspondence information management means for managing correspondence information between the card ID and user identification information;
User information acquisition means for acquiring user identification information corresponding to the card ID acquired by the card ID acquisition means from the correspondence information management means, and acquiring a user password related to the acquired user identification information;
An image forming apparatus comprising: an authentication control unit configured to execute a user authentication process based on the acquired user information identification information and the password.   The image forming apparatus according to claim 1, wherein the user information acquiring unit acquires a password input via an input unit included in the image forming apparatus.   The image forming apparatus according to claim 2, further comprising: a password registration unit that registers the password input via the input unit in the correspondence information management unit in association with the card ID.   The image forming apparatus according to claim 3, wherein the user information acquisition unit acquires a password corresponding to the card ID acquired by the card ID acquisition unit from the correspondence information management unit.   The card read by the card reading device when a user is authenticated by an authentication process executed by the authentication control unit based on user identification information and a password input via an input unit included in the image forming apparatus 5. The image forming apparatus according to claim 1, further comprising a card ID registration unit that registers an ID in the correspondence information management unit in association with the user identification information.   When the user is not authenticated based on the password input through the input unit, the user is input by a new password through the input unit and is executed by the authentication control unit based on the new password. 4. The image forming apparatus according to claim 3, wherein when the password is authenticated, the password registration unit updates the password registered in the correspondence information management unit with the new password.   The card validity registration means for registering information indicating the validity of the card, which is set through the input means included in the image forming apparatus, in the correspondence information management means in association with the card ID. The image forming apparatus according to claim 6. An authentication control method executed by an image forming apparatus,
A card ID acquisition procedure for acquiring a card ID read from the card by the card reader;
The user ID information corresponding to the card ID acquired by the card ID acquisition unit is acquired from the correspondence information management unit that manages the correspondence information between the card ID and the user identification information, and the user identification information related to the acquired user identification information A user information acquisition procedure for acquiring a user password;
An authentication control method comprising: an authentication control procedure for executing user authentication processing based on the acquired user information identification information and the password.   The authentication control method according to claim 8, wherein the user information acquisition procedure acquires a password input via an input unit included in the image forming apparatus.   The authentication control method according to claim 9, further comprising: a password registration procedure for registering the password input via the input unit in the correspondence information management unit in association with the card ID.   The authentication control method according to claim 10, wherein the user information acquisition procedure acquires a password corresponding to the card ID acquired by the card ID acquisition unit from the correspondence information management unit.   The card read by the card reading device when a user is authenticated by an authentication process executed by the authentication control unit based on user identification information and a password input via an input unit included in the image forming apparatus The authentication control method according to claim 8, further comprising a card ID registration procedure for registering an ID in the correspondence information management unit in association with the user identification information.   When the user is not authenticated based on the password input through the input unit, the user is input by the authentication process in which a new password is input through the input unit and the authentication control procedure is executed based on the new password. The authentication control method according to claim 10, further comprising a password update procedure for updating a password registered in the correspondence information management unit with the new password when the password is authenticated.   9. A card validity registration procedure for registering information indicating whether or not the card is valid, which is set through an input unit included in the image forming apparatus, in the correspondence information management unit in association with the card ID. The authentication control method as described in any one of thru | or 13. In the image forming device,
A card ID acquisition procedure for acquiring a card ID read from the card by the card reader;
The user ID information corresponding to the card ID acquired by the card ID acquisition unit is acquired from the correspondence information management unit that manages the correspondence information between the card ID and the user identification information, and the user identification information related to the acquired user identification information A user information acquisition procedure for acquiring a user password;
A program for executing an authentication control procedure for executing a user authentication process based on the acquired user information identification information and the password.   The program according to claim 15, wherein the user information acquisition procedure acquires a password input via an input unit included in the image forming apparatus.   17. The program according to claim 16, further comprising a password registration procedure for registering the password input via the input unit in the correspondence information management unit in association with the card ID.   The program according to claim 17, wherein the user information acquisition procedure acquires a password corresponding to the card ID acquired by the card ID acquisition unit from the correspondence information management unit.   The card read by the card reading device when a user is authenticated by an authentication process executed by the authentication control unit based on user identification information and a password input via an input unit included in the image forming apparatus The program according to any one of claims 15 to 18, further comprising a card ID registration procedure for registering an ID in the correspondence information management unit in association with the user identification information.   When the user is not authenticated based on the password input through the input unit, the user is input by the authentication process in which a new password is input through the input unit and the authentication control procedure is executed based on the new password. 18. The program according to claim 17, further comprising a password update procedure for updating a password registered in the correspondence information management means with the new password when the password is authenticated.   16. The card validity registration procedure for registering information indicating whether or not the card is valid, which is set through an input unit included in the image forming apparatus, in the correspondence information management unit in association with the card ID. The program as described in any one of thru | or 20.

Images